Trojan.Siggen12.30997

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'K8box' = '"%ProgramFiles(x86)%\Kuai8\K8GM.exe" -background'

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Modifies file system

Creates the following files

%TEMP%\nsb5bd6.tmp
%TEMP%\gm~4ed7.tmp
%TEMP%\gm~504e.tmp
%TEMP%\gm~52bf.tmp
%TEMP%\gm~5437.tmp
%TEMP%\gm~55dd.tmp
%TEMP%\gm~5764.tmp
%TEMP%\gm~590a.tmp
%TEMP%\gm~5b6c.tmp
%TEMP%\gm~5ddd.tmp
%TEMP%\gm~5f73.tmp
%TEMP%\gm~6119.tmp
%TEMP%\gm~4727.tmp
%TEMP%\gm~495a.tmp
%TEMP%\gm~6291.tmp
%TEMP%\gm~6a8f.tmp
%TEMP%\gm~6c07.tmp
%TEMP%\gm~6dad.tmp
%TEMP%\gm~6fef.tmp
%TEMP%\gm~7195.tmp
%TEMP%\gm~73d8.tmp
%TEMP%\gm~758d.tmp
%TEMP%\gm~77d0.tmp
%TEMP%\gm~7a60.tmp
%TEMP%\gm~7be7.tmp
%TEMP%\gm~7d8d.tmp
%TEMP%\gm~6502.tmp
%TEMP%\gm~6744.tmp
%TEMP%\gm~4581.tmp
%TEMP%\gm~433f.tmp
%TEMP%\gm~40be.tmp
%TEMP%\gm~13ea.tmp
%TEMP%\gm~1590.tmp
%TEMP%\gm~1717.tmp
%TEMP%\gm~1998.tmp
%TEMP%\gm~1bda.tmp
%TEMP%\gm~1cb5.tmp
%TEMP%\gm~1e2d.tmp
%TEMP%\gm~2178.tmp
%TEMP%\gm~2244.tmp
%TEMP%\gm~231f.tmp
%TEMP%\gm~23eb.tmp
%TEMP%\gm~24c7.tmp
%TEMP%\gm~1263.tmp
%TEMP%\gm~2583.tmp
%TEMP%\gm~2891.tmp
%TEMP%\gm~2b11.tmp
%TEMP%\gm~2d54.tmp
%TEMP%\gm~2f19.tmp
%TEMP%\gm~30a0.tmp
%TEMP%\gm~3237.tmp
%TEMP%\gm~33cd.tmp
%TEMP%\gm~3573.tmp
%TEMP%\gm~37b6.tmp
%TEMP%\gm~3b4f.tmp
%TEMP%\gm~3cd6.tmp
%TEMP%\gm~3f47.tmp
%TEMP%\gm~265e.tmp
%TEMP%\gm~7fc0.tmp
%TEMP%\gm~8156.tmp
%TEMP%\gm~8398.tmp
%TEMP%\gm~852f.tmp
%TEMP%\gm~c03c.tmp
%TEMP%\gm~c1b4.tmp
%TEMP%\gm~c473.tmp
%TEMP%\gm~c52f.tmp
%TEMP%\gm~c6c6.tmp
%TEMP%\gm~c791.tmp
%TEMP%\gm~c928.tmp
%TEMP%\gm~caaf.tmp
%TEMP%\gm~cf04.tmp
%TEMP%\gm~d07b.tmp
%TEMP%\gm~d221.tmp
%TEMP%\gm~d2dd.tmp
%TEMP%\gm~d484.tmp
%TEMP%\gm~d54f.tmp
%TEMP%\gm~d715.tmp
%TEMP%\gm~d89c.tmp
%TEMP%\gm~d968.tmp
%TEMP%\gm~da33.tmp
%TEMP%\gm~dbca.tmp
%TEMP%\gm~dc96.tmp
%TEMP%\gm~dd71.tmp
%TEMP%\gm~dee9.tmp
%TEMP%\gm~e07f.tmp
%TEMP%\gm~e13b.tmp
%TEMP%\gm~e2d2.tmp
%TEMP%\gm~e449.tmp
%TEMP%\gm~e525.tmp
%TEMP%\gm~bdcb.tmp
%TEMP%\gm~bb79.tmp
%TEMP%\gm~bd0f.tmp
%TEMP%\gm~ba01.tmp
%TEMP%\gm~86a6.tmp
%TEMP%\gm~8908.tmp
%TEMP%\gm~8b3a.tmp
%TEMP%\gm~8ce1.tmp
%TEMP%\gm~8f23.tmp
%TEMP%\gm~9194.tmp
%TEMP%\gm~93d6.tmp
%TEMP%\gm~9637.tmp
%TEMP%\gm~986a.tmp
%TEMP%\gm~9adb.tmp
%TEMP%\gm~9d0e.tmp
%TEMP%\gm~9ea4.tmp
%TEMP%\gm~a01c.tmp
%TEMP%\gm~a27d.tmp
%TEMP%\gm~a404.tmp
%TEMP%\gm~a666.tmp
%TEMP%\gm~a7dd.tmp
%TEMP%\gm~aa6d.tmp
%TEMP%\gm~ac04.tmp
%TEMP%\gm~ad9a.tmp
%TEMP%\gm~af12.tmp
%TEMP%\gm~b0b8.tmp
%TEMP%\gm~b22f.tmp
%TEMP%\gm~b491.tmp
%TEMP%\gm~b608.tmp
%TEMP%\gm~b79f.tmp
%TEMP%\gm~b86b.tmp
%TEMP%\gm~e5f1.tmp
%TEMP%\gm~ff2.tmp
%TEMP%\gm~db0.tmp
%TEMP%\gm~b2f.tmp
%ProgramFiles(x86)%\kuai8\tool\msvcp80.dll
%ProgramFiles(x86)%\kuai8\tool\msvcr80.dll
%ProgramFiles(x86)%\kuai8\tool_x64\k8shell.dll
%ProgramFiles(x86)%\kuai8\tool_x64\k8shellicon.dll
%ProgramFiles(x86)%\kuai8\tool\k8shell.dll
%ProgramFiles(x86)%\kuai8\tool\k8shellicon.dll
%APPDATA%\kuai8\data\database.gmx
%APPDATA%\kuai8\data\plugin\top.gmx
%APPDATA%\kuai8\data\plugin\scan.gmx
%APPDATA%\kuai8\data\plugin\window.gmx
%APPDATA%\kuai8\data\plugin\netwl.gmx
%ProgramFiles(x86)%\kuai8\tool\k8netdetect.exe
%ProgramFiles(x86)%\kuai8\tool\microsoft.vc80.crt.manifest
%APPDATA%\kuai8\data\plugin\inwl.gmx
%ProgramFiles(x86)%\kuai8\audio\complete.wav
%TEMP%\gm~7686.tmp
%APPDATA%\kuai8\update.ini
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\快吧游戏.lnk
%APPDATA%\microsoft\internet explorer\quick launch\快吧游戏.lnk
%HOMEPATH%\desktop\快吧游戏.lnk
%HOMEPATH%\desktop\快吧页游大厅.lnk
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\快吧游戏.lnk
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\快吧页游大厅.lnk
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\卸载快吧.lnk
%APPDATA%\kuai8\location.ini
%APPDATA%\kuai8\data\plugin\pc.gmx
%APPDATA%\kuai8\data\plugin\search.gmx
%ProgramFiles(x86)%\kuai8\tool\k8pluginfix.exe
%ProgramFiles(x86)%\kuai8\tool\k8rtlfix.exe
%ProgramFiles(x86)%\kuai8\tool\k8minipage.exe
%TEMP%\nsr5be7.tmp\k8nsisminiextend.dll
%ProgramFiles(x86)%\kuai8\k8gm.exe
%ProgramFiles(x86)%\kuai8\k8browser.exe
%ProgramFiles(x86)%\kuai8\k8web.exe
%ProgramFiles(x86)%\kuai8\k8update.exe
%ProgramFiles(x86)%\kuai8\k8version.dll
%ProgramFiles(x86)%\kuai8\k8bugreport.exe
%ProgramFiles(x86)%\kuai8\k8urlencrypt.dll
%ProgramFiles(x86)%\kuai8\k8common.dll
%ProgramFiles(x86)%\kuai8\k8dlutils.dll
%ProgramFiles(x86)%\kuai8\k8dlplatform.exe
%ProgramFiles(x86)%\kuai8\k8uirender.dll
%TEMP%\nsr5be7.tmp\system.dll
%ProgramFiles(x86)%\kuai8\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\kuai8\msvcr80.dll
%ProgramFiles(x86)%\kuai8\uninstall.exe
%ProgramFiles(x86)%\kuai8\k8gameshell32.dll
%ProgramFiles(x86)%\kuai8\k8gameshell64.dll
%ProgramFiles(x86)%\kuai8\tool\k8restorewindow.dll
%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe
%ProgramFiles(x86)%\kuai8\tool\k8common.dll
%ProgramFiles(x86)%\kuai8\tool\k8uirender.dll
%ProgramFiles(x86)%\kuai8\tool\k8dlutils.dll
%ProgramFiles(x86)%\kuai8\tool\k8external.exe
%ProgramFiles(x86)%\kuai8\tool\k8tray.exe
%ProgramFiles(x86)%\kuai8\tool\k8taskbar.exe
%ProgramFiles(x86)%\kuai8\msvcp80.dll
%TEMP%\gmtemp\restart.gmt
%APPDATA%\kuai8\data\local\recent.xml
%APPDATA%\kuai8\data\local\user.xml
%APPDATA%\kuai8\data\search.gms-journal
%TEMP%\gmicon\71016.gmp
%TEMP%\gmicon\71017.gmp
%TEMP%\gmicon\71018.gmp
%TEMP%\gmicon\71019.gmp
%TEMP%\gmicon\71020.gmp
%TEMP%\gmicon\71021.gmp
%TEMP%\gmicon\71022.gmp
%TEMP%\gmicon\71023.gmp
%TEMP%\gmicon\71024.gmp
%TEMP%\gmicon\71025.gmp
%TEMP%\gmicon\71026.gmp
%TEMP%\gm~eb22.tmp
%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\yxh.kuai8box[1].xml
%TEMP%\gm~edc2.tmp
%TEMP%\gm~f062.tmp
%TEMP%\gm~f449.tmp
%TEMP%\gm~f708.tmp
%TEMP%\gm~f95a.tmp
%TEMP%\gm~fbbb.tmp
%TEMP%\gm~fd42.tmp
%TEMP%\gm~fed9.tmp
%TEMP%\gm~50.tmp
%TEMP%\gm~1e7.tmp
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021031020210311\index.dat
%TEMP%\gm~35e.tmp
%TEMP%\gm~5c0.tmp
%TEMP%\gm~802.tmp
%TEMP%\gmicon\71015.gmp
%TEMP%\gmicon\71013.gmp
%TEMP%\gmicon\71014.gmp
%TEMP%\gmicon\71012.gmp
%APPDATA%\kuai8\data\search.gms
%APPDATA%\kuai8\config\config.xml
%APPDATA%\kuai8\cache.xml
%APPDATA%\kuai8\config\config.ini
%APPDATA%\kuai8\tipadr\2021310163451_1268.xml
%TEMP%\gm~b47f.tmp
%APPDATA%\kuai8\floatadr\tipad_202007_20200706104831141.png
%TEMP%\gmicon\20082.gmp
%TEMP%\gm~c61e.tmp
%TEMP%\gm~c8be.tmp
%TEMP%\gmicon\20323.gmp
%TEMP%\gmicon\20399.gmp
%TEMP%\gm~d280.tmp
%TEMP%\gm~d4f1.tmp
%TEMP%\gm~d687.tmp
%TEMP%\gmicon\40008.gmp
%TEMP%\gm~d8d9.tmp
%TEMP%\gmicon\71002.gmp
%TEMP%\gmicon\71003.gmp
%TEMP%\gmicon\71004.gmp
%TEMP%\gmicon\71005.gmp
%TEMP%\gmicon\71006.gmp
%TEMP%\gmicon\71007.gmp
%TEMP%\gmicon\71008.gmp
%TEMP%\gmicon\71009.gmp
%TEMP%\gmicon\71010.gmp
%TEMP%\gmicon\71011.gmp
%TEMP%\gm~9a8.tmp
%TEMP%\gm~e787.tmp

Deletes the following files

%APPDATA%\kuai8\data\plugin\top.gmx
%TEMP%\nsr5be7.tmp\k8nsisminiextend.dll
%TEMP%\nsr5be7.tmp\system.dll
%APPDATA%\kuai8\update.ini
%APPDATA%\kuai8\data\search.gms-journal
%TEMP%\gm~b47f.tmp
%TEMP%\gm~c61e.tmp
%TEMP%\gm~c8be.tmp
%TEMP%\gm~d280.tmp
%TEMP%\gm~d4f1.tmp
%TEMP%\gm~d687.tmp
%TEMP%\gm~d8d9.tmp

Moves the following files

from %TEMP%\gmicon\20082.gmp to %APPDATA%\kuai8\pic\20082.gmp
from %TEMP%\gm~852f.tmp to %APPDATA%\kuai8\pic\20032.gmp
from %TEMP%\gm~86a6.tmp to %APPDATA%\kuai8\pic\20033.gmp
from %TEMP%\gm~8908.tmp to %APPDATA%\kuai8\pic\20034.gmp
from %TEMP%\gm~8b3a.tmp to %APPDATA%\kuai8\pic\20035.gmp
from %TEMP%\gm~8ce1.tmp to %APPDATA%\kuai8\pic\20036.gmp
from %TEMP%\gm~8f23.tmp to %APPDATA%\kuai8\pic\20038.gmp
from %TEMP%\gm~9194.tmp to %APPDATA%\kuai8\pic\20039.gmp
from %TEMP%\gm~93d6.tmp to %APPDATA%\kuai8\pic\20042.gmp
from %TEMP%\gm~9637.tmp to %APPDATA%\kuai8\pic\20043.gmp
from %TEMP%\gm~986a.tmp to %APPDATA%\kuai8\pic\20044.gmp
from %TEMP%\gm~9adb.tmp to %APPDATA%\kuai8\pic\20046.gmp
from %TEMP%\gm~9d0e.tmp to %APPDATA%\kuai8\pic\20048.gmp
from %TEMP%\gm~9ea4.tmp to %APPDATA%\kuai8\pic\20049.gmp
from %TEMP%\gm~a01c.tmp to %APPDATA%\kuai8\pic\20051.gmp
from %TEMP%\gm~a27d.tmp to %APPDATA%\kuai8\pic\20052.gmp
from %TEMP%\gm~a404.tmp to %APPDATA%\kuai8\pic\20053.gmp
from %TEMP%\gm~a666.tmp to %APPDATA%\kuai8\pic\20055.gmp
from %TEMP%\gm~8398.tmp to %APPDATA%\kuai8\pic\20031.gmp
from %TEMP%\gm~a7dd.tmp to %APPDATA%\kuai8\pic\20056.gmp
from %TEMP%\gm~8156.tmp to %APPDATA%\kuai8\pic\20030.gmp
from %TEMP%\gm~7d8d.tmp to %APPDATA%\kuai8\pic\20026.gmp
from %TEMP%\gm~5b6c.tmp to %APPDATA%\kuai8\pic\20002.gmp
from %TEMP%\gm~5ddd.tmp to %APPDATA%\kuai8\pic\20004.gmp
from %TEMP%\gm~5f73.tmp to %APPDATA%\kuai8\pic\20005.gmp
from %TEMP%\gm~6119.tmp to %APPDATA%\kuai8\pic\20006.gmp
from %TEMP%\gm~6291.tmp to %APPDATA%\kuai8\pic\20007.gmp
from %TEMP%\gm~6502.tmp to %APPDATA%\kuai8\pic\20009.gmp
from %TEMP%\gm~6744.tmp to %APPDATA%\kuai8\pic\20010.gmp
from %TEMP%\gm~6a8f.tmp to %APPDATA%\kuai8\pic\20013.gmp
from %TEMP%\gm~6c07.tmp to %APPDATA%\kuai8\pic\20016.gmp
from %TEMP%\gm~6dad.tmp to %APPDATA%\kuai8\pic\20017.gmp
from %TEMP%\gm~6fef.tmp to %APPDATA%\kuai8\pic\20018.gmp
from %TEMP%\gm~7195.tmp to %APPDATA%\kuai8\pic\20019.gmp
from %TEMP%\gm~73d8.tmp to %APPDATA%\kuai8\pic\20020.gmp
from %TEMP%\gm~758d.tmp to %APPDATA%\kuai8\pic\20021.gmp
from %TEMP%\gm~77d0.tmp to %APPDATA%\kuai8\pic\20022.gmp
from %TEMP%\gm~7a60.tmp to %APPDATA%\kuai8\pic\20023.gmp
from %TEMP%\gm~7be7.tmp to %APPDATA%\kuai8\pic\20025.gmp
from %TEMP%\gm~7fc0.tmp to %APPDATA%\kuai8\pic\20027.gmp
from %TEMP%\gm~aa6d.tmp to %APPDATA%\kuai8\pic\20058.gmp
from %TEMP%\gm~ac04.tmp to %APPDATA%\kuai8\pic\20060.gmp
from %TEMP%\gm~ad9a.tmp to %APPDATA%\kuai8\pic\20061.gmp
from %TEMP%\gm~d484.tmp to %APPDATA%\kuai8\pic\40007.gmp
from %TEMP%\gm~d54f.tmp to %APPDATA%\kuai8\pic\40010.gmp
from %TEMP%\gm~d715.tmp to %APPDATA%\kuai8\pic\40011.gmp
from %TEMP%\gm~d89c.tmp to %APPDATA%\kuai8\pic\40012.gmp
from %TEMP%\gm~d968.tmp to %APPDATA%\kuai8\pic\40013.gmp
from %TEMP%\gm~da33.tmp to %APPDATA%\kuai8\pic\40014.gmp
from %TEMP%\gm~dbca.tmp to %APPDATA%\kuai8\pic\40015.gmp
from %TEMP%\gm~e787.tmp to %APPDATA%\kuai8\pic\40037.gmp
from %TEMP%\gm~dc96.tmp to %APPDATA%\kuai8\pic\40016.gmp
from %TEMP%\gm~dee9.tmp to %APPDATA%\kuai8\pic\40030.gmp
from %TEMP%\gm~e07f.tmp to %APPDATA%\kuai8\pic\40031.gmp
from %TEMP%\gm~e13b.tmp to %APPDATA%\kuai8\pic\40032.gmp
from %TEMP%\gm~e2d2.tmp to %APPDATA%\kuai8\pic\40033.gmp
from %TEMP%\gm~e449.tmp to %APPDATA%\kuai8\pic\40034.gmp
from %TEMP%\gm~e525.tmp to %APPDATA%\kuai8\pic\40035.gmp
from %TEMP%\gm~e5f1.tmp to %APPDATA%\kuai8\pic\40036.gmp
from %TEMP%\gm~d221.tmp to %APPDATA%\kuai8\pic\40005.gmp
from %TEMP%\gm~d2dd.tmp to %APPDATA%\kuai8\pic\40006.gmp
from %TEMP%\gm~d07b.tmp to %APPDATA%\kuai8\pic\40003.gmp
from %TEMP%\gm~cf04.tmp to %APPDATA%\kuai8\pic\40002.gmp
from %TEMP%\gm~caaf.tmp to %APPDATA%\kuai8\pic\20396.gmp
from %TEMP%\gm~b0b8.tmp to %APPDATA%\kuai8\pic\20063.gmp
from %TEMP%\gm~b22f.tmp to %APPDATA%\kuai8\pic\20071.gmp
from %TEMP%\gm~b491.tmp to %APPDATA%\kuai8\pic\20077.gmp
from %TEMP%\gm~b608.tmp to %APPDATA%\kuai8\pic\20098.gmp
from %TEMP%\gm~b79f.tmp to %APPDATA%\kuai8\pic\20310.gmp
from %TEMP%\gm~b86b.tmp to %APPDATA%\kuai8\pic\20315.gmp
from %TEMP%\gm~ba01.tmp to %APPDATA%\kuai8\pic\20317.gmp
from %TEMP%\gm~590a.tmp to %APPDATA%\kuai8\pic\20001.gmp
from %TEMP%\gm~bd0f.tmp to %APPDATA%\kuai8\pic\20358.gmp
from %TEMP%\gm~bb79.tmp to %APPDATA%\kuai8\pic\20345.gmp
from %TEMP%\gm~c03c.tmp to %APPDATA%\kuai8\pic\20360.gmp
from %TEMP%\gm~c1b4.tmp to %APPDATA%\kuai8\pic\20365.gmp
from %TEMP%\gm~c473.tmp to %APPDATA%\kuai8\pic\20371.gmp
from %TEMP%\gm~c52f.tmp to %APPDATA%\kuai8\pic\20372.gmp
from %TEMP%\gm~c6c6.tmp to %APPDATA%\kuai8\pic\20374.gmp
from %TEMP%\gm~c791.tmp to %APPDATA%\kuai8\pic\20375.gmp
from %TEMP%\gm~c928.tmp to %APPDATA%\kuai8\pic\20383.gmp
from %TEMP%\gm~af12.tmp to %APPDATA%\kuai8\pic\20062.gmp
from %TEMP%\gm~bdcb.tmp to %APPDATA%\kuai8\pic\20359.gmp
from %TEMP%\gm~dd71.tmp to %APPDATA%\kuai8\pic\40017.gmp
from %TEMP%\gm~5764.tmp to %APPDATA%\kuai8\pic\70992.gmp
from %TEMP%\gm~40be.tmp to %APPDATA%\kuai8\pic\70827.gmp
from %TEMP%\gmicon\71020.gmp to %APPDATA%\kuai8\pic\71020.gmp
from %TEMP%\gmicon\71021.gmp to %APPDATA%\kuai8\pic\71021.gmp
from %TEMP%\gmicon\71022.gmp to %APPDATA%\kuai8\pic\71022.gmp
from %TEMP%\gmicon\71023.gmp to %APPDATA%\kuai8\pic\71023.gmp
from %TEMP%\gmicon\71024.gmp to %APPDATA%\kuai8\pic\71024.gmp
from %TEMP%\gmicon\71025.gmp to %APPDATA%\kuai8\pic\71025.gmp
from %TEMP%\gmicon\71026.gmp to %APPDATA%\kuai8\pic\71026.gmp
from %TEMP%\gm~eb22.tmp to %APPDATA%\kuai8\pic\17811.gmp
from %TEMP%\gm~edc2.tmp to %APPDATA%\kuai8\pic\17812.gmp
from %TEMP%\gm~f062.tmp to %APPDATA%\kuai8\pic\17813.gmp
from %TEMP%\gm~f449.tmp to %APPDATA%\kuai8\pic\17814.gmp
from %TEMP%\gm~f708.tmp to %APPDATA%\kuai8\pic\17815.gmp
from %TEMP%\gm~f95a.tmp to %APPDATA%\kuai8\pic\17816.gmp
from %TEMP%\gm~fbbb.tmp to %APPDATA%\kuai8\pic\17817.gmp
from %TEMP%\gm~fd42.tmp to %APPDATA%\kuai8\pic\17818.gmp
from %TEMP%\gm~fed9.tmp to %APPDATA%\kuai8\pic\17819.gmp
from %TEMP%\gm~50.tmp to %APPDATA%\kuai8\pic\17820.gmp
from %TEMP%\gmicon\71019.gmp to %APPDATA%\kuai8\pic\71019.gmp
from %TEMP%\gm~1e7.tmp to %APPDATA%\kuai8\pic\20101.gmp
from %TEMP%\gmicon\71018.gmp to %APPDATA%\kuai8\pic\71018.gmp
from %TEMP%\gmicon\71016.gmp to %APPDATA%\kuai8\pic\71016.gmp
from %TEMP%\gmicon\20323.gmp to %APPDATA%\kuai8\pic\20323.gmp
from %TEMP%\gmicon\20399.gmp to %APPDATA%\kuai8\pic\20399.gmp
from %TEMP%\gmicon\40008.gmp to %APPDATA%\kuai8\pic\40008.gmp
from %TEMP%\gmicon\71002.gmp to %APPDATA%\kuai8\pic\71002.gmp
from %TEMP%\gmicon\71003.gmp to %APPDATA%\kuai8\pic\71003.gmp
from %TEMP%\gmicon\71004.gmp to %APPDATA%\kuai8\pic\71004.gmp
from %TEMP%\gmicon\71005.gmp to %APPDATA%\kuai8\pic\71005.gmp
from %TEMP%\gmicon\71006.gmp to %APPDATA%\kuai8\pic\71006.gmp
from %TEMP%\gmicon\71007.gmp to %APPDATA%\kuai8\pic\71007.gmp
from %TEMP%\gmicon\71008.gmp to %APPDATA%\kuai8\pic\71008.gmp
from %TEMP%\gmicon\71009.gmp to %APPDATA%\kuai8\pic\71009.gmp
from %TEMP%\gmicon\71010.gmp to %APPDATA%\kuai8\pic\71010.gmp
from %TEMP%\gmicon\71011.gmp to %APPDATA%\kuai8\pic\71011.gmp
from %TEMP%\gmicon\71012.gmp to %APPDATA%\kuai8\pic\71012.gmp
from %TEMP%\gmicon\71013.gmp to %APPDATA%\kuai8\pic\71013.gmp
from %TEMP%\gmicon\71014.gmp to %APPDATA%\kuai8\pic\71014.gmp
from %TEMP%\gmicon\71015.gmp to %APPDATA%\kuai8\pic\71015.gmp
from %TEMP%\gmicon\71017.gmp to %APPDATA%\kuai8\pic\71017.gmp
from %TEMP%\gm~35e.tmp to %APPDATA%\kuai8\pic\20127.gmp
from %TEMP%\gm~5c0.tmp to %APPDATA%\kuai8\pic\20193.gmp
from %TEMP%\gm~802.tmp to %APPDATA%\kuai8\pic\20204.gmp
from %TEMP%\gm~30a0.tmp to %APPDATA%\kuai8\pic\70634.gmp
from %TEMP%\gm~3237.tmp to %APPDATA%\kuai8\pic\70652.gmp
from %TEMP%\gm~33cd.tmp to %APPDATA%\kuai8\pic\70657.gmp
from %TEMP%\gm~3573.tmp to %APPDATA%\kuai8\pic\70723.gmp
from %TEMP%\gm~37b6.tmp to %APPDATA%\kuai8\pic\70729.gmp
from %TEMP%\gm~3b4f.tmp to %APPDATA%\kuai8\pic\70730.gmp
from %TEMP%\gm~3cd6.tmp to %APPDATA%\kuai8\pic\70754.gmp
from %TEMP%\gm~5437.tmp to %APPDATA%\kuai8\pic\70937.gmp
from %TEMP%\gm~3f47.tmp to %APPDATA%\kuai8\pic\70796.gmp
from %TEMP%\gm~433f.tmp to %APPDATA%\kuai8\pic\70839.gmp
from %TEMP%\gm~4581.tmp to %APPDATA%\kuai8\pic\70840.gmp
from %TEMP%\gm~4727.tmp to %APPDATA%\kuai8\pic\70878.gmp
from %TEMP%\gm~495a.tmp to %APPDATA%\kuai8\pic\70879.gmp
from %TEMP%\gm~4ed7.tmp to %APPDATA%\kuai8\pic\70880.gmp
from %TEMP%\gm~504e.tmp to %APPDATA%\kuai8\pic\70916.gmp
from %TEMP%\gm~52bf.tmp to %APPDATA%\kuai8\pic\70932.gmp
from %TEMP%\gm~2d54.tmp to %APPDATA%\kuai8\pic\70561.gmp
from %TEMP%\gm~2f19.tmp to %APPDATA%\kuai8\pic\70568.gmp
from %TEMP%\gm~2b11.tmp to %APPDATA%\kuai8\pic\70515.gmp
from %TEMP%\gm~2891.tmp to %APPDATA%\kuai8\pic\70392.gmp
from %TEMP%\gm~265e.tmp to %APPDATA%\kuai8\pic\70307.gmp
from %TEMP%\gm~b2f.tmp to %APPDATA%\kuai8\pic\20242.gmp
from %TEMP%\gm~db0.tmp to %APPDATA%\kuai8\pic\20298.gmp
from %TEMP%\gm~ff2.tmp to %APPDATA%\kuai8\pic\20299.gmp
from %TEMP%\gm~1263.tmp to %APPDATA%\kuai8\pic\20401.gmp
from %TEMP%\gm~13ea.tmp to %APPDATA%\kuai8\pic\20444.gmp
from %TEMP%\gm~1590.tmp to %APPDATA%\kuai8\pic\20445.gmp
from %TEMP%\gm~1717.tmp to %APPDATA%\kuai8\pic\20447.gmp
from %TEMP%\gm~55dd.tmp to %APPDATA%\kuai8\pic\70938.gmp
from %TEMP%\gm~1bda.tmp to %APPDATA%\kuai8\pic\40142.gmp
from %TEMP%\gm~1998.tmp to %APPDATA%\kuai8\pic\20457.gmp
from %TEMP%\gm~1e2d.tmp to %APPDATA%\kuai8\pic\40150.gmp
from %TEMP%\gm~2178.tmp to %APPDATA%\kuai8\pic\40155.gmp
from %TEMP%\gm~2244.tmp to %APPDATA%\kuai8\pic\40156.gmp
from %TEMP%\gm~231f.tmp to %APPDATA%\kuai8\pic\40163.gmp
from %TEMP%\gm~23eb.tmp to %APPDATA%\kuai8\pic\40164.gmp
from %TEMP%\gm~24c7.tmp to %APPDATA%\kuai8\pic\40167.gmp
from %TEMP%\gm~2583.tmp to %APPDATA%\kuai8\pic\40174.gmp
from %TEMP%\gm~9a8.tmp to %APPDATA%\kuai8\pic\20218.gmp
from %TEMP%\gm~1cb5.tmp to %APPDATA%\kuai8\pic\40149.gmp
from %TEMP%\gm~35e.tmp to %APPDATA%\kuai8\pic\40071.gmp

Modifies the following files

Substitutes the following files

%APPDATA%\kuai8\data\plugin\top.gmx
%APPDATA%\kuai8\data\search.gms-journal
%TEMP%\gmicon\20082.gmp
%TEMP%\gmicon\20323.gmp
%TEMP%\gmicon\20399.gmp

Network activity

Connects to

'up####.kuai8box.com':80
'gm#.##ai8box.com':80
'st##.#uai8box.com':80
'se#####.kuai8box.com':80
'v2.####te.kuai8box.com':80
'yx#.##ai8box.com':80
'up#.##ai8box.com':80
'qu###.kuai8box.com':80
'ic##.#uai8box.com':80
'im#.##ai8box.com':80
'hm.##idu.com':443

TCP

HTTP GET requests

http://up####.kuai8box.com/update_database.php?da########################################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/20007.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20009.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20010.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20013.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20016.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20017.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20018.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20019.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20020.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20021.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70796.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20022.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20025.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20026.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20027.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20030.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20031.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20032.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20033.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20034.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20035.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20036.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20005.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20006.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20004.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20002.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20001.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70392.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70515.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70561.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70568.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70634.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70652.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70657.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70723.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70729.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70730.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20038.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20023.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70754.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70839.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70840.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70878.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70879.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70880.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70916.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70932.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70937.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70938.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70992.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70307.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70827.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20062.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40037.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20043.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20383.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20396.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40002.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40003.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40005.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40006.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40007.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40010.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40011.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40012.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20039.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40013.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40015.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40016.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40017.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40030.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40031.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40032.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40033.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40034.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40035.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40036.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20374.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20375.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20372.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20371.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20365.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20046.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20048.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20049.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20051.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20052.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20053.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20055.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20056.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20058.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20060.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20042.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40174.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20061.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20071.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20077.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20098.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20310.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20315.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20317.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20345.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20358.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20359.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20360.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20044.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20063.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40014.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40167.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20299.gmp
http://up#.##ai8box.com/gmp_64/2018.11.29/71001-71100.gmz
http://yx#.##ai8box.com/static/box/template/bgskin/index.js
http://yx#.##ai8box.com/static/box/image/default_icon.png
http://im#.##ai8box.com/slider/202103/20210308105202782.jpg
http://yx#.##ai8box.com/static/box/template/game/game_icon.css
http://yx#.##ai8box.com/static/box/template/game/game_icon.js
http://yx#.##ai8box.com/static/box/image/more_text.png
http://yx#.##ai8box.com/static/box/image/icon/icon_category.png
http://yx#.##ai8box.com/static/box/image/icon/tip_new.png
http://yx#.##ai8box.com/static/box/image/icon/tip_hot.png
http://yx#.##ai8box.com/static/web/lib/jscrollpane/jquery.hup.jscrollpane.min.js
http://yx#.##ai8box.com/static/box/image/icon/tip_recommend.png
http://im#.##ai8box.com/slider/202012/20201209110415679.jpg
http://yx#.##ai8box.com/static/box/template/game/store_game_icon.js
http://yx#.##ai8box.com/static/box/image/default_store_index.png
http://im#.##ai8box.com/slider/202005/20200507111615862.jpg
http://yx#.##ai8box.com/static/box/image/bg/store_list_bg_1png.png
http://yx#.##ai8box.com/static/box/template/game/rank_list.css
http://im#.##ai8box.com/slider/202004/20200429112935682.jpg
http://yx#.##ai8box.com/static/box/template/game/rank_list.js
http://yx#.##ai8box.com/static/box/image/icon/rank_hot.png
http://yx#.##ai8box.com/static/box/template/game/game_bubble.js
http://yx#.##ai8box.com/static/box/page/recommend/hot.js
http://yx#.##ai8box.com/static/web/lib/jquery.toast/fonts/toast.eot?76####
http://yx#.##ai8box.com/static/box/page/recommend/hot.css
http://yx#.##ai8box.com/static/box/function.js
http://yx#.##ai8box.com/static/box/w2c.js
http://st##.#uai8box.com/stat.php?da#############################################################################################################################################################...
http://up####.kuai8box.com/update_plugin.php?da##################################################################################################################################################...
http://v2.####te.kuai8box.com/game/start?da######################################################################################################################################################...
http://up####.kuai8box.com/update_top.php?da########################################################################################
http://up#.##ai8box.com/gmp_64/2016.12.09/20301-20400.gmz
http://yx#.##ai8box.com/static/web/lib/compatible/jquery.extend.js
http://up#.##ai8box.com/gmp_64/2016.12.09/20001-20100.gmz
http://yx#.##ai8box.com/static/web/lib/jquery/jquery.cookie.js
http://yx#.##ai8box.com/static/web/lib/jquery/jquery.lazy.js
http://yx#.##ai8box.com/static/web/lib/jquery/jquery.superslide.js
http://yx#.##ai8box.com/static/box/template/game/game_bubble.css
http://yx#.##ai8box.com/static/box/template/game/store_game_icon.css
http://yx#.##ai8box.com/static/web/lib/jquery/jquery.mousewheel.js
http://yx#.##ai8box.com/static/web/lib/jscrollpane/jquery.jscrollpane.min.css
http://st##.#uai8box.com/online_stat.php?da######################################################################################################################################################...
http://yx#.##ai8box.com/static/web/lib/jquery.toast/js/toast.script.js
http://yx#.##ai8box.com/static/web/lib/jquery.toast/css/toast.style.css
http://yx#.##ai8box.com/static/web/js/html5shiv.min.js
http://yx#.##ai8box.com/static/web/lib/compatible/html5.js
http://yx#.##ai8box.com/static/web/lib/compatible/respond.min.js
http://yx#.##ai8box.com/static/web/lib/compatible/PIE_IE678.js
http://yx#.##ai8box.com/static/box/main.css
http://yx#.##ai8box.com/static/box/main.js
http://gm#.##ai8box.com/update_new/update_177_2/update176_8-177_2.xml
http://up#.##ai8box.com/gmp_64/2016.09.14/40001-40100.gmz
http://im#.##ai8box.com/slider/202012/20201209111230641.gif
http://ic##.#uai8box.com/game_icon/gmp_64/40163.gmp
http://yx#.##ai8box.com/static/box/image/scroll/scoll_long.png
http://ic##.#uai8box.com/game_icon/gmp_64/17817.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17818.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17819.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17820.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20101.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20127.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20193.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20204.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20218.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20242.gmp
http://yx#.##ai8box.com/static/box/image/gotop.png
http://ic##.#uai8box.com/game_icon/gmp_64/20298.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20401.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20444.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20445.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20447.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20457.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40142.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40149.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40150.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40155.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/40156.gmp
http://ic##.#uai8box.com/game_icon/icon_64/20016.png
http://ic##.#uai8box.com/game_icon/gmp_64/17816.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17815.gmp
http://ic##.#uai8box.com/game_icon/icon_64/71073.png
http://ic##.#uai8box.com/game_icon/icon_64/71072.png
http://ic##.#uai8box.com/game_icon/icon_64/71092.png
http://ic##.#uai8box.com/game_icon/icon_64/71086.png
http://im#.##ai8box.com/slider/202103/20210308105206591.jpg
http://ic##.#uai8box.com/game_icon/icon_64/71059.png
http://im#.##ai8box.com/slider/202012/20201209110419293.jpg
http://im#.##ai8box.com/slider/202005/20200507111619275.jpg
http://im#.##ai8box.com/slider/202004/20200429112939980.jpg
http://ic##.#uai8box.com/game_icon/icon_64/71065.png
http://ic##.#uai8box.com/game_icon/gmp_64/17811.gmp
http://im#.##ai8box.com/slider/202009/20200916104223335.jpg
http://im#.##ai8box.com/slider/202009/20200916104216274.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/40164.gmp
http://ic##.#uai8box.com/game_icon/icon_64/71084.png
http://ic##.#uai8box.com/game_icon/icon_64/71088.png
http://ic##.#uai8box.com/game_icon/gmp_64/17812.gmp
http://im#.##ai8box.com/slider/202012/20201209111333962.jpg
http://ic##.#uai8box.com/game_icon/icon_64/71061.png
http://ic##.#uai8box.com/game_icon/icon_64/71044.png
http://ic##.#uai8box.com/game_icon/gmp_64/17813.gmp
http://ic##.#uai8box.com/game_icon/icon_64/70916.png
http://ic##.#uai8box.com/game_icon/icon_64/71089.png
http://ic##.#uai8box.com/game_icon/icon_64/71071.png
http://ic##.#uai8box.com/game_icon/gmp_64/17814.gmp
http://yx#.##ai8box.com/static/box/image/scroll/scoll_short.png
http://im#.##ai8box.com/slider/202012/20201209111206285.jpg
http://ic##.#uai8box.com/game_icon/gmp_64/40038.gmp

HTTP POST requests

http://up####.kuai8box.com/update_icon.php?da####################################################################

'hm.##idu.com':443

UDP

DNS ASK up####.kuai8box.com
DNS ASK gm#.##ai8box.com
DNS ASK st##.#uai8box.com
DNS ASK se#####.kuai8box.com
DNS ASK v2.####te.kuai8box.com
DNS ASK yx#.##ai8box.com
DNS ASK up#.##ai8box.com
DNS ASK qu###.kuai8box.com
DNS ASK ic##.#uai8box.com
DNS ASK im#.##ai8box.com
DNS ASK hm.##idu.com

Miscellaneous

Searches for the following windows

ClassName: 'GMBubbleWnd' WindowName: ''
ClassName: 'GMKuaiBaWnd' WindowName: '快吧游戏'
ClassName: '' WindowName: '快吧Flash游戏'
ClassName: '' WindowName: '快吧网页游戏'
ClassName: '' WindowName: '快吧游戏浏览器'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Progman' WindowName: 'Program Manager'
ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: 'FolderView'

Creates and executes the following

'%ProgramFiles(x86)%\kuai8\k8gm.exe' -update_data
'%ProgramFiles(x86)%\kuai8\k8update.exe' -install
'%ProgramFiles(x86)%\kuai8\k8gm.exe' -show=3 -atonce
'%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe' -query_action
'%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1
'%ProgramFiles(x86)%\kuai8\k8update.exe' -installrun
'%ProgramFiles(x86)%\kuai8\tool\k8minipage.exe' -miniurl="http://mi##.91nzh.com/mini3/index-nx.html" -minititle="4" -miniwidth="750" -miniheight="500" -mininewpage="2" -delay="2" -silence="1" -topmost="3" -without="1" -menu="2" -title_text="...
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL' (with hidden window)
'%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1' (with hidden window)
'%ProgramFiles(x86)%\kuai8\k8update.exe' -installrun' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8Shell.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8Shell.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8ShellIcon.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8ShellIcon.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней