Trojan.Siggen19.58460

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="ВїГ¬В°Г‰flashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="ВїГ¬В°Г‰Г“ГЋГЏВ·В№ГњГЂГГ†Г·" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="ВїГ¬В°Г‰Г”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="ВїГ¬В°Г‰ГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="ВїГ¬В°Г‰Г“ГЋГЏВ·ГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL

Внедряет код в

следующие системные процессы:

%WINDIR%\explorer.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nskd9db.tmp
%TEMP%\gm~f3c8.tmp
%TEMP%\gm~f6d5.tmp
%APPDATA%\kuai8\slider\slider_202104_20210406110004627.jpg
%TEMP%\gm~f7e0.tmp
%APPDATA%\kuai8\slider\slider_202004_20200429112935682.jpg
%TEMP%\gm~3d4.tmp
%APPDATA%\kuai8\slider\slider_202004_20200429112939980.jpg
%APPDATA%\kuai8\slider\slider_202103_20210331172811484.jpg
%TEMP%\gm~1a38.tmp
%TEMP%\gm~f2be.tmp
%TEMP%\gm~eeb8.tmp
%TEMP%\gm~fa70.tmp
%TEMP%\gm~13a0.tmp
%APPDATA%\kuai8\slider\slider_202012_20201209111206285.jpg
%TEMP%\gm~1219.tmp
%TEMP%\gm~16cd.tmp
%TEMP%\gm~14c9.tmp
%APPDATA%\kuai8\slider\slider_202012_20201209111230641.gif
%TEMP%\gm~193e.tmp
%TEMP%\gm~bf0.tmp
%APPDATA%\kuai8\slider\slider_201605_20160523162136750.gif
%TEMP%\gm~ae36.tmp
%APPDATA%\kuai8\slider\slider_202103_20210331172821640.jpg
%TEMP%\gm~c3b3.tmp
%TEMP%\gm~b451.tmp
%TEMP%\gm~b56b.tmp
%APPDATA%\kuai8\slider\slider_202104_20210406110000717.jpg
%TEMP%\gm~b357.tmp
%TEMP%\gm~b675.tmp
%TEMP%\gm~ba8b.tmp
%TEMP%\gm~bb96.tmp
%TEMP%\gm~bfac.tmp
%TEMP%\gm~e996.tmp
%TEMP%\gm~edbd.tmp
%TEMP%\gm~eaa0.tmp
%TEMP%\gm~c4bf.tmp
%TEMP%\gm~c6e2.tmp
%TEMP%\gm~c7dc.tmp
%TEMP%\gm~d881.tmp
%TEMP%\gm~da47.tmp
%TEMP%\gm~e262.tmp
%TEMP%\gm~e2a2.tmp
%TEMP%\gm~e590.tmp
%TEMP%\gm~c0a6.tmp
%TEMP%\gm~c3c4.tmp
%TEMP%\gm~b04a.tmp
%TEMP%\gm~1a49.tmp
%TEMP%\gm~1f6b.tmp
%TEMP%\gm~36f7.tmp
%TEMP%\gm~38af.tmp
%TEMP%\gm~38ae.tmp
%TEMP%\gm~39b9.tmp
%TEMP%\gm~3da2.tmp
%TEMP%\gm~3cd6.tmp
%TEMP%\gm~3fb5.tmp
%TEMP%\gm~42d3.tmp
%TEMP%\gm~3541.tmp
%TEMP%\gm~37a4.tmp
%TEMP%\gm~42b3.tmp
%TEMP%\gm~494c.tmp
%TEMP%\gm~494b.tmp
%TEMP%\gm~4c1b.tmp
%TEMP%\gm~4e1f.tmp
%TEMP%\gm~4fe4.tmp
%TEMP%\gm~5033.tmp
%TEMP%\gm~5247.tmp
%TEMP%\gm~55f0.tmp
%TEMP%\gm~44f6.tmp
%TEMP%\gm~45c2.tmp
%TEMP%\gm~1c5d.tmp
%TEMP%\gm~1c5c.tmp
%APPDATA%\kuai8\slider\slider_202012_20201209111333962.jpg
%TEMP%\gm~1f7c.tmp
%TEMP%\gm~2077.tmp
%TEMP%\gm~227a.tmp
%TEMP%\gm~227b.tmp
%TEMP%\gm~2386.tmp
%TEMP%\gm~25aa.tmp
%TEMP%\gm~2599.tmp
%TEMP%\gm~33e8.tmp
%TEMP%\gm~1d68.tmp
%TEMP%\gm~3689.tmp
%TEMP%\gm~26b4.tmp
%TEMP%\gm~2bc7.tmp
%TEMP%\gm~2dbb.tmp
%TEMP%\gm~2fce.tmp
%TEMP%\gm~2fcf.tmp
%TEMP%\gm~30d9.tmp
%TEMP%\gm~32dd.tmp
%TEMP%\gm~32ee.tmp
%TEMP%\gm~28a8.tmp
%TEMP%\gm~28b9.tmp
%TEMP%\gm~29c3.tmp
%TEMP%\gm~ae35.tmp
%TEMP%\gm~ab28.tmp
%TEMP%\gm~aa2e.tmp
%ProgramFiles(x86)%\kuai8\tool\k8minipage.exe
%ProgramFiles(x86)%\kuai8\tool\k8rtlfix.exe
%ProgramFiles(x86)%\kuai8\tool\k8pluginfix.exe
%ProgramFiles(x86)%\kuai8\tool\k8netdetect.exe
%ProgramFiles(x86)%\kuai8\tool\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\kuai8\tool\msvcp80.dll
%ProgramFiles(x86)%\kuai8\tool\msvcr80.dll
%APPDATA%\kuai8\data\database.gmx
%ProgramFiles(x86)%\kuai8\tool\k8external.exe
%TEMP%\gm~1daf.tmp
%ProgramFiles(x86)%\kuai8\tool\k8dlutils.dll
%APPDATA%\kuai8\data\plugin\window.gmx
%APPDATA%\kuai8\data\plugin\netwl.gmx
%APPDATA%\kuai8\data\plugin\inwl.gmx
%APPDATA%\kuai8\data\plugin\pc.gmx
%ProgramFiles(x86)%\kuai8\audio\complete.wav
%TEMP%\gm~145a.tmp
%APPDATA%\kuai8\update.ini
%TEMP%\gm~18ed.tmp
%APPDATA%\kuai8\data\plugin\top.gmx
%APPDATA%\kuai8\data\plugin\hot.gmx
%APPDATA%\kuai8\data\plugin\scan.gmx
%ProgramFiles(x86)%\kuai8\tool\k8common.dll
%ProgramFiles(x86)%\kuai8\k8dlutils.dll
%TEMP%\nspd9fb.tmp\k8nsisminiextend.dll
%ProgramFiles(x86)%\kuai8\k8gm.exe
%ProgramFiles(x86)%\kuai8\k8flash.exe
%ProgramFiles(x86)%\kuai8\k8browser.exe
%ProgramFiles(x86)%\kuai8\k8web.exe
%ProgramFiles(x86)%\kuai8\k8update.exe
%ProgramFiles(x86)%\kuai8\k8version.dll
%ProgramFiles(x86)%\kuai8\k8bugreport.exe
%ProgramFiles(x86)%\kuai8\tool\k8uirender.dll
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\快吧游戏.lnk
%TEMP%\nspd9fb.tmp\system.dll
%ProgramFiles(x86)%\kuai8\k8dlplatform.exe
%ProgramFiles(x86)%\kuai8\k8uirender.dll
%ProgramFiles(x86)%\kuai8\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\kuai8\msvcp80.dll
%ProgramFiles(x86)%\kuai8\msvcr80.dll
%ProgramFiles(x86)%\kuai8\uninstall.exe
%ProgramFiles(x86)%\kuai8\tool\k8restorewindow.dll
%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe
%ProgramFiles(x86)%\kuai8\k8common.dll
%ProgramFiles(x86)%\kuai8\k8urlencrypt.dll
%ProgramFiles(x86)%\kuai8\tool\k8tray.exe
%APPDATA%\microsoft\internet explorer\quick launch\ВїГ¬В°Г©ГіГ®ГЇВ·.lnk
%TEMP%\gm~8cae.tmp
%TEMP%\gm~8fbc.tmp
%APPDATA%\kuai8\slider\slider_202104_20210422104742815.jpg
%TEMP%\gm~90c6.tmp
%APPDATA%\kuai8\slider\slider_202103_20210329132433423.jpg
%TEMP%\gm~92ca.tmp
%APPDATA%\kuai8\slider\slider_202103_20210329132440308.jpg
%TEMP%\gm~94fc.tmp
%TEMP%\gm$d.510.3839\kuai8box_v10.2.1.8391_update.exe
%APPDATA%\kuai8\slider\slider_202104_20210422104738204.jpg
%TEMP%\gm~8eb2.tmp
%TEMP%\gm~9700.tmp
%TEMP%\gm~9a20.tmp
%TEMP%\gm~9c43.tmp
%TEMP%\gm~9d4d.tmp
%TEMP%\gm~9e76.tmp
%TEMP%\gm~a135.tmp
%TEMP%\gm~a626.tmp
%TEMP%\gm~a721.tmp
%TEMP%\gm~975f.tmp
%TEMP%\gm~981b.tmp
%TEMP%\gm~99b2.tmp
%TEMP%\gm~8a8b.tmp
%TEMP%\gm~8887.tmp
%HOMEPATH%\desktop\ВїГ¬В°Г©ГіГ®ГЇВ·.lnk
%APPDATA%\microsoft\windows\start menu\programs\ВїГ¬В°Г©ГіГ®ГЇВ·\ВїГ¬В°Г©ГіГ®ГЇВ·.lnk
%APPDATA%\microsoft\windows\start menu\programs\ВїГ¬В°Г©ГіГ®ГЇВ·\ВїГ¬В°Г©flashВІВҐВ·ГҐГ¦Г·.lnk
%APPDATA%\microsoft\windows\start menu\programs\ВїГ¬В°Г©ГіГ®ГЇВ·\ВїГ¬В°Г©ГІВіГіГ®ВґГіГ¬Гј.lnk
%APPDATA%\microsoft\windows\start menu\programs\ВїГ¬В°Г©ГіГ®ГЇВ·\Г°В¶ГґГёВїГ¬В°Г©.lnk
%TEMP%\gmtemp\restart.gmt
%APPDATA%\kuai8\data\local\recent.xml
%APPDATA%\kuai8\data\local\user.xml
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\search.gms
%HOMEPATH%\desktop\ВїГ¬В°Г©ГІВіГіГ®ВґГіГ¬Гј.lnk
%APPDATA%\kuai8\config\config.xml
%TEMP%\gm~7b28.tmp
%TEMP%\gm~819e.tmp
%APPDATA%\kuai8\slider\slider_202104_20210407103631388.jpg
%TEMP%\gm~8299.tmp
%TEMP%\gm~8420.tmp
%TEMP%\gm~854a.tmp
%TEMP%\gm~8450.tmp
%TEMP%\gm~8674.tmp
%APPDATA%\kuai8\slider\slider_202104_20210407103635443.jpg
%APPDATA%\kuai8\cache.xml
%TEMP%\gm~566e.tmp
%TEMP%\gm~5b01.tmp

Удаляет следующие файлы

%APPDATA%\kuai8\data\plugin\hot.gmx
%APPDATA%\kuai8\data\plugin\top.gmx
%TEMP%\nspd9fb.tmp\k8nsisminiextend.dll
%TEMP%\nspd9fb.tmp\system.dll
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\plugin\scan.gmx
%APPDATA%\kuai8\data\plugin\window.gmx
%APPDATA%\kuai8\pic\20053.gmp
%APPDATA%\kuai8\pic\20445.gmp
%APPDATA%\kuai8\data\search.gms
%TEMP%\gm~566e.tmp

Перемещает следующие файлы

%TEMP%\gm~7b28.tmp в %APPDATA%\kuai8\pic\70568.gmp
%TEMP%\gm~2bc7.tmp в %APPDATA%\kuai8\pic\40157.gmp
%TEMP%\gm~29c3.tmp в %APPDATA%\kuai8\pic\68901.gmp
%TEMP%\gm~28b9.tmp в %APPDATA%\kuai8\pic\40156.gmp
%TEMP%\gm~28a8.tmp в %APPDATA%\kuai8\pic\68898.gmp
%TEMP%\gm~26b4.tmp в %APPDATA%\kuai8\pic\68897.gmp
%TEMP%\gm~2599.tmp в %APPDATA%\kuai8\pic\40155.gmp
%TEMP%\gm~25aa.tmp в %APPDATA%\kuai8\pic\68786.gmp
%TEMP%\gm~2386.tmp в %APPDATA%\kuai8\pic\68781.gmp
%TEMP%\gm~227b.tmp в %APPDATA%\kuai8\pic\40154.gmp
%TEMP%\gm~227a.tmp в %APPDATA%\kuai8\pic\68767.gmp
%TEMP%\gm~2077.tmp в %APPDATA%\kuai8\pic\68761.gmp
%TEMP%\gm~1f7c.tmp в %APPDATA%\kuai8\pic\40153.gmp
%TEMP%\gm~1f6b.tmp в %APPDATA%\kuai8\pic\68676.gmp
%TEMP%\gm~1d68.tmp в %APPDATA%\kuai8\pic\68668.gmp
%TEMP%\gm~1c5d.tmp в %APPDATA%\kuai8\pic\40149.gmp
%TEMP%\gm~1c5c.tmp в %APPDATA%\kuai8\pic\68559.gmp
%TEMP%\gm~1a49.tmp в %APPDATA%\kuai8\pic\60398.gmp
%TEMP%\gm~1a38.tmp в %APPDATA%\kuai8\pic\40133.gmp
%TEMP%\gm~193e.tmp в %APPDATA%\kuai8\pic\20458.gmp
%TEMP%\gm~16cd.tmp в %APPDATA%\kuai8\pic\40071.gmp
%TEMP%\gm~1219.tmp в %APPDATA%\kuai8\pic\40031.gmp
%TEMP%\gm~13a0.tmp в %APPDATA%\kuai8\pic\20397.gmp
%TEMP%\gm~fa70.tmp в %APPDATA%\kuai8\pic\20383.gmp
%TEMP%\gm~2dbb.tmp в %APPDATA%\kuai8\pic\68902.gmp
%TEMP%\gm~2fce.tmp в %APPDATA%\kuai8\pic\51768.gmp
%TEMP%\gm~2fcf.tmp в %APPDATA%\kuai8\pic\40158.gmp
%TEMP%\gm~30d9.tmp в %APPDATA%\kuai8\pic\68905.gmp
%TEMP%\gm~36f7.tmp в %APPDATA%\kuai8\data\database.gmx
%TEMP%\gm~4fe4.tmp в %APPDATA%\kuai8\pic\70574.gmp
%TEMP%\gm~5247.tmp в %APPDATA%\kuai8\pic\68962.gmp
%TEMP%\gm~5033.tmp в %APPDATA%\kuai8\pic\68110.gmp
%TEMP%\gm~4e1f.tmp в %APPDATA%\kuai8\pic\67762.gmp
%TEMP%\gm~494b.tmp в %APPDATA%\kuai8\pic\70307.gmp
%TEMP%\gm~4c1b.tmp в %APPDATA%\kuai8\pic\55842.gmp
%TEMP%\gm~494c.tmp в %APPDATA%\kuai8\pic\52845.gmp
%TEMP%\gm~45c2.tmp в %APPDATA%\kuai8\pic\52039.gmp
%TEMP%\gm~44f6.tmp в %APPDATA%\kuai8\pic\40178.gmp
%TEMP%\gm~42b3.tmp в %APPDATA%\kuai8\pic\68963.gmp
%TEMP%\gm~3cd6.tmp в %APPDATA%\kuai8\pic\68961.gmp
%TEMP%\gm~42d3.tmp в %APPDATA%\kuai8\pic\40164.gmp
%TEMP%\gm~3fb5.tmp в %APPDATA%\kuai8\pic\40163.gmp
%TEMP%\gm~3da2.tmp в %APPDATA%\kuai8\pic\40162.gmp
%TEMP%\gm~39b9.tmp в %APPDATA%\kuai8\pic\68960.gmp
%TEMP%\gm~38ae.tmp в %APPDATA%\kuai8\pic\40161.gmp
%TEMP%\gm~38af.tmp в %APPDATA%\kuai8\pic\68959.gmp
%TEMP%\gm~37a4.tmp в %APPDATA%\kuai8\pic\68958.gmp
%TEMP%\gm~3541.tmp в %APPDATA%\kuai8\pic\40160.gmp
%TEMP%\gm~3689.tmp в %APPDATA%\kuai8\pic\68956.gmp
%TEMP%\gm~33e8.tmp в %APPDATA%\kuai8\pic\68937.gmp
%TEMP%\gm~32ee.tmp в %APPDATA%\kuai8\pic\40159.gmp
%TEMP%\gm~32dd.tmp в %APPDATA%\kuai8\pic\68906.gmp
%TEMP%\gm~55f0.tmp в %APPDATA%\kuai8\pic\70631.gmp
%TEMP%\gm~bf0.tmp в %APPDATA%\kuai8\pic\40015.gmp
%TEMP%\gm~3d4.tmp в %APPDATA%\kuai8\pic\40004.gmp
%TEMP%\gm~f7e0.tmp в %APPDATA%\kuai8\pic\20374.gmp
%TEMP%\gm~a721.tmp в %APPDATA%\kuai8\pic\17282.gmp
%TEMP%\gm~a626.tmp в %APPDATA%\kuai8\pic\16865.gmp
%TEMP%\gm~a135.tmp в %APPDATA%\kuai8\pic\17157.gmp
%TEMP%\gm~9e76.tmp в %APPDATA%\kuai8\pic\10080.gmp
%TEMP%\gm~9d4d.tmp в %APPDATA%\kuai8\pic\17143.gmp
%TEMP%\gm~9c43.tmp в %APPDATA%\kuai8\pic\17104.gmp
%TEMP%\gm~9a20.tmp в %APPDATA%\kuai8\pic\16980.gmp
%TEMP%\gm~99b2.tmp в %APPDATA%\kuai8\data\plugin\icon.gmx
%TEMP%\gm~981b.tmp в %APPDATA%\kuai8\pic\16971.gmp
%TEMP%\gm~9700.tmp в %APPDATA%\kuai8\pic\16950.gmp
%TEMP%\gm~94fc.tmp в %APPDATA%\kuai8\pic\16948.gmp
%TEMP%\gm~92ca.tmp в %APPDATA%\kuai8\pic\16852.gmp
%TEMP%\gm~90c6.tmp в %APPDATA%\kuai8\pic\16842.gmp
%TEMP%\gm~8fbc.tmp в %APPDATA%\kuai8\pic\16766.gmp
%TEMP%\gm~8eb2.tmp в %APPDATA%\kuai8\pic\16757.gmp
%TEMP%\gm~8cae.tmp в %APPDATA%\kuai8\pic\16388.gmp
%TEMP%\gm~8a8b.tmp в %APPDATA%\kuai8\pic\16292.gmp
%TEMP%\gm~8887.tmp в %APPDATA%\kuai8\pic\71106.gmp
%TEMP%\gm~8674.tmp в %APPDATA%\kuai8\pic\71086.gmp
%TEMP%\gm~854a.tmp в %APPDATA%\kuai8\pic\71059.gmp
%TEMP%\gm~8420.tmp в %APPDATA%\kuai8\pic\70916.gmp
%TEMP%\gm~8299.tmp в %APPDATA%\kuai8\pic\70878.gmp
%TEMP%\gm~819e.tmp в %APPDATA%\kuai8\pic\70729.gmp
%TEMP%\gm~aa2e.tmp в %APPDATA%\kuai8\pic\16951.gmp
%TEMP%\gm~ab28.tmp в %APPDATA%\kuai8\pic\17288.gmp
%TEMP%\gm~ae35.tmp в %APPDATA%\kuai8\pic\20002.gmp
%TEMP%\gm~ae36.tmp в %APPDATA%\kuai8\pic\17004.gmp
%TEMP%\gm~f3c8.tmp в %APPDATA%\kuai8\pic\20360.gmp
%TEMP%\gm~f2be.tmp в %APPDATA%\kuai8\pic\20399.gmp
%TEMP%\gm~eeb8.tmp в %APPDATA%\kuai8\pic\20359.gmp
%TEMP%\gm~eaa0.tmp в %APPDATA%\kuai8\pic\20317.gmp
%TEMP%\gm~e996.tmp в %APPDATA%\kuai8\pic\17895.gmp
%TEMP%\gm~e590.tmp в %APPDATA%\kuai8\pic\20299.gmp
%TEMP%\gm~e2a2.tmp в %APPDATA%\kuai8\pic\17894.gmp
%TEMP%\gm~e262.tmp в %APPDATA%\kuai8\pic\20298.gmp
%TEMP%\gm~da47.tmp в %APPDATA%\kuai8\pic\20218.gmp
%TEMP%\gm~d881.tmp в %APPDATA%\kuai8\pic\17612.gmp
%TEMP%\gm~c7dc.tmp в %APPDATA%\kuai8\pic\20204.gmp
%TEMP%\gm~c4bf.tmp в %APPDATA%\kuai8\pic\20189.gmp
%TEMP%\gm~c6e2.tmp в %APPDATA%\kuai8\pic\17495.gmp
%TEMP%\gm~c3c4.tmp в %APPDATA%\kuai8\pic\17421.gmp
%TEMP%\gm~c3b3.tmp в %APPDATA%\kuai8\pic\20127.gmp
%TEMP%\gm~c0a6.tmp в %APPDATA%\kuai8\pic\20053.gmp
%TEMP%\gm~bfac.tmp в %APPDATA%\kuai8\pic\17420.gmp
%TEMP%\gm~bb96.tmp в %APPDATA%\kuai8\pic\20052.gmp
%TEMP%\gm~ba8b.tmp в %APPDATA%\kuai8\pic\17404.gmp
%TEMP%\gm~b675.tmp в %APPDATA%\kuai8\pic\20039.gmp
%TEMP%\gm~b357.tmp в %APPDATA%\kuai8\pic\17374.gmp
%TEMP%\gm~b56b.tmp в %APPDATA%\kuai8\pic\20016.gmp
%TEMP%\gm~b451.tmp в %APPDATA%\kuai8\pic\20009.gmp
%TEMP%\gm~b04a.tmp в %APPDATA%\kuai8\pic\20005.gmp
%TEMP%\gm~f6d5.tmp в %APPDATA%\kuai8\pic\20445.gmp
%TEMP%\gm~5b01.tmp в %APPDATA%\kuai8\pic\70640.gmp

Подменяет следующие файлы

%APPDATA%\kuai8\data\plugin\hot.gmx
%APPDATA%\kuai8\data\plugin\top.gmx
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\plugin\scan.gmx
%APPDATA%\kuai8\data\plugin\window.gmx
%APPDATA%\kuai8\pic\20053.gmp
%APPDATA%\kuai8\pic\20445.gmp
%APPDATA%\kuai8\data\search.gms

Сетевая активность

Подключается к

'up####.kuai8.com':80
'gm#.##ai8box.com':80
'st##.kuai8.com':80
'se####e.kuai8.com':80
'ic##.#uai8box.com':80
'd1.###i8game.com':80
'up#.##ai8box.com':80

TCP

Запросы HTTP GET

http://up####.kuai8.com/update_hot.php?da############################################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/20458.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40133.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/60398.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68559.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40149.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68668.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40153.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68897.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68761.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68767.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40154.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68781.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68786.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40155.gmp
http://ic##.#uai8box.com/slider/202012/20201209111230641.gif
http://ic##.#uai8box.com/game_icon/gmp_64/68676.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40071.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20383.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20399.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20360.gmp
http://ic##.#uai8box.com/slider/202104/20210406110004627.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/20445.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20374.gmp
http://ic##.#uai8box.com/slider/202004/20200429112935682.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/40004.gmp
http://ic##.#uai8box.com/slider/202012/20201209111206285.jpg
http://ic##.#uai8box.com/slider/202004/20200429112939980.jpg
http://ic##.#uai8box.com/slider/202103/20210331172811484.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/40015.gmp
http://ic##.#uai8box.com/slider/202103/20210331172821640.jpg
http://ic##.#uai8box.com/slider/201605/20160523162136750.gif
http://ic##.#uai8box.com/game_icon/gmp_64/20397.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40031.gmp
http://ic##.#uai8box.com/slider/202012/20201209111333962.jpg
http://up####.kuai8.com/update_top.php?da############################################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/68901.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68963.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40164.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40178.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/52039.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/52845.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70307.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/67762.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40156.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70574.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68110.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68962.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70631.gmp
http://up####.kuai8.com/update_hot.php?da##########################################################################################
http://up#.##ai8box.com/gmp_64/2018.11.29/17201-17300.gmz
http://ic##.#uai8box.com/game_icon/gmp_64/40163.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20359.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40162.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40159.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40157.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68902.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/51768.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40158.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68905.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68906.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68898.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68960.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68937.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40160.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68956.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68958.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40161.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68959.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/68961.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/55842.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20317.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17421.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/71106.gmp
http://ic##.#uai8box.com/slider/202104/20210422104738204.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/16292.gmp
http://d1.###i8game.com/update/Kuai8_GameManager_v10.2.1.8391_Update.exe
http://ic##.#uai8box.com/game_icon/gmp_64/16388.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/16757.gmp
http://ic##.#uai8box.com/slider/202104/20210422104742815.jpg
http://gm#.##ai8box.com/window/window_9_5.gmx
http://ic##.#uai8box.com/game_icon/gmp_64/16842.gmp
http://ic##.#uai8box.com/slider/202103/20210329132433423.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/16852.gmp
http://ic##.#uai8box.com/slider/202103/20210329132440308.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/16948.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/16950.gmp
http://ic##.#uai8box.com/slider/202104/20210407103635443.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/16766.gmp
http://up####.kuai8.com/update/index.php?da######################################################################################################################################################...
http://se####e.kuai8.com/time.php?da########
http://gm#.##ai8box.com/hot_20/hot_20_117_6.gmx
http://up####.kuai8.com/update_top.php?da##########################################################################################
http://gm#.##ai8box.com/top/top_112_2.gmx
http://up####.kuai8.com/update_database.php?da##########################################################################################
http://gm#.##ai8box.com/database_new/database_203_5.gmx
http://st##.kuai8.com/stat.php?da####################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/70568.gmp
http://gm#.##ai8box.com/scan/scan_12_9.gmx
http://up####.kuai8.com/update_plugin.php?da#####################################################################################################################################################...
http://ic##.#uai8box.com/slider/202104/20210407103631388.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/70729.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70878.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70916.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/71059.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/71086.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/16951.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20299.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/16980.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17404.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20052.gmp
http://up####.kuai8.com/update_icon.php?da##############################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/17420.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20053.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20127.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20189.gmp
http://gm#.##ai8box.com/upicons/upicons_25_4.gmx
http://ic##.#uai8box.com/game_icon/gmp_64/17495.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20204.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17612.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20218.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20298.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17894.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20039.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17895.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17374.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17282.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17104.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17143.gmp
http://up####.kuai8.com/update_icon.php?da############################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/10080.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17157.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/16865.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/16971.gmp
http://ic##.#uai8box.com/slider/202104/20210406110000717.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/17288.gmp
http://up####.kuai8.com/update_icon.php?da################################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/20002.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17004.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20005.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20009.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20016.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70640.gmp

Запросы HTTP POST

http://up####.kuai8.com/update_icon.php?da######################################################################
http://st##.kuai8.com/stat/do_stat.php?da##########################################################################################################

UDP

DNS ASK up####.kuai8.com
DNS ASK gm#.##ai8box.com
DNS ASK st##.kuai8.com
DNS ASK se####e.kuai8.com
DNS ASK ic##.#uai8box.com
DNS ASK d1.###i8game.com
DNS ASK up#.##ai8box.com

Другое

Ищет следующие окна

ClassName: 'GMBubbleWnd' WindowName: ''
ClassName: 'GMKuaiBaWnd' WindowName: 'ВїГ¬В°Г‰Г“ГЋГЏВ·'
ClassName: '' WindowName: 'ВїГ¬В°Г‰FlashГ“ГЋГЏВ·'
ClassName: '' WindowName: 'ВїГ¬В°Г‰ГЌГёГ’ВіГ“ГЋГЏВ·'
ClassName: '' WindowName: 'ВїГ¬В°Г‰Г“ГЋГЏВ·Г¤ВЇГЂГЂГ†Г·'
ClassName: 'Progman' WindowName: 'Program Manager'
ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: 'FolderView'
ClassName: '' WindowName: '快吧Flash游戏'
ClassName: '' WindowName: '快吧游戏浏览器'
ClassName: '' WindowName: '快吧升级提示'
ClassName: '' WindowName: '快吧版本更新'

Создает и запускает на исполнение

'%ProgramFiles(x86)%\kuai8\k8gm.exe' -update_data
'%ProgramFiles(x86)%\kuai8\k8update.exe' -install
'%ProgramFiles(x86)%\kuai8\k8gm.exe' -atonce
'%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe' -query_action
'%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="ВїГ¬В°Г‰Г“ГЋГЏВ·В№ГњГЂГГ†Г·" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="ВїГ¬В°Г‰flashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="ВїГ¬В°Г‰Г“ГЋГЏВ·ГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="ВїГ¬В°Г‰Г”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="ВїГ¬В°Г‰ГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL' (со скрытым окном)
'%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="ВїГ¬В°Г‰Г“ГЋГЏВ·В№ГњГЂГГ†Г·" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="ВїГ¬В°Г‰flashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="ВїГ¬В°Г‰Г“ГЋГЏВ·ГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="ВїГ¬В°Г‰Г”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="ВїГ¬В°Г‰ГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней