Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\funplus.st\shell\open\command] '' = 'D:\FunPlus\Stormshot\Launcher.exe %1'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'st_global' = 'D:\FunPlus\Stormshot\Launcher.exe'
Modifies file system
Creates the following files
- %TEMP%\st_tmp.dl
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_messages.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_native.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_nativedebugger.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_preview.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_profiler.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_quickprofiler.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qjpeg.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_server.dll
- D:\funplus\stormshot\1.0.0.96\qtqml\qmlplugin.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qpdf.dll
- D:\funplus\stormshot\1.0.0.96\scenegraph\qsgd3d12backend.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qsvg.dll
- D:\funplus\stormshot\1.0.0.96\iconengines\qsvgicon.dll
- D:\funplus\stormshot\1.0.0.96\qt5core.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_inspector.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_local.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_debugger.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qico.dll
- D:\funplus\stormshot\1.0.0.96\qt5network.dll
- D:\funplus\stormshot\1.0.0.96\libssl-1_1-x64.dll
- D:\funplus\stormshot\1.0.0.96\libssl-1_1.dll
- D:\funplus\stormshot\1.0.0.96\qtqml\models.2\modelsplugin.dll
- D:\funplus\stormshot\1.0.0.96\msvcp100.dll
- D:\funplus\stormshot\1.0.0.96\msvcp140.dll
- D:\funplus\stormshot\1.0.0.96\qt5gui.dll
- D:\funplus\stormshot\1.0.0.96\libegl.dll
- D:\funplus\stormshot\1.0.0.96\qmltooling\qmldbg_tcp.dll
- D:\funplus\stormshot\1.0.0.96\msvcp140_1.dll
- D:\funplus\stormshot\1.0.0.96\opengl32sw.dll
- D:\funplus\stormshot\1.0.0.96\postproc-55.dll
- D:\funplus\stormshot\1.0.0.96\bearer\qgenericbearer.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qgif.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qicns.dll
- D:\funplus\stormshot\1.0.0.96\msvcp140_2.dll
- D:\funplus\stormshot\1.0.0.96\msvcp140_codecvt_ids.dll
- D:\funplus\stormshot\1.0.0.96\msvcr100.dll
- D:\funplus\stormshot\1.0.0.96\translations\qt_zh_cn.qm
- D:\funplus\stormshot\1.0.0.96\qt5qml.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qwebp.dll
- D:\funplus\stormshot\1.0.0.96\platforms\qwindows.dll
- D:\funplus\stormshot\1.0.0.96\styles\qwindowsvistastyle.dll
- D:\funplus\stormshot\1.0.0.96\vccorlib140.dll
- D:\funplus\stormshot\1.0.0.96\vcruntime140.dll
- D:\funplus\stormshot\1.0.0.96\vcruntime140_1.dll
- D:\funplus\stormshot\1.0.0.96\qtqml\workerscript.2\workerscriptplugin.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qwbmp.dll
- D:\funplus\stormshot\1.0.0.96\libcrypto-1_1.dll
- D:\funplus\stormshot\1.0.0.96\virtualkeyboard\qtvirtualkeyboard_thai.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\funplus\stormshot\卸载.lnk
- D:\funplus\stormshot\prefs\st_global_setting.ini.lock
- D:\funplus\stormshot\prefs\st_global_setting.ini.ddnpyu
- D:\funplus\stormshot\prefs\st_global_setting.ini.iyjxuf
- D:\funplus\stormshot\prefs\st_global_setting.ini.pwvltj
- D:\funplus\stormshot\prefs\st_global_setting.ini.zhsuih
- %HOMEPATH%\desktop\stormshot.lnk
- D:\funplus\stormshot\installsettings.ini
- D:\funplus\stormshot\1.0.0.96\libglesv2.dll
- D:\funplus\stormshot\1.0.0.96\virtualkeyboard\qtvirtualkeyboard_pinyin.dll
- D:\funplus\stormshot\1.0.0.96\qtqml\remoteobjects\qtqmlremoteobjects.dll
- D:\funplus\stormshot\1.0.0.96\qt5quick.dll
- D:\funplus\stormshot\1.0.0.96\qt5quickwidgets.dll
- D:\funplus\stormshot\1.0.0.96\qt5remoteobjects.dll
- D:\funplus\stormshot\1.0.0.96\qt5svg.dll
- D:\funplus\stormshot\1.0.0.96\qt5websockets.dll
- D:\funplus\stormshot\1.0.0.96\qt5widgets.dll
- D:\funplus\stormshot\1.0.0.96\virtualkeyboard\qtvirtualkeyboard_tcime.dll
- D:\funplus\stormshot\1.0.0.96\qt5qmlmodels.dll
- D:\funplus\stormshot\1.0.0.96\qt5qmlworkerscript.dll
- D:\funplus\stormshot\1.0.0.96\qtqml\statemachine\qtqmlstatemachine.dll
- D:\funplus\stormshot\1.0.0.96\qtquick.2\qtquick2plugin.dll
- D:\funplus\stormshot\1.0.0.96\qtquick\timeline\qtquicktimelineplugin.dll
- D:\funplus\stormshot\1.0.0.96\platforminputcontexts\qtvirtualkeyboardplugin.dll
- D:\funplus\stormshot\1.0.0.96\virtualkeyboard\qtvirtualkeyboard_hangul.dll
- D:\funplus\stormshot\1.0.0.96\virtualkeyboard\qtvirtualkeyboard_openwnn.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qtiff.dll
- D:\funplus\stormshot\1.0.0.96\imageformats\qtga.dll
- D:\funplus\stormshot\1.0.0.96\libcrypto-1_1-x64.dll
- D:\funplus\stormshot\1.0.0.96\fpxui.dll
- D:\funplus\stormshot\1.0.0.96\fpxgamemanager32.dll
- D:\funplus\stormshot\1.0.0.96\translations\qt_bg.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_ca.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_cs.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_da.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_de.qm
- D:\funplus\stormshot\plugin\7z.21.07\far\7-ziprus.lng
- D:\funplus\stormshot\config\icon.png
- D:\funplus\stormshot\1.0.0.96\translations\qt_ar.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_en.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_fr.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_gd.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_he.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_hr.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_hu.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_es.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_fa.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_fi.qm
- D:\funplus\stormshot\prefs\st_global_setting.ini.cqxsog
- D:\funplus\stormshot\1.0.0.96\translations\qt_it.qm
- D:\funplus\stormshot\plugin\7z.21.07\far\7-zipeng.hlf
- D:\funplus\stormshot\1.0.0.96\qtqml\workerscript.2\qmldir
- D:\funplus\stormshot\1.0.0.96\qtqml\models.2\qmldir
- D:\funplus\stormshot\1.0.0.96\qtqml\remoteobjects\qmldir
- D:\funplus\stormshot\1.0.0.96\qtqml\statemachine\qmldir
- D:\funplus\stormshot\1.0.0.96\qtquick.2\qmldir
- D:\funplus\stormshot\1.0.0.96\qtquick\timeline\qmldir
- D:\funplus\stormshot\plugin\7z.21.07\far\7-ziprus.hlf
- D:\funplus\stormshot\plugin\7z.21.07\far\7-zipeng.lng
- D:\funplus\stormshot\1.0.0.96\qtqml\qmldir
- D:\funplus\stormshot\plugin\7z.21.07\history.txt
- D:\funplus\stormshot\plugin\7z.21.07\license.txt
- D:\funplus\stormshot\plugin\7z.21.07\readme.txt
- D:\funplus\stormshot\plugin\7z.21.07\far\far7z.reg
- D:\funplus\stormshot\plugin\7z.21.07\far\7ztofar.ini
- D:\funplus\stormshot\config\version.ini
- D:\funplus\stormshot\1.0.0.96\fpx_config_pc
- D:\funplus\stormshot\plugin\7z.21.07\far\far7z.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\funplus\stormshot\stormshot.lnk
- D:\funplus\stormshot\1.0.0.96\translations\qt_ja.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_nl.qm
- D:\funplus\stormshot\uaclauncher.exe
- D:\funplus\stormshot\uninstall.exe
- D:\funplus\stormshot\1.0.0.96\uninstall.exe
- D:\funplus\stormshot\plugin\7z.21.07\far\7-zipfar.dll
- D:\funplus\stormshot\plugin\7z.21.07\far\7-zipfar64.dll
- D:\funplus\stormshot\plugin\7z.21.07\7za.dll
- D:\funplus\stormshot\1.0.0.96\translations\qt_ko.qm
- D:\funplus\stormshot\1.0.0.96\pc-launcher.exe
- D:\funplus\stormshot\launcher.exe
- D:\funplus\stormshot\1.0.0.96\concrt140.dll
- D:\funplus\stormshot\1.0.0.96\d3dcompiler_47.dll
- D:\funplus\stormshot\1.0.0.96\fpx.dll
- D:\funplus\stormshot\1.0.0.96\fpx32.dll
- D:\funplus\stormshot\1.0.0.96\fpxcore.dll
- D:\funplus\stormshot\1.0.0.96\fpxgame.dll
- D:\funplus\stormshot\plugin\7z.21.07\x64\7za.dll
- D:\funplus\stormshot\plugin\7z.21.07\x64\7zxa.dll
- D:\funplus\stormshot\1.0.0.96\translations\qt_lv.qm
- D:\funplus\stormshot\plugin\7z.21.07\7zxa.dll
- D:\funplus\stormshot\1.0.0.96\fun-cid.log
- D:\funplus\stormshot\1.0.0.96\translations\qt_nn.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_pl.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_pt_br.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_ru.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_sk.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_tr.qm
- D:\funplus\stormshot\1.0.0.96\qtquick.2\plugins.qmltypes
- D:\funplus\stormshot\plugin\7z.21.07\x64\7za.exe
- D:\funplus\stormshot\plugin\7z.21.07\7za.exe
- D:\funplus\stormshot\1.0.0.96\qtqml\workerscript.2\plugins.qmltypes
- D:\funplus\stormshot\1.0.0.96\qtquick\timeline\plugins.qmltypes
- D:\funplus\stormshot\1.0.0.96\qtqml\remoteobjects\plugins.qmltypes
- D:\funplus\stormshot\1.0.0.96\qtqml\statemachine\plugins.qmltypes
- D:\funplus\stormshot\1.0.0.96\qtqml\plugins.qmltypes
- D:\funplus\stormshot\1.0.0.96\qtqml\models.2\plugins.qmltypes
- D:\funplus\stormshot\1.0.0.96\translations\qt_uk.qm
- D:\funplus\stormshot\1.0.0.96\translations\qt_zh_tw.qm
- D:\funplus\stormshot\prefs\st_global_setting.ini.djxalf
Sets the 'hidden' attribute to the following files
- %TEMP%\st.exe
Deletes the following files
- D:\funplus\stormshot\prefs\st_global_setting.ini.lock
Moves the following files
- from %TEMP%\st_tmp.dl to %TEMP%\st.exe
- from D:\funplus\stormshot\prefs\st_global_setting.ini.ddnpyu to D:\funplus\stormshot\prefs\st_global_setting.ini
- from D:\funplus\stormshot\prefs\st_global_setting.ini.iyjxuf to D:\funplus\stormshot\prefs\st_global_setting.ini
- from D:\funplus\stormshot\prefs\st_global_setting.ini.pwvltj to D:\funplus\stormshot\prefs\st_global_setting.ini
- from D:\funplus\stormshot\prefs\st_global_setting.ini.zhsuih to D:\funplus\stormshot\prefs\st_global_setting.ini
- from D:\funplus\stormshot\prefs\st_global_setting.ini.cqxsog to D:\funplus\stormshot\prefs\st_global_setting.ini
- from D:\funplus\stormshot\prefs\st_global_setting.ini.djxalf to D:\funplus\stormshot\prefs\st_global_setting.ini
Substitutes the following files
- D:\funplus\stormshot\prefs\st_global_setting.ini.lock
Network activity
Connects to
- 'kg########t-st.kingsgroupgames.com':443
- 'us########rm-download.akamaized.net':443
- 'up#####s3.funplus.com':443
- 'pc######t-api.funplus.com':443
- 'x.##2.us':80
TCP
HTTP GET requests
- http://x.##2.us/x.cer
Other
- 'kg########t-st.kingsgroupgames.com':443
- 'us########rm-download.akamaized.net':443
- 'pc######t-api.funplus.com':443
- 'up#####s3.funplus.com':443
UDP
- DNS ASK kg########t-st.kingsgroupgames.com
- DNS ASK us########rm-download.akamaized.net
- DNS ASK up#####s3.funplus.com
- DNS ASK pc######t-api.funplus.com
- DNS ASK x.##2.us
Miscellaneous
Creates and executes the following
- '%TEMP%\st.exe'
- 'D:\funplus\stormshot\launcher.exe'
- 'D:\funplus\stormshot\1.0.0.96\pc-launcher.exe' --currentPath="D:\FunPlus\Stormshot" --configVersion=1.#.0.96 --launchExe="D:\FunPlus\Stormshot\Launcher.exe"
Executes the following
- 'D:\funplus\stormshot\launcher.exe' ' (with hidden window)
- 'D:\funplus\stormshot\1.0.0.96\pc-launcher.exe' --currentPath="D:\FunPlus\Stormshot" --configVersion=1.#.0.96 --launchExe="D:\FunPlus\Stormshot\Launcher.exe"' (with hidden window)
