Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\FlashCenterService] 'ImagePath' = '"%ProgramFiles(x86)%\FlashCenter\FlashCenterService.exe"'
- [HKLM\System\CurrentControlSet\Services\FlashCenterService] 'Start' = '00000002'
Creates the following services
- 'FlashCenterService' "%ProgramFiles(x86)%\FlashCenter\FlashCenterService.exe"
- 'FlashCenterService' %ProgramFiles(x86)%\FlashCenter\FlashCenterService.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FlashCenter.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCBrowserManager.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCBrowser.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "Update.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCTips.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCPlay.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCLogin.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FlashRepair.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FlashCenterService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im mmc.exe
Modifies file system
Creates the following files
- %TEMP%\nsp69ea.tmp
- %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\wasm\index
- %LOCALAPPDATA%\flash_center\cache\flashcenter\visited links
- %TEMP%\nsu6a0a.tmp\shellexecasuser.dll
- %WINDIR%\syswow64\macromed\flash\flashhelperservice.exe_tmp{c0777ece-4d7b-43b2-9209-54bf05566e5e}
- %TEMP%\nsu6a0a.tmp\nsisdl.dll
- C:\users\public\desktop\flash center.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\flash center\flash center.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\flash center\flash centeruninst.lnk
- %LOCALAPPDATA%\flash_center\setting.xml
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\flash center.lnk
- %LOCALAPPDATA%\microsoft\edge\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\liebao\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\google\chrome\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\sogouexplorer\webkit\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\config.db
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\flash center.lnk
- %LOCALAPPDATA%\flash_center\config.db-journal
- %LOCALAPPDATA%\flash_center\fcbrowser\cache\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\360se6\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %ProgramFiles(x86)%\flashcenter\servicelog.txt
- %APPDATA%\microsoft\internet explorer\quick launch\flash center.lnk
- %ProgramFiles(x86)%\flashcenter\wow_helper.exe
- %ProgramFiles(x86)%\flashcenter\widevinecdmadapter.dll
- %ProgramFiles(x86)%\flashcenter\update.exe
- %ProgramFiles(x86)%\flashcenter\swiftshader\libglesv2.dll
- %ProgramFiles(x86)%\flashcenter\swiftshader\libegl.dll
- %ProgramFiles(x86)%\flashcenter\ssleay32.dll
- %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\js\index
- %LOCALAPPDATA%\flash_center\cache\flashcenter\gpucache\index
- %LOCALAPPDATA%\flash_center\cache\flashcenter\gpucache\data_0
- %LOCALAPPDATA%\flash_center\cache\flashcenter\gpucache\data_1
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\f_000002
- %LOCALAPPDATA%\flash_center\cache\flashcenter\databases\databases.db-journal
- %TEMP%\install_flash_player_offline_ppapi_cn_fc.exe_tmp{a83996b4-e3d1-4128-83b7-2f7153034b36}
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\f_000001
- %LOCALAPPDATA%\flash_center\cache\flashcenter\log
- %LOCALAPPDATA%\flash_center\cache\flashcenter\000001.dbtmp
- %LOCALAPPDATA%\flash_center\cache\flashcenter\manifest-000001
- %LOCALAPPDATA%\flash_center\cache\flashcenter\reporting and nel
- %LOCALAPPDATA%\flash_center\cache\flashcenter\reporting and nel-journal
- %LOCALAPPDATA%\flash_center\cache\flashcenter\quotamanager
- %LOCALAPPDATA%\flash_center\cache\flashcenter\quotamanager-journal
- %LOCALAPPDATA%\flash_center\cache\flashcenter\indexeddb\flashcenter_framework_0.indexeddb.leveldb\000003.log
- %LOCALAPPDATA%\flash_center\cache\flashcenter\indexeddb\flashcenter_framework_0.indexeddb.leveldb\log
- %LOCALAPPDATA%\flash_center\cache\flashcenter\indexeddb\flashcenter_framework_0.indexeddb.leveldb\000001.dbtmp
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\data_3
- %LOCALAPPDATA%\flash_center\cache\flashcenter\indexeddb\flashcenter_framework_0.indexeddb.leveldb\manifest-000001
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\data_2
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\data_1
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\data_0
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cache\index
- %LOCALAPPDATA%\flash_center\cache\flashcenter\local storage\leveldb\log
- %LOCALAPPDATA%\flash_center\cache\flashcenter\local storage\leveldb\000001.dbtmp
- %LOCALAPPDATA%\flash_center\cache\flashcenter\local storage\leveldb\manifest-000001
- %LOCALAPPDATA%\flash_center\cache\flashcenter\7bf9dc92-770b-4336-9303-c32737932411.tmp
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cookies
- %LOCALAPPDATA%\flash_center\cache\flashcenter\cookies-journal
- %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\wasm\index-dir\temp-index
- %LOCALAPPDATA%\flash_center\cache\flashcenter\gpucache\data_3
- %LOCALAPPDATA%\flash_center\cache\flashcenter\gpucache\data_2
- %LOCALAPPDATA%\flash_center\cache\flashcenter\databases\databases.db
- %ProgramFiles(x86)%\flashcenter\sqldrivers\qsqlite.dll
- %ProgramFiles(x86)%\flashcenter\qt5xml.dll
- %ProgramFiles(x86)%\flashcenter\qt5widgets.dll
- %ProgramFiles(x86)%\flashcenter\licences\libcurl\copying
- %ProgramFiles(x86)%\flashcenter\licences\duilib\license
- %ProgramFiles(x86)%\flashcenter\licences\chromium embedded framework\license.txt
- %ProgramFiles(x86)%\flashcenter\images\swf.ico
- %ProgramFiles(x86)%\flashcenter\images\split.ico
- %ProgramFiles(x86)%\flashcenter\images\pdf_reader.ico
- %ProgramFiles(x86)%\flashcenter\images\pdftoword.ico
- %ProgramFiles(x86)%\flashcenter\images\pdftoppt.ico
- %ProgramFiles(x86)%\flashcenter\images\pdftoother.ico
- %ProgramFiles(x86)%\flashcenter\images\pdftoimages.ico
- %ProgramFiles(x86)%\flashcenter\images\pdftoexcel.ico
- %ProgramFiles(x86)%\flashcenter\images\pdfsplit.ico
- %ProgramFiles(x86)%\flashcenter\images\pdfreader.ico
- %ProgramFiles(x86)%\flashcenter\images\pdf.ico
- %ProgramFiles(x86)%\flashcenter\images\merge.ico
- %ProgramFiles(x86)%\flashcenter\images\compress.ico
- %ProgramFiles(x86)%\flashcenter\icudtl.dat
- %ProgramFiles(x86)%\flashcenter\devtools_resources.pak
- %ProgramFiles(x86)%\flashcenter\cef_extensions.pak
- %ProgramFiles(x86)%\flashcenter\cef_200_percent.pak
- %ProgramFiles(x86)%\flashcenter\cef_100_percent.pak
- %ProgramFiles(x86)%\flashcenter\cef.pak
- %TEMP%\nsu6a0a.tmp\nsis7z.dll
- %ProgramFiles(x86)%\flashcenter\flashcenter.7z
- %TEMP%\nsu6a0a.tmp\nsexec.dll
- %TEMP%\nsu6a0a.tmp\bgworker.dll
- %TEMP%\nsu6a0a.tmp\stdutils.dll
- %TEMP%\nsu6a0a.tmp\system.dll
- %TEMP%\nsu6a0a.tmp\nsflashcenterplug.dll
- %ProgramFiles(x86)%\flashcenter\licences\nsis\copying
- %ProgramFiles(x86)%\flashcenter\licences\openssl\license
- %ProgramFiles(x86)%\flashcenter\licences\qt libraries\license.lgpl.txt
- %ProgramFiles(x86)%\flashcenter\locales\zh-cn.pak
- %ProgramFiles(x86)%\flashcenter\qt5network.dll
- %ProgramFiles(x86)%\flashcenter\qt5gui.dll
- %ProgramFiles(x86)%\flashcenter\qt5core.dll
- %ProgramFiles(x86)%\flashcenter\platforms\qwindows.dll
- %ProgramFiles(x86)%\flashcenter\msvcr120.dll
- %ProgramFiles(x86)%\flashcenter\msvcp120.dll
- %ProgramFiles(x86)%\flashcenter\memoryupdate.dll
- %ProgramFiles(x86)%\flashcenter\libglesv2.dll
- %ProgramFiles(x86)%\flashcenter\libegl.dll
- %ProgramFiles(x86)%\flashcenter\libeay32.dll
- %ProgramFiles(x86)%\flashcenter\libcef.dll
- %ProgramFiles(x86)%\flashcenter\imageformats\qjpeg.dll
- %ProgramFiles(x86)%\flashcenter\imageformats\qico.dll
- %ProgramFiles(x86)%\flashcenter\imageformats\qgif.dll
- %ProgramFiles(x86)%\flashcenter\flashrepair.exe
- %ProgramFiles(x86)%\flashcenter\flashsettingsservice.dll
- %ProgramFiles(x86)%\flashcenter\flashcenteruninst.exe
- %ProgramFiles(x86)%\flashcenter\flashcenterservice.exe
- %ProgramFiles(x86)%\flashcenter\flashcenter.exe
- %ProgramFiles(x86)%\flashcenter\fcplay.exe
- %ProgramFiles(x86)%\flashcenter\fclogin.exe
- %ProgramFiles(x86)%\flashcenter\fcbrowsermanager.exe
- %ProgramFiles(x86)%\flashcenter\fcbrowser.exe
- %ProgramFiles(x86)%\flashcenter\d3dcompiler_47.dll
- %ProgramFiles(x86)%\flashcenter\d3dcompiler_43.dll
- %ProgramFiles(x86)%\flashcenter\chrome_elf.dll
- %ProgramFiles(x86)%\flashcenter\browsermodule.dll
- %ProgramFiles(x86)%\flashcenter\v8_context_snapshot.bin
- %ProgramFiles(x86)%\flashcenter\snapshot_blob.bin
- %ProgramFiles(x86)%\flashcenter\natives_blob.bin
- %ProgramFiles(x86)%\flashcenter\qt5sql.dll
- %LOCALAPPDATA%\flash_center\cache\flashcenter\d9f8ff24-d2d0-40f7-8dca-2ffc22a95875.tmp
Deletes the following files
- %ProgramFiles(x86)%\flashcenter\flashcenter.7z
- %APPDATA%\360se6\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\fcbrowser\cache\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\config.db-journal
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\sogouexplorer\webkit\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\config.db
- %LOCALAPPDATA%\google\chrome\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\liebao\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\microsoft\edge\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
Moves the following files
- from %WINDIR%\syswow64\macromed\flash\flashhelperservice.exe_tmp{c0777ece-4d7b-43b2-9209-54bf05566e5e} to %WINDIR%\syswow64\macromed\flash\flashhelperservice.exe
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\wasm\index-dir\temp-index to %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\wasm\index-dir\the-real-index
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\js\index-dir\temp-index to %LOCALAPPDATA%\flash_center\cache\flashcenter\code cache\js\index-dir\the-real-index
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\7bf9dc92-770b-4336-9303-c32737932411.tmp to %LOCALAPPDATA%\flash_center\cache\flashcenter\localprefs.json
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\local storage\leveldb\000001.dbtmp to %LOCALAPPDATA%\flash_center\cache\flashcenter\local storage\leveldb\current
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\indexeddb\flashcenter_framework_0.indexeddb.leveldb\000001.dbtmp to %LOCALAPPDATA%\flash_center\cache\flashcenter\indexeddb\flashcenter_framework_0.indexeddb.leveldb\current
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\000001.dbtmp to %LOCALAPPDATA%\flash_center\cache\flashcenter\current
- from %LOCALAPPDATA%\flash_center\cache\flashcenter\d9f8ff24-d2d0-40f7-8dca-2ffc22a95875.tmp to %LOCALAPPDATA%\flash_center\cache\flashcenter\network persistent state
- from %TEMP%\install_flash_player_offline_ppapi_cn_fc.exe_tmp{a83996b4-e3d1-4128-83b7-2f7153034b36} to %TEMP%\install_flash_player_offline_ppapi_cn_fc.exe
Substitutes the following files
- %APPDATA%\360se6\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\fcbrowser\cache\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\config.db-journal
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\sogouexplorer\webkit\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\google\chrome\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\liebao\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\microsoft\edge\user data\default\pepper data\shockwave flash\writableroot\#sharedobjects\258y1z9z\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\flash_center\config.db
Network activity
Connects to
- 'to###i.flash.cn':80
- 'ap###.flash.cn':443
- 'to###i.flash.cn':443
- 'ap#.#lash.cn':443
- 'ap####2.flash.cn':443
- 'do####ad.ffnews.cn':443
TCP
HTTP GET requests
- http://to###i.flash.cn/hm4.gif?pr################################################################################################################################################################...
Other
- 'ap#.#lash.cn':443
- 'to###i.flash.cn':443
- 'ap###.flash.cn':443
- 'ap####2.flash.cn':443
UDP
- DNS ASK to###i.flash.cn
- DNS ASK ap###.flash.cn
- DNS ASK ap#.#lash.cn
- DNS ASK fl##h.cn
- DNS ASK ap####2.flash.cn
- DNS ASK do####ad.ffnews.cn
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\flashcenter\flashcenterservice.exe' /start
- '%ProgramFiles(x86)%\flashcenter\flashcenterservice.exe'
- '%ProgramFiles(x86)%\flashcenter\flashrepair.exe'
- '%ProgramFiles(x86)%\flashcenter\flashcenter.exe' {\"launchtype\":\"/install-mini\"}
- '%ProgramFiles(x86)%\flashcenter\flashcenter.exe' --type=gpu-process --field-trial-handle=1232,13413619463281552865,4320862935785524523,131072 --enable-features=CastMediaRouteProvider,CookieDeprecationMessages,CrossOriginEmbedderPolicy,CrossOr...
- '%ProgramFiles(x86)%\flashcenter\flashcenter.exe' --type=utility --field-trial-handle=1232,13413619463281552865,4320862935785524523,131072 --enable-features=CastMediaRouteProvider,CookieDeprecationMessages,CrossOriginEmbedderPolicy,CrossOrigin...
- '%ProgramFiles(x86)%\flashcenter\flashcenter.exe' --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --enable-experimental-web-platform-features --force-device-scale-factor=1 --log-file="%ProgramFiles(x86)%\FlashCenter\deb...
- '%TEMP%\install_flash_player_offline_ppapi_cn_fc.exe' -install
- '%WINDIR%\syswow64\macromed\flash\flashhelperservice.exe' -Uninstall
- '%WINDIR%\syswow64\macromed\flash\flashhelperservice.exe' -Start -dp=fc -fp=ppapi
- '%WINDIR%\syswow64\macromed\flash\flashhelperservice.exe' -dp=fc -fp=ppapi
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /t /im mmc.exe && title CMD
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Flash Helper Service" && title CMD
- '%WINDIR%\syswow64\sc.exe' delete "Flash Helper Service"
- '%WINDIR%\syswow64\cmd.exe' /c sc stop "Flash Helper Service" && title CMD
- '%WINDIR%\syswow64\sc.exe' stop "Flash Helper Service"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FlashCenter.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCBrowserManager.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCBrowser.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "Update.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCTips.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCPlay.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FCLogin.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FlashRepair.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "FlashCenterService.exe"' (with hidden window)
