Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command] '' = '"%ProgramFiles(x86)%\Opera\Launcher.exe" -noautoupdate -- "%1"'
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im FlashHelperService.exe
- '<SYSTEM32>\taskkill.exe' /f /im FlashPlayerUpdateService.exe
Запускает большое число процессов
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zipsfx.000\activex\!)install_flash_player_ax.bat
- %WINDIR%\syswow64\macromed\flash\flashplayerplugin.exe
- %WINDIR%\syswow64\macromed\flash\flashplayer.xpt
- <SYSTEM32>\macromed\flash\npswf.dll
- <SYSTEM32>\macromed\flash\cleaner_flash_player_ax.bat
- %WINDIR%\syswow64\macromed\flash\flash.ocx
- <SYSTEM32>\macromed\flash\flash.ocx
- %WINDIR%\syswow64\flashplayercplapp.cpl
- %WINDIR%\syswow64\flashplayerapp.exe
- nul
- %TEMP%\7zipsfx.000\ppapi\x64files\pepflashplayer.dll
- %TEMP%\7zipsfx.000\ppapi\x64files\manifest.json
- %TEMP%\7zipsfx.000\ppapi\x64files\flash.ico
- %TEMP%\7zipsfx.000\ppapi\x32files\pepflashplayer.dll
- %TEMP%\7zipsfx.000\ppapi\x32files\manifest.json
- %WINDIR%\syswow64\macromed\flash\npsw.dll
- %TEMP%\7zipsfx.000\ppapi\x32files\flash.ico
- %TEMP%\7zipsfx.000\ppapi\!)install_flash_player_ppapi.bat
- %TEMP%\7zipsfx.000\npapi\x64files\npswf.dll
- %TEMP%\7zipsfx.000\npapi\x32files\npsw.dll
- %TEMP%\7zipsfx.000\npapi\x32files\flashplayerplugin.exe
- %TEMP%\7zipsfx.000\npapi\x32files\flashplayer.xpt
- %TEMP%\7zipsfx.000\npapi\cleaner_flash_player_npapi.bat
- %TEMP%\7zipsfx.000\npapi\!)install_flash_player_npapi.bat
- %TEMP%\7zipsfx.000\activex\x64files\flash7.ocx
- %TEMP%\7zipsfx.000\activex\x64files\flash.ocx
- %TEMP%\7zipsfx.000\activex\x32files\flash7.ocx
- %TEMP%\7zipsfx.000\activex\x32files\flash.ocx
- %TEMP%\7zipsfx.000\activex\cleaner_flash_player_ax.bat
- %TEMP%\7zipsfx.000\activex\app\flashplayercplapp.cpl
- %TEMP%\7zipsfx.000\activex\app\flashplayerapp.exe
- %TEMP%\7zipsfx.000\ppapi\cleaner_flash_player_ppapi.bat
- <SYSTEM32>\macromed\flash\cleaner_flash_player_npapi.bat
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.000" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.000\PPAPI\!)Install_Flash_Player_PPAPI.bat" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "XPTPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\flashplayer.xpt"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Path" /d "%WINDIR%\SysWOW64\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPlugin" /f /v "PlayerPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPlugin" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Path" /d "<SYSTEM32>\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPlugin" /f /v "PlayerPath" /d "<SYSTEM32>\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPlugin" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy /y "%TEMP%\7ZipSfx.000\NPAPI\Cleaner_Flash_Player_NPAPI.bat" "<SYSTEM32>\Macromed\Flash\" 1>NUL 2>NUL"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\NPAPI\x32files\*" "%WINDIR%\SysWOW64\Macromed\Flash\"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\NPAPI\x64files\*" "<SYSTEM32>\Macromed\Flash\"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPluginReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPlugin" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerPluginReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Security Center" /f /v "cval"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Security Center\Svc\Vol" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerPlugin" /f
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\Macromed\Flash\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\Macromed\Flash\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\timeout.exe' /t 2
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.000" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.000\NPAPI\!)Install_Flash_Player_NPAPI.bat" (со скрытым окном)
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\PPAPI\x64files\*" "<SYSTEM32>\Macromed\Flash\"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\PPAPI\x32files\*" "%WINDIR%\SysWOW64\Macromed\Flash\"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayName" /d "Adobe Flash Player 34 NPAPI" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "UninstallString" /d "<SYSTEM32>\Macromed\Flash\Cleaner_Flash_Player_AX.bat" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\Flash.ocx" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "URLUpdateInfo" /d "http://www.adobe.com/go/getflashplayer/" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "URLInfoAbout" /d "http://www.adobe.com" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "Publisher" /d "Adobe" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "HelpLink" /d "http://www.adobe.com/go/flashplayer_support/" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayVersion" /d "34.0.0.323" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayName" /d "Adobe Flash Player 34 ActiveX" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "PlayerPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\pepflashplayer.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepperReleaseType" /f /v "Release" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isPartner" /t REG_DWORD /d "1"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo f"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isMSI" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isESR" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "PlayerPath" /d "<SYSTEM32>\Macromed\Flash\pepflashplayer.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepperReleaseType" /f /v "Release" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isScriptDebugger" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isPartner" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isMSI" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isESR" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy /y "%TEMP%\7ZipSfx.000\PPAPI\Cleaner_Flash_Player_PPAPI.bat" "<SYSTEM32>\Macromed\Flash\" 1>NUL 2>NUL"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f /v "PlayerPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f /v "PlayerPath" /d "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\takeown.exe' /f "%WINDIR%\SysWOW64\Macromed\Flash\*" /a /r /d y
- '<SYSTEM32>\takeown.exe' /f "<SYSTEM32>\Macromed\Flash\*" /a /r /d y
- '<SYSTEM32>\findstr.exe' "\<6\.[0-9]\.[0-9][0-9]*\> \<10\.[0-9]\.[0-9][0-9]*\>"
- '<SYSTEM32>\cmd.exe' /S /D /c" ver"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION" /f /v "FlashHelperService.exe"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION" /f /v "FlashHelperService.exe"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerUpdateService.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashHelperService.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\AdobeFlashPlayerUpdateSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\Flash Helper Service" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashHelper" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashHelper" /f
- '<SYSTEM32>\schtasks.exe' /delete /tn "FlashHelper TaskMachineCore" /f
- '<SYSTEM32>\schtasks.exe' /delete /tn "Adobe Flash Player Updater" /f
- '<SYSTEM32>\sc.exe' stop "Flash Helper Service"
- '<SYSTEM32>\reg.exe' QUERY "HKU\S-1-5-19"
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.000" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.000\ActiveX\!)Install_Flash_Player_AX.bat" (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f (со скрытым окном)
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\Macromed\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\Macromed\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\FlashPlayerApp.exe" /c /grant "Everyone:f"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f /v "Version" /d "34.0.0.323"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\FlashPlayerCPLApp.cpl" /c /grant "Everyone:f"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy /y "%TEMP%\7ZipSfx.000\ActiveX\Cleaner_Flash_Player_AX.bat" "<SYSTEM32>\Macromed\Flash\" 1>NUL 2>NUL"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\SysWOW64\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\ActiveX\x32files\Flash7.ocx" "%WINDIR%\SysWOW64\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\ActiveX\x64files\Flash7.ocx" "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\find.exe' "6.1."
- '<SYSTEM32>\find.exe' "6.0."
- '<SYSTEM32>\find.exe' "5."
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\ActiveX\x32files\Flash.ocx" "%WINDIR%\SysWOW64\Macromed\Flash\"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\ActiveX\x64files\Flash.ocx" "<SYSTEM32>\Macromed\Flash\"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isScriptDebugger" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayVersion" /d "34.0.0.323" (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil64_ActiveX.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil32_ActiveX.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerApp.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveXReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveXReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayer" /f
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\FlashPlayerCPLApp.cpl" /c /grant "Everyone:f"
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\FlashPlayerApp.exe" /c /grant "Everyone:f"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.000\ActiveX\app\*" "%WINDIR%\SysWOW64\"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "HelpLink" /d "http://www.adobe.com/go/flashplayer_support/" (со скрытым окном)
