That’s not Flash, he thought. That’s a system hook.
He switched to the Resources tab and extracted a text file hidden inside a dummy sound resource. The file was named README_TO_ARCHAEOLOGIST.txt . He opened it. “If you’re reading this, you’re using a decompiler. Probably Sothink. Good choice. I left this here because I knew someone would come looking for Chimera. The real Chimera wasn’t a game. It was a honeypot. The .swf you just opened contains a backdoor. The moment you ran the decompiler’s ‘Preview’ function, it executed the first frame’s preloader. That preloader already copied a stub to your temp directory. Sorry. But don’t panic. You have 60 minutes to delete the stub before it phones home. To find the stub, look for a file named ‘sothink_portable_keygen.exe’ in your AppData folder. Delete it. Then destroy the USB drive. And for God’s sake, never trust a portable executable from a forgotten server.” Elias’s hands trembled. He minimized Sothink and opened his Task Manager. There it was: sothink_portable_keygen.exe running under a random alphanumeric name. It had zero percent CPU, but it had open network connections—one to an IP address in Belarus. sothink swf decompiler portable
He never ran a portable decompiler again. That’s not Flash, he thought