Техническая информация
Для обеспечения автозапуска и распространения
Изменяет следующие исполняемые системные файлы
- %WINDIR%\syswow64\flashplayercplapp.cpl
- %WINDIR%\syswow64\flashplayerapp.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\setup.cmd
- %WINDIR%\syswow64\macromed\temp\{1f990a66-fb43-4399-81f9-8493e9114e82}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{d9af9647-3081-452e-81c2-829d3c7e79bb}\installflashplayer.exe
- <SYSTEM32>\macromed\temp\{7a9ff755-a0df-4871-953e-91fef4112a1c}\fpb.tmp
- <SYSTEM32>\macromed\temp\{0d4bd54f-fb5b-4f45-9205-f35f97f79d91}\fpb.tmp
- %TEMP%\msi1afce.log
- %TEMP%\{70f0f88a-387b-40eb-93bd-9877db9d668d}\isillegalupgrade.vbs
- <SYSTEM32>\macromed\flash\pepflashplayer64_32_0_0_142.dll
- %TEMP%\{cbe3b547-5306-45eb-beb1-c79a81b1bf0e}\installflashplayer.exe
- <SYSTEM32>\macromed\flash\flash64_32_0_0_142.ocx
- <SYSTEM32>\macromed\flash\flashutil64_32_0_0_142_activex.exe
- <SYSTEM32>\macromed\flash\flashutil64_32_0_0_142_activex.dll
- %WINDIR%\syswow64\macromed\flash\flash32_32_0_0_142.ocx
- %WINDIR%\syswow64\macromed\flash\flashutil32_32_0_0_142_activex.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_32_0_0_142_activex.dll
- %WINDIR%\syswow64\macromed\flash\flashinstall32.log
- %WINDIR%\syswow64\macromed\temp\{a38dcc37-3b02-43de-a947-f15cbc038d07}\fpb.tmp
- %WINDIR%\syswow64\macromed\flash\manifest.json
- %WINDIR%\syswow64\macromed\flash\pepper.vch
- %WINDIR%\syswow64\macromed\flash\flashutil32_32_0_0_142_pepper.dll
- %TEMP%\rarsfx0\flashplayer_32_plugin_npapi.exe
- %TEMP%\rarsfx0\flashplayer_32_ppapi_debug.exe
- %WINDIR%\syswow64\macromed\temp\{1e79228f-23ec-4ff8-8a10-bfb15e828861}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{f27f51cf-1304-4dd1-a0ee-23f0839b020a}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{262baf5b-6027-4abc-a018-bac5fee7f7de}\installflashplayer.exe
- <SYSTEM32>\macromed\temp\{68f88a0f-e076-4fd7-8782-91e1d52ff9f1}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{63852fae-7edf-4fbf-aecb-f8f492e028ab}\fpb.tmp
- %TEMP%\{848e6c84-87ce-4870-aa60-38c76e91132e}\fpb.tmp
- <SYSTEM32>\macromed\temp\{11c68409-8804-4622-adc2-96a058b86163}\fpb.tmp
- <SYSTEM32>\macromed\flash\flashutil64_32_0_0_142_pepper.dll
- <SYSTEM32>\macromed\flash\pepper.vch
- <SYSTEM32>\macromed\flash\manifest.json
- <SYSTEM32>\macromed\flash\flashinstall64.log
- %WINDIR%\syswow64\macromed\flash\pepflashplayer32_32_0_0_142.dll
- %WINDIR%\syswow64\macromed\flash\flashutil32_32_0_0_142_pepper.exe
- %TEMP%\rarsfx0\flashplayer_32_ax_activex.exe
- <SYSTEM32>\macromed\flash\flashutil64_32_0_0_142_pepper.exe
- %WINDIR%\syswow64\macromed\temp\{6b78d3fa-355c-4947-bbf2-e80ec62e539d}\fpb.tmp
Удаляет следующие файлы
- %WINDIR%\syswow64\macromed\temp\{1e79228f-23ec-4ff8-8a10-bfb15e828861}\fpb.tmp
- %WINDIR%\installer\{70f0f88a-387b-40eb-93bd-9877db9d668d}\arpproducticon.exe
- <SYSTEM32>\macromed\temp\{0d4bd54f-fb5b-4f45-9205-f35f97f79d91}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{d9af9647-3081-452e-81c2-829d3c7e79bb}\installflashplayer.exe
- %WINDIR%\syswow64\macromed\temp\{1f990a66-fb43-4399-81f9-8493e9114e82}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{63852fae-7edf-4fbf-aecb-f8f492e028ab}\fpb.tmp
- %WINDIR%\syswow64\macromed\flash\npswf32_18_0_0_261.dll
- %WINDIR%\syswow64\macromed\flash\flashutil32_18_0_0_261_plugin.exe
- %WINDIR%\tasks\adobe flash player updater.job
- <SYSTEM32>\tasks\adobe flash player updater
- %WINDIR%\syswow64\macromed\flash\flashplayerupdateservice.exe
- %WINDIR%\syswow64\macromed\flash\flashplayer.xpt
- %WINDIR%\syswow64\macromed\flash\flashplayerplugin_18_0_0_261.exe
- %WINDIR%\syswow64\macromed\flash\plugin.vch
- <SYSTEM32>\macromed\flash\npswf64_18_0_0_261.dll
- <SYSTEM32>\macromed\flash\flashutil64_18_0_0_261_plugin.exe
- %TEMP%\{70f0f88a-387b-40eb-93bd-9877db9d668d}\isillegalupgrade.vbs
- <SYSTEM32>\macromed\flash\plugin.vch
- %TEMP%\{cbe3b547-5306-45eb-beb1-c79a81b1bf0e}\installflashplayer.exe
- <SYSTEM32>\macromed\flash\activex.vch
- <SYSTEM32>\macromed\temp\{68f88a0f-e076-4fd7-8782-91e1d52ff9f1}\fpb.tmp
- <SYSTEM32>\macromed\flash\flashinstall.log
- <SYSTEM32>\macromed\temp\{11c68409-8804-4622-adc2-96a058b86163}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{262baf5b-6027-4abc-a018-bac5fee7f7de}\installflashplayer.exe
- %WINDIR%\syswow64\macromed\flash\flashinstall.log
- %WINDIR%\syswow64\macromed\temp\{f27f51cf-1304-4dd1-a0ee-23f0839b020a}\fpb.tmp
- %WINDIR%\syswow64\macromed\temp\{a38dcc37-3b02-43de-a947-f15cbc038d07}\fpb.tmp
- <SYSTEM32>\macromed\temp\{7a9ff755-a0df-4871-953e-91fef4112a1c}\fpb.tmp
- %WINDIR%\syswow64\macromed\flash\flash32_19_0_0_207.ocx
- %WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.dll
- %WINDIR%\syswow64\macromed\flash\activex.vch
- <SYSTEM32>\macromed\flash\flash64_19_0_0_207.ocx
- <SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.exe
- <SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.dll
- %TEMP%\{848e6c84-87ce-4870-aa60-38c76e91132e}\fpb.tmp
- %WINDIR%\installer\{0699cbd6-fff5-4211-97a7-9c32e744f5f4}\arpproducticon.exe
Подменяет следующие файлы
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
Сетевая активность
Подключается к
- 'fp######ad.macromedia.com':443
- 'microsoft.com':80
- 'fp######ad2.macromedia.com':80
TCP
Запросы HTTP GET
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml32.0.0.142~installVector=1&previousVersion=0.0.0.0&pProc=cmd.exe&lang=en&cpuWordLength=64&playerType=pep&os=w...
- http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml32.0.0.142~installVector=1&previousVersion=19.0.0.207&pProc=cmd.exe&lang=en&cpuWordLength=64&playerType=ax&os...
Другие
- 'fp######ad.macromedia.com':443
UDP
- DNS ASK fp######ad.macromedia.com
- DNS ASK microsoft.com
- DNS ASK fp######ad2.macromedia.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\flashplayer_32_ppapi_debug.exe' -install
- '%WINDIR%\syswow64\macromed\temp\{262baf5b-6027-4abc-a018-bac5fee7f7de}\installflashplayer.exe' -install -skipARPEntry -iv 1 -au 4294967295
- '%TEMP%\rarsfx0\flashplayer_32_ax_activex.exe' -install
- '%WINDIR%\syswow64\macromed\temp\{d9af9647-3081-452e-81c2-829d3c7e79bb}\installflashplayer.exe' -install -skipARPEntry -iv 1 -au 4294967295
- '%TEMP%\{cbe3b547-5306-45eb-beb1-c79a81b1bf0e}\installflashplayer.exe' -uninstall activex
- '<SYSTEM32>\macromed\flash\flashutil64_32_0_0_142_activex.exe' -refreshIEElevationPolicies
- '%WINDIR%\syswow64\macromed\flash\flashutil32_32_0_0_142_activex.exe' -refreshIEElevationPolicies
- '%TEMP%\rarsfx0\flashplayer_32_plugin_npapi.exe' -install
- '%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_207_ActiveX.exe" >> NUL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\SysWOW64\Macromed\Flash\FlashUtil32_18_0_0_261_Plugin.exe" >> NUL' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.cmd" "
- '<SYSTEM32>\msiexec.exe' /q /X {70F0F88A-387B-40EB-93BD-9877DB9D668D}
- '%WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.exe' -uninstall activex -msi
- '%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_207_ActiveX.exe" >> NUL
- '<SYSTEM32>\msiexec.exe' /q /X {0699CBD6-FFF5-4211-97A7-9C32E744F5F4}
- '%WINDIR%\syswow64\macromed\flash\flashutil32_18_0_0_261_plugin.exe' -uninstall plugin -msi
- '%WINDIR%\syswow64\macromed\flash\flashplayerupdateservice.exe' -uninstall
- '%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\SysWOW64\Macromed\Flash\FlashUtil32_18_0_0_261_Plugin.exe" >> NUL
