Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="¿ì°ÉflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="¿ì°ÉÓÎÏ·ÏÂÔГƽ̨" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="¿ì°ÉÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="¿ì°ÉÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="¿ì°ÉÓÎÏ·¹ÜÀГÆ÷" mode=ENABLE scope=ALL
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsw8f73.tmp
- %TEMP%\gm~af3d.tmp
- %TEMP%\gm~add6.tmp
- %TEMP%\gm~ac5e.tmp
- %TEMP%\gm~ab44.tmp
- %TEMP%\gm~aa69.tmp
- %TEMP%\gm~a97e.tmp
- %TEMP%\gm~b133.tmp
- %TEMP%\gm~af8c.tmp
- %TEMP%\gm~a65f.tmp
- %TEMP%\gm~a620.tmp
- %TEMP%\gm~a3fd.tmp
- %TEMP%\gm~a360.tmp
- %TEMP%\gm~a275.tmp
- %TEMP%\gm~a19a.tmp
- %TEMP%\gm~a8d1.tmp
- %TEMP%\gmicon\40101.gmp
- %TEMP%\gm~b21e.tmp
- %TEMP%\gmicon\40149.gmp
- %TEMP%\gmicon\40148.gmp
- %TEMP%\gm~c2ad.tmp
- %TEMP%\gm~bee4.tmp
- %TEMP%\gm~bee5.tmp
- %TEMP%\gmicon\40008.gmp
- %TEMP%\gm~bdda.tmp
- %TEMP%\gmicon\20082.gmp
- %TEMP%\gm~baeb.tmp
- %TEMP%\gm~bbe6.tmp
- %TEMP%\gm~b81c.tmp
- %TEMP%\gm~b7fc.tmp
- %TEMP%\gm~b57c.tmp
- %TEMP%\gm~b52d.tmp
- %TEMP%\gm~b3c5.tmp
- %TEMP%\gm~a0af.tmp
- %TEMP%\gm~a7e6.tmp
- %TEMP%\gm~b23e.tmp
- %TEMP%\gmicon\40150.gmp
- %TEMP%\gm~9d80.tmp
- %TEMP%\gm~8564.tmp
- %TEMP%\gm~89cc.tmp
- %TEMP%\gm~88f1.tmp
- %TEMP%\gm~8778.tmp
- %TEMP%\gm~8815.tmp
- %TEMP%\gm~867e.tmp
- %TEMP%\gm~8e43.tmp
- %TEMP%\gm~8b64.tmp
- %TEMP%\gm~8cfa.tmp
- %TEMP%\gm~834e.tmp
- %TEMP%\gm~80fc.tmp
- %TEMP%\gm~816a.tmp
- %TEMP%\gm~7f75.tmp
- %TEMP%\gm~7f64.tmp
- %TEMP%\gm~836f.tmp
- %TEMP%\gm~8f4d.tmp
- %TEMP%\gm~9d22.tmp
- %TEMP%\gm~9f17.tmp
- %TEMP%\gm~8a2b.tmp
- %TEMP%\gm~9bf8.tmp
- %TEMP%\gm~9b3c.tmp
- %TEMP%\gm~9a61.tmp
- %TEMP%\gm~9937.tmp
- %TEMP%\gm~98c9.tmp
- %TEMP%\gm~9733.tmp
- %TEMP%\gm~9732.tmp
- %TEMP%\gm~95ab.tmp
- %TEMP%\gm~9472.tmp
- %TEMP%\gm~9413.tmp
- %TEMP%\gm~927c.tmp
- %TEMP%\gm~924c.tmp
- %TEMP%\gm~90e5.tmp
- %TEMP%\gm~9038.tmp
- %TEMP%\gm~9ff2.tmp
- %TEMP%\gm~43d0.tmp
- %TEMP%\gmicon\40102.gmp
- %TEMP%\gm~ff9b.tmp
- %TEMP%\gm~ff2d.tmp
- %TEMP%\gm~fde5.tmp
- %TEMP%\gm~fd19.tmp
- %TEMP%\gm~fc2e.tmp
- %TEMP%\gm~fa68.tmp
- %TEMP%\gm~142.tmp
- %TEMP%\gm~2f8.tmp
- %TEMP%\gm~fa29.tmp
- %TEMP%\gm~f7b6.tmp
- %TEMP%\gm~f6cb.tmp
- %TEMP%\gm~f506.tmp
- %TEMP%\gm~f4e5.tmp
- %TEMP%\gm~f34f.tmp
- %TEMP%\gm~f8b2.tmp
- %TEMP%\gm~f7d6.tmp
- %TEMP%\gmicon\40127.gmp
- %TEMP%\gm~4cd.tmp
- %TEMP%\gm~1697.tmp
- %TEMP%\gm~1407.tmp
- %TEMP%\gm~1406.tmp
- %TEMP%\gm~1250.tmp
- %TEMP%\gm~1117.tmp
- %TEMP%\gm~fcf.tmp
- %TEMP%\gm~e08.tmp
- %TEMP%\gm~e19.tmp
- %TEMP%\gm~b97.tmp
- %TEMP%\gm~b29.tmp
- %TEMP%\gm~9f0.tmp
- %TEMP%\gm~905.tmp
- %TEMP%\gm~675.tmp
- %TEMP%\gm~606.tmp
- %TEMP%\gm~f264.tmp
- %TEMP%\gm~f205.tmp
- %TEMP%\gm~23c.tmp
- %TEMP%\gm~f09d.tmp
- %TEMP%\gm~efa3.tmp
- %TEMP%\gm~d201.tmp
- %TEMP%\gmicon\40140.gmp
- %TEMP%\gm~ce65.tmp
- %TEMP%\gm~cea5.tmp
- %TEMP%\gm~cbb6.tmp
- %TEMP%\gm~cb67.tmp
- %TEMP%\gm~c8b8.tmp
- %TEMP%\gm~c4d0.tmp
- %TEMP%\gmicon\40139.gmp
- %TEMP%\gm~7ddd.tmp
- %TEMP%\gmicon\40135.gmp
- %TEMP%\gmicon\40134.gmp
- %TEMP%\gmicon\40133.gmp
- %TEMP%\gmicon\40129.gmp
- %TEMP%\gmicon\40128.gmp
- %TEMP%\gm~d378.tmp
- %TEMP%\gm~d5ba.tmp
- %TEMP%\gm~84f6.tmp
- %TEMP%\gm~d993.tmp
- %TEMP%\gm~d686.tmp
- %TEMP%\gm~d154.tmp
- %TEMP%\gm~eddc.tmp
- %TEMP%\gm~ec17.tmp
- %TEMP%\gm~eb2c.tmp
- %TEMP%\gm~e995.tmp
- %TEMP%\gm~e8f8.tmp
- %TEMP%\gm~e714.tmp
- %TEMP%\gm~e60a.tmp
- %TEMP%\gm~e35a.tmp
- %TEMP%\gm~e0da.tmp
- %TEMP%\gm~e06b.tmp
- %TEMP%\gm~dea6.tmp
- %TEMP%\gm~dca2.tmp
- %TEMP%\gm~dbc7.tmp
- %TEMP%\gm~d9a4.tmp
- %TEMP%\gm~ee2b.tmp
- %TEMP%\gm~7d6f.tmp
- %TEMP%\gm~7b8a.tmp
- %TEMP%\gm~7b6a.tmp
- %HOMEPATH%\desktop\¿ì°éóîï·.lnk
- %ProgramFiles(x86)%\kuai8\uninstall.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\¿ì°éóîï·\ð¶ôø¿ì°é.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\¿ì°éóîï·\¿ì°éò³óî´óìü.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\¿ì°éóîï·\¿ì°éflash²¥·åæ÷.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\¿ì°éóîï·\¿ì°éóîï·.lnk
- %APPDATA%\kuai8\data\search.gms
- %APPDATA%\kuai8\data\local\user.xml
- %APPDATA%\kuai8\data\search.gms-journal
- %TEMP%\gm~d2bb.tmp
- %TEMP%\gm~cf12.tmp
- %APPDATA%\kuai8\update.ini
- %TEMP%\gm~cafc.tmp
- %ProgramFiles(x86)%\kuai8\audio\complete.wav
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\快吧游戏管理器.lnk
- %TEMP%\gm~1766.tmp
- %TEMP%\gm~2ab2.tmp
- %APPDATA%\kuai8\data\plugin\pc.gmx
- %APPDATA%\kuai8\data\plugin\netwl.gmx
- %TEMP%\gm~2851.tmp
- %APPDATA%\kuai8\slider\slider_202103_20210329132433423.jpg
- %TEMP%\gm~26aa.tmp
- %TEMP%\gm~2504.tmp
- %TEMP%\gm~22a3.tmp
- %TEMP%\gm~1ff3.tmp
- %APPDATA%\kuai8\slider\slider_202104_20210422104738204.jpg
- %TEMP%\gm~1e4d.tmp
- %TEMP%\gm~1d62.tmp
- %APPDATA%\kuai8\slider\slider_202104_20210407103631388.jpg
- %TEMP%\gm~1cb6.tmp
- %TEMP%\gm~1bda.tmp
- %APPDATA%\kuai8\cache.xml
- %APPDATA%\kuai8\config\config.xml
- %APPDATA%\microsoft\internet explorer\quick launch\¿ì°éóîï·.lnk
- %APPDATA%\kuai8\data\plugin\inwl.gmx
- %APPDATA%\kuai8\data\plugin\window.gmx
- %ProgramFiles(x86)%\kuai8\tool\k8bubble.exe
- %ProgramFiles(x86)%\kuai8\k8bugreport.exe
- %ProgramFiles(x86)%\kuai8\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\kuai8\k8uirender.dll
- %ProgramFiles(x86)%\kuai8\k8dlplatform.exe
- %ProgramFiles(x86)%\kuai8\k8dlutils.dll
- %ProgramFiles(x86)%\kuai8\k8common.dll
- %ProgramFiles(x86)%\kuai8\k8urlencrypt.dll
- %ProgramFiles(x86)%\kuai8\k8version.dll
- %ProgramFiles(x86)%\kuai8\msvcr80.dll
- %ProgramFiles(x86)%\kuai8\k8update.exe
- %ProgramFiles(x86)%\kuai8\k8browser.exe
- %ProgramFiles(x86)%\kuai8\k8flash.exe
- %ProgramFiles(x86)%\kuai8\k8gm.exe
- %TEMP%\nsw8f74.tmp\system.dll
- %TEMP%\nsw8f74.tmp\k8nsisminiextend.dll
- %TEMP%\gm~2c68.tmp
- %TEMP%\gm~1715.tmp
- %ProgramFiles(x86)%\kuai8\tool\k8restorewindow.dll
- %ProgramFiles(x86)%\kuai8\tool\k8uirender.dll
- %ProgramFiles(x86)%\kuai8\msvcp80.dll
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\data\database.gmx
- %ProgramFiles(x86)%\kuai8\tool\msvcr80.dll
- %ProgramFiles(x86)%\kuai8\tool\msvcp80.dll
- %ProgramFiles(x86)%\kuai8\tool\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\kuai8\tool\k8gamepacker.exe
- %ProgramFiles(x86)%\kuai8\tool\k8netdetect.exe
- %ProgramFiles(x86)%\kuai8\tool\k8pluginfix.exe
- %ProgramFiles(x86)%\kuai8\tool\k8sfx.exe
- %ProgramFiles(x86)%\kuai8\tool\k8rtlfix.exe
- %ProgramFiles(x86)%\kuai8\tool\k8tip.exe
- %ProgramFiles(x86)%\kuai8\tool\k8dlutils.dll
- %ProgramFiles(x86)%\kuai8\tool\k8common.dll
- %TEMP%\gm~1783.tmp
- %APPDATA%\kuai8\slider\slider_202104_20210406110000717.jpg
- %TEMP%\gm~2f97.tmp
- %TEMP%\gm~6a09.tmp
- %TEMP%\gm~67a6.tmp
- %TEMP%\gm~67f5.tmp
- %TEMP%\gm~65f0.tmp
- %TEMP%\gm~6505.tmp
- %TEMP%\gm~6504.tmp
- %APPDATA%\kuai8\data\local\recent.xml
- %TEMP%\gm~635e.tmp
- %TEMP%\gm~6179.tmp
- %TEMP%\gm~6030.tmp
- %TEMP%\gm~5e0c.tmp
- %TEMP%\gm~5e99.tmp
- %TEMP%\gm~5d02.tmp
- %TEMP%\gm~5bf8.tmp
- %TEMP%\gm~6a0a.tmp
- %TEMP%\gm~6ba0.tmp
- %TEMP%\gm~79f3.tmp
- %TEMP%\gm~59e3.tmp
- %TEMP%\gm~6bff.tmp
- %TEMP%\gm~7975.tmp
- %TEMP%\gm~786b.tmp
- %TEMP%\gm~7780.tmp
- %TEMP%\gm~76d3.tmp
- %TEMP%\gm~758a.tmp
- %TEMP%\gm~7480.tmp
- %TEMP%\gm~72ea.tmp
- %TEMP%\gm~720e.tmp
- %TEMP%\gm~7142.tmp
- %TEMP%\gm~7067.tmp
- %TEMP%\gm~7018.tmp
- %TEMP%\gm~6ecf.tmp
- %TEMP%\gm~6e04.tmp
- %TEMP%\gm~6d38.tmp
- %TEMP%\gm~5b6a.tmp
- %TEMP%\gm~61c8.tmp
- %TEMP%\gm~5937.tmp
- %TEMP%\gm~584c.tmp
- %TEMP%\gm~2d91.tmp
- %TEMP%\gm~3547.tmp
- %APPDATA%\kuai8\slider\slider_201605_20160523162136750.gif
- %TEMP%\gm~3db4.tmp
- %TEMP%\gm~3bbf.tmp
- %APPDATA%\kuai8\slider\slider_202103_20210331172811484.jpg
- %TEMP%\gm~3855.tmp
- %TEMP%\gm~37e7.tmp
- %TEMP%\gm~34f8.tmp
- %TEMP%\gm~4054.tmp
- %APPDATA%\kuai8\slider\slider_202004_20200429112935682.jpg
- %TEMP%\gm~32e4.tmp
- %TEMP%\gm~32c4.tmp
- %TEMP%\gm~3082.tmp
- %TEMP%\gm~2f86.tmp
- %TEMP%\gm~415f.tmp
- %TEMP%\gm~2dff.tmp
- %TEMP%\gm~44bb.tmp
- %TEMP%\gm~4836.tmp
- %TEMP%\gm~55fa.tmp
- %TEMP%\gm~3fc7.tmp
- %TEMP%\gm~55ab.tmp
- %TEMP%\gm~5472.tmp
- %TEMP%\gm~52fa.tmp
- %TEMP%\gm~52da.tmp
- %TEMP%\gm~50f6.tmp
- %TEMP%\gm~5049.tmp
- %TEMP%\gm~4f6e.tmp
- %TEMP%\gm~4d1b.tmp
- %TEMP%\gm~4d89.tmp
- %TEMP%\gm~4b84.tmp
- %TEMP%\gm~4ad8.tmp
- %TEMP%\gm~49ed.tmp
- %TEMP%\gm~4866.tmp
- %TEMP%\gm~4558.tmp
- %TEMP%\gm~1939.tmp
Удаляет следующие файлы
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\pic\70307.gmp
- %APPDATA%\kuai8\pic\20399.gmp
- %TEMP%\gmicon\40149.gmp
- %TEMP%\gmicon\40133.gmp
- %TEMP%\gm~bee5.tmp
- %TEMP%\gm~bdda.tmp
- %TEMP%\gm~baeb.tmp
- %APPDATA%\kuai8\pic\70932.gmp
- %APPDATA%\kuai8\pic\20445.gmp
- %APPDATA%\kuai8\data\plugin\netwl.gmx
- %APPDATA%\kuai8\data\plugin\window.gmx
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\search.gms-journal
- %TEMP%\nsw8f74.tmp\system.dll
- %TEMP%\nsw8f74.tmp\k8nsisminiextend.dll
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\pic\20053.gmp
- %APPDATA%\kuai8\pic\71087.gmp
Перемещает следующие файлы
- %TEMP%\gm~d2bb.tmp в %APPDATA%\kuai8\data\database.gmx
- %TEMP%\gmicon\40008.gmp в %APPDATA%\kuai8\pic\40008.gmp
- %TEMP%\gm~bee4.tmp в %APPDATA%\kuai8\pic\70876.gmp
- %TEMP%\gm~c2ad.tmp в %APPDATA%\kuai8\pic\70883.gmp
- %TEMP%\gmicon\40101.gmp в %APPDATA%\kuai8\pic\40101.gmp
- %TEMP%\gmicon\40102.gmp в %APPDATA%\kuai8\pic\40102.gmp
- %TEMP%\gmicon\40127.gmp в %APPDATA%\kuai8\pic\40127.gmp
- %TEMP%\gmicon\40128.gmp в %APPDATA%\kuai8\pic\40128.gmp
- %TEMP%\gmicon\40129.gmp в %APPDATA%\kuai8\pic\40129.gmp
- %TEMP%\gmicon\40133.gmp в %APPDATA%\kuai8\pic\40133.gmp
- %TEMP%\gmicon\40134.gmp в %APPDATA%\kuai8\pic\40134.gmp
- %TEMP%\gm~bbe6.tmp в %APPDATA%\kuai8\pic\70873.gmp
- %TEMP%\gmicon\20082.gmp в %APPDATA%\kuai8\pic\20082.gmp
- %TEMP%\gmicon\40135.gmp в %APPDATA%\kuai8\pic\40135.gmp
- %TEMP%\gmicon\40148.gmp в %APPDATA%\kuai8\pic\40148.gmp
- %TEMP%\gmicon\40149.gmp в %APPDATA%\kuai8\pic\40149.gmp
- %TEMP%\gmicon\40150.gmp в %APPDATA%\kuai8\pic\40150.gmp
- %TEMP%\gm~c4d0.tmp в %APPDATA%\kuai8\pic\70898.gmp
- %TEMP%\gm~c8b8.tmp в %APPDATA%\kuai8\pic\70913.gmp
- %TEMP%\gm~cb67.tmp в %APPDATA%\kuai8\pic\00005.gmp
- %TEMP%\gm~cbb6.tmp в %APPDATA%\kuai8\pic\70918.gmp
- %TEMP%\gm~cea5.tmp в %APPDATA%\kuai8\pic\70922.gmp
- %TEMP%\gm~ce65.tmp в %APPDATA%\kuai8\pic\00111.gmp
- %TEMP%\gm~d154.tmp в %APPDATA%\kuai8\pic\70924.gmp
- %TEMP%\gmicon\40139.gmp в %APPDATA%\kuai8\pic\40139.gmp
- %TEMP%\gmicon\40140.gmp в %APPDATA%\kuai8\pic\40140.gmp
- %TEMP%\gm~d378.tmp в %APPDATA%\kuai8\pic\70928.gmp
- %TEMP%\gm~d201.tmp в %APPDATA%\kuai8\pic\00151.gmp
- %TEMP%\gm~b57c.tmp в %APPDATA%\kuai8\pic\68962.gmp
- %TEMP%\gm~a0af.tmp в %APPDATA%\kuai8\pic\68901.gmp
- %TEMP%\gm~9ff2.tmp в %APPDATA%\kuai8\pic\70735.gmp
- %TEMP%\gm~a19a.tmp в %APPDATA%\kuai8\pic\68902.gmp
- %TEMP%\gm~a275.tmp в %APPDATA%\kuai8\pic\68905.gmp
- %TEMP%\gm~a360.tmp в %APPDATA%\kuai8\pic\70744.gmp
- %TEMP%\gm~a3fd.tmp в %APPDATA%\kuai8\pic\68906.gmp
- %TEMP%\gm~a620.tmp в %APPDATA%\kuai8\pic\70793.gmp
- %TEMP%\gm~a65f.tmp в %APPDATA%\kuai8\pic\68937.gmp
- %TEMP%\gm~a7e6.tmp в %APPDATA%\kuai8\pic\55842.gmp
- %TEMP%\gm~b7fc.tmp в %APPDATA%\kuai8\pic\68963.gmp
- %TEMP%\gm~9d80.tmp в %APPDATA%\kuai8\pic\68897.gmp
- %TEMP%\gm~b81c.tmp в %APPDATA%\kuai8\pic\70871.gmp
- %TEMP%\gm~a97e.tmp в %APPDATA%\kuai8\pic\51768.gmp
- %TEMP%\gm~ac5e.tmp в %APPDATA%\kuai8\pic\70816.gmp
- %TEMP%\gm~add6.tmp в %APPDATA%\kuai8\pic\68956.gmp
- %TEMP%\gm~af3d.tmp в %APPDATA%\kuai8\pic\70821.gmp
- %TEMP%\gm~af8c.tmp в %APPDATA%\kuai8\pic\68958.gmp
- %TEMP%\gm~b133.tmp в %APPDATA%\kuai8\pic\68959.gmp
- %TEMP%\gm~b21e.tmp в %APPDATA%\kuai8\pic\68960.gmp
- %TEMP%\gm~b23e.tmp в %APPDATA%\kuai8\pic\70835.gmp
- %TEMP%\gm~b3c5.tmp в %APPDATA%\kuai8\pic\68961.gmp
- %TEMP%\gm~b52d.tmp в %APPDATA%\kuai8\pic\70836.gmp
- %TEMP%\gm~a8d1.tmp в %APPDATA%\kuai8\pic\70812.gmp
- %TEMP%\gm~aa69.tmp в %APPDATA%\kuai8\pic\52039.gmp
- %TEMP%\gm~ab44.tmp в %APPDATA%\kuai8\pic\52845.gmp
- %TEMP%\gm~6505.tmp в %APPDATA%\kuai8\pic\17768.gmp
- %TEMP%\gm~d5ba.tmp в %APPDATA%\kuai8\pic\00237.gmp
- %TEMP%\gm~fc2e.tmp в %APPDATA%\kuai8\pic\16393.gmp
- %TEMP%\gm~fde5.tmp в %APPDATA%\kuai8\pic\16410.gmp
- %TEMP%\gm~ff2d.tmp в %APPDATA%\kuai8\pic\71066.gmp
- %TEMP%\gm~ff9b.tmp в %APPDATA%\kuai8\pic\16423.gmp
- %TEMP%\gm~142.tmp в %APPDATA%\kuai8\pic\16424.gmp
- %TEMP%\gm~23c.tmp в %APPDATA%\kuai8\pic\71067.gmp
- %TEMP%\gm~2f8.tmp в %APPDATA%\kuai8\pic\16438.gmp
- %TEMP%\gm~4cd.tmp в %APPDATA%\kuai8\pic\16669.gmp
- %TEMP%\gm~606.tmp в %APPDATA%\kuai8\pic\71068.gmp
- %TEMP%\gm~675.tmp в %APPDATA%\kuai8\pic\17973.gmp
- %TEMP%\gm~fa68.tmp в %APPDATA%\kuai8\pic\16386.gmp
- %TEMP%\gm~905.tmp в %APPDATA%\kuai8\pic\17974.gmp
- %TEMP%\gm~fd19.tmp в %APPDATA%\kuai8\pic\71061.gmp
- %TEMP%\gm~b29.tmp в %APPDATA%\kuai8\pic\71069.gmp
- %TEMP%\gm~e19.tmp в %APPDATA%\kuai8\pic\17977.gmp
- %TEMP%\gm~e08.tmp в %APPDATA%\kuai8\pic\71087.gmp
- %TEMP%\gm~fcf.tmp в %APPDATA%\kuai8\pic\17978.gmp
- %TEMP%\gm~1117.tmp в %APPDATA%\kuai8\pic\71091.gmp
- %TEMP%\gm~1250.tmp в %APPDATA%\kuai8\pic\17979.gmp
- %TEMP%\gm~1406.tmp в %APPDATA%\kuai8\pic\71093.gmp
- %TEMP%\gm~1407.tmp в %APPDATA%\kuai8\pic\17980.gmp
- %TEMP%\gm~1697.tmp в %APPDATA%\kuai8\pic\20101.gmp
- %TEMP%\gm~1783.tmp в %APPDATA%\kuai8\pic\20193.gmp
- %TEMP%\gm~9f0.tmp в %APPDATA%\kuai8\pic\17975.gmp
- %TEMP%\gm~fa29.tmp в %APPDATA%\kuai8\pic\71056.gmp
- %TEMP%\gm~b97.tmp в %APPDATA%\kuai8\pic\17976.gmp
- %TEMP%\gm~f8b2.tmp в %APPDATA%\kuai8\pic\16383.gmp
- %TEMP%\gm~f7d6.tmp в %APPDATA%\kuai8\pic\71053.gmp
- %TEMP%\gm~d993.tmp в %APPDATA%\kuai8\pic\70931.gmp
- %TEMP%\gm~dbc7.tmp в %APPDATA%\kuai8\pic\70932.gmp
- %TEMP%\gm~dca2.tmp в %APPDATA%\kuai8\pic\02017.gmp
- %TEMP%\gm~dea6.tmp в %APPDATA%\kuai8\pic\70933.gmp
- %TEMP%\gm~e06b.tmp в %APPDATA%\kuai8\pic\05665.gmp
- %TEMP%\gm~e0da.tmp в %APPDATA%\kuai8\pic\70956.gmp
- %TEMP%\gm~e35a.tmp в %APPDATA%\kuai8\pic\07918.gmp
- %TEMP%\gm~e60a.tmp в %APPDATA%\kuai8\pic\70967.gmp
- %TEMP%\gm~e714.tmp в %APPDATA%\kuai8\pic\09572.gmp
- %TEMP%\gm~e8f8.tmp в %APPDATA%\kuai8\pic\70980.gmp
- %TEMP%\gm~e995.tmp в %APPDATA%\kuai8\pic\10907.gmp
- %TEMP%\gm~eb2c.tmp в %APPDATA%\kuai8\pic\70987.gmp
- %TEMP%\gm~d9a4.tmp в %APPDATA%\kuai8\pic\01854.gmp
- %TEMP%\gm~ec17.tmp в %APPDATA%\kuai8\pic\12332.gmp
- %TEMP%\gm~efa3.tmp в %APPDATA%\kuai8\pic\12706.gmp
- %TEMP%\gm~ee2b.tmp в %APPDATA%\kuai8\pic\71011.gmp
- %TEMP%\gm~f09d.tmp в %APPDATA%\kuai8\pic\15950.gmp
- %TEMP%\gm~f264.tmp в %APPDATA%\kuai8\pic\16347.gmp
- %TEMP%\gm~f205.tmp в %APPDATA%\kuai8\pic\71032.gmp
- %TEMP%\gm~f34f.tmp в %APPDATA%\kuai8\pic\16354.gmp
- %TEMP%\gm~f4e5.tmp в %APPDATA%\kuai8\pic\71033.gmp
- %TEMP%\gm~f506.tmp в %APPDATA%\kuai8\pic\16367.gmp
- %TEMP%\gm~f6cb.tmp в %APPDATA%\kuai8\pic\16368.gmp
- %TEMP%\gm~f7b6.tmp в %APPDATA%\kuai8\pic\16370.gmp
- %TEMP%\gm~9d22.tmp в %APPDATA%\kuai8\pic\70716.gmp
- %TEMP%\gm~eddc.tmp в %APPDATA%\kuai8\pic\12705.gmp
- %TEMP%\gm~9f17.tmp в %APPDATA%\kuai8\pic\68898.gmp
- %TEMP%\gm~9bf8.tmp в %APPDATA%\kuai8\pic\68786.gmp
- %TEMP%\gm~9b3c.tmp в %APPDATA%\kuai8\pic\70640.gmp
- %TEMP%\gm~9a61.tmp в %APPDATA%\kuai8\pic\68781.gmp
- %TEMP%\gm~4ad8.tmp в %APPDATA%\kuai8\pic\17420.gmp
- %TEMP%\gm~4b84.tmp в %APPDATA%\kuai8\pic\17468.gmp
- %TEMP%\gm~4d89.tmp в %APPDATA%\kuai8\pic\17421.gmp
- %TEMP%\gm~4d1b.tmp в %APPDATA%\kuai8\pic\17545.gmp
- %TEMP%\gm~4f6e.tmp в %APPDATA%\kuai8\pic\17581.gmp
- %TEMP%\gm~5049.tmp в %APPDATA%\kuai8\pic\17495.gmp
- %TEMP%\gm~50f6.tmp в %APPDATA%\kuai8\pic\17591.gmp
- %TEMP%\gm~52da.tmp в %APPDATA%\kuai8\pic\17694.gmp
- %TEMP%\gm~52fa.tmp в %APPDATA%\kuai8\pic\17592.gmp
- %TEMP%\gm~4836.tmp в %APPDATA%\kuai8\pic\17404.gmp
- %TEMP%\gm~44bb.tmp в %APPDATA%\kuai8\pic\17374.gmp
- %TEMP%\gm~49ed.tmp в %APPDATA%\kuai8\pic\17288.gmp
- %TEMP%\gm~5472.tmp в %APPDATA%\kuai8\pic\17698.gmp
- %TEMP%\gm~5937.tmp в %APPDATA%\kuai8\pic\17894.gmp
- %TEMP%\gm~59e3.tmp в %APPDATA%\kuai8\pic\17725.gmp
- %TEMP%\gm~5bf8.tmp в %APPDATA%\kuai8\pic\17895.gmp
- %TEMP%\gm~5b6a.tmp в %APPDATA%\kuai8\pic\17731.gmp
- %TEMP%\gm~5d02.tmp в %APPDATA%\kuai8\pic\17734.gmp
- %TEMP%\gm~5e99.tmp в %APPDATA%\kuai8\pic\17739.gmp
- %TEMP%\gm~5e0c.tmp в %APPDATA%\kuai8\pic\20053.gmp
- %TEMP%\gm~6030.tmp в %APPDATA%\kuai8\pic\17744.gmp
- %TEMP%\gm~61c8.tmp в %APPDATA%\kuai8\pic\17746.gmp
- %TEMP%\gm~55ab.tmp в %APPDATA%\kuai8\pic\17612.gmp
- %TEMP%\gm~55fa.tmp в %APPDATA%\kuai8\pic\17699.gmp
- %TEMP%\gm~584c.tmp в %APPDATA%\kuai8\pic\17724.gmp
- %TEMP%\gm~4558.tmp в %APPDATA%\kuai8\pic\17157.gmp
- %TEMP%\gm~43d0.tmp в %APPDATA%\kuai8\pic\17143.gmp
- %TEMP%\gm~6179.tmp в %APPDATA%\kuai8\pic\20399.gmp
- %TEMP%\gm~1bda.tmp в %APPDATA%\kuai8\pic\70916.gmp
- %TEMP%\gm~1cb6.tmp в %APPDATA%\kuai8\pic\71040.gmp
- %TEMP%\gm~1e4d.tmp в %APPDATA%\kuai8\pic\71044.gmp
- %TEMP%\gm~1ff3.tmp в %APPDATA%\kuai8\pic\71059.gmp
- %TEMP%\gm~22a3.tmp в %APPDATA%\kuai8\pic\71071.gmp
- %TEMP%\gm~2504.tmp в %APPDATA%\kuai8\pic\71086.gmp
- %TEMP%\gm~26aa.tmp в %APPDATA%\kuai8\pic\71101.gmp
- %TEMP%\gm~2851.tmp в %APPDATA%\kuai8\pic\71103.gmp
- %TEMP%\gm~2ab2.tmp в %APPDATA%\kuai8\pic\71106.gmp
- %TEMP%\gm~2c68.tmp в %APPDATA%\kuai8\pic\16292.gmp
- %TEMP%\gm~2dff.tmp в %APPDATA%\kuai8\pic\16388.gmp
- %TEMP%\gm~1766.tmp в %APPDATA%\kuai8\pic\70568.gmp
- %TEMP%\gm~2f97.tmp в %APPDATA%\kuai8\data\plugin\icon.gmx
- %TEMP%\gm~3082.tmp в %APPDATA%\kuai8\pic\16766.gmp
- %TEMP%\gm~32e4.tmp в %APPDATA%\kuai8\pic\16842.gmp
- %TEMP%\gm~34f8.tmp в %APPDATA%\kuai8\pic\10080.gmp
- %TEMP%\gm~3547.tmp в %APPDATA%\kuai8\pic\16852.gmp
- %TEMP%\gm~37e7.tmp в %APPDATA%\kuai8\pic\16865.gmp
- %TEMP%\gm~3855.tmp в %APPDATA%\kuai8\pic\16948.gmp
- %TEMP%\gm~3bbf.tmp в %APPDATA%\kuai8\pic\16951.gmp
- %TEMP%\gm~3db4.tmp в %APPDATA%\kuai8\pic\16950.gmp
- %TEMP%\gm~3fc7.tmp в %APPDATA%\kuai8\pic\16980.gmp
- %TEMP%\gm~4054.tmp в %APPDATA%\kuai8\pic\17004.gmp
- %TEMP%\gm~415f.tmp в %APPDATA%\kuai8\pic\17104.gmp
- %TEMP%\gm~2f86.tmp в %APPDATA%\kuai8\pic\16757.gmp
- %TEMP%\gm~1715.tmp в %APPDATA%\kuai8\pic\71114.gmp
- %TEMP%\gm~d686.tmp в %APPDATA%\kuai8\pic\70930.gmp
- %TEMP%\gm~635e.tmp в %APPDATA%\kuai8\pic\17767.gmp
- %TEMP%\gm~67f5.tmp в %APPDATA%\kuai8\pic\40001.gmp
- %TEMP%\gm~8564.tmp в %APPDATA%\kuai8\pic\40160.gmp
- %TEMP%\gm~84f6.tmp в %APPDATA%\kuai8\pic\20360.gmp
- %TEMP%\gm~867e.tmp в %APPDATA%\kuai8\pic\20374.gmp
- %TEMP%\gm~8815.tmp в %APPDATA%\kuai8\pic\20383.gmp
- %TEMP%\gm~8778.tmp в %APPDATA%\kuai8\pic\40161.gmp
- %TEMP%\gm~88f1.tmp в %APPDATA%\kuai8\pic\20397.gmp
- %TEMP%\gm~8a2b.tmp в %APPDATA%\kuai8\pic\40162.gmp
- %TEMP%\gm~8b64.tmp в %APPDATA%\kuai8\pic\20458.gmp
- %TEMP%\gm~8e43.tmp в %APPDATA%\kuai8\pic\40163.gmp
- %TEMP%\gm~80fc.tmp в %APPDATA%\kuai8\pic\20317.gmp
- %TEMP%\gm~8cfa.tmp в %APPDATA%\kuai8\pic\60398.gmp
- %TEMP%\gm~834e.tmp в %APPDATA%\kuai8\pic\20359.gmp
- %TEMP%\gm~9038.tmp в %APPDATA%\kuai8\pic\40164.gmp
- %TEMP%\gm~924c.tmp в %APPDATA%\kuai8\pic\40178.gmp
- %TEMP%\gm~927c.tmp в %APPDATA%\kuai8\pic\68559.gmp
- %TEMP%\gm~9413.tmp в %APPDATA%\kuai8\pic\68668.gmp
- %TEMP%\gm~9472.tmp в %APPDATA%\kuai8\pic\70307.gmp
- %TEMP%\gm~95ab.tmp в %APPDATA%\kuai8\pic\68676.gmp
- %TEMP%\gm~9732.tmp в %APPDATA%\kuai8\pic\70574.gmp
- %TEMP%\gm~9733.tmp в %APPDATA%\kuai8\pic\68761.gmp
- %TEMP%\gm~9937.tmp в %APPDATA%\kuai8\pic\70631.gmp
- %TEMP%\gm~98c9.tmp в %APPDATA%\kuai8\pic\68767.gmp
- %TEMP%\gm~8f4d.tmp в %APPDATA%\kuai8\pic\67762.gmp
- %TEMP%\gm~4866.tmp в %APPDATA%\kuai8\pic\17282.gmp
- %TEMP%\gm~90e5.tmp в %APPDATA%\kuai8\pic\68110.gmp
- %TEMP%\gm~836f.tmp в %APPDATA%\kuai8\pic\40159.gmp
- %TEMP%\gm~816a.tmp в %APPDATA%\kuai8\pic\40158.gmp
- %TEMP%\gm~7f64.tmp в %APPDATA%\kuai8\pic\20299.gmp
- %TEMP%\gm~67a6.tmp в %APPDATA%\kuai8\pic\17775.gmp
- %TEMP%\gm~6a09.tmp в %APPDATA%\kuai8\pic\40004.gmp
- %TEMP%\gm~6a0a.tmp в %APPDATA%\kuai8\pic\17782.gmp
- %TEMP%\gm~6bff.tmp в %APPDATA%\kuai8\pic\40015.gmp
- %TEMP%\gm~6ba0.tmp в %APPDATA%\kuai8\pic\20002.gmp
- %TEMP%\gm~6d38.tmp в %APPDATA%\kuai8\pic\20005.gmp
- %TEMP%\gm~6e04.tmp в %APPDATA%\kuai8\pic\40031.gmp
- %TEMP%\gm~6ecf.tmp в %APPDATA%\kuai8\pic\20009.gmp
- %TEMP%\gm~7018.tmp в %APPDATA%\kuai8\pic\40071.gmp
- %TEMP%\gm~7067.tmp в %APPDATA%\kuai8\pic\20016.gmp
- %TEMP%\gm~65f0.tmp в %APPDATA%\kuai8\pic\17773.gmp
- %TEMP%\gm~7142.tmp в %APPDATA%\kuai8\pic\20039.gmp
- %TEMP%\gm~72ea.tmp в %APPDATA%\kuai8\pic\20052.gmp
- %TEMP%\gm~758a.tmp в %APPDATA%\kuai8\pic\40149.gmp
- %TEMP%\gm~7780.tmp в %APPDATA%\kuai8\pic\40153.gmp
- %TEMP%\gm~76d3.tmp в %APPDATA%\kuai8\pic\20127.gmp
- %TEMP%\gm~786b.tmp в %APPDATA%\kuai8\pic\20189.gmp
- %TEMP%\gm~7975.tmp в %APPDATA%\kuai8\pic\40154.gmp
- %TEMP%\gm~79f3.tmp в %APPDATA%\kuai8\pic\20204.gmp
- %TEMP%\gm~7b6a.tmp в %APPDATA%\kuai8\pic\40155.gmp
- %TEMP%\gm~7b8a.tmp в %APPDATA%\kuai8\pic\20218.gmp
- %TEMP%\gm~7d6f.tmp в %APPDATA%\kuai8\pic\40156.gmp
- %TEMP%\gm~7ddd.tmp в %APPDATA%\kuai8\pic\20298.gmp
- %TEMP%\gm~720e.tmp в %APPDATA%\kuai8\pic\40133.gmp
- %TEMP%\gm~7f75.tmp в %APPDATA%\kuai8\pic\40157.gmp
- %TEMP%\gm~6504.tmp в %APPDATA%\kuai8\pic\20445.gmp
- %TEMP%\gm~1939.tmp в %APPDATA%\kuai8\pic\20242.gmp
Подменяет следующие файлы
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\data\search.gms-journal
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\plugin\window.gmx
- %APPDATA%\kuai8\data\plugin\netwl.gmx
- %APPDATA%\kuai8\pic\20053.gmp
- %APPDATA%\kuai8\pic\20445.gmp
Сетевая активность
Подключается к
- 'up####.kuai8.com':80
- 'gm#.##ai8box.com':80
- 'st##.kuai8.com':80
- 'se####e.kuai8.com':80
- 'ic##.#uai8box.com':80
- 'up#.##ai8box.com':80
TCP
Запросы HTTP GET
- http://up####.kuai8.com/update_hot.php?da########################################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/52845.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70816.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68956.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70821.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68958.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68959.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68960.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70835.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68961.gmp
- http://up####.kuai8.com/update_icon.php?da##############################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/70836.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/51768.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/52039.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68962.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70873.gmp
- http://up#.##ai8box.com/gmp_64/2016.12.09/20001-20100.gmz
- http://up#.##ai8box.com/gmp_64/2016.09.14/40001-40100.gmz
- http://ic##.#uai8box.com/game_icon/gmp_64/70876.gmp
- http://up#.##ai8box.com/gmp_64/2018.11.29/40101-40200.gmz
- http://ic##.#uai8box.com/game_icon/gmp_64/70883.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70898.gmp
- http://up####.kuai8.com/update_icon.php?da########################################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/70913.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00005.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70918.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68963.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70871.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70812.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/55842.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68937.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40163.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/67762.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40164.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68110.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40178.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68559.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68668.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70307.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68676.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70574.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68761.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68767.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/60398.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70631.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70640.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68786.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70716.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68897.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68898.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70735.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68901.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68902.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68905.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70744.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68906.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70793.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/68781.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00111.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70924.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20242.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00151.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16393.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71061.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16410.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71066.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16423.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16424.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71067.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16438.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16669.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71068.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17973.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71056.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16386.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17974.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17976.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71087.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17977.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17978.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71091.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17979.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71093.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17980.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20101.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71114.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20193.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17975.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71069.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16383.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71053.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16370.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00237.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70930.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70931.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/01854.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70932.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/02017.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70933.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/05665.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70956.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/07918.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70967.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/09572.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70928.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70980.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70987.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/12332.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/12705.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71011.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/12706.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/15950.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71032.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16347.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16354.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71033.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16367.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16368.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/10907.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20458.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70922.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40162.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17468.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16757.gmp
- http://gm#.##ai8box.com/upicons/upicons_25_0.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/16766.gmp
- http://gm#.##ai8box.com/inswhitelist/inswhitelist_1_8.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/16842.gmp
- http://ic##.#uai8box.com/slider/202004/20200429112935682.jpg
- http://up####.kuai8.com/update_icon.php?da##########################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/10080.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16852.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16865.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16948.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16388.gmp
- http://up####.kuai8.com/update_plugin.php?da############################################################################
- http://ic##.#uai8box.com/slider/202103/20210331172811484.jpg
- http://ic##.#uai8box.com/slider/201605/20160523162136750.gif
- http://up####.kuai8.com/update_icon.php?da############################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/16980.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17004.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17104.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17143.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17374.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17157.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17404.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17282.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17288.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16951.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16950.gmp
- http://gm#.##ai8box.com/window/window_9_5.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/16292.gmp
- http://ic##.#uai8box.com/slider/202104/20210406110000717.jpg
- http://up####.kuai8.com/update_top.php?da########################################################################################
- http://gm#.##ai8box.com/top/top_109_6.gmx
- http://up####.kuai8.com/update_database.php?da########################################################################################
- http://gm#.##ai8box.com/database_new/database_197_1.gmx
- http://st##.kuai8.com/stat.php?da####################################################################
- http://up####.kuai8.com/update/?da###############################################################################################################################################################...
- http://se####e.kuai8.com/time.php?da########
- http://up####.kuai8.com/update_soft_module.php?da##########################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/70568.gmp
- http://up####.kuai8.com/update_plugin.php?da##########################################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/70916.gmp
- http://up####.kuai8.com/update_plugin.php?da########################################################################################
- http://gm#.##ai8box.com/hot_20/hot_20_117_6.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/71040.gmp
- http://st##.kuai8.com/online_stat.php?da#########################################################################################################################################################...
- http://gm#.##ai8box.com/scan/scan_12_9.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/71044.gmp
- http://up####.kuai8.com/update_plugin.php?da##########################################################################################################
- http://ic##.#uai8box.com/slider/202104/20210422104738204.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71059.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71071.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71086.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71101.gmp
- http://ic##.#uai8box.com/slider/202103/20210329132433423.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71103.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71106.gmp
- http://ic##.#uai8box.com/slider/202104/20210407103631388.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/17420.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17545.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20383.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17421.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40071.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20016.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20039.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40133.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20052.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40149.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20127.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40153.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20189.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40154.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20204.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40031.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20009.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40155.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20298.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20299.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40157.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20317.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40158.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20359.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40159.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20360.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40160.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20374.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40161.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20218.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40156.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20005.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40015.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20002.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17495.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17591.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17694.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17592.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17698.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17612.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17699.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17724.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17894.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17725.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17731.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17895.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17581.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17734.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17739.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17744.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20399.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17746.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17767.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20445.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17768.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17773.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17775.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40001.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40004.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17782.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20053.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20397.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20310.gmp
Запросы HTTP POST
- http://up####.kuai8.com/update_icon.php?da######################################################################
UDP
- DNS ASK up####.kuai8.com
- DNS ASK gm#.##ai8box.com
- DNS ASK st##.kuai8.com
- DNS ASK se####e.kuai8.com
- DNS ASK ic##.#uai8box.com
- DNS ASK up#.##ai8box.com
Другое
Ищет следующие окна
- ClassName: 'GMBubbleWnd' WindowName: ''
- ClassName: 'GMKuaiBaWnd' WindowName: '¿ì°ÉÓÎÏ·'
- ClassName: '' WindowName: '¿ì°ÉFlashÓÎÏ·'
- ClassName: '' WindowName: '¿ì°ÉÍøÒ³ÓÎÏ·'
- ClassName: '' WindowName: '¿ì°ÉÓÎÏ·ä¯ÀÀÆ÷'
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\kuai8\k8gm.exe' -update_data
- '%ProgramFiles(x86)%\kuai8\k8update.exe' -install
- '%ProgramFiles(x86)%\kuai8\k8gm.exe' -atonce -show=3
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="¿ì°ÉÓÎÏ·¹ÜÀГÆ÷" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="¿ì°ÉflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="¿ì°ÉÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="¿ì°ÉÓÎÏ·ÏÂÔГƽ̨" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="¿ì°ÉÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="¿ì°ÉÓÎÏ·¹ÜÀГÆ÷" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="¿ì°ÉflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="¿ì°ÉÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="¿ì°ÉÓÎÏ·ÏÂÔГƽ̨" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="¿ì°ÉÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL
