Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'K8box' = '"%ProgramFiles(x86)%\Kuai8\K8GM.exe" -background'
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="¿ì°ÉÓÎÏ·¹ÜÀГÆ÷" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="¿ì°ÉflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="¿ì°ÉÓÎÏ·ÏÂÔГƽ̨" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="¿ì°ÉÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="¿ì°ÉÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL
Внедряет код в
следующие системные процессы:
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nszc67a.tmp
- %TEMP%\gm~a8ed.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160644310.gif
- %TEMP%\gm~aae1.tmp
- %TEMP%\gm~b5bc.tmp
- %TEMP%\gm~b7bf.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160609338.gif
- %TEMP%\gm~b9a4.tmp
- %TEMP%\gm~bef3.tmp
- %TEMP%\gm~c8fa.tmp
- %TEMP%\gm~c099.tmp
- %TEMP%\gm~c194.tmp
- %TEMP%\gm~c388.tmp
- %TEMP%\gm~c416.tmp
- %TEMP%\gm~c455.tmp
- %TEMP%\gm~c62a.tmp
- %TEMP%\gm~c80f.tmp
- %TEMP%\gm~a850.tmp
- %TEMP%\gm~bc44.tmp
- %TEMP%\gm~a67b.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822161542558.jpg
- %APPDATA%\kuai8\slider\slider_202208_20220822160046908.jpg
- %TEMP%\gm~8934.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160052785.jpg
- %APPDATA%\kuai8\slider\slider_202302_20230213102158142.jpg
- %APPDATA%\kuai8\tipadr\tipad_202305_20230516171908314.ico
- %TEMP%\gm~8de6.tmp
- %APPDATA%\kuai8\slider\slider_202302_20230213102205217.jpg
- %TEMP%\gm~9353.tmp
- %TEMP%\gm~a428.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822161556848.jpg
- %APPDATA%\kuai8\slider\slider_202106_20210611153330562.jpg
- %APPDATA%\kuai8\slider\slider_202106_20210611153335526.jpg
- %TEMP%\gm~9b11.tmp
- %APPDATA%\kuai8\slider\slider_201605_20160523162136750.gif
- %TEMP%\gm~a07f.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160533595.gif
- %TEMP%\gm~a5de.tmp
- %TEMP%\gm~cade.tmp
- %TEMP%\gm~cbba.tmp
- %TEMP%\gm~cdae.tmp
- %TEMP%\gm~f062.tmp
- %TEMP%\gm~f1ba.tmp
- %TEMP%\gm~f312.tmp
- %TEMP%\gm~f42c.tmp
- %TEMP%\gm~f4f8.tmp
- %TEMP%\gm~f5f2.tmp
- %TEMP%\gm~ee3e.tmp
- %TEMP%\gm~f013.tmp
- %TEMP%\gm~f6ce.tmp
- %TEMP%\gm~fa0c.tmp
- %TEMP%\gm~fa7a.tmp
- %TEMP%\gm~fc01.tmp
- %TEMP%\gm~fd49.tmp
- %TEMP%\gm~fda8.tmp
- %TEMP%\gm~ff10.tmp
- %TEMP%\gm~f7f7.tmp
- %TEMP%\gm~f8b3.tmp
- %TEMP%\gm~edb0.tmp
- %TEMP%\gm~ec68.tmp
- %TEMP%\gm~eb1f.tmp
- %TEMP%\gm~d5cb.tmp
- %TEMP%\gm~d6e4.tmp
- %TEMP%\gm~d86b.tmp
- %TEMP%\gm~da8e.tmp
- %TEMP%\gm~db4b.tmp
- %TEMP%\gm~dd7d.tmp
- %TEMP%\gm~de1a.tmp
- %TEMP%\gm~d1f3.tmp
- %TEMP%\gm~e03d.tmp
- %TEMP%\gm~e30d.tmp
- %TEMP%\gm~e37b.tmp
- %TEMP%\gm~e5ae.tmp
- %TEMP%\gm~e5fd.tmp
- %TEMP%\gm~e87d.tmp
- %TEMP%\gm~e8ad.tmp
- %TEMP%\gm~ea82.tmp
- %TEMP%\gm~e0da.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160023126.jpg
- %TEMP%\gm~ffad.tmp
- %TEMP%\gm~831b.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160016124.jpg
- %ProgramFiles(x86)%\kuai8\tool\k8common.dll
- %ProgramFiles(x86)%\kuai8\tool\k8uirender.dll
- %ProgramFiles(x86)%\kuai8\tool\k8dlutils.dll
- %ProgramFiles(x86)%\kuai8\tool\k8external.exe
- %ProgramFiles(x86)%\kuai8\tool\k8tray.exe
- %ProgramFiles(x86)%\kuai8\tool\k8minipage.exe
- %ProgramFiles(x86)%\kuai8\tool\k8rtlfix.exe
- %ProgramFiles(x86)%\kuai8\tool\k8netdetect.exe
- %APPDATA%\kuai8\data\database.gmx
- %ProgramFiles(x86)%\kuai8\tool\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\kuai8\tool\msvcp80.dll
- %ProgramFiles(x86)%\kuai8\tool\msvcr80.dll
- %ProgramFiles(x86)%\kuai8\tool_x64\k8shell.dll
- %ProgramFiles(x86)%\kuai8\tool_x64\k8shellicon.dll
- %ProgramFiles(x86)%\kuai8\tool\k8shell.dll
- %ProgramFiles(x86)%\kuai8\tool\k8shellicon.dll
- %ProgramFiles(x86)%\kuai8\tool\k8bubble.exe
- %ProgramFiles(x86)%\kuai8\tool\k8pluginfix.exe
- %ProgramFiles(x86)%\kuai8\tool\k8restorewindow.dll
- %ProgramFiles(x86)%\kuai8\k8version.dll
- %TEMP%\nspc68b.tmp\system.dll
- %TEMP%\nspc68b.tmp\k8nsisminiextend.dll
- %ProgramFiles(x86)%\kuai8\k8gm.exe
- %ProgramFiles(x86)%\kuai8\k8flash.exe
- %ProgramFiles(x86)%\kuai8\k8browser.exe
- %ProgramFiles(x86)%\kuai8\k8web.exe
- %ProgramFiles(x86)%\kuai8\k8update.exe
- %ProgramFiles(x86)%\kuai8\k8bugreport.exe
- %ProgramFiles(x86)%\kuai8\msvcr80.dll
- %ProgramFiles(x86)%\kuai8\k8urlencrypt.dll
- %ProgramFiles(x86)%\kuai8\k8common.dll
- %ProgramFiles(x86)%\kuai8\k8dlutils.dll
- %ProgramFiles(x86)%\kuai8\k8dlplatform.exe
- %ProgramFiles(x86)%\kuai8\k8uirender.dll
- %ProgramFiles(x86)%\kuai8\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\kuai8\msvcp80.dll
- %ProgramFiles(x86)%\kuai8\uninstall.exe
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\search.gms
- %TEMP%\gm~73b8.tmp
- %TEMP%\gm~75eb.tmp
- %TEMP%\gm~76e6.tmp
- %APPDATA%\kuai8\config\config.xml
- %APPDATA%\kuai8\cache.xml
- %APPDATA%\kuai8\data\local\user.xml
- %APPDATA%\kuai8\data\search.gms-journal
- %APPDATA%\kuai8\config\config.ini
- %TEMP%\gm~7ace.tmp
- %APPDATA%\kuai8\tipadr\2023721134411_1072.xml
- %APPDATA%\kuai8res\icons\tipad_202305_20230516171919667.ico
- %TEMP%\gm~7d02.tmp
- %TEMP%\gm~7c17.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160728655.jpg
- %TEMP%\gm~79b4.tmp
- %APPDATA%\kuai8\slider\slider_202208_20220822160724169.jpg
- %APPDATA%\kuai8\data\local\recent.xml
- %TEMP%\gmtemp\restart.gmt
- %APPDATA%\microsoft\windows\start menu\programs\¿ì°éóîï·\ð¶ôø¿ì°é.lnk
- %APPDATA%\kuai8\data\plugin\netwl.gmx
- %APPDATA%\kuai8\data\plugin\inwl.gmx
- %APPDATA%\kuai8\data\plugin\pc.gmx
- %APPDATA%\kuai8\data\plugin\search.gmx
- %ProgramFiles(x86)%\kuai8\audio\complete.wav
- %TEMP%\gm~fce4.tmp
- %APPDATA%\kuai8\update.ini
- %APPDATA%\kuai8\data\plugin\window.gmx
- %TEMP%\gm~2bf.tmp
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\快吧游戏.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\¿ì°éóîï·.lnk
- %HOMEPATH%\desktop\¿ì°éóîï·.lnk
- %HOMEPATH%\desktop\¿ì°éò³óî´óìü.lnk
- %APPDATA%\microsoft\windows\start menu\programs\¿ì°éóîï·\¿ì°éóîï·.lnk
- %APPDATA%\microsoft\windows\start menu\programs\¿ì°éóîï·\¿ì°éflash²¥·åæ÷.lnk
- %APPDATA%\microsoft\windows\start menu\programs\¿ì°éóîï·\¿ì°éò³óî´óìü.lnk
- %TEMP%\gm~61a.tmp
- %TEMP%\gm$d.289.982\kuai8box_v10.2.1.8391_update.exe
- %TEMP%\gm~fffc.tmp
Удаляет следующие файлы
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\pic\40156.gmp
- %APPDATA%\kuai8\pic\40149.gmp
- %APPDATA%\kuai8\pic\40133.gmp
- %APPDATA%\kuai8\pic\40071.gmp
- %APPDATA%\kuai8\pic\40031.gmp
- %APPDATA%\kuai8\pic\40015.gmp
- %APPDATA%\kuai8\pic\40004.gmp
- %APPDATA%\kuai8\pic\40001.gmp
- %APPDATA%\kuai8\pic\20445.gmp
- %APPDATA%\kuai8\data\plugin\search.gmx
- %APPDATA%\kuai8\pic\16865.gmp
- %APPDATA%\kuai8\pic\71071.gmp
- %TEMP%\gm$d.289.982\kuai8box_v10.2.1.8391_update.exe
- %APPDATA%\kuai8\pic\20399.gmp
- %APPDATA%\kuai8\pic\20053.gmp
- %APPDATA%\kuai8\pic\20009.gmp
- %APPDATA%\kuai8\data\search.gms
- %APPDATA%\kuai8\data\plugin\window.gmx
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\search.gms-journal
- %TEMP%\nspc68b.tmp\system.dll
- %TEMP%\nspc68b.tmp\k8nsisminiextend.dll
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\pic\40157.gmp
- %APPDATA%\kuai8\pic\40158.gmp
Перемещает следующие файлы
- %TEMP%\gm~73b8.tmp в %APPDATA%\kuai8\pic\70932.gmp
- %TEMP%\gm~ee3e.tmp в %APPDATA%\kuai8\pic\40031.gmp
- %TEMP%\gm~ec68.tmp в %APPDATA%\kuai8\pic\40015.gmp
- %TEMP%\gm~eb1f.tmp в %APPDATA%\kuai8\pic\00171.gmp
- %TEMP%\gm~ea82.tmp в %APPDATA%\kuai8\pic\40004.gmp
- %TEMP%\gm~e87d.tmp в %APPDATA%\kuai8\pic\00164.gmp
- %TEMP%\gm~e8ad.tmp в %APPDATA%\kuai8\pic\40001.gmp
- %TEMP%\gm~edb0.tmp в %APPDATA%\kuai8\pic\00406.gmp
- %TEMP%\gm~e5fd.tmp в %APPDATA%\kuai8\pic\20445.gmp
- %TEMP%\gm~e37b.tmp в %APPDATA%\kuai8\pic\20399.gmp
- %TEMP%\gm~e30d.tmp в %APPDATA%\kuai8\pic\00131.gmp
- %TEMP%\gm~e0da.tmp в %APPDATA%\kuai8\pic\20053.gmp
- %TEMP%\gm~e03d.tmp в %APPDATA%\kuai8\pic\00126.gmp
- %TEMP%\gm~de1a.tmp в %APPDATA%\kuai8\pic\17895.gmp
- %TEMP%\gm~dd7d.tmp в %APPDATA%\kuai8\pic\00124.gmp
- %TEMP%\gm~e5ae.tmp в %APPDATA%\kuai8\pic\00149.gmp
- %TEMP%\gm~f013.tmp в %APPDATA%\kuai8\pic\40071.gmp
- %TEMP%\gm~f062.tmp в %APPDATA%\kuai8\pic\00046.gmp
- %TEMP%\gm~f1ba.tmp в %APPDATA%\kuai8\pic\40133.gmp
- %TEMP%\gm~ffad.tmp в %APPDATA%\kuai8\pic\40158.gmp
- %TEMP%\gm~ff10.tmp в %APPDATA%\kuai8\pic\71111.gmp
- %TEMP%\gm~fd49.tmp в %APPDATA%\kuai8\pic\71071.gmp
- %TEMP%\gm~fda8.tmp в %APPDATA%\kuai8\pic\40157.gmp
- %TEMP%\gm~fc01.tmp в %APPDATA%\kuai8\pic\40156.gmp
- %TEMP%\gm~fa7a.tmp в %APPDATA%\kuai8\pic\20009.gmp
- %TEMP%\gm~fa0c.tmp в %APPDATA%\kuai8\pic\40155.gmp
- %TEMP%\gm~f8b3.tmp в %APPDATA%\kuai8\pic\20005.gmp
- %TEMP%\gm~c416.tmp в %APPDATA%\kuai8\data\database.gmx
- %TEMP%\gm~f7f7.tmp в %APPDATA%\kuai8\pic\40154.gmp
- %TEMP%\gm~f6ce.tmp в %APPDATA%\kuai8\pic\20002.gmp
- %TEMP%\gm~f5f2.tmp в %APPDATA%\kuai8\pic\40153.gmp
- %TEMP%\gm~f4f8.tmp в %APPDATA%\kuai8\pic\16410.gmp
- %TEMP%\gm~f42c.tmp в %APPDATA%\kuai8\pic\40149.gmp
- %TEMP%\gm~f312.tmp в %APPDATA%\kuai8\pic\01160.gmp
- %TEMP%\gm~db4b.tmp в %APPDATA%\kuai8\pic\17894.gmp
- %TEMP%\gm~fffc.tmp в %APPDATA%\kuai8\pic\71115.gmp
- %TEMP%\gm~da8e.tmp в %APPDATA%\kuai8\pic\00120.gmp
- %TEMP%\gm~d6e4.tmp в %APPDATA%\kuai8\pic\00119.gmp
- %TEMP%\gm~a8ed.tmp в %APPDATA%\kuai8\data\plugin\icon.gmx
- %TEMP%\gm~a67b.tmp в %APPDATA%\kuai8\pic\00021.gmp
- %TEMP%\gm~a428.tmp в %APPDATA%\kuai8\pic\00020.gmp
- %TEMP%\gm~a07f.tmp в %APPDATA%\kuai8\pic\00012.gmp
- %TEMP%\gm~9b11.tmp в %APPDATA%\kuai8\pic\00007.gmp
- %TEMP%\gm~9353.tmp в %APPDATA%\kuai8\pic\71239.gmp
- %TEMP%\gm~a850.tmp в %APPDATA%\kuai8\pic\00032.gmp
- %TEMP%\gm~8de6.tmp в %APPDATA%\kuai8\pic\71238.gmp
- %TEMP%\gm~831b.tmp в %APPDATA%\kuai8\pic\71233.gmp
- %TEMP%\gm~7c17.tmp в %APPDATA%\kuai8\pic\71229.gmp
- %TEMP%\gm~7ace.tmp в %APPDATA%\kuai8\pic\71220.gmp
- %TEMP%\gm~79b4.tmp в %APPDATA%\kuai8\pic\71185.gmp
- %TEMP%\gm~76e6.tmp в %APPDATA%\kuai8\pic\71182.gmp
- %TEMP%\gm~75eb.tmp в %APPDATA%\kuai8\pic\71181.gmp
- %TEMP%\gm~8934.tmp в %APPDATA%\kuai8\pic\71237.gmp
- %TEMP%\gm~aae1.tmp в %APPDATA%\kuai8\pic\00035.gmp
- %TEMP%\gm~b5bc.tmp в %APPDATA%\kuai8\pic\10876.gmp
- %TEMP%\gm~b7bf.tmp в %APPDATA%\kuai8\pic\00068.gmp
- %TEMP%\gm~d5cb.tmp в %APPDATA%\kuai8\pic\17592.gmp
- %TEMP%\gm~cdae.tmp в %APPDATA%\kuai8\pic\00115.gmp
- %TEMP%\gm~d1f3.tmp в %APPDATA%\kuai8\pic\17495.gmp
- %TEMP%\gm~cbba.tmp в %APPDATA%\kuai8\pic\17421.gmp
- %TEMP%\gm~cade.tmp в %APPDATA%\kuai8\pic\00107.gmp
- %TEMP%\gm~c8fa.tmp в %APPDATA%\kuai8\pic\17420.gmp
- %TEMP%\gm~c80f.tmp в %APPDATA%\kuai8\pic\00102.gmp
- %TEMP%\gm~c62a.tmp в %APPDATA%\kuai8\pic\17404.gmp
- %TEMP%\gm~c455.tmp в %APPDATA%\kuai8\pic\00087.gmp
- %TEMP%\gm~c388.tmp в %APPDATA%\kuai8\pic\17374.gmp
- %TEMP%\gm~c099.tmp в %APPDATA%\kuai8\pic\00082.gmp
- %TEMP%\gm~c194.tmp в %APPDATA%\kuai8\pic\17004.gmp
- %TEMP%\gm~bef3.tmp в %APPDATA%\kuai8\pic\16951.gmp
- %TEMP%\gm~bc44.tmp в %APPDATA%\kuai8\pic\00069.gmp
- %TEMP%\gm~b9a4.tmp в %APPDATA%\kuai8\pic\16865.gmp
- %TEMP%\gm~d86b.tmp в %APPDATA%\kuai8\pic\17612.gmp
- %TEMP%\gm~d5cb.tmp в %APPDATA%\kuai8\pic\20019.gmp
Подменяет следующие файлы
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\data\search.gms-journal
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\plugin\window.gmx
- %APPDATA%\kuai8\data\search.gms
Сетевая активность
Подключается к
- 'up####.kuai8.com':80
- 'gm#.##ai8box.com':80
- 'st##.kuai8.com':80
- 'se####e.kuai8.com':80
- 'ic##.#uai8box.com':80
- 'd1.###i8game.com':80
TCP
Запросы HTTP GET
- http://up####.kuai8.com/update_hot.php?da########################################################################################
- http://ic##.#uai8box.com/game_icon/gmp_64/00131.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20053.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00126.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17895.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00124.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17894.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00120.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17612.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00119.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17592.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00149.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20399.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17421.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00107.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17420.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00102.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17404.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00087.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17374.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17004.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00082.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16951.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/17495.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71237.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20445.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40158.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71111.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40157.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71071.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40156.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20009.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40155.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20005.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40154.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/20002.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40153.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16410.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40149.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/01160.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40133.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00046.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40071.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40031.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00406.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40015.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00171.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40004.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/40001.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00069.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00115.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/16865.gmp
- http://ic##.#uai8box.com/slider/202208/20220822160609338.gif
- http://ic##.#uai8box.com/game_icon/gmp_64/00068.gmp
- http://ic##.#uai8box.com/slider/202208/20220822160724169.jpg
- http://d1.###i8game.com/update/Kuai8_GameManager_v10.2.1.8391_Update.exe
- http://ic##.#uai8box.com/slider/202208/20220822160016124.jpg
- http://ic##.#uai8box.com/slider/202208/20220822160728655.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71229.gmp
- http://up####.kuai8.com/update/index.php?da######################################################################################################################################################...
- http://gm#.##ai8box.com/scan/scan_12_9.gmx
- http://ic##.#uai8box.com/tipad/202305/20230516171919667.ico
- http://st##.kuai8.com/online_stat.php?da#########################################################################################################################################################...
- http://ic##.#uai8box.com/game_icon/gmp_64/71220.gmp
- http://up####.kuai8.com/update_plugin.php?da#####################################################################################################################################################...
- http://ic##.#uai8box.com/game_icon/gmp_64/71185.gmp
- http://ic##.#uai8box.com/slider/202208/20220822160023126.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71182.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/71181.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/70932.gmp
- http://up####.kuai8.com/bubble_action.php?da#####################################################################################################################################################...
- http://st##.kuai8.com/stat.php?da####################################################################
- http://gm#.##ai8box.com/database_new/database_208_3.gmx
- http://up####.kuai8.com/update_database.php?da########################################################################################
- http://gm#.##ai8box.com/top/top_115_2.gmx
- http://up####.kuai8.com/update_top.php?da########################################################################################
- http://gm#.##ai8box.com/hot_20/hot_20_117_8.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/71115.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00164.gmp
- http://ic##.#uai8box.com/slider/202208/20220822160046908.jpg
- http://ic##.#uai8box.com/slider/202302/20230213102158142.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71233.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/10876.gmp
- http://ic##.#uai8box.com/slider/202208/20220822160644310.gif
- http://ic##.#uai8box.com/game_icon/gmp_64/00035.gmp
- http://gm#.##ai8box.com/upicons/upicons_25_5.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/00032.gmp
- http://ic##.#uai8box.com/game_icon/gmp_64/00021.gmp
- http://gm#.##ai8box.com/window/window_9_5.gmx
- http://ic##.#uai8box.com/game_icon/gmp_64/00020.gmp
- http://up####.kuai8.com/update_icon.php?da############################################################################
- http://ic##.#uai8box.com/slider/202208/20220822160533595.gif
- http://ic##.#uai8box.com/game_icon/gmp_64/00012.gmp
- http://ic##.#uai8box.com/slider/201605/20160523162136750.gif
- http://ic##.#uai8box.com/game_icon/gmp_64/00007.gmp
- http://ic##.#uai8box.com/slider/202106/20210611153335526.jpg
- http://ic##.#uai8box.com/slider/202106/20210611153330562.jpg
- http://up####.kuai8.com/update_icon.php?da##########################################################################
- http://ic##.#uai8box.com/slider/202208/20220822161556848.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71239.gmp
- http://ic##.#uai8box.com/slider/202208/20220822161542558.jpg
- http://ic##.#uai8box.com/slider/202302/20230213102205217.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71238.gmp
- http://ic##.#uai8box.com/tipad/202305/20230516171908314.ico
- http://ic##.#uai8box.com/slider/202208/20220822160052785.jpg
- http://ic##.#uai8box.com/game_icon/gmp_64/71132.gmp
Запросы HTTP POST
- http://up####.kuai8.com/update_icon.php?da####################################################################
- http://st##.kuai8.com/stat/do_stat.php?da##########################################################################################################
UDP
- DNS ASK up####.kuai8.com
- DNS ASK gm#.##ai8box.com
- DNS ASK st##.kuai8.com
- DNS ASK se####e.kuai8.com
- DNS ASK ic##.#uai8box.com
- DNS ASK d1.###i8game.com
Другое
Ищет следующие окна
- ClassName: 'GMBubbleWnd' WindowName: ''
- ClassName: 'GMKuaiBaWnd' WindowName: '¿ì°ÉÓÎÏ·'
- ClassName: '' WindowName: '¿ì°ÉFlashÓÎÏ·'
- ClassName: '' WindowName: '¿ì°ÉÍøÒ³ÓÎÏ·'
- ClassName: '' WindowName: '¿ì°ÉÓÎÏ·ä¯ÀÀÆ÷'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'GMKuaiBaWnd' WindowName: '快吧游戏'
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\kuai8\k8gm.exe' -update_data
- '%ProgramFiles(x86)%\kuai8\k8update.exe' -install
- '%ProgramFiles(x86)%\kuai8\k8gm.exe' -show=3 -atonce
- '%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe' -query_action
- '%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1
- '%ProgramFiles(x86)%\kuai8\tool\k8tray.exe' -advert_type=2 -advert_file="%APPDATA%\Kuai8\tipadr\2023721134411_1072.xml"
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="¿ì°ÉÓÎÏ·¹ÜÀГÆ÷" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="¿ì°ÉflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="¿ì°ÉÓÎÏ·ÏÂÔГƽ̨" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="¿ì°ÉÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="¿ì°ÉÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL' (со скрытым окном)
- '%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="¿ì°ÉÓÎÏ·¹ÜÀГÆ÷" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="¿ì°ÉflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="¿ì°ÉÓÎÏ·ÏÂÔГƽ̨" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="¿ì°ÉÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="¿ì°ÉÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8Shell.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8Shell.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8ShellIcon.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8ShellIcon.dll"
