Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command] '' = '"%ProgramFiles%\Mozilla Firefox\firefox.exe" -osint -url "%1"'
- [<HKLM>\Software\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command] '' = '"%WINDIR%\F16.exe" %1'
Creates or modifies the following files
- %WINDIR%\tasks\adobe flash player updater.job
Changes the following executable system files
- <SYSTEM32>\flashplayercplapp.cpl
- <SYSTEM32>\flashplayerapp.exe
- <SYSTEM32>\macromed\flash\flashplayerupdateservice.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\flash_player.cmd
- %WINDIR%\f16.exe
- %TEMP%\{82e68b58-c45a-4e3c-aae2-cadf1d4e367b}\fpb.tmp
- %TEMP%\{95173731-d7b1-4956-af39-b5bdb4d3b913}\fpb.tmp
- %TEMP%\{d5910727-668e-478b-9bc3-e471302c4ae3}\fpb.tmp
- <SYSTEM32>\macromed\flash\flashutil32_11_2_202_228_activex.dll
- <SYSTEM32>\macromed\flash\flashutil32_11_2_202_228_activex.exe
- %ALLUSERSPROFILE%\start menu\programs\утилиты\adobe flash projector.lnk
- <SYSTEM32>\macromed\flash\flash32_11_2_202_228.ocx
- %TEMP%\{8c9ee5cf-3503-4585-8adb-b5e06d24838c}\fpb.tmp
- %TEMP%\rarsfx0\npswf32_11_2_202_228.dll
- %TEMP%\rarsfx0\uninstall_flashplayer11_2r202_228_win_32bit.exe
- %TEMP%\rarsfx0\flashplayer11_2r202_228_winax_32bit.exe
- %TEMP%\rarsfx0\flashplayer11_2r202_228_win_32bit.exe
- %TEMP%\rarsfx0\flash_player.exe
- %TEMP%\{dd96d104-2a62-4fc4-a6e7-8b4731185894}\fpb.tmp
- <SYSTEM32>\macromed\flash\npswf32_11_2_202_228.dll
Deletes the following files
- %TEMP%\{8c9ee5cf-3503-4585-8adb-b5e06d24838c}\fpb.tmp
- <SYSTEM32>\macromed\flash\flash.ocx
- %TEMP%\{d5910727-668e-478b-9bc3-e471302c4ae3}\fpb.tmp
- %TEMP%\{dd96d104-2a62-4fc4-a6e7-8b4731185894}\fpb.tmp
- %TEMP%\{95173731-d7b1-4956-af39-b5bdb4d3b913}\fpb.tmp
- %TEMP%\{82e68b58-c45a-4e3c-aae2-cadf1d4e367b}\fpb.tmp
- %TEMP%\rarsfx0\flashplayer11_2r202_228_winax_32bit.exe
- %TEMP%\rarsfx0\flashplayer11_2r202_228_win_32bit.exe
- %TEMP%\rarsfx0\flash_player.cmd
- %TEMP%\rarsfx0\flash_player.exe
- %TEMP%\rarsfx0\npswf32_11_2_202_228.dll
- %TEMP%\rarsfx0\uninstall_flashplayer11_2r202_228_win_32bit.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\flashplayer11_2r202_228_winax_32bit.exe' /install
- '<SYSTEM32>\macromed\flash\flashutil32_11_2_202_228_activex.exe' -refreshIEElevationPolicies
- '%TEMP%\rarsfx0\flashplayer11_2r202_228_win_32bit.exe' /install
- '%TEMP%\rarsfx0\flash_player.exe'
- '<SYSTEM32>\reg.exe' add HKCR\.swf /ve /d ShockwaveFlash.ShockwaveFlash /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKCR\ShockwaveFlash.ShockwaveFlash\shell\open\command" /ve /d "\"%WINDIR%\F16.exe\" %1" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKCR\ShockwaveFlash.ShockwaveFlash\DefaultIcon" /ve /d "%WINDIR%\F16.exe,-608" /f' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Flash_Player.cmd" "
- '<SYSTEM32>\macromed\flash\flashplayerupdateservice.exe' -createDefaultTask
- '<SYSTEM32>\reg.exe' add HKCR\.swf /ve /d ShockwaveFlash.ShockwaveFlash /f
- '<SYSTEM32>\reg.exe' add "HKCR\ShockwaveFlash.ShockwaveFlash\shell\open\command" /ve /d "\"%WINDIR%\F16.exe\" %1" /f
- '<SYSTEM32>\reg.exe' add "HKCR\ShockwaveFlash.ShockwaveFlash\DefaultIcon" /ve /d "%WINDIR%\F16.exe,-608" /f
- '<SYSTEM32>\xcopy.exe' /Y /C "NPSWF32_11_2_202_228.dll" "<SYSTEM32>\Macromed\Flash\"
