24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample a79fc8ac3d17… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a79fc8ac3d17…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8"],"about":{"@type":"SoftwareApplication","name":"KMPlayer_4.2.1.4.exe","applicationCategory":["peexe","executable"],"identifier":"a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T484,GetVersion@KERNEL32.DLL at 00053624-00002828-48129-15-00406966 GetVersionExW@KERNEL32.DLL at 00053624-00002828-48129-60-0040650D GetVersion@KERNEL32.DLL at 00053624-00002828-55986-15-00406966 GetVersionExW@KERNEL32.DLL at 00074834-00002456-23506-136-0040A274 GetVersion@KERNEL32.DLL at 00074834-00002456-23506-143-0040646C GetVersion@KERNEL32.DLL at 00074834-00002456-23506-254-00401064 GetVersion@KERNEL32.DLL at 00075541-00002612-31119-2510-004675E8 GetVersionExA@KERNEL32.DLL at 00075541-00002612-31119-2497-0040DAE0 GetVersion@KERNEL32.DLL at 00075541-00002612-31119-1568-0042E1EC GetVersion@KERNEL32.DLL at 00077847-00002504-46136-1568-0042E1EC GetVersionExA@KERNEL32.DLL at 00077847-00002504-46136-2497-0040DAE0 GetVersion@KERNEL32.DLL at 00077847-00002504-46136-2510-004675E8 GetVersion@KERNEL32.DLL at 00079407-00001948-59794-1569-0042E1EC GetVersion@KERNEL32.DLL at 00079407-00001948-59794-2511-004675E8 GetVersionExA@KERNEL32.DLL at 00079407-00001948-59794-2498-0040DAE0 GetVersion@KERNEL32.DLL at 00080972-00001348-7708-1569-0042E1EC GetVersion@kernel32.dll at 38234-278-004011A0 GetVersionExW@kernel32.dll at 38234-270-004067BC26:Tff5,Found API call GetSystemTime@KERNELBASE.DLL (Target: "a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe"; Stream UID: "00053624-00002828-60743-43-004068DF") which is directly followed by "cmp eax, FFFFFFFFh" and "retn 0004h". See related instructions: "... +103 call 00406883h +108 push esi +109 call dword ptr [0040807Ch] ;GetSystemTime +115 xor ecx, ecx +117 cmp eax, FFFFFFFFh +120 setne cl +123 mov eax, ecx +125 pop ebx +126 pop edi +127 pop esi +128 retn 0004h" ... at 00053624-00002828-60743-43-004068DF Found API call GetSystemTime@KERNELBASE.DLL (Target: "a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe"; Stream UID: "00053624-00002828-60743-35-00405F90") which is directly followed by "cmp eax, FFFFFFFFh" and "je 00405FADh". See related instructions: "... +0 push dword ptr [esp+04h] +4 call dword ptr [0040807Ch] ;GetSystemTime +10 cmp eax, FFFFFFFFh +13 je 00405FADh" ... at 00053624-00002828-60743-35-00405F90 Found API call GetVersion@KERNEL32.DLL (Target: "KMPAddedCode_OpperCD.exe"; Stream UID: "00074834-00002456-23506-143-0040646C") which is directly followed by "cmp edx, 05h" and "jne 0040648Bh". See related instructions: "... +0 call 004011A0h ;GetVersion +5 mov edx, eax +7 and edx, 000000FFh +13 and eax, 0000FF00h +18 shr eax, 08h +21 cmp edx, 05h +24 jne 0040648Bh" ... at 00074834-00002456-23506-143-0040646C Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate_NO.exe"; Stream UID: "00075541-00002612-31119-2510-004675E8") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [0046FC04h]". See related instructions: "... +26 call 00407178h ;GetVersion +31 and eax, 000000FFh +36 cmp ax, 0004h +40 setnb byte ptr [0046FC04h]" ... at 00075541-00002612-31119-2510-004675E8 Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate_NO.exe"; Stream UID: "00075541-00002612-31119-1568-0042E1EC") which is directly followed by "cmp ax, 0004h" and "jc 0042E3F6h". See related instructions: "... +152 call 00404DC4h +157 call 00407178h ;GetVersion +162 and eax, 000000FFh +167 cmp ax, 0004h +171 jc 0042E3F6h" ... at 00075541-00002612-31119-1568-0042E1EC Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate_NO.exe"; Stream UID: "00077847-00002504-46136-1568-0042E1EC") which is directly followed by "cmp ax, 0004h" and "jc 0042E3F6h". See related instructions: "... +152 call 00404DC4h +157 call 00407178h ;GetVersion +162 and eax, 000000FFh +167 cmp ax, 0004h +171 jc 0042E3F6h" ... at 00077847-00002504-46136-1568-0042E1EC Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate_NO.exe"; Stream UID: "00077847-00002504-46136-2510-004675E8") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [0046FC04h]". See related instructions: "... +26 call 00407178h ;GetVersion +31 and eax, 000000FFh +36 cmp ax, 0004h +40 setnb byte ptr [0046FC04h]" ... at 00077847-00002504-46136-2510-004675E8 Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate.exe"; Stream UID: "00079407-00001948-59794-1569-0042E1EC") which is directly followed by "cmp ax, 0004h" and "jc 0042E3F6h". See related instructions: "... +152 call 00404DC4h +157 call 00407178h ;GetVersion +162 and eax, 000000FFh +167 cmp ax, 0004h +171 jc 0042E3F6h" ... at 00079407-00001948-59794-1569-0042E1EC Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate.exe"; Stream UID: "00079407-00001948-59794-2511-004675E8") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [0046FC04h]". See related instructions: "... +26 call 00407178h ;GetVersion +31 and eax, 000000FFh +36 cmp ax, 0004h +40 setnb byte ptr [0046FC04h]" ... at 00079407-00001948-59794-2511-004675E8 Found API call GetVersion@KERNEL32.DLL (Target: "kmpFileAssociate.exe"; Stream UID: "00080972-00001348-7708-1569-0042E1EC") which is directly followed by "cmp ax, 0004h" and "jc 0042E3F6h". See related instructions: "... +152 call 00404DC4h +157 call 00407178h ;GetVersion +162 and eax, 000000FFh +167 cmp ax, 0004h +171 jc 0042E3F6h" ... at 00080972-00001348-7708-1569-0042E1EC27:T457,"" queries volume information of "C:\" at 00053624-00002828-0000010C-165013892 "" queries volume information of "C:\KMPlayer\KMPlayer.exe" at 00053624-00002828-0000010C-165038730 "" queries volume information of "C:\" at 00053624-00002828-0000010C-165162790 "" queries volume information of "C:\KMPlayer\uninstall.exe" at 00053624-00002828-0000010C-165163095 "" queries volume information of "C:\" at 00053624-00002828-0000010C-165180347 "" queries volume information of "C:\KMPlayer\KMPlayer.exe" at 00053624-00002828-0000010C-165180650 "pin2taskbar.exe" queries volume information of "C:\" at 00072301-00004040-0000010C-166405964 "pin2taskbar.exe" queries volume information of "C:\KMPlayer\KMPlayer.exe" at 00072301-00004040-0000010C-166416285 "pin2taskbar.exe" queries volume information of "C:\" at 00072301-00004040-0000010C-168206420 "pin2taskbar.exe" queries volume information of "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\KMPlayer.exe.lnk" at 00072301-00004040-0000010C-16820687528:T49a,"" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\THE KMPLAYER") "" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\THE KMPLAYER") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\A79FC8AC3D179230D755C21DAAB548A91E524E64E233DBC81F4EC100706778A8.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\A79FC8AC3D179230D755C21DAAB548A91E524E64E233DBC81F4EC100706778A8.EXE") "pin2taskbar.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PIN2TASKBAR.EXE") "pin2taskbar.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PIN2TASKBAR.EXE") "kmpFileAssociate_NO.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KMPFILEASSOCIATE_NO.EXE") "kmpFileAssociate_NO.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KMPFILEASSOCIATE_NO.EXE") "kmpFileAssociate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KMPFILEASSOCIATE.EXE") "kmpFileAssociate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KMPFILEASSOCIATE.EXE")29:T52c,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!qjqsv3q!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!qjqsv3q!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!ietldcache!" "Local\!IETld!Mutex" "Local\_!MSFTHISTORY!_" "Local\ZoneAttributeCacheCounterMutex" "Local\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!ietldcache!" "Local\WininetStartupMutex" "Local\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!cookies!" "Local\c:!users!qjqsv3q!appdata!local!microsoft!windows!temporary internet files!content.ie5!"2a:T6c2,"Indonesia.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators" "MediaInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Film Projector Sepia Toning.txt" has type "C source ASCII text with CRLF line terminators" "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 191 x 290 x 24" "files.txt" has type "ASCII text with CRLF line terminators" "MoreInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Sinhalese.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators" "kmp_ini_7zip.7z" has type "7-zip archive data version 0.3" "Portuguese.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators" "Kurdish Sorani.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators" "ColorTheme.ini" has type "ISO-8859 text with CRLF line terminators" "KIconLib.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "avutil-lav-55.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "Sharpen Complex.txt" has type "C source UTF-8 Unicode text with CRLF line terminators" "Letterbox.txt" has type "C source ASCII text with CRLF line terminators" "xviddll.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Wave.txt" has type "C source ASCII text with CRLF line terminators" "aac_parser.ax" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Remap_16_235.txt" has type "C source ASCII text with CRLF line terminators"2b:T2dfd,Heuristic match: "%]M@2P.ph" Heuristic match: "d:, $.BJ" Heuristic match: "Bjz b.tf" Heuristic match: "2Op|k9.CC" Heuristic match: "Ftov+U#ho.AG" Heuristic match: "Yz=AwD.gU" Heuristic match: "\9CO'dI.gR" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://t2.symcb.com0" Pattern match: "http://t1.symcb.com/ThawtePCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "http://tl.symcb.com/tl.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://tl.symcd.com0&" Pattern match: "http://tl.symcb.com/tl.crt0" Pattern match: "http://www.Pandora.Tv" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "http://www.kmplayer.com" Heuristic match: "ac3filter.ax" Heuristic match: "MpaDecFilter.ax" Heuristic match: "LAVAudio.ax" Heuristic match: "LAVCUVID.ax" Heuristic match: "LAVSplitter.ax" Heuristic match: "LAVVideo.ax" Heuristic match: "KMPlayer.TP" Heuristic match: "KMPlayer.AU" Heuristic match: "KMPlayer.tp" Heuristic match: "update.kmpmedia.net" Heuristic match: "cdn.kmplayer.com" Pattern match: "www.bytetouruniverse.com" Heuristic match: "log.kmplayer.com" Heuristic match: "GlassFrame.Top" Pattern match: "http://www.homecinema-fr.com/forum/viewtopic.php?t=29814317" Pattern match: "http://www.gnu.org/copyleft/gpl.html" Pattern match: "http://libmpeg2.sourceforge.net/" Pattern match: "http://www.underbit.com/products/mad/" Pattern match: "http://liba52.sourceforge.net/" Pattern match: "http://developers.videolan.org/libdca.html" Pattern match: "http://www.mplayerhq.hu/" Pattern match: "http://mediainfo.sourceforge.net/" Pattern match: "http://sourceforge.net/projects/guliverkli/" Pattern match: "http://www.gnu.org/licenses/old-licenses/gpl-2.0.html" Pattern match: "https://code.google.com/p/lavfilters/" Pattern match: "http://www.gnu.org/copyleft/lesser.html" Pattern match: "http://ffmpeg.sourceforge.net/" Pattern match: "http://www.xvid.org/" Pattern match: "http://www.musepack.net/" Pattern match: "http://corecodec.org/projects/mmswitch" Pattern match: "http://www.gnu.org/software/libiconv/" Pattern match: "http://www.audiocoding.com" Pattern match: "http://fastmm.sourceforge.net" Pattern match: "http://en.wikipedia.org/wiki/BSD_license" Pattern match: "http://www.xiph.org/ogg/vorbis/" Pattern match: "http://flac.sourceforge.net/" Pattern match: "http://www.theora.org/" Pattern match: "http://www.mozilla.org/MPL/" Pattern match: "http://www.delphi-gems.com/Graphics.php" Pattern match: "http://www.nero.com/" Pattern match: "http://www.monkeysaudio.com/" Pattern match: "http://www.un4seen.com/" Pattern match: "http://www.rarlab.com/" Pattern match: "www.progdigy.com" Pattern match: "http://www.bluecave.net" Pattern match: "http://www.dsp-worx.de" Pattern match: "https://www.pasindu.lk/" Pattern match: "http://www.kmplayer.com/down/kmp.exe" Pattern match: "http://www.kmplayer.com/down/kmpver.txt" Pattern match: "http://www.kmplayer.com/down/kmpup.htm" Pattern match: "http://www.kmplayer.com/forums/forumdisplay.php?f=39" Pattern match: "http://www.kmplayer.com/codec/search_codec.php?bbs_code=%s&c_code=%s" Pattern match: "http://www.kmplayer.com/forums/" Pattern match: "http://www.kmplayer.com/beta/url.zip" Pattern match: "http://yp.shoutcast.com" Pattern match: "www.kmplayer.com" Pattern match: "www.kmplayer.com/forums" Pattern match: "www.facebook.com/KMPmedia" Pattern match: "www.gplus.to/KMPlayer" Pattern match: "www.twitter.com/KMPmedia" Pattern match: "http://www.kmplayer.com/forums" Pattern match: "http://myhome.naver.com/gi037/e-sky/e-sky.htm" Pattern match: "http://myhome.naver.com/gi037/e-sky/url.zip" Pattern match: "http://www.shoutcast.com/directory/" Pattern match: "http://www.tntware.com" Heuristic match: "StatwarsControl1.Item86=kyh96403@hanmail.net" Heuristic match: "StatwarsControl1.Item87=kyh96403@hotmail.com" Heuristic match: "// Code by jim.ro" Pattern match: "http://forum.doom9.org/showthread.php?t=157634" Pattern match: "http://en.wikipedia.org/wiki/Pixel_shader" Pattern match: "upload.ffmpeg.org/incoming/" Pattern match: "www.kurdiu.org" Heuristic match: "StatwarsControl1.Item91= anasmahdi@yahoo.com" Pattern match: "WWW.kurdiu.org" Heuristic match: "aac_parser.ax" Pattern match: "http://www.fourcc.org/indexrgb.htm" Pattern match: "http://en.wikipedia.org/wiki/AMV_video_format" Pattern match: "http://www.pbcore.org/PBCore/PBCoreNamespace.html" Pattern match: "http://www.ebu.ch/metadata/cs/ebu_AudioCompressionCodeCS.xml#" Pattern match: "http://description.fims.tv" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://www.ebu.ch/metadata/cs/ebu_VideoCompressionCodeCS.xml#" Pattern match: "mediaarea.net/mediaarea" Pattern match: "mediaarea.net/mediaarea/mediaarea_0_1.xsd" Pattern match: "mediaarea.net/MediaInfo" Pattern match: "mediaarea.net/mediatrace" Pattern match: "mediaarea.net/mediatrace/mediatrace_0_1.xsd" Pattern match: "mediaarea.net/micromediatrace" Pattern match: "mediaarea.net/micromediatrace/micromediatrace.xsd" Pattern match: "mediaarea.net/mediainfo" Pattern match: "mediaarea.net/mediainfo/mediainfo_2_0.xsd" Pattern match: "http://www.aiim.org/pdfa/ns/id/" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;Base" Pattern match: "http://xmm.sourceforge.net/DivX5-6_Xvid_Bitstream_version.php" Pattern match: "http://wiki.hydrogenaudio.org/index.php?title=Recommended_Ogg_Vorbis" Pattern match: "area.net/mediatrace" Pattern match: "iaarea.net/micromediatrace" Pattern match: "ea.net/micromediatrace" Pattern match: "iaarea.net/mediainfo" Pattern match: "http://sourceforge.net/projects/mediainfo/" Pattern match: "http://MediaArea.net/MediaInfo" Pattern match: "http://en.wikipedia.org/wiki/Chinese_MP4/MTV_Player" Pattern match: "http://www.webmproject.org/" Pattern match: "http://www.nue.tu-berlin.de/forschung/projekte/lossless/mp4als.html#downloads;Lossless" Pattern match: "http://www.lossless-audio.com/;Lossless" Pattern match: "http://www.twinvq.org/english/index_en.html" Pattern match: "http://www.adobe.com/;Lossless" Pattern match: "http://ffdshow.sourceforge.net/tikiwiki/tiki-index.php?page=Getting+ffdshow;Lossless" Pattern match: "http://www.3gpp.org/;3GPP" Pattern match: "iso.org/;Motion" Pattern match: "www.apple.com/quicktime/download/standalone.html;ISO" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;Adobe" Pattern match: "http://diracvideo.org/" Pattern match: "http://ffdshow-tryout.sourceforge.net/" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;422" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;;;YUV;4:2:2" Pattern match: "http://www.cineform.com/" Pattern match: "http://www.digitalvoodoo.net/" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;;;YUV" Pattern match: "http://www.itu.int/" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;Normal;;YUV;4:2:2" Pattern match: "http://www.bitjazz.com/" Pattern match: "http://www.real.com" Pattern match: "http://www.3ivx.com/download/;;;YUV;4:2:0" Pattern match: "http://www.array.com;;;YUV;4:2:0" Pattern match: "www.apple.com/quicktime/download/standalone.html;High;;YUV;4:2:2" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/Avid.VfW.codec.v2.0d2.exe" Pattern match: "telecom.net.ua/~video/codecs/Avid.VfW.codec.v2.0d2.exe;;;YUV" Pattern match: "http://www.cineform.com/products/ConnectHD.htm;;;YUV" Pattern match: "http://www.cyberlink.com" Pattern match: "http://ffdshow-tryout.sourceforge.net/;;;YUV;4:2:0" Pattern match: "http://mediaarea.net/DX50;;;YUV;4:2:0" Pattern match: "sourceforge.net/project/showfiles.php?group_id=82303&package_id=84358;;;YUV" Pattern match: "http://www.fourcc.org/indexyuv.htm;;;YUV" Pattern match: "http://www.fourcc.org/indexyuv.htm" Pattern match: "1.iptelecom.net.ua/~video/codecs/LEAD.MCMP-JPEG.v1.016.codec.exe;;;YUV" Pattern match: "et.ua/~video/codecs/Pinnacle.ReelTime.v2.5.software.only.codec.exe;;;YUV" Pattern match: "http://www.apple.com/quicktime/download/standalone.html" Pattern match: "http://www.on2.com/vp7.php3" Pattern match: "http://www.q-team.de" Pattern match: "http://www.fourcc.org/indexrgb.htm;;;RGB" Pattern match: "http://www.lucasarts.com/" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/CUseeMe.JPEG.CODEC.v1.17.exe;;;YUV" Pattern match: "http://eMajix.com" Pattern match: "http://umezawa.dyndns.info/archive/utvideo;;;YUV;4:2:0" Pattern match: "www.yks.ne.jp/~hori/" Pattern match: "ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe;Alpha" Pattern match: "http://www.microsoft.com/windows/windowsmedia/format/codecdownload.aspx" Pattern match: "http://mediaarea.net/XVID;;;YUV;4:2:0" Pattern match: "http://www.fourcc.org/indexyuv.htm;;;YUV;4:1:1" Pattern match: "http://www.iis.fraunhofer.de/amm/index.html" Pattern match: "http://www.meridian-audio.com" Pattern match: "http://www.apple.com/quicktime/download/standalone.html;Wide" Pattern match: "http://www.nellymoser.com/" Pattern match: "http://www.microsoft.com/windows/" Pattern match: "http://www.voxware.com/" Pattern match: "http://dividix.host.sk;.net" Pattern match: "t.com/windows/windowsmedia/format/codecdownload.aspx;;Version" Pattern match: "http://www.intel.com/" Pattern match: "http://www.vorbis.com" Pattern match: "http://www.microsoft.com" Pattern match: "http://www.divx.com" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/Autodesk.Animator.v1.11.Codec.exe" Pattern match: "ftp.asuscom.de/pub/asuscom/treiber/vga/ASUS_VGA_TOOLS/asv2dec.zip" Pattern match: "http://www.cineform.com/products/ConnectHD.htm" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/PICVideo.MJPG.v2.10.27.codec.exe" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/LEAD.MCMP-JPEG.v1.016.codec.exe" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/Pinnacle.ReelTime.v2.5.software.only.codec.exe" Pattern match: "http://mediaxw.sourceforge.net" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/PICVideo.Lossless.JPEG.codec.v2.10.27.exe" Pattern match: "http://mirror01.iptelecom.net.ua/~video/codecs/CUseeMe.JPEG.CODEC.v1.17.exe" Pattern match: "http://umezawa.dyndns.info/archive/utvideo;;;RGBA;4:4:4:4" Pattern match: "ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe" Pattern match: "www.apple.com/quicktime/download/standalone.html" Pattern match: "osoft.com/windows/" Pattern match: "http://dividix.host.sk" Pattern match: "www.intel.com/" Pattern match: "Xiph.Org/Sjeng.Org" Heuristic match: "ws.com" Pattern match: "www.ebu.ch/metadata/cs/ebu_AudioCompressionCodeCS.xml#" Pattern match: "http://www.digicine.com/PROTO-ASDCP-PKL-20040311#" Pattern match: "http://www.smpte-ra.org/schemas/429-8/2007/PKL" Pattern match: "http://www.digicine.com/PROTO-ASDCP-AM-20040311#" Pattern match: "http://www.smpte-ra.org/schemas/429-9/2007/AM" Pattern match: "http://www.smpte-ra.org/schemas/2067-2/2013" Pattern match: "http://www.smpte-ra.org/schemas/2067-2/XXXX" Pattern match: "http://www.smpte-ra.org/schemas/2067-3/2013" Pattern match: "http://www.smpte-ra.org/schemas/2067-3/XXXX" Pattern match: "http://www.digicine.com/PROTO-ASDCP-CPL-20040511#" Pattern match: "http://www.smpte-ra.org/schemas/429-7/2006/CPL" Pattern match: "http://ns.adobe.com/f4m/1.0"2c:T830,"Live;;VDONet Live (H,263);;;; VDST;VirtualDub;;VirtualDub remote frameclient ICM driver;;;; VDTZ;YUV;;VideoTizer / Darim Vision YUV;;;;YUV;4:2:2 VGPX;VGP;;Alaris VideoGramPixel;;;; VIDM;MPEG-4 Visual;DivX 5 Pro;DivX 5.0 Pro Supported;;;;YUV;4:2:0 VIDS;Vitec;;Vitec Multimedia YUV 4:2:2;www.yks.ne.jp/~hori/;;; VIFP;VFAPI;;Virtual Frame API (VFAPI dummy format);;;; VIV1;H.263;Vivo;;;;; VIV2;H.263;Vivo;;;;; VIVO;H.263;Vivo;;;;; VIXL;JPEG;Miro XL;Miro Video XL;http://mirror01.iptelecom.net.ua/~video/codecs/miroVIDEO-XL.codec.v2.2.exe;;;YUV VJPG;JPEG;;;;;;YUV VLV1;Videologic;;;;;; VMNC;Vmware;;;http://www.vmware.com/;;; VP30;VP3;On2;;;;; VP31;VP3;On2;;;;; VP32;VP3;On2;;;;; VP40;VP4;On2;;;;; VP50;VP5;On2;;;;; VP60;VP6;On2;;http://ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe;Simple;; VP61;VP6;On2;;http://ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe;Advanced;; VP62;VP6;On2;;http://ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe;Heightened Sharpness;; VP6A;VP6;On2;;ht" (Indicator: "vmware") "YUV;4CC;V;YUV;;VideoTizer / Darim Vision YUV VGPX;VGP;4CC;V;;;Alaris VideoGramPixel VIDM;DivX 5 pro;4CC;V;MPEG-4V;;DivX 5.0 Pro Supported VIDS;Vitec;4CC;V;;;Vitec Multimedia YUV 4:2:2;www.yks.ne.jp/~hori/ VIFP;VFAPI;4CC;V;;;Virtual Frame API (VFAPI dummy format) VIV1;H.263;4CC;V;;;Vivo H.263 VIV2;H.263;4CC;V;;;Vivo H.263 VIVO;H.263;4CC;V;;;Vivo H.263 VIXL;Miro XL;4CC;V;JPEG;;Miro Video XL;http://mirror01.iptelecom.net.ua/~video/codecs/miroVIDEO-XL.codec.v2.2.exe VJPG;JPEG;4CC;V;JPEG;; VLV1;Videologic;4CC;V;;; VMNC;Vmware;4CC;V;;;;http://www.vmware.com/ VP30;VP3;4CC;V;;;On2 VP3 VP31;VP3;4CC;V;;;On2 VP3 VP32;VP3;4CC;V;;;On2 VP3 VP40;VP4;4CC;V;;;On2 TrueCast VP4 VP50;VP5;4CC;V;;;On2 TrueCast VP5 VP60;VP6;4CC;V;;;On2 TrueCast VP6 VP61;VP6;4CC;V;;;On2 TrueCast VP6.1 VP62;VP6;4CC;V;;;On2 TrueCast VP6.2;http://ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe VP6A;VP6;4CC;V;;;On2 TrueCast VP6.2;http://ftp.pub.cri74.org/pub/win9x/video/codecs/VP6/vp6_vfw_codec.exe VP6F;VP6;4CC;V;;;On2 TrueCast VP6.2;htt" (Indicator: "vmware")2d:T4dd,"C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nse58F0.tmp" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\splash.bmp" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\kmp_ini_7zip.7z" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\addon_kmp_longtext_Group.txt" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\addon_kmp_longtext_Group_barcon.txt" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\addon_kmp_longtext_Group_barcon_A.txt" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\addon_kmp_longtext_Group_barcon_B.txt" for deletion "C:\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe" marked "%TEMP%\nsa5E9E.tmp\addon_kmp_longtext_Group_Etc01.txt" for deletion2e:T5a6,"" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "KMPlayer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "KMPlayer.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "KMPlayer.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "KMPlayer.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "KMPlayer.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")2f:Ta41,"KMPlayer.exe" wrote bytes "8bff558bece949ccf77490909090909090909090909090909090909090909005" to virtual address "0x0092D89C" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "e9f169238b" to virtual address "0x756F627A" ("ChangeDisplaySettingsExA@USER32.DLL") "KMPlayer.exe" wrote bytes "e95ed2208b" to virtual address "0x7571FA39" ("ChangeDisplaySettingsExW@USER32.DLL") "KMPlayer.exe" wrote bytes "8bff558bece950c9eb7490909090909090909090909090909090909090909005" to virtual address "0x0092DCD4" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "8bff558bece9683cf67490909090909090909090909090909090909090909005" to virtual address "0x0092D7FC" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "e982f8098b" to virtual address "0x7588CF31" ("RegDeleteValueW@ADVAPI32.DLL") "KMPlayer.exe" wrote bytes "e987922b94cccc" to virtual address "0x6C672820" "KMPlayer.exe" wrote bytes "558bec518b4518e9e750d46b9090909090909090909090909090909090909007" to virtual address "0x0092D734" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "e93eb2098b" to virtual address "0x75891469" ("RegCreateKeyExA@ADVAPI32.DLL") "KMPlayer.exe" wrote bytes "e99a26148b" to virtual address "0x757EA629" ("DeviceIoControl@KERNEL32.DLL") "KMPlayer.exe" wrote bytes "8bff558bece96986dc7490909090909090909090909090909090909090909005" to virtual address "0x0092DC0C" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "8bff558bece966d0f77490909090909090909090909090909090909090909005" to virtual address "0x0092D84C" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "8bff558bece968f6f57490909090909090909090909090909090909090909005" to virtual address "0x0092D8C4" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "e9ec4e088b" to virtual address "0x758A773F" ("RegFlushKey@ADVAPI32.DLL") "KMPlayer.exe" wrote bytes "8bff558bece950f5f57490909090909090909090909090909090909090909005" to virtual address "0x0092D7AC" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "e94ef9098b" to virtual address "0x7588CD01" ("RegCreateKeyA@ADVAPI32.DLL") "KMPlayer.exe" wrote bytes "e99d22088b" to virtual address "0x758AA4EA" ("RegDeleteValueA@ADVAPI32.DLL") "KMPlayer.exe" wrote bytes "e9781e088b" to virtual address "0x758AA8B7" ("RegDeleteKeyA@ADVAPI32.DLL") "KMPlayer.exe" wrote bytes "8bff558bece93b3df67490909090909090909090909090909090909090909005" to virtual address "0x0092D7D4" (part of module "KMPLAYER.EXE") "KMPlayer.exe" wrote bytes "8bff558bece93c6ff67490909090909090909090909090909090909090909005" to virtual address "0x0092D75C" (part of module "KMPLAYER.EXE")30:T6a8,"" wrote 32 bytes to a remote process "%TEMP%\nsa5E9E.tmp\pin2taskbar.exe" (Handle: 480) "" wrote 52 bytes to a remote process "%TEMP%\nsa5E9E.tmp\pin2taskbar.exe" (Handle: 480) "" wrote 4 bytes to a remote process "%TEMP%\nsa5E9E.tmp\pin2taskbar.exe" (Handle: 480) "" wrote 32 bytes to a remote process "C:\KMPlayer\KMPlayer.exe" (Handle: 494) "" wrote 52 bytes to a remote process "C:\KMPlayer\KMPlayer.exe" (Handle: 494) "" wrote 4 bytes to a remote process "C:\KMPlayer\KMPlayer.exe" (Handle: 494) "" wrote 1500 bytes to a remote process "%TEMP%\nsa5E9E.tmp\KMPAddedCode_OpperCD.exe" (Handle: 514) "" wrote 4 bytes to a remote process "%TEMP%\nsa5E9E.tmp\KMPAddedCode_OpperCD.exe" (Handle: 514) "" wrote 32 bytes to a remote process "%TEMP%\nsa5E9E.tmp\KMPAddedCode_OpperCD.exe" (Handle: 514) "" wrote 52 bytes to a remote process "%TEMP%\nsa5E9E.tmp\KMPAddedCode_OpperCD.exe" (Handle: 514) "" wrote 32 bytes to a remote process "%TEMP%\nsa5E9E.tmp\kmpFileAssociate_NO.exe" (Handle: 480) "" wrote 52 bytes to a remote process "%TEMP%\nsa5E9E.tmp\kmpFileAssociate_NO.exe" (Handle: 480) "" wrote 4 bytes to a remote process "%TEMP%\nsa5E9E.tmp\kmpFileAssociate_NO.exe" (Handle: 480) "" wrote 32 bytes to a remote process "%TEMP%\nsa5E9E.tmp\kmpFileAssociate.exe" (Handle: 480) "" wrote 52 bytes to a remote process "%TEMP%\nsa5E9E.tmp\kmpFileAssociate.exe" (Handle: 480) "" wrote 4 bytes to a remote process "%TEMP%\nsa5E9E.tmp\kmpFileAssociate.exe" (Handle: 480)31:T5f0,Found malicious artifacts related to "61.111.8.189" (ASN: 3786, Owner: LG DACOM Corporation): ... URL: http://61.111.8.189/BoxQos?mode=load&guid={B8C632DF-1257-4608-83C3-70D7906BFF5E} (AV positives: 1/63 scanned on 05/08/2015 09:17:34) URL: http://61.111.8.189/BoxQos?mode=fail&guid={B8C632DF-1257-4608-83C3-70D7906BFF5E}&domainip=50.58.243.137&errorcode=4 (AV positives: 1/63 scanned on 05/08/2015 09:17:33) URL: http://61.111.8.189/BoxQos?mode=fail&guid={60452142-8FD1-4BE3-848E-11DF52E35C9B}&domainip=88.221.14.25&errorcode=1 (AV positives: 1/62 scanned on 04/15/2015 10:49:40) URL: http://61.111.8.189/BoxQos?mode=load&guid={977AD16E-C1DE-490B-A14D-C22C713FD2EB} (AV positives: 1/62 scanned on 04/14/2015 09:59:47) URL: http://61.111.8.189/BoxQos?mode=load&guid={88E1D3E5-4F18-44E1-80F2-BC0028462D88} (AV positives: 2/62 scanned on 04/03/2015 01:26:34) File SHA256: 754c804659be2c7f2bf2f8399b6d1d95ea30f5a34c0d943fa5dd0b8d69f35ef7 (AV positives: 41/60 scanned on 06/30/2017 03:12:13) File SHA256: e5f6a5ac914f926385ba6e613e1da4366af96436471bb87367cd284390987346 (AV positives: 38/62 scanned on 06/24/2017 10:15:58) File SHA256: 5942e364ce2b5a323c4e4bf800bb8184b05ef6b34585207d7db27e0dbba5def3 (AV positives: 54/62 scanned on 06/11/2017 16:15:37) File SHA256: 4f3f872f895712c3b2cbe43596979c9401d7252a3e4d30bffbde18c6e1aef529 (AV positives: 48/60 scanned on 06/09/2017 04:51:50) File SHA256: dcf457b90bcfaeabfbd052fe240d7494cbcfc5ac0b7f970dbbd84697769035dc (AV positives: 50/61 scanned on 06/01/2017 21:43:54)32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAERERERERERERERERAAAAuAAAAAAAAAAAAAAAAIsAAAAAAAAAAAAAAAAAAAAAADA7u7u7u7u7u7u7u7u7swOwu7u7u7u7u7u7u7u7u7sLgLu7u7u7u7u7u7u7u7u7CAC7u7u7u7u7u7u7u7u7uwAHu7u7u7u7u7u7u7u7u7twB7u7u7u7u7u7u7u7u7u7cAi7uIi7u7u7u7u7u7iLu4AIu7iIi7u7u7u7u7iIi7uACLu4iIiLu7u7u7iIiIu7gAu7uIiIiLu7u7uIiIiLu7A7u7iIiIiIu7uIiIiIi7uzG7u4iIiIiIu4iIiIiIu7sQi7N3d3d3d3eIiIiIiLu4CwuzVVVVVVVVWIiIiIg7sLsLs1VVVVVVVVV4iIiIu7C7C7NVVVVVVVVVWIiIiLuwuwuzVVVVVVVVVYiIiIh7CwsLs1VVVVVVVXj4iIiIcHAAsLNVVVVVVVePiIiIiHCAAAcEVVVVVVVHiIiIiIhwgAAEBFVVVVVQAAiIiIiIcIAABQRVVVVUBViAeIiIiHCAAAUEVVVVDVAAePB4iIhwgAAFBFVVAFUAAACIBIiIcHAABABVQNUAAAAAAI8HiABwAAAAAAVAAAAAAAAH8AAAAAAAAF1QAAAAAAAAAAj/AAAAAAAAAAAAAAAAAAAAAAAAD/////////////////////4AAAB8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABwAAAA+AAAAfgAAAH4AAAB+AAAB/gAAAf+AAAH/gBgB/4B+Af+A/wH/g//B/4f/4f+f//n////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790412840311,"unified_at":"2026-09-26T08:54:00.311Z","metadata":{"hashes":{"sha256":"a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8","sha1":"18f85413020668a4f3acae2ee6820eecad24641e","md5":"6b7e9b4c98669b2863de2cf682d0b16d","sha512":"8ea884de82aebc707c85411c5879a35edd87720d286e0628936a8678eff1ec54b048f280bc117a7fdc9899f44fdba7187adefdfb8719837991bf398d573f29ff","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"KMPlayer_4.2.1.4.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":39473240,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499427427000,"last_seen":1660599668000,"last_multi_scan":1660599668000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":27,"suspicious_count":24,"malicious_count":10,"total":61},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00072301-00004040-3475-11-012312CD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00072301-00004040-3475-32-01231CD0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00072301-00004040-3475-291-01232B2A\n SetUnhandledExceptionFilter@KERNEL32.dll at 55160-2260-1004E7C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNELBASE.DLL at 00053624-00002828-60743-43-004068DF\n GetSystemTime@KERNELBASE.DLL at 00053624-00002828-60743-35-00405F90\n GetSystemTime@KERNELBASE.DLL at 00053624-00002828-60743-23-00405FB0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00072301-00004040-3475-82-01233263\n GetLocalTime@KERNEL32.DLL at 00075541-00002612-31119-987-0040B4AC\n GetLocalTime@KERNEL32.DLL at 00077847-00002504-46136-987-0040B4AC\n GetLocalTime@KERNEL32.DLL at 00079407-00001948-59794-988-0040B4AC\n GetLocalTime@KERNEL32.DLL at 00080972-00001348-7708-988-0040B4AC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00053624-00002828-48129-88-00404605\n GetDiskFreeSpaceW@KERNEL32.DLL at 00053624-00002828-55986-88-00404605\n GetDiskFreeSpaceW@KERNEL32.DLL at 00074834-00002456-23506-386-00407F84\n GetDiskFreeSpaceA@KERNEL32.DLL at 00075541-00002612-31119-968-00409BB0\n GetDiskFreeSpaceA@KERNEL32.DLL at 00077847-00002504-46136-968-00409BB0\n GetDiskFreeSpaceA@KERNEL32.DLL at 00079407-00001948-59794-969-00409BB0\n GetDiskFreeSpaceA@KERNEL32.DLL at 00080972-00001348-7708-969-00409BB0\n GetDiskFreeSpaceW@kernel32.dll at 38234-465-004066D0","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$26","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00053624-00002828-0000010C-165013892\n \"\" queries volume information of \"C:\\\" at 00053624-00002828-0000010C-165162790\n \"\" queries volume information of \"C:\\\" at 00053624-00002828-0000010C-165180347\n \"pin2taskbar.exe\" queries volume information of \"C:\\\" at 00072301-00004040-0000010C-166405964\n \"pin2taskbar.exe\" queries volume information of \"C:\\\" at 00072301-00004040-0000010C-168206420","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE - Served Attached HTTP\" (SID: 2014520, Rev: 6, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"update.kmpmedia.net\"\n \"cdn.kmplayer.com\"\n \"www.bytetouruniverse.com\"\n \"log.kmplayer.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"110.45.195.195:80\"\n \"14.0.45.89:80\"\n \"54.72.60.251:80\"\n \"61.111.8.189:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"skbar\\Release\\Pin2Taskbar.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsq5D8F.tmp\"\n \"\" created file \"%TEMP%\\nsa5E9E.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$29","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"MediaInfo.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"MoreInfo.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"KIconLib.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"avutil-lav-55.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"), Antivirus vendors marked dropped file \"xviddll.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"inetc.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"aac_parser.ax\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /player/ini_goods/1/0 HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: update.kmpmedia.net\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /KMP/player/ini/goods/old_00_unicode_20161102042649.7z HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: cdn.kmplayer.com\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /player/goods/?sq=46&division=d HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: update.kmpmedia.net\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /Gtbusfax84UZ8q2damWR_BZNW8_Cp6bYh04IuaIHwFdR+k6KaMQfjC6DsvFOmXDKtqwg2p8ObWI3+kNxqSnGGX_JPguVMwaIS5_eUPhvMmcPbB8IiJOGkkJazTOQq9MW325e33mbmfNox3+LbeEL9geblcgc9A==-Ow== HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: www.bytetouruniverse.com\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /kmp?env=(4.2.1.4)&mode=install&install=1&update=0 HTTP/1.1\nUser-Agent: http_parser\nHost: log.kmplayer.com\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6D450000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"\n \"\" searching for class \"Shell_TrayWnd\"\n \"\" searching for class \"msctls_progress32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"pin2taskbar.exe\" with commandline \"pin \"C:\\KMPlayer\\KMPlayer.exe\"\" (UID: 00072301-00004040)\n Spawned process \"KMPlayer.exe\" with commandline \"-install\" (UID: 00073667-00002344)\n Spawned process \"KMPAddedCode_OpperCD.exe\" (UID: 00074834-00002456)\n Spawned process \"kmpFileAssociate_NO.exe\" (UID: 00075541-00002612)\n Spawned process \"kmpFileAssociate_NO.exe\" (UID: 00077847-00002504)\n Spawned process \"kmpFileAssociate.exe\" (UID: 00079407-00001948)\n Spawned process \"kmpFileAssociate.exe\" (UID: 00080972-00001348)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Installation/Persistance","name":"Accessed IE Quick Launch directory","description":"\"pin2taskbar.exe\" obtained handle to \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\" (Type: \"FileHandle\")\n \"pin2taskbar.exe\" obtained handle to \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\KMPlayer.exe.lnk\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":10,"id":"handle-2","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"pin2taskbar.exe\" connecting to \"\\ThemeApiPort\"\n \"KMPlayer.exe\" connecting to \"\\ThemeApiPort\"\n \"kmpFileAssociate_NO.exe\" connecting to \"\\ThemeApiPort\"\n \"kmpFileAssociate.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2a","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"v+*'\"","origin":"Network Traffic","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"TntLabel5.Caption=www.facebook.com/KMPmedia\" (Indicator: \"facebook.com\")\n \"TntLabel7.Caption=www.twitter.com/KMPmedia\" (Indicator: \"twitter\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"pin2taskbar.exe\" opened \"\\Device\\KsecDD\"\n \"KMPlayer.exe\" opened \"\\Device\\KsecDD\"\n \"kmpFileAssociate_NO.exe\" opened \"\\Device\\KsecDD\"\n \"kmpFileAssociate.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 47 calls to GetProcAddress@KERNEL32.DLL at 00075541-00002612-31119-1537-0042A19C\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00075541-00002612-31119-4086-0042C508\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00075541-00002612-31119-2004-00446DE8\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00077847-00002504-46136-2004-00446DE8\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00077847-00002504-46136-1537-0042A19C\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00077847-00002504-46136-4086-0042C508\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00079407-00001948-59794-1538-0042A19C\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00079407-00001948-59794-4094-0042C508\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00079407-00001948-59794-2005-00446DE8\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00080972-00001348-7708-1538-0042A19C\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00080972-00001348-7708-2005-00446DE8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"MediaInfo.dll.35509638\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$2c","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"pin2taskbar.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"pin2taskbar.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)\n 1/65 reputation engines marked \"http://www.kmplayer.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00074834-00002456-23506-93-0040ECA4\n SizeofResource@KERNEL32.DLL at 00074834-00002456-23506-515-004067AE\n FindResourceA@KERNEL32.DLL at 00075541-00002612-31119-1184-004184A8\n FindResourceA@KERNEL32.DLL at 00075541-00002612-31119-1197-0041B1AC\n FreeResource@KERNEL32.DLL at 00075541-00002612-31119-3853-0041B218\n FindResourceA@KERNEL32.DLL at 00077847-00002504-46136-1184-004184A8\n FindResourceA@KERNEL32.DLL at 00077847-00002504-46136-1197-0041B1AC\n FreeResource@KERNEL32.DLL at 00077847-00002504-46136-3853-0041B218\n FindResourceA@KERNEL32.DLL at 00079407-00001948-59794-1198-0041B1AC\n FindResourceA@KERNEL32.DLL at 00079407-00001948-59794-1185-004184A8\n FreeResource@KERNEL32.DLL at 00079407-00001948-59794-3861-0041B218\n FindResourceA@KERNEL32.DLL at 00080972-00001348-7708-1185-004184A8\n FindResourceA@KERNEL32.DLL at 00080972-00001348-7708-1198-0041B1AC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"pin2taskbar.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"pin2taskbar.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"pin2taskbar.exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"pin2taskbar.exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"pin2taskbar.exe\" read file \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"MediaInfo.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MoreInfo.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"KIconLib.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"avutil-lav-55.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"xviddll.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"inetc.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"aac_parser.ax\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"KMPAddedCode_OpperCD.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"KMPlayer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.2.1.4\"\n Heuristic match: \"KMPlayer 4.2.1.4 Setup\"\n Heuristic match: \"/kmp?env=(4.2.1.4)&mode=install&install=1&update=0\"\n Heuristic match: \"KMPVer=4.0.7.1 (2016/04/27)\"\n Heuristic match: \"LangVer=4.0.7.1 (2016/04/27)\"\n Heuristic match: \"Your software uses an outdated interface, You must use MediaInfo.DLL 0.4.1.1 instead\"\n Heuristic match: \"Omneon .01.02.01.01.01.00\"\n Heuristic match: \"Omneon .01.02.01.02.01.00\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"CloseCmd=\" (Indicator: \"cmd=\")\n \"Screen3DChangeCmd=\" (Indicator: \"cmd=\")\n \"ControlBoxViewCmd=\" (Indicator: \"cmd=\")\n \"ViewFileINFOCmd=\" (Indicator: \"cmd=\")\n \"ConfigureViewCmd=\" (Indicator: \"cmd=\")\n \"ExitCmd=\" (Indicator: \"cmd=\")\n \"OpenFileCmd=\" (Indicator: \"cmd=\")\n \"OpenURLCmd=URL\" (Indicator: \"cmd=\")\n \"OpenFolderCmd=\" (Indicator: \"cmd=\")\n \"OpenTVOutCmd=\" (Indicator: \"cmd=\")\n \"OpenIEMediaCmd=IE\" (Indicator: \"cmd=\")\n \"OpenRecentCmd=\" (Indicator: \"cmd=\")\n \"OpenReTryCmd=\" (Indicator: \"cmd=\")\n \"OpenWDMCmd=WDM/BDA\" (Indicator: \"cmd=\")\n \"OpenBaseWDMCmd=\" (Indicator: \"cmd=\")\n \"OpenDVDDeviceCmd=DVD\" (Indicator: \"cmd=\")\n \"OpenDVDFileCmd=DVD\" (Indicator: \"cmd=\")\n \"OpenVCDCmd=Open Video CD %VCDOpenMenu%\" (Indicator: \"cmd=\")\n \"WDMOpenAnalogCmd=Open WDM (ATV) %WDMAnalogOpenMenu%\" (Indicator: \"cmd=\")\n \"WDMOpenDigitalCmd=Open BDA (DTV) %WDMHDTVOpenMenu%\" (Indicator: \"cmd=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"KMPlayer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"kmpFileAssociate_NO.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"kmpFileAssociate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")\n \"KMPlayer.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"KMPlayer.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00053624-00002828-48129-93-0040522D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.DLL at 00053624-00002828-48129-88-00404605\n GetAsyncKeyState@USER32.DLL at 00053624-00002828-55986-88-00404605\n GetKeyboardState@USER32.DLL at 00075541-00002612-31119-1852-0043EB58\n GetKeyboardState@USER32.DLL at 00075541-00002612-31119-1772-0043B19C\n GetKeyboardState@USER32.DLL at 00077847-00002504-46136-1772-0043B19C\n GetKeyboardState@USER32.DLL at 00077847-00002504-46136-1852-0043EB58\n GetKeyboardState@USER32.DLL at 00079407-00001948-59794-1773-0043B19C\n GetKeyboardState@USER32.DLL at 00079407-00001948-59794-1853-0043EB58\n GetKeyboardState@USER32.DLL at 00080972-00001348-7708-1773-0043B19C\n GetKeyboardState@USER32.DLL at 00080972-00001348-7708-1853-0043EB58","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2d","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nse58F0.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\splash.bmp\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\kmp_ini_7zip.7z\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\addon_kmp_longtext_Group.txt\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\addon_kmp_longtext_Group_barcon.txt\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\addon_kmp_longtext_Group_barcon_A.txt\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\addon_kmp_longtext_Group_barcon_B.txt\" with delete access\n \"\" opened \"%TEMP%\\nsa5E9E.tmp\\addon_kmp_longtext_Group_Etc01_A.txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00075541-00002612-31119-2489-00464D78\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00077847-00002504-46136-2489-00464D78\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00079407-00001948-59794-2476-00464E3C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"ChangeDisplaySettingsExA@USER32.DLL\" in \"KMPlayer.exe\"\n \"ChangeDisplaySettingsExW@USER32.DLL\" in \"KMPlayer.exe\"\n \"RegDeleteValueW@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegCreateKeyExA@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"DeviceIoControl@KERNEL32.DLL\" in \"KMPlayer.exe\"\n \"RegFlushKey@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegCreateKeyA@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegDeleteValueA@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegDeleteKeyA@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegCreateKeyW@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegCloseKey@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegDeleteKeyW@ADVAPI32.DLL\" in \"KMPlayer.exe\"\n \"RegCreateKeyExW@ADVAPI32.DLL\" in \"KMPlayer.exe\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$2e","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"KMPlayer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"KMPlayer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"kmpFileAssociate_NO.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"kmpFileAssociate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/63 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"9/81 Antivirus vendors marked dropped file \"KMPAddedCode_OpperCD.exe\" as malicious (classified as \"AdWare.DealPly\" with 11% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"9/81 Antivirus vendors marked spawned process \"KMPAddedCode_OpperCD.exe\" (PID: 2456) as malicious (classified as \"AdWare.DealPly\" with 11% detection rate)\n 1/59 Antivirus vendors marked spawned process \"kmpFileAssociate_NO.exe\" (PID: 2612) as malicious (classified as \"Malware.Generic\" with 1% detection rate)\n 1/59 Antivirus vendors marked spawned process \"kmpFileAssociate_NO.exe\" (PID: 2504) as malicious (classified as \"Malware.Generic\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$30","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: NSIS_Inetc (Mozilla)\n http_parser","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$31","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00053624-00002828-48129-1-004039E3\n ExitWindowsEx@USER32.DLL at 00074834-00002456-23506-515-004067AE\n ExitWindowsEx@user32.dll at 38234-619-004067AE","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00053624-00002828)\n Spawned process \"pin2taskbar.exe\" with commandline \"pin \"C:\\KMPlayer\\KMPlayer.exe\"\" (UID: 00072301-00004040)\n Spawned process \"KMPlayer.exe\" with commandline \"-install\" (UID: 00073667-00002344)\n Spawned process \"KMPAddedCode_OpperCD.exe\" (UID: 00074834-00002456)\n Spawned process \"kmpFileAssociate_NO.exe\" (UID: 00075541-00002612)\n Spawned process \"kmpFileAssociate_NO.exe\" (UID: 00077847-00002504)\n Spawned process \"kmpFileAssociate.exe\" (UID: 00079407-00001948)\n Spawned process \"kmpFileAssociate.exe\" (UID: 00080972-00001348)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":83,"files_written_count":255,"files_deleted_count":0,"registry_keys_created_count":86,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":86,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"595f6b3f7ca3e13d7d0864f9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Multi.Threats","contacted_countries":["KOR","USA"],"submit_name":"KMPlayer_4.2.1.4.exe","analysis_start_time":"2017-07-07T13:08:30+00:00","indicators_count":{"informative":27,"suspicious":38,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"110.45.195.195","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"address":"14.0.45.89","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"address":"54.72.60.251","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"address":"61.111.8.189","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}],"dns_resolutions":[{"domain":"log.kmplayer.com","address":"61.111.8.189","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"domain":"update.kmpmedia.net","address":"110.45.195.195","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"domain":"www.bytetouruniverse.com","address":"54.72.60.251","country":"United States","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"domain":"cdn.kmplayer.com","address":"14.0.45.89","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}],"http_requests":[{"host":"update.kmpmedia.net","host_ip":"110.45.195.195:80","url":"/player/ini_goods/1/0","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /player/ini_goods/1/0 HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: update.kmpmedia.net\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"host":"cdn.kmplayer.com","host_ip":"14.0.45.89:80","url":"/KMP/player/ini/goods/old_00_unicode_20161102042649.7z","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /KMP/player/ini/goods/old_00_unicode_20161102042649.7z HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: cdn.kmplayer.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"host":"update.kmpmedia.net","host_ip":"110.45.195.195:80","url":"/player/goods/?sq=46&division=d","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /player/goods/?sq=46&division=d HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: update.kmpmedia.net\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"host":"www.bytetouruniverse.com","host_ip":"54.72.60.251:80","url":"/Gtbusfax84UZ8q2damWR_BZNW8_Cp6bYh04IuaIHwFdR+k6KaMQfjC6DsvFOmXDKtqwg2p8ObWI3+kNxqSnGGX_JPguVMwaIS5_eUPhvMmcPbB8IiJOGkkJazTOQq9MW325e33mbmfNox3+LbeEL9geblcgc9A==-Ow==","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /Gtbusfax84UZ8q2damWR_BZNW8_Cp6bYh04IuaIHwFdR+k6KaMQfjC6DsvFOmXDKtqwg2p8ObWI3+kNxqSnGGX_JPguVMwaIS5_eUPhvMmcPbB8IiJOGkkJazTOQq9MW325e33mbmfNox3+LbeEL9geblcgc9A==-Ow== HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: www.bytetouruniverse.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"host":"log.kmplayer.com","host_ip":"61.111.8.189:80","url":"/kmp?env=(4.2.1.4)&mode=install&install=1&update=0","method":"GET","response_code":"200","response_phrase":"Log Processed","header":"GET /kmp?env=(4.2.1.4)&mode=install&install=1&update=0 HTTP/1.1\nUser-Agent: http_parser\nHost: log.kmplayer.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}],"processes":[{"pid":2828,"ppid":0,"name":"a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe","command_line":"","sha256":"a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8","normalized_path":"C:\\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe","uid":"00053624-00002828","icon":"$32"},{"pid":4040,"ppid":2828,"name":"pin2taskbar.exe","command_line":"pin \"C:\\KMPlayer\\KMPlayer.exe\"","sha256":"b0df9c447047cf0c96a84441b07959e25473c1d7140e0a95b6b2084962b88e62","normalized_path":"%TEMP%\\nsa5E9E.tmp\\pin2taskbar.exe","parent_uid":"00053624-00002828","uid":"00072301-00004040"},{"pid":2344,"ppid":2828,"name":"KMPlayer.exe","command_line":"-install","sha256":"b0ef166b3246ed391b066e4d1901db44acee660a51a05974d9074c72baaa5b3b","normalized_path":"C:\\KMPlayer\\KMPlayer.exe","parent_uid":"00053624-00002828","uid":"00073667-00002344"},{"pid":2456,"ppid":2828,"name":"KMPAddedCode_OpperCD.exe","command_line":"","sha256":"559131d84c7c320a6a0c78616c4496b868a96609e3b6db10bb13877b1451a002","normalized_path":"%TEMP%\\nsa5E9E.tmp\\KMPAddedCode_OpperCD.exe","parent_uid":"00053624-00002828","uid":"00074834-00002456"},{"pid":2612,"ppid":2828,"name":"kmpFileAssociate_NO.exe","command_line":"","sha256":"3434d181c129d13d717b2483b8816752cc6f859078b1414178a97ffa5c689d02","normalized_path":"%TEMP%\\nsa5E9E.tmp\\kmpFileAssociate_NO.exe","parent_uid":"00053624-00002828","uid":"00075541-00002612"},{"pid":2504,"ppid":2828,"name":"kmpFileAssociate_NO.exe","command_line":"","sha256":"3434d181c129d13d717b2483b8816752cc6f859078b1414178a97ffa5c689d02","normalized_path":"%TEMP%\\nsa5E9E.tmp\\kmpFileAssociate_NO.exe","parent_uid":"00053624-00002828","uid":"00077847-00002504"},{"pid":1948,"ppid":2828,"name":"kmpFileAssociate.exe","command_line":"","sha256":"613656e16d283bc034fd25b600df02901e454d860babaf3b71fffceee5817208","normalized_path":"%TEMP%\\nsa5E9E.tmp\\kmpFileAssociate.exe","parent_uid":"00053624-00002828","uid":"00079407-00001948"},{"pid":1348,"ppid":2828,"name":"kmpFileAssociate.exe","command_line":"","sha256":"613656e16d283bc034fd25b600df02901e454d860babaf3b71fffceee5817208","normalized_path":"%TEMP%\\nsa5E9E.tmp\\kmpFileAssociate.exe","parent_uid":"00053624-00002828","uid":"00080972-00001348"}],"all_imported_dlls":["Wldap32.dll","urlmon.dll","gdi32.dll","IPHLPAPI.DLL","shell32.dll","version.dll","rasadhlp.dll","WSHTCPIP.DLL","ntshrui.dll","dsound.dll","GdiPlus.dll","rasapi32.dll","oleacc.dll","shdocvw.dll","devrtl.dll","nlaapi.dll","rpcrt4.dll","psapi.dll","winnsi.dll","FWPUCLNT.DLL","slc.dll","kernel32.dll","RpcRtRemote.dll","msasn1.dll","normaliz.dll","ExplorerFrame.dll","acppage.dll","ole32.dll","clbcatq.dll","winrnr.dll","netutils.dll","shfolder.dll","imageres.dll","ws2_32.dll","xmllite.dll","cscapi.dll","sspicli.dll","ntmarta.dll","mswsock.dll","SensApi.dll","imm32.dll","msctf.dll","cryptbase.dll","rsaenh.dll","linkinfo.dll","msi.dll","powrprof.dll","devobj.dll","dnsapi.dll","msxml3.dll","gameux.dll","PProcDLL.DLL","winmm.dll","rtutils.dll","comdlg32.dll","IntelWiDiExtensions.dll","wtsapi32.dll","msimg32.dll","wship6.dll","npmproxy.dll","msls31.dll","Dialer.dll","sfc.dll","profapi.dll","twext.dll","wer.dll","lpk.dll","usp10.dll","oleaut32.dll","iertutil.dll","dhcpcsvc6.dll","netapi32.dll","rpcss.dll","crypt32.dll","nsDialogs.dll","srvcli.dll","sfc_os.dll","user32.dll","uxtheme.dll","wininet.dll","rasman.dll","userenv.dll","wsock32.dll","pnrpnsp.dll","advapi32.dll","ntdll.dll","cfgmgr32.dll","dwmapi.dll","msxml3r.dll","dui70.dll","olepro32.dll","netmsg.dll","w7tbp.dll","oleaccrc.dll","secur32.dll","riched20.dll","dciman32.dll","wkscli.dll","winsta.dll","KernelBase.dll","sechost.dll","duser.dll","mpr.dll","setupapi.dll","netprofm.dll","tiptsf.dll","shlwapi.dll","dhcpcsvc.dll","ddraw.dll","NapiNSP.dll","nsi.dll","security.dll","comctl32.dll","System.dll","cryptsp.dll","nsis7z.dll","apphelp.dll","msvcrt.dll","propsys.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"KMPAddedCode_OpperCD.exe","sha256":"559131d84c7c320a6a0c78616c4496b868a96609e3b6db10bb13877b1451a002","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"MoreInfo.dll","sha256":"227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"inetc.dll","sha256":"5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"avutil-lav-55.dll","sha256":"489d0f3aa40325d19e5450ba85e0e12d017fc428be52c90550e30898eb57cf55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"KIconLib.dll","sha256":"f7eebd650d9afcf67be34c6ed12eef4849bf5ce2cd5f184a529387bd880fc112","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"MediaInfo.dll","sha256":"7fd0f47fa02e8f9bd7b43eea21328db8c0ea496e2ccead0c358486fc9989d9d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"xviddll.dll","sha256":"e7cf37294b32708fba87a6aef4c4e3add90c7d04d5deff3e197f73e8322cc7c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"KMPlayer.exe","sha256":"7ce2908387b2bd66ddd690353a0d6f57d434b5af13f765325eed97237dc80e98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"KMPlayer.exe.lnk","sha256":"9c69554621b81900d64e6d21ef9d99a50c98da0fc46097310a03f23db15f49ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Uninstall KMPlayer.lnk","sha256":"19cafa87fcb28b1207d0a146799ef2de69c64937885313e103351e97a5f7c0d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"old_00_unicode_20161102042649[1].7z","sha256":"1b61e93619f6113a67d466f5ee67b18094de3f83b3880d6531b0860d8a731571","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"kmplayer[1].exe","sha256":"559131d84c7c320a6a0c78616c4496b868a96609e3b6db10bb13877b1451a002","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"AdvSplash.dll","sha256":"b08d6797848ee8eef5393391a7318e10720d55d03c910a2127c03b074c4966af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Description.txt","sha256":"a6ef34292bf0d22e739a80f1c33511a49723a7d4af9e890a731fa82cd086d316","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Dialer.dll","sha256":"4e63d7b877a7e8889b6cd7bebc1dec767bff0f5bd41d8936d4a5b29d934ea4c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"KMP_AssociateDefaultProgram.exe","sha256":"37947c7495edfc0bcb609384ab8ecb460ed114751684fdf1f33484657c691288","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"LangDLL.dll","sha256":"47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"System.dll","sha256":"7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"_addon_kmp_unicode.ini","sha256":"da6c8d8a28ba2d7f09b1b357464fb6e8f405d78b71bb34cade83b131711bb94c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"kmpFileAssociate.exe","sha256":"613656e16d283bc034fd25b600df02901e454d860babaf3b71fffceee5817208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"kmpFileAssociate_NO.exe","sha256":"3434d181c129d13d717b2483b8816752cc6f859078b1414178a97ffa5c689d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"kmp_ini_7zip.7z","sha256":"1b61e93619f6113a67d466f5ee67b18094de3f83b3880d6531b0860d8a731571","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"loading.swf","sha256":"6f24056f99e04e52370771c2671a493d209cc8c6c5d21b920b67b26d936e1f2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"modern-header.bmp","sha256":"5c200ab91692f8c01596a072772bfa3a32c5441061e6f94e1fed4ec17b75cd94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"modern-wizard.bmp","sha256":"20418f4a4c2ab596506722b1b635d3f5f5f8b40be5fb9d51a62f9de736222324","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"nsDialogs.dll","sha256":"416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"nsProcess.dll","sha256":"30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"nsis7z.dll","sha256":"37dd96230521a91dc7eba0d0a4fe8726b4405562b1a96363a01e28334bde94fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"nxs.dll","sha256":"ee9da9fad0ae660326395e1d5c293838253389f4939d6216aab945e0228fecab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"pin2taskbar.exe","sha256":"b0df9c447047cf0c96a84441b07959e25473c1d7140e0a95b6b2084962b88e62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"w7tbp.dll","sha256":"53bb519e3293164947ac7cbd7e612f637d77a7b863e3534ba1a7e39b350d3c00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"KMPlayer.lnk","sha256":"8980344b3817d9837d274cf1c8f41538e0f39ff28afdc4372a1f269cdf71e6df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"AboutDLL.dll","sha256":"37268e5bc9f50a78dbe98d2e7d56cce6a685e006cde96b84b5b2f7961712eaa8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"IntelQuickSyncDecoder.dll","sha256":"8aa240b74ea22807058fe0c7cf443aa919183924f6145ea493db56e855507b67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"avcodec-lav-57.dll","sha256":"abac15010f0de7acc63f82bf4f1329624bc59258a28beeb5aa2e5ed52a1a965e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"avfilter-lav-6.dll","sha256":"626a4ac9ff419241a29381ad67543115e54c3d36e0965e6bb99ddb2c5858ec3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"avformat-lav-57.dll","sha256":"c7fbcdedb8161ead69c9773646a829372d5a0ccdc589c09cd600057f2d94cf12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"avresample-lav-3.dll","sha256":"98518f173d80d39b83cf474d5fa6aba73a9a77d131369b1f9820ddff1b9b8052","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libbluray.dll","sha256":"61e7352b74c80b84646abb46d8bc8b6f5cb8c5c880803b5ab6b78e4c43713774","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"swscale-lav-4.dll","sha256":"97ffc01aaedcbfdc3545add38e85508c7a2b922a77ffd4ea294302ea4f5d08f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"utils.dll","sha256":"6c12e355ca38b462bcc43e7fbe54d9674d174d20e07fb748b857463d49029ea6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"D3DX9sab.dll","sha256":"0854e66ef6032014645d3663661ddbadd9008f3ac01740f519b15f5e4a8fe13f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"DTView.dll","sha256":"6d73c5c5de91456e8695e5f8d8f323c7fc22f0bd0f911fe530a11b83cf8f8250","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"ImLoader.dll","sha256":"19938d6fe6fee5de2d3e23f94376a99da727575882cfb1a9b73ac720b7817c7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"IntelWiDiExtensions.dll","sha256":"13a33cffd8c0488b44a86b2d7c4b3037947c6f54bd143a30e86b3792dfd589d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"LibIntelCodec.dll","sha256":"e8b06d258f12788d27e16b022e82e714d4a4db8e1fb1a265219b99b0ee070461","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"LibRealSenseKMP.dll","sha256":"9da530ae8735ca4908a6176d1ac38827bd14a7c7d4bd98940ff6baaf8216df2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"OggVorbis.dll","sha256":"3d9969026db5acfbea3102e2d2086f57b5d35f01fbdcc089aca64e9d9ebb8688","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Old_QUARTZ.DLL","sha256":"600941e70316b3f37e2a3be711c8887759c389759b7a72980ae79ebc1933e574","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"OptimFROG.dll","sha256":"ab20c16f73a7ca3d2fea4b125d97b716b40438cfc05cdcfa8c470caf58891d78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"PProcDLL.DLL","sha256":"d5b8cd8d9993dc465db31f1dcafcdd706181c035017ac221d5ac26c967879233","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"VSFilter.dll","sha256":"c83c9f247e5501d5db06e9e2de3ac26ceb2bda82b2db2f23460aa00976ef6beb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass.dll","sha256":"a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_alac.dll","sha256":"f57c2e18acee1a13bd9bc6a442a9ad7a10deae2c0709a653fa10cf342586cca3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_ape.dll","sha256":"7cf69627f5f80ca33eeb16c62417f94a897c03f070a7e5b5e2e83087e1e0bba9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_flac.dll","sha256":"9ecda6fa8c95b8299fdeaf4ac47123c8beed7e8f9fd59dc9ac2ff9dd8f7585a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_mpc.dll","sha256":"35dbc8e6aadb62c6f102634d167fea5d53a7ae38d046efc639f455140626300a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_ofr.dll","sha256":"edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_spx.dll","sha256":"72b842141069b6cb4a7af7401ce19fd5e76874064a94b09449a2888e0348cc0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_tta.dll","sha256":"0a69d4b7571ba9fcc28a2da8159e5765756418eddd0648a935f2f31dae6f89b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"bass_wv.dll","sha256":"55bff0efe6bc30598091dd55dfc3d402b94c0c5210746c233eecd4051a6fea51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"cv100.dll","sha256":"6eeeee6401e9a199d67fc5fb095f4cc292d3cbd37fa7111b3a84c1043d76c5e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"cxcore100.dll","sha256":"39748cd7fd0b0d270239bd8d7e59e9477a1c1b358f9d66004646cbeff2e36443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"ffmpeg.exe","sha256":"6b8f6538d89ade53333dbe1a9c3b3df47f3dbeb472fcc742d48b065271a530cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"iconv.dll","sha256":"dee0617599e3ffbf6aacefceef58de15d05b02447d9aee85ab1a074a82767704","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"liba52.dll","sha256":"598c51da8a3196647bf975fd6b790c507ba5cbb62b62a3adcdfad3e270c17788","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libcodec.dll","sha256":"abd75f92dca4f83360ced5545f1aa8efd3bf417bddb9246c91a0c7a1761eeb66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libdts.dll","sha256":"fc9aa2b9546b477a71a5997962db8fd1bce1d75f5bd567b277f27bf7a936a5d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libfaac.dll","sha256":"9e3ddc8275ab85da12fac73292570d21b1c1c5bb57897801751537a68955e139","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libfaad2.dll","sha256":"225ad460cda6dedb41d95506340533f7107cbd44eb92108f55863a6029598bc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libguide40.dll","sha256":"83fffcee58767d863285fc8c24d3ae04a22f0cbf9ce181a2692513b513a216f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libmad.dll","sha256":"caa3ab8b8bc3d8c02cac4bc64bf897c393291437f722121655a0ed3dbde9c1bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libmfxsw32.dll","sha256":"999e706b5e0fb9f4c1701e8216de1c2d70e0cc876df5fa8955f014b451d0780c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libmpeg2.dll","sha256":"1b9d4020d689cc4d03ce1d3e0067c59af8128387580814fecd78aba5a9952cb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"libmplay.dll","sha256":"b03555510d7c3bd2bcdb6f20b5fdd856412046996993646cb03d08dce169070d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"qscl.dll","sha256":"44d8369ff58b1b327f83f525b5bc57a7f830a699066763ca06c2584abb7199fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"siftDLL.dll","sha256":"0b0f8e901d4747dab134c82385a146fa5ebbcd3166fa764b4de2db75e4fe2333","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"theora.dll","sha256":"89646181d0e524a2e3eae8952983841aee9525a670387b6af4b509fd4eef13ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"uninstall.exe","sha256":"54b76ce1bbe8bfc802f32672d0fcf1992f13f8e2a0c20050ce14872b48e087c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"unrarDLL.dll","sha256":"97d8e67484327feb5f0f89e41c9e2aae6d0fa38ee16f736a6059d58b4b5da554","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"vp8vfw.dll","sha256":"ce8a4f6994480686be05ecfcc840423393b99aa6cc25a74320c4b209f540ba20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"xvidcore.dll","sha256":"a99275aad031af164455ea3c6aa6d7e638709e98f99a37b7672b4c087cac4b57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"xvidvfw.dll","sha256":"d668641c57c5b9f04eeb8bc881802503ffaba52a082ff0fb25515db3c453137a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}],"files_written":[{"path":"C:\\a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\Description.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\null.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\WINMM.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\splash.wav.WAV","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsq5D8F.tmp","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\kmpFileAssociate_NO.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\old_00_unicode_20161102042649[1].7z","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\loading.swf","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\nxs.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\modern-header.bmp","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\kmplayer[1].exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\resources\\themes\\Aero\\Shell\\NormalColor\\ShellStyle.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\OLEACCRC.DLL.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\loading.swf","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\AboutDLL.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\DTView.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\PProcDLL.DLL","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\URLList.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libmplay.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Old_QUARTZ.DLL","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_alac.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_ape.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_flac.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_mpc.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_tta.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_wv.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_spx.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\bass_ofr.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\OptimFROG.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\ColorTheme.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\unrarDLL.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\ImLoader.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\KIconLib.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\MediaInfo.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\gpl.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\LGPL.TXT","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\D3DX9sab.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\ffmpeg.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\cv100.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\cxcore100.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libguide40.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\siftDLL.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\IntelWiDiExtensions.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\AudioVADT.png","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Albanian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Arabic.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Azeri.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Belarusian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Brazilian Portuguese.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Bulgarian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Chinesebig5.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Chinesesimp.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Croatian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Czech.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Dutch.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\English.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\EnglishUK.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Estonian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Farsi.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Finnish.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\French.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\German.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Greek.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Hebrew.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Hungarian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Indonesia.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Italian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Japanese.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Khmer.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Korean.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Kurdish Sorani.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Norwegian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Polish.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Portuguese.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Romanian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Russian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Serbian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Sinhalese.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Slovak.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Spanish.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Swedish.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Thai.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Turkish.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Ukrainian.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Language\\Vietnam.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\+Deinterlace(Blend).txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\0-255 to 16-235.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\16-235 to 0-255.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\BT.601 to BT.709.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Cartoon Shader.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Contour Color.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Contour.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Deinterlace (blend).txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Denoise.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\DisplayLessThan16 v1_1.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\DisplayLessThan16.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\EdgeSharpen v1_1(jim ro).txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\EdgeSharpen v1_1.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\EdgeSharpen.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\EdgeSharpen2.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Emboss.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Expose Banding.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Film Projector Lamp Vignette.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Film Projector Sepia Toning.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Grayscale.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Invert.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Letterbox.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\NightVision.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Procamp.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Remap_16_235.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Sharpen Complex 2.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Sharpen Complex.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Sharpen.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\SharpenComplex (jim ro).txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\SharpenFlou (jim ro).txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\SharpenFlou.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Sharpen_3x3.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Sharpen_5x5.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\SpacialSoften.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Sphere.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Spotlight.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\SuperResolution.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\UV Swap.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Undot.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Unsharp mask.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\Wave.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Shader\\YV12 Chroma Upsampling.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\IntelQuickSyncDecoder.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\LAVFilters.Dependencies.manifest","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\LAVSplitter.ax","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\LAVVideo.ax","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\LAVAudio.ax","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\libbluray.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\avcodec-lav-57.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\avfilter-lav-6.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\avformat-lav-57.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\avresample-lav-3.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\avutil-lav-55.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\swscale-lav-4.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Core\\utils.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libcodec.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\xviddll.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libmpeg2.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libfaad2.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libmad.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\theora.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\OggVorbis.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libdts.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\liba52.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libfaac.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\LibIntelCodec.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\libmfxsw32.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\iconv.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\MMSwitch.ax","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\aac_parser.ax","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\audioswitcher.ax","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\qscl.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\LibRealSenseKMP.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\files.txt","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\xvidcore.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\xvidvfw.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\vp8vfw.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\VSFilter.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\KMP_AssociateDefaultProgram.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\kmpFileAssociate.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Skins\\Default.ksf","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\Skins\\touch.ksf","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\The KMPlayer","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\The KMPlayer\\KMPlayer.lnk","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\The KMPlayer\\KMPlayer Home Page.url","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\uninstall.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\The KMPlayer\\Uninstall KMPlayer.lnk","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%USERPROFILE%\\Desktop\\KMPlayer.lnk","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\pin2taskbar.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer\\KMPlayer.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\twext.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\acppage.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\KMPlayer","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\KMPlayer.exe.lnk","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\KMPlayer.exe.lnk","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Users\\QjqsV3q","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%TEMP%\\nsa5E9E.tmp\\KMPAddedCode_OpperCD.exe","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\KMPLAYER_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\KMPLAYER_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCU\\SOFTWARE\\KMPLAYER\\KMP3.0\\OPTIONAREA\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\OPEN\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\PLAY\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\PLAY\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\PLAY\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\ENQUEUE\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\ENQUEUE\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3G2\\SHELL\\ENQUEUE\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.3G2\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\OPEN\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\PLAY\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\PLAY\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\PLAY\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\ENQUEUE\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\ENQUEUE\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP\\SHELL\\ENQUEUE\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.3GP\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\OPEN\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\PLAY\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\PLAY\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\PLAY\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\ENQUEUE\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\ENQUEUE\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GP2\\SHELL\\ENQUEUE\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.3GP2\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\OPEN\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\PLAY\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\PLAY\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\PLAY\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\ENQUEUE\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\ENQUEUE\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.3GPP\\SHELL\\ENQUEUE\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.3GPP\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\OPEN\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\PLAY\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\PLAY\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\PLAY\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\ENQUEUE\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\ENQUEUE\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.AMV\\SHELL\\ENQUEUE\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.AMV\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\OPEN\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\PLAY\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\PLAY\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\PLAY\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\ENQUEUE\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\ENQUEUE\\DROPTARGET\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\KMPLAYER.ASF\\SHELL\\ENQUEUE\\","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qjqsv3q!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qjqsv3q!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\c:!users!qjqsv3q!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\c:!users!qjqsv3q!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\c:!users!qjqsv3q!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x00000928)","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]},{"name":"Local\\DirectSound DllMain mutex (0x00000928)","sources":[{"report_type":"sandbox","report_id":"595f6b3f7ca3e13d7d0864f9"}]}]}},"report_ids":{"sandbox_job_ids":["595f6b3f7ca3e13d7d0864f9"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample a79fc8ac3d17… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a79fc8ac3d17…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample a79fc8ac3d17… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a79fc8ac3d17…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a79fc8ac3d179230d755c21daab548a91e524e64e233dbc81f4ec100706778a8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample a79fc8ac3d17… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a79fc8ac3d17…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]