Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-U0IAJ.tmp\Kur [x86].tmp' /SL5="$100E0,8182239,167424,%TEMP%\Kur [x86].exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\Kur [x86].exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\MPC-BE\Shaders\is-0B828.tmp
- %APPDATA%\MPC-BE\Shaders\is-PN25L.tmp
- %APPDATA%\MPC-BE\Shaders\is-2PHU3.tmp
- %APPDATA%\MPC-BE\Shaders\is-38T7D.tmp
- %APPDATA%\MPC-BE\Shaders\is-8QJOM.tmp
- %APPDATA%\MPC-BE\Shaders\is-97PKR.tmp
- %APPDATA%\MPC-BE\Shaders\is-LO090.tmp
- %APPDATA%\MPC-BE\Shaders\is-5K8KT.tmp
- %PROGRAM_FILES%\MPC-BE\is-6BHFH.tmp
- %PROGRAM_FILES%\MPC-BE\is-B8CQ5.tmp
- %PROGRAM_FILES%\MPC-BE\is-RVE9B.tmp
- %PROGRAM_FILES%\MPC-BE\is-4QL1L.tmp
- %APPDATA%\MPC-BE\Shaders\is-QP5OE.tmp
- %APPDATA%\MPC-BE\Shaders\is-P1U5M.tmp
- %APPDATA%\MPC-BE\Shaders\is-SFV9F.tmp
- %APPDATA%\MPC-BE\Shaders\is-MCKP8.tmp
- %APPDATA%\MPC-BE\Shaders\is-8U6FT.tmp
- %HOMEPATH%\Desktop\MPC-BE.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\MPC-BE\Uninstall MPC-BE.lnk
- %APPDATA%\MPC-BE\Shaders\is-5V6SR.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\MPC-BE\MPC-BE.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\MPC-BE\MPC-BE on the Web.url
- %PROGRAM_FILES%\MPC-BE\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\MPC-BE\Changelog.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\MPC-BE\ChangelogRus.lnk
- %APPDATA%\MPC-BE\Shaders\is-53F1V.tmp
- %APPDATA%\MPC-BE\Shaders\is-KVGSJ.tmp
- %APPDATA%\MPC-BE\Shaders\is-TARUF.tmp
- %APPDATA%\MPC-BE\Shaders\is-18PBG.tmp
- %APPDATA%\MPC-BE\Shaders\is-34CFQ.tmp
- %APPDATA%\MPC-BE\Shaders\is-VQ9SP.tmp
- %APPDATA%\MPC-BE\Shaders\is-NFCKR.tmp
- %APPDATA%\MPC-BE\Shaders\is-TBSEF.tmp
- %PROGRAM_FILES%\MPC-BE\is-LB0SB.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-SIRDF.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-J70SA.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-UC1N5.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-GP875.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-0IIN8.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-0JL46.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-N7VIQ.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-TDI0G.tmp
- %TEMP%\is-U0IAJ.tmp\Kur [x86].tmp
- %TEMP%\is-OL1VR.tmp\_isetup\_shfoldr.dll
- %TEMP%\aut1.tmp
- %TEMP%\Kur [x86].exe
- %PROGRAM_FILES%\MPC-BE\is-F8IRV.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-2EETP.tmp
- %PROGRAM_FILES%\MPC-BE\is-N6VEC.tmp
- %PROGRAM_FILES%\MPC-BE\is-PEKS8.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-043D4.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-7UNN8.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-FCR5D.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-0D2IP.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-QRVJL.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-9B8BT.tmp
- %PROGRAM_FILES%\MPC-BE\is-IF6VP.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-TPAPF.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-JAP00.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-BR3I4.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-VMSLR.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-8TU32.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-TMBV1.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-TT4MT.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-O7U0L.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-G2HTJ.tmp
- %PROGRAM_FILES%\MPC-BE\Lang\is-3TQEJ.tmp
Удаляет следующие файлы:
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\is-U0IAJ.tmp\Kur [x86].tmp
- %TEMP%\Kur [x86].exe
- %TEMP%\aut1.tmp
- %TEMP%\is-OL1VR.tmp\_isetup\_shfoldr.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Перемещает следующие файлы:
- %APPDATA%\MPC-BE\Shaders\is-2PHU3.tmp в %APPDATA%\MPC-BE\Shaders\contour.psh
- %APPDATA%\MPC-BE\Shaders\is-P1U5M.tmp в %APPDATA%\MPC-BE\Shaders\BT.601 to BT.709.psh
- %APPDATA%\MPC-BE\Shaders\is-QP5OE.tmp в %APPDATA%\MPC-BE\Shaders\16-235 to 0-255 [SD][HD].psh
- %APPDATA%\MPC-BE\Shaders\is-38T7D.tmp в %APPDATA%\MPC-BE\Shaders\deinterlace (blend).psh
- %APPDATA%\MPC-BE\Shaders\is-LO090.tmp в %APPDATA%\MPC-BE\Shaders\emboss.psh
- %APPDATA%\MPC-BE\Shaders\is-PN25L.tmp в %APPDATA%\MPC-BE\Shaders\edge sharpen.psh
- %APPDATA%\MPC-BE\Shaders\is-0B828.tmp в %APPDATA%\MPC-BE\Shaders\denoise.psh
- %PROGRAM_FILES%\MPC-BE\is-4QL1L.tmp в %PROGRAM_FILES%\MPC-BE\Changelog.txt
- %PROGRAM_FILES%\MPC-BE\is-RVE9B.tmp в %PROGRAM_FILES%\MPC-BE\Authors mpc-hc team.txt
- %PROGRAM_FILES%\MPC-BE\is-LB0SB.tmp в %PROGRAM_FILES%\MPC-BE\Authors.txt
- %PROGRAM_FILES%\MPC-BE\is-6BHFH.tmp в %PROGRAM_FILES%\MPC-BE\Changelog.Rus.txt
- %APPDATA%\MPC-BE\Shaders\is-MCKP8.tmp в %APPDATA%\MPC-BE\Shaders\16-235 to 0-255 [SD].psh
- %APPDATA%\MPC-BE\Shaders\is-SFV9F.tmp в %APPDATA%\MPC-BE\Shaders\0-255 to 16-235.psh
- %PROGRAM_FILES%\MPC-BE\is-B8CQ5.tmp в %PROGRAM_FILES%\MPC-BE\Readme.txt
- %APPDATA%\MPC-BE\Shaders\is-TBSEF.tmp в %APPDATA%\MPC-BE\Shaders\sphere.psh
- %APPDATA%\MPC-BE\Shaders\is-NFCKR.tmp в %APPDATA%\MPC-BE\Shaders\sharpen.psh
- %APPDATA%\MPC-BE\Shaders\is-KVGSJ.tmp в %APPDATA%\MPC-BE\Shaders\sharpen complex.psh
- %APPDATA%\MPC-BE\Shaders\is-34CFQ.tmp в %APPDATA%\MPC-BE\Shaders\spotlight.psh
- %HOMEPATH%\Desktop\MPC-BE.lnk в %HOMEPATH%\Desktop\Media Player Classic Black Edition.lnk
- %APPDATA%\MPC-BE\Shaders\is-5V6SR.tmp в %APPDATA%\MPC-BE\Shaders\YV12 Chroma Upsampling.psh
- %APPDATA%\MPC-BE\Shaders\is-VQ9SP.tmp в %APPDATA%\MPC-BE\Shaders\wave.psh
- %APPDATA%\MPC-BE\Shaders\is-97PKR.tmp в %APPDATA%\MPC-BE\Shaders\LCD angle correction.psh
- %APPDATA%\MPC-BE\Shaders\is-8QJOM.tmp в %APPDATA%\MPC-BE\Shaders\invert.psh
- %APPDATA%\MPC-BE\Shaders\is-5K8KT.tmp в %APPDATA%\MPC-BE\Shaders\grayscale.psh
- %APPDATA%\MPC-BE\Shaders\is-8U6FT.tmp в %APPDATA%\MPC-BE\Shaders\letterbox.psh
- %APPDATA%\MPC-BE\Shaders\is-53F1V.tmp в %APPDATA%\MPC-BE\Shaders\sharpen complex 2.psh
- %APPDATA%\MPC-BE\Shaders\is-18PBG.tmp в %APPDATA%\MPC-BE\Shaders\procamp.psh
- %APPDATA%\MPC-BE\Shaders\is-TARUF.tmp в %APPDATA%\MPC-BE\Shaders\nightvision.psh
- %PROGRAM_FILES%\MPC-BE\is-IF6VP.tmp в %PROGRAM_FILES%\MPC-BE\COPYING.txt
- %PROGRAM_FILES%\MPC-BE\Lang\is-TDI0G.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.es.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-N7VIQ.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.el.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-J70SA.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.de.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-0IIN8.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.eu.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-8TU32.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.hu.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-043D4.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.he.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-0JL46.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.fr.dll
- %PROGRAM_FILES%\MPC-BE\is-F8IRV.tmp в %PROGRAM_FILES%\MPC-BE\mpciconlib.dll
- %PROGRAM_FILES%\MPC-BE\is-PEKS8.tmp в %PROGRAM_FILES%\MPC-BE\mpc-be.exe
- %PROGRAM_FILES%\MPC-BE\is-N6VEC.tmp в %PROGRAM_FILES%\MPC-BE\unins000.exe
- %PROGRAM_FILES%\MPC-BE\Lang\is-2EETP.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.br.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-SIRDF.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.cz.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-GP875.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.ca.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-UC1N5.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.by.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-7UNN8.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.sk.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-QRVJL.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.sc.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-0D2IP.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.ru.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-FCR5D.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.sv.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-9B8BT.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.ua.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-JAP00.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.tr.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-TPAPF.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.tc.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-VMSLR.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.ja.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-BR3I4.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.it.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-TMBV1.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.hy.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-G2HTJ.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.kr.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-O7U0L.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.ro.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-TT4MT.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.pl.dll
- %PROGRAM_FILES%\MPC-BE\Lang\is-3TQEJ.tmp в %PROGRAM_FILES%\MPC-BE\Lang\mpcresources.nl.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
