Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = ''
Modifies file system
Creates the following files
- %TEMP%\{ff824933-b471-4974-b7d2-386e94d78ed5}
- <Current directory>\$$iutemp\a_m_onepiece_pet_stemina.zip
- <Current directory>\$$iutemp\a_m_onepiece_pet_strock.zip
- <Current directory>\$$iutemp\a_m_onepiece_pet_walk.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_att01.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_run.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_safezone.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_stay.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_stemina.zip
- <Current directory>\$$iutemp\a_m_onepiece_pet_safezone.zip
- <Current directory>\$$iutemp\a_m_onepiece_pet_stay.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_strock.zip
- <Current directory>\$$iutemp\glogic.zip
- <Current directory>\$$iutemp\b_m_onepiece_pet.zip
- <Current directory>\$$iutemp\b_w_onepiece_pet.zip
- <Current directory>\$$iutemp\onepiece_m_brook_ts.zip
- <Current directory>\$$iutemp\onepiece_m_garp.zip
- <Current directory>\$$iutemp\onepiece_m_law.zip
- <Current directory>\$$iutemp\onepiece_m_luffy_ts.zip
- <Current directory>\$$iutemp\onepiece_m_mdragon.zip
- <Current directory>\$$iutemp\a_w_onepiece_pet_walk.zip
- <Current directory>\$$iutemp\effect.zip
- <Current directory>\$$iutemp\a_m_onepiece_pet_run.zip
- <Current directory>\$$iutemp\a_m_onepiece_pet_att01.zip
- <Current directory>\$$iutemp\animation.zip
- %TEMP%\update.urs.$$$.$$$
- %TEMP%\update.urs.$$$
- %TEMP%\update.ini
- %TEMP%\incupdate_tempimg1.jpg
- %TEMP%\incupdate_tempimg2.jpg
- %TEMP%\incupdate_tempimg3.jpg
- %TEMP%\incupdate_tempimg4.jpg
- %TEMP%\{373889dd-86de-4492-803a-654fbfab206c}
- %TEMP%\{98cd2efa-2579-49a7-a2e0-29c8b7b3c763}
- <Current directory>\$$iutemp\update.urs
- %TEMP%\incupdate.idx
- %TEMP%\updateidx.ini
- %TEMP%\update.zip
- %TEMP%\update.exe
- %TEMP%\sblcopyf.ini
- %TEMP%\sblcopyf.exe
- %TEMP%\{f929da9d-fbdc-4146-94c7-7c18981ce1a1}
- %TEMP%\{af2f1787-6910-4818-be1f-10fa343f1cfa}
- %TEMP%\{16904a60-894b-44eb-838f-d28159f6acf5}
- <Current directory>\$$iutemp\bugtrap.zip
- %TEMP%\updateidx.$$$
- <Current directory>\$$iutemp\onepiece_m_sanji_ts.zip
- <Current directory>\$$iutemp\onepiece_m_sengoku.zip
Deletes the following files
- %TEMP%\{ff824933-b471-4974-b7d2-386e94d78ed5}
- %TEMP%\{f929da9d-fbdc-4146-94c7-7c18981ce1a1}
- %TEMP%\update.exe
- <Current directory>\$$iutemp\update.urs
- %TEMP%\incupdate_tempimg4.jpg
- %TEMP%\incupdate_tempimg3.jpg
- %TEMP%\incupdate_tempimg2.jpg
- %TEMP%\incupdate_tempimg1.jpg
- %TEMP%\{16904a60-894b-44eb-838f-d28159f6acf5}
- %TEMP%\update.urs.$$$
- %TEMP%\updateidx.ini
- %TEMP%\updateidx.$$$
- %TEMP%\incupdate.idx
- %TEMP%\{373889dd-86de-4492-803a-654fbfab206c}
- %TEMP%\{98cd2efa-2579-49a7-a2e0-29c8b7b3c763}
- %TEMP%\update.ini
- %TEMP%\update.urs.$$$.$$$
- %TEMP%\update.zip
- %TEMP%\{af2f1787-6910-4818-be1f-10fa343f1cfa}
Substitutes the following files
- <Current directory>\$$iutemp\update.urs
- %TEMP%\update.urs.$$$
- %TEMP%\update.ini
- %TEMP%\incupdate_tempimg1.jpg
- %TEMP%\incupdate_tempimg2.jpg
- %TEMP%\incupdate_tempimg3.jpg
- %TEMP%\incupdate_tempimg4.jpg
- %TEMP%\incupdate.idx
- %TEMP%\updateidx.$$$
- %TEMP%\updateidx.ini
Network activity
TCP
HTTP GET requests
- http://www.og###gran.com/tianyongcn/incupdate.idx
- http://www.og###gran.com/tianyongcn/onepiece_m_sanji_ts.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_mdragon.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_luffy_ts.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_law.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_garp.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_brook_ts.zip
- http://www.og###gran.com/tianyongcn/b_w_onepiece_pet.zip
- http://www.og###gran.com/tianyongcn/b_m_onepiece_pet.zip
- http://www.og###gran.com/tianyongcn/glogic.zip
- http://www.og###gran.com/tianyongcn/effect.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_walk.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_strock.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_stemina.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_stay.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_safezone.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_run.zip
- http://www.og###gran.com/tianyongcn/a_w_onepiece_pet_att01.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_walk.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_strock.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_stemina.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_stay.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_safezone.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_run.zip
- http://www.og###gran.com/tianyongcn/a_m_onepiece_pet_att01.zip
- http://www.og###gran.com/tianyongcn/animation.zip
- http://www.og###gran.com/tianyongcn/bugtrap.zip
- http://www.og###gran.com/tianyongcn/update.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_sengoku.zip
- http://www.og###gran.com/tianyongcn/onepiece_m_shanks.zip
UDP
- DNS ASK og###gran.com
Miscellaneous
Creates and executes the following
- '%TEMP%\sblcopyf.exe'
