Technical Information
To ensure autorun and distribution
Substitutes the following executable system files
- %WINDIR%\SysWOW64\FlashPlayerApp.exe with %WINDIR%\syswow64\flashplayerapp.exe
- %WINDIR%\SysWOW64\FlashPlayerCPLApp.cpl with %WINDIR%\syswow64\flashplayercplapp.cpl
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im FlashHelperService.exe
- '<SYSTEM32>\taskkill.exe' /f /im FlashPlayerUpdateService.exe
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\instflash.cmd
- %TEMP%\7zipsfx.002\x32files\flashplayer.xpt
- %TEMP%\7zipsfx.002\x32files\flashplayerplugin.exe
- %TEMP%\7zipsfx.002\x32files\npswf.dll
- %TEMP%\7zipsfx.002\x64files\npswf.dll
- <SYSTEM32>\macromed\flash\npswf.dll
- %WINDIR%\syswow64\macromed\flash\flashplayerplugin.exe
- <SYSTEM32>\macromed\flash\cleaner_flash_player_npapi.bat
- %TEMP%\7zipsfx.001\x32files\flash.ocx
- %TEMP%\7zipsfx.003\!)install_flash_player_ppapi.bat
- %TEMP%\7zipsfx.003\cleaner_flash_player_ppapi.bat
- %TEMP%\7zipsfx.003\x32files\flash.ico
- %TEMP%\7zipsfx.003\x32files\manifest.json
- %TEMP%\7zipsfx.003\x64files\flash.ico
- %TEMP%\7zipsfx.003\x64files\manifest.json
- %TEMP%\7zipsfx.002\cleaner_flash_player_npapi.bat
- %TEMP%\7zipsfx.002\!)install_flash_player_npapi.bat
- <SYSTEM32>\macromed\flash\cleaner_flash_player_ax.bat
- %WINDIR%\syswow64\macromed\flash\flash.ocx
- <SYSTEM32>\macromed\flash\flash.ocx
- nul
- %TEMP%\7zipsfx.001\x64files\flash7.ocx
- %TEMP%\7zipsfx.001\x64files\flash.ocx
- %TEMP%\7zipsfx.001\x32files\flash7.ocx
- %WINDIR%\syswow64\macromed\flash\npswf.dll
- %TEMP%\7zipsfx.001\app\flashplayerapp.exe
- %TEMP%\7zipsfx.001\app\flashplayercplapp.cpl
- %TEMP%\7zipsfx.001\cleaner_flash_player_ax.bat
- %TEMP%\7zipsfx.001\!)install_flash_player_ax.bat
- %TEMP%\7zipsfx.000\adobe_flash_player_ppapi_v34_0_0_242.exe
- %TEMP%\7zipsfx.000\adobe_flash_player_npapi_v34_0_0_242.exe
- %TEMP%\7zipsfx.000\adobe_flash_player_activex_v34_0_0_242.exe
- %TEMP%\7zipsfx.003\x32files\pepflashplayer.dll
- %TEMP%\7zipsfx.003\x64files\pepflashplayer.dll
Deletes the following files
- %WINDIR%\tasks\adobe flash player updater.job
- %TEMP%\7zipsfx.002\x32files\flashplayerplugin.exe
- %TEMP%\7zipsfx.002\x32files\flashplayer.xpt
- %TEMP%\7zipsfx.002\cleaner_flash_player_npapi.bat
- %TEMP%\7zipsfx.002\!)install_flash_player_npapi.bat
- %WINDIR%\syswow64\macromed\flash\npswf32_18_0_0_261.dll
- <SYSTEM32>\macromed\flash\npswf64_18_0_0_261.dll
- %WINDIR%\syswow64\macromed\flash\flashplayerplugin_18_0_0_261.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_18_0_0_261_plugin.exe
- <SYSTEM32>\macromed\flash\flashutil64_18_0_0_261_plugin.exe
- %TEMP%\7zipsfx.001\x64files\flash7.ocx
- %TEMP%\7zipsfx.001\x64files\flash.ocx
- %TEMP%\7zipsfx.001\x32files\flash7.ocx
- %TEMP%\7zipsfx.001\x32files\flash.ocx
- %TEMP%\7zipsfx.001\cleaner_flash_player_ax.bat
- %TEMP%\7zipsfx.002\x32files\npswf.dll
- %TEMP%\7zipsfx.001\app\flashplayercplapp.cpl
- %TEMP%\7zipsfx.001\!)install_flash_player_ax.bat
- %WINDIR%\syswow64\flashplayercplapp.cpl
- %WINDIR%\syswow64\flashplayerapp.exe
- %WINDIR%\syswow64\macromed\flash\flashinstall.log
- <SYSTEM32>\macromed\flash\flashinstall.log
- %WINDIR%\syswow64\macromed\flash\mms.cfg
- %WINDIR%\syswow64\macromed\flash\flash32_19_0_0_207.ocx
- <SYSTEM32>\macromed\flash\flash64_19_0_0_207.ocx
- %WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.exe
- <SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.dll
- <SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.dll
- %WINDIR%\syswow64\macromed\flash\flashplayerupdateservice.exe
- <SYSTEM32>\tasks\adobe flash player updater
- %TEMP%\7zipsfx.001\app\flashplayerapp.exe
- %TEMP%\7zipsfx.002\x64files\npswf.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\adobe_flash_player_activex_v34_0_0_242.exe' /ai /gm2
- '%TEMP%\7zipsfx.000\adobe_flash_player_ppapi_v34_0_0_242.exe' /ai /gm2
- '%TEMP%\7zipsfx.000\adobe_flash_player_npapi_v34_0_0_242.exe' /ai /gm2
- '<SYSTEM32>\cmd.exe' /c attrib +h "%TEMP%\7ZipSfx.000"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "DisplayVersion" /d "34.0.0.242"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "DisplayName" /d "Adobe Flash Player 34 PPAPI"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.003" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.003\!)Install_Flash_Player_PPAPI.bat"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "UninstallString" /d "<SYSTEM32>\Macromed\Flash\Cleaner_Flash_Player_NPAPI.bat"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\NPSWF.dll"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "HelpLink" /d "https://www.42##own.com/2082.html"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayName" /d "Adobe Flash Player 34 NPAPI"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "HelpLink" /d "https://www.42##own.com/2082.html"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.002" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.002\!)Install_Flash_Player_NPAPI.bat"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "UninstallString" /d "<SYSTEM32>\Macromed\Flash\Cleaner_Flash_Player_AX.bat"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\Flash.ocx"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "HelpLink" /d "https://www.42##own.com/2082.html"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayVersion" /d "34.0.0.242"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayName" /d "Adobe Flash Player 34 ActiveX"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.001" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.001\!)Install_Flash_Player_AX.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\InstFlash.cmd" "' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayVersion" /d "34.0.0.242"' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\Flash.ico"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c attrib +h "%TEMP%\7ZipSfx.000"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPlugin" /f /v "PlayerPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPlugin" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Path" /d "<SYSTEM32>\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPlugin" /f /v "PlayerPath" /d "<SYSTEM32>\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPlugin" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy /y "%TEMP%\7ZipSfx.002\Cleaner_Flash_Player_NPAPI.bat" "<SYSTEM32>\Macromed\Flash\" 1>NUL 2>NUL"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.002\x32files\*" "%WINDIR%\SysWOW64\Macromed\Flash\"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.002\x64files\*" "<SYSTEM32>\Macromed\Flash\"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPluginReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerPluginReleaseType" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Path" /d "%WINDIR%\SysWOW64\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Security Center" /f /v "cval"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Security Center\Svc\Vol" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerPlugin" /f
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\Macromed\Flash\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\Macromed\Flash\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.002" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.002\!)Install_Flash_Player_NPAPI.bat"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "UninstallString" /d "<SYSTEM32>\Macromed\Flash\Cleaner_Flash_Player_AX.bat"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "HelpLink" /d "https://www.42##own.com/2082.html"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPlugin" /f
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.001\x64files\Flash.ocx" "<SYSTEM32>\Macromed\Flash\"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "XPTPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\flashplayer.xpt"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "DisplayVersion" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "DisplayName" /d "Adobe Flash Player 34 PPAPI"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "PlayerPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\pepflashplayer.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepperReleaseType" /f /v "Release" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isScriptDebugger" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isPartner" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isMSI" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "isESR" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerPepper" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "PlayerPath" /d "<SYSTEM32>\Macromed\Flash\pepflashplayer.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepperReleaseType" /f /v "Release" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayVersion" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isMSI" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isESR" /t REG_DWORD /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy /y "%TEMP%\7ZipSfx.003\Cleaner_Flash_Player_PPAPI.bat" "<SYSTEM32>\Macromed\Flash\" 1>NUL 2>NUL"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.003\x32files\*" "%WINDIR%\SysWOW64\Macromed\Flash\"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.003\x64files\*" "<SYSTEM32>\Macromed\Flash\"
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.003" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.003\!)Install_Flash_Player_PPAPI.bat"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "UninstallString" /d "<SYSTEM32>\Macromed\Flash\Cleaner_Flash_Player_NPAPI.bat"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\NPSWF.dll"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "HelpLink" /d "https://www.42##own.com/2082.html"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayVersion" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isPartner" /t REG_DWORD /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI" /f /v "DisplayName" /d "Adobe Flash Player 34 NPAPI"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayName" /d "Adobe Flash Player 34 ActiveX"
- '<SYSTEM32>\timeout.exe' /t 2
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f /v "PlayerPath" /d "%WINDIR%\SysWOW64\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashHelperService.exe" /f
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\Macromed\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\takeown.exe' /f "%WINDIR%\SysWOW64\FlashPlayerCPLApp.cpl" /a
- '<SYSTEM32>\takeown.exe' /f "%WINDIR%\SysWOW64\FlashPlayerApp.exe" /a
- '<SYSTEM32>\takeown.exe' /f "%WINDIR%\SysWOW64\Macromed\Flash\*" /a /r /d y
- '<SYSTEM32>\takeown.exe' /f "<SYSTEM32>\Macromed\Flash\*" /a /r /d y
- '<SYSTEM32>\findstr.exe' "\<6\.[0-9]\.[0-9][0-9]*\> \<10\.[0-9]\.[0-9][0-9]*\>"
- '<SYSTEM32>\cmd.exe' /S /D /c" ver"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION" /f /v "FlashHelperService.exe"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION" /f /v "FlashHelperService.exe"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "HelpLink" /d "https://www.42##own.com/2082.html"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\FlashPlayerApp.exe" /c /grant "Everyone:f"
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\AdobeFlashPlayerUpdateSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\Flash Helper Service" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashHelper" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashHelper" /f
- '<SYSTEM32>\schtasks.exe' /delete /tn "FlashHelper TaskMachineCore" /f
- '<SYSTEM32>\schtasks.exe' /delete /tn "Adobe Flash Player Updater" /f
- '<SYSTEM32>\sc.exe' stop "Flash Helper Service"
- '<SYSTEM32>\reg.exe' QUERY "HKU\S-1-5-19"
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.001" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.001\!)Install_Flash_Player_AX.bat"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\InstFlash.cmd" "
- '<SYSTEM32>\attrib.exe' +h "%TEMP%\7ZipSfx.000"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerUpdateService.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerPepper" /f /v "isScriptDebugger" /t REG_DWORD /d "0"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\FlashPlayerCPLApp.cpl" /c /grant "Everyone:f"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayer" /f
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\FlashPlayerApp.exe" /c /grant "Everyone:f"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f /v "PlayerPath" /d "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f /v "Version" /d "34.0.0.242"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy /y "%TEMP%\7ZipSfx.001\Cleaner_Flash_Player_AX.bat" "<SYSTEM32>\Macromed\Flash\" 1>NUL 2>NUL"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\SysWOW64\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.001\x32files\Flash7.ocx" "%WINDIR%\SysWOW64\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.001\x64files\Flash7.ocx" "<SYSTEM32>\Macromed\Flash\Flash.ocx"
- '<SYSTEM32>\find.exe' "6.1."
- '<SYSTEM32>\find.exe' "6.0."
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\FlashPlayerCPLApp.cpl" /c /grant "Everyone:f"
- '<SYSTEM32>\find.exe' "5."
- '<SYSTEM32>\icacls.exe' "%WINDIR%\SysWOW64\Macromed\*" /t /c /grant "Everyone:f"
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.001\app\*" "%WINDIR%\SysWOW64\"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo f"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil64_ActiveX.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil32_ActiveX.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerApp.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveXReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveXReleaseType" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f
- '<SYSTEM32>\xcopy.exe' /c/i/r/y "%TEMP%\7ZipSfx.001\x32files\Flash.ocx" "%WINDIR%\SysWOW64\Macromed\Flash\"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player PPAPI" /f /v "DisplayIcon" /d "<SYSTEM32>\Macromed\Flash\Flash.ico"
