Trojan.Siggen18.49414

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="快吧flash游戏程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL

Modifies file system

Creates the following files

%TEMP%\nsr67b8.tmp
%TEMP%\gm~5c8e.tmp
%TEMP%\gm~63a1.tmp
%TEMP%\gm~66ec.tmp
%TEMP%\gm~690f.tmp
%TEMP%\gm~6b51.tmp
%TEMP%\gm~7947.tmp
%TEMP%\gm~3fbc.tmp
%TEMP%\gm~874c.tmp
%TEMP%\gm~8de3.tmp
%TEMP%\gm~912e.tmp
%TEMP%\gm~942c.tmp
%TEMP%\gm~965e.tmp
%TEMP%\gm~9c87.tmp
%TEMP%\gm~9fc3.tmp
%TEMP%\gm~a1f5.tmp
%TEMP%\gm~5931.tmp
%TEMP%\gm~8a97.tmp
%TEMP%\gm~5b74.tmp
%TEMP%\gm~5a4b.tmp
%TEMP%\gm~5808.tmp
%TEMP%\gm~56ee.tmp
%TEMP%\gm~22f2.tmp
%TEMP%\gm~2b1d.tmp
%TEMP%\gm~2eb7.tmp
%TEMP%\gm~2fe0.tmp
%TEMP%\gm~37bd.tmp
%TEMP%\gm~3c22.tmp
%TEMP%\gm~a428.tmp
%TEMP%\gm~3e73.tmp
%TEMP%\gm~1dff.tmp
%TEMP%\gm~4105.tmp
%TEMP%\gm~4df2.tmp
%TEMP%\gm~5034.tmp
%TEMP%\gm~514e.tmp
%TEMP%\gm~5268.tmp
%TEMP%\gm~5391.tmp
%TEMP%\gm~54ab.tmp
%TEMP%\gm~2061.tmp
%TEMP%\gm~55c5.tmp
%TEMP%\gm~4bbf.tmp
%TEMP%\gm~21a9.tmp
%TEMP%\gm~a63b.tmp
%TEMP%\gm~af06.tmp
%TEMP%\gmtemp\msvcr80.dll
%TEMP%\gmtemp\msvcp80.dll
%TEMP%\gm~d4b3.tmp
%TEMP%\gmtemp\microsoft.vc80.crt.manifest
%TEMP%\gmtemp\k8common.dll
%TEMP%\gmtemp\k8uirender.dll
%TEMP%\gmtemp\download\kuai8box_v10.2.1.8391_update.exe
%TEMP%\gm~d000.tmp
%TEMP%\gmtemp\download.gmt
%TEMP%\gmtemp\upgrade.gmt
%TEMP%\gm~d6e5.tmp
%TEMP%\gm~d928.tmp
%TEMP%\gm~da41.tmp
%TEMP%\gm~dc84.tmp
%TEMP%\gm~dd9d.tmp
%TEMP%\gm~deb7.tmp
%TEMP%\gmtemp\k8update.exe
%TEMP%\gmtemp\k8urlencrypt.dll
%TEMP%\gm~d232.tmp
%TEMP%\gm~cbab.tmp
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\快吧游戏.lnk
%TEMP%\gm~b129.tmp
%TEMP%\gm~b35b.tmp
%TEMP%\gm~b475.tmp
%TEMP%\gm~b6b7.tmp
%TEMP%\gm~b8ea.tmp
%TEMP%\gm~ba13.tmp
%TEMP%\gm~a86e.tmp
%TEMP%\gm~acd3.tmp
%TEMP%\gm~aaa0.tmp
%TEMP%\gm~bc46.tmp
%TEMP%\gm~c1e5.tmp
%TEMP%\gm~c2ff.tmp
%TEMP%\gm~c419.tmp
%TEMP%\gm~c542.tmp
%TEMP%\gm~c65c.tmp
%TEMP%\gm~c776.tmp
%TEMP%\gm~be69.tmp
%TEMP%\gm~bf92.tmp
%TEMP%\gm~c0bc.tmp
%TEMP%\gm$d.303.1675\kuai8box_v10.2.1.8391_update.exe
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022092120220922\index.dat
%TEMP%\gmicon\40140.gmp
%ProgramFiles(x86)%\kuai8\tool\k8tray.exe
%ProgramFiles(x86)%\kuai8\tool\k8minipage.exe
%ProgramFiles(x86)%\kuai8\tool\k8rtlfix.exe
%ProgramFiles(x86)%\kuai8\tool\k8pluginfix.exe
%ProgramFiles(x86)%\kuai8\tool\k8netdetect.exe
%ProgramFiles(x86)%\kuai8\tool\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\kuai8\tool\msvcp80.dll
%APPDATA%\kuai8\data\plugin\netwl.gmx
%ProgramFiles(x86)%\kuai8\tool\msvcr80.dll
%ProgramFiles(x86)%\kuai8\tool_x64\k8shellicon.dll
%ProgramFiles(x86)%\kuai8\tool\k8shell.dll
%ProgramFiles(x86)%\kuai8\tool\k8shellicon.dll
%APPDATA%\kuai8\data\database.gmx
%APPDATA%\kuai8\data\plugin\top.gmx
%APPDATA%\kuai8\data\plugin\scan.gmx
%ProgramFiles(x86)%\kuai8\tool\k8uirender.dll
%ProgramFiles(x86)%\kuai8\tool\k8common.dll
%ProgramFiles(x86)%\kuai8\tool\k8external.exe
%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe
%ProgramFiles(x86)%\kuai8\tool\k8restorewindow.dll
%TEMP%\nsm67e8.tmp\system.dll
%ProgramFiles(x86)%\kuai8\k8gm.exe
%ProgramFiles(x86)%\kuai8\k8flash.exe
%ProgramFiles(x86)%\kuai8\k8browser.exe
%ProgramFiles(x86)%\kuai8\k8web.exe
%ProgramFiles(x86)%\kuai8\k8update.exe
%ProgramFiles(x86)%\kuai8\k8version.dll
%APPDATA%\kuai8\data\plugin\window.gmx
%ProgramFiles(x86)%\kuai8\k8bugreport.exe
%ProgramFiles(x86)%\kuai8\tool_x64\k8shell.dll
%ProgramFiles(x86)%\kuai8\k8common.dll
%ProgramFiles(x86)%\kuai8\k8dlplatform.exe
%ProgramFiles(x86)%\kuai8\k8uirender.dll
%ProgramFiles(x86)%\kuai8\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\kuai8\msvcp80.dll
%ProgramFiles(x86)%\kuai8\msvcr80.dll
%ProgramFiles(x86)%\kuai8\uninstall.exe
%ProgramFiles(x86)%\kuai8\k8urlencrypt.dll
%TEMP%\nsm67e8.tmp\k8nsisminiextend.dll
%ProgramFiles(x86)%\kuai8\k8dlutils.dll
%ProgramFiles(x86)%\kuai8\tool\k8dlutils.dll
%APPDATA%\kuai8\data\plugin\inwl.gmx
%TEMP%\gm~d78.tmp
%TEMP%\gmicon\20399.gmp
%TEMP%\gm~f4d.tmp
%TEMP%\gmicon\40008.gmp
%TEMP%\gm~10e4.tmp
%TEMP%\gmicon\40148.gmp
%TEMP%\gmicon\40149.gmp
%APPDATA%\kuai8\cache.xml
%APPDATA%\kuai8\data\plugin\pc.gmx
%TEMP%\gmicon\20323.gmp
%TEMP%\gmicon\40150.gmp
%TEMP%\gmicon\40128.gmp
%TEMP%\gmicon\40129.gmp
%TEMP%\gmicon\40133.gmp
%TEMP%\gmicon\40134.gmp
%TEMP%\gmicon\40135.gmp
%TEMP%\gmicon\40139.gmp
%TEMP%\gmicon\40101.gmp
%TEMP%\gmicon\40102.gmp
%TEMP%\gmicon\40127.gmp
%TEMP%\gmtemp\startup.gmt
%TEMP%\gm~dff0.tmp
%TEMP%\gm~695.tmp
%ProgramFiles(x86)%\kuai8\audio\complete.wav
%TEMP%\gm~a360.tmp
%APPDATA%\kuai8\update.ini
%TEMP%\gm~aa92.tmp
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\快吧游戏.lnk
%APPDATA%\microsoft\internet explorer\quick launch\快吧游戏.lnk
%HOMEPATH%\desktop\快吧游戏.lnk
%TEMP%\gmicon\20082.gmp
%APPDATA%\kuai8\config\config.xml
%HOMEPATH%\desktop\快吧页游大厅.lnk
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\快吧页游大厅.lnk
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\卸载快吧.lnk
%TEMP%\gmtemp\restart.gmt
%APPDATA%\kuai8\data\local\recent.xml
%APPDATA%\kuai8\data\local\user.xml
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\search.gms
%APPDATA%\kuai8\data\plugin\search.gmx
%APPDATA%\microsoft\windows\start menu\programs\快吧游戏\快吧flash播放器.lnk
%TEMP%\gm~e80c.tmp

Deletes the following files

%APPDATA%\kuai8\data\plugin\top.gmx
%TEMP%\gm~3fbc.tmp
%TEMP%\gm~3e73.tmp
%TEMP%\gm~3c22.tmp
%TEMP%\gm~22f2.tmp
%TEMP%\gm~21a9.tmp
%TEMP%\gm~2061.tmp
%TEMP%\gm~1dff.tmp
%TEMP%\gm~4105.tmp
%APPDATA%\kuai8\data\search.gms
%TEMP%\gm~f4d.tmp
%TEMP%\gm~d78.tmp
%TEMP%\gm~695.tmp
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\update.ini
%TEMP%\nsm67e8.tmp\system.dll
%TEMP%\nsm67e8.tmp\k8nsisminiextend.dll
%TEMP%\gm~10e4.tmp
%TEMP%\gm$d.303.1675\kuai8box_v10.2.1.8391_update.exe

Moves the following files

from %TEMP%\gm~aa92.tmp to %APPDATA%\kuai8\data\database.gmx
from %TEMP%\gm~ba13.tmp to %APPDATA%\kuai8\pic\20025.gmp
from %TEMP%\gm~b8ea.tmp to %APPDATA%\kuai8\pic\20023.gmp
from %TEMP%\gm~b6b7.tmp to %APPDATA%\kuai8\pic\20022.gmp
from %TEMP%\gm~b475.tmp to %APPDATA%\kuai8\pic\20021.gmp
from %TEMP%\gm~b35b.tmp to %APPDATA%\kuai8\pic\20020.gmp
from %TEMP%\gm~b129.tmp to %APPDATA%\kuai8\pic\20019.gmp
from %TEMP%\gm~af06.tmp to %APPDATA%\kuai8\pic\20018.gmp
from %TEMP%\gm~acd3.tmp to %APPDATA%\kuai8\pic\20017.gmp
from %TEMP%\gm~aaa0.tmp to %APPDATA%\kuai8\pic\20016.gmp
from %TEMP%\gm~a86e.tmp to %APPDATA%\kuai8\pic\20013.gmp
from %TEMP%\gm~a63b.tmp to %APPDATA%\kuai8\pic\20010.gmp
from %TEMP%\gm~a428.tmp to %APPDATA%\kuai8\pic\20009.gmp
from %TEMP%\gm~a1f5.tmp to %APPDATA%\kuai8\pic\20007.gmp
from %TEMP%\gm~9fc3.tmp to %APPDATA%\kuai8\pic\20006.gmp
from %TEMP%\gm~9c87.tmp to %APPDATA%\kuai8\pic\20005.gmp
from %TEMP%\gm~965e.tmp to %APPDATA%\kuai8\pic\20004.gmp
from %TEMP%\gm~942c.tmp to %APPDATA%\kuai8\pic\20002.gmp
from %TEMP%\gm~8de3.tmp to %APPDATA%\kuai8\pic\71094.gmp
from %TEMP%\gm~912e.tmp to %APPDATA%\kuai8\pic\20001.gmp
from %TEMP%\gm~bc46.tmp to %APPDATA%\kuai8\pic\20026.gmp
from %TEMP%\gm~be69.tmp to %APPDATA%\kuai8\pic\20027.gmp
from %TEMP%\gm~deb7.tmp to %APPDATA%\kuai8\pic\20052.gmp
from %TEMP%\gm~dd9d.tmp to %APPDATA%\kuai8\pic\20051.gmp
from %TEMP%\gm~dc84.tmp to %APPDATA%\kuai8\pic\20049.gmp
from %TEMP%\gm~da41.tmp to %APPDATA%\kuai8\pic\20048.gmp
from %TEMP%\gm~d928.tmp to %APPDATA%\kuai8\pic\20047.gmp
from %TEMP%\gm~d6e5.tmp to %APPDATA%\kuai8\pic\20046.gmp
from %TEMP%\gm~d4b3.tmp to %APPDATA%\kuai8\pic\20044.gmp
from %TEMP%\gm~d232.tmp to %APPDATA%\kuai8\pic\20043.gmp
from %TEMP%\gm~cbab.tmp to %APPDATA%\kuai8\pic\20039.gmp
from %TEMP%\gm~56ee.tmp to %APPDATA%\kuai8\pic\20193.gmp
from %TEMP%\gm~c776.tmp to %APPDATA%\kuai8\pic\20038.gmp
from %TEMP%\gm~c65c.tmp to %APPDATA%\kuai8\pic\20036.gmp
from %TEMP%\gm~c542.tmp to %APPDATA%\kuai8\pic\20035.gmp
from %TEMP%\gm~c419.tmp to %APPDATA%\kuai8\pic\20034.gmp
from %TEMP%\gm~c2ff.tmp to %APPDATA%\kuai8\pic\20033.gmp
from %TEMP%\gm~c1e5.tmp to %APPDATA%\kuai8\pic\20032.gmp
from %TEMP%\gm~c0bc.tmp to %APPDATA%\kuai8\pic\20031.gmp
from %TEMP%\gm~bf92.tmp to %APPDATA%\kuai8\pic\20030.gmp
from %TEMP%\gm~8a97.tmp to %APPDATA%\kuai8\pic\71087.gmp
from %TEMP%\gm~874c.tmp to %APPDATA%\kuai8\pic\71071.gmp
from %TEMP%\gm~7947.tmp to %APPDATA%\kuai8\pic\70932.gmp
from %TEMP%\gmicon\40149.gmp to %APPDATA%\kuai8\pic\40149.gmp
from %TEMP%\gmicon\40148.gmp to %APPDATA%\kuai8\pic\40148.gmp
from %TEMP%\gmicon\40140.gmp to %APPDATA%\kuai8\pic\40140.gmp
from %TEMP%\gmicon\40139.gmp to %APPDATA%\kuai8\pic\40139.gmp
from %TEMP%\gmicon\40135.gmp to %APPDATA%\kuai8\pic\40135.gmp
from %TEMP%\gmicon\40134.gmp to %APPDATA%\kuai8\pic\40134.gmp
from %TEMP%\gmicon\40133.gmp to %APPDATA%\kuai8\pic\40133.gmp
from %TEMP%\gmicon\40129.gmp to %APPDATA%\kuai8\pic\40129.gmp
from %TEMP%\gmicon\40128.gmp to %APPDATA%\kuai8\pic\40128.gmp
from %TEMP%\gmicon\40127.gmp to %APPDATA%\kuai8\pic\40127.gmp
from %TEMP%\gmicon\40102.gmp to %APPDATA%\kuai8\pic\40102.gmp
from %TEMP%\gmicon\40101.gmp to %APPDATA%\kuai8\pic\40101.gmp
from %TEMP%\gmicon\40008.gmp to %APPDATA%\kuai8\pic\40008.gmp
from %TEMP%\gmicon\20399.gmp to %APPDATA%\kuai8\pic\20399.gmp
from %TEMP%\gmicon\20323.gmp to %APPDATA%\kuai8\pic\20323.gmp
from %TEMP%\gmicon\20082.gmp to %APPDATA%\kuai8\pic\20082.gmp
from %TEMP%\gm~2b1d.tmp to %APPDATA%\kuai8\pic\17763.gmp
from %TEMP%\gm~2eb7.tmp to %APPDATA%\kuai8\pic\17983.gmp
from %TEMP%\gmicon\40150.gmp to %APPDATA%\kuai8\pic\40150.gmp
from %TEMP%\gm~2fe0.tmp to %APPDATA%\kuai8\pic\17984.gmp
from %TEMP%\gm~6b51.tmp to %APPDATA%\kuai8\pic\20457.gmp
from %TEMP%\gm~37bd.tmp to %APPDATA%\kuai8\pic\17985.gmp
from %TEMP%\gm~690f.tmp to %APPDATA%\kuai8\pic\20447.gmp
from %TEMP%\gm~66ec.tmp to %APPDATA%\kuai8\pic\20445.gmp
from %TEMP%\gm~63a1.tmp to %APPDATA%\kuai8\pic\20401.gmp
from %TEMP%\gm~5c8e.tmp to %APPDATA%\kuai8\pic\20299.gmp
from %TEMP%\gm~5b74.tmp to %APPDATA%\kuai8\pic\20298.gmp
from %TEMP%\gm~5a4b.tmp to %APPDATA%\kuai8\pic\20242.gmp
from %TEMP%\gm~5931.tmp to %APPDATA%\kuai8\pic\20218.gmp
from %TEMP%\gm~d000.tmp to %APPDATA%\kuai8\pic\20042.gmp
from %TEMP%\gm~dff0.tmp to %APPDATA%\kuai8\pic\20053.gmp
from %TEMP%\gm~55c5.tmp to %APPDATA%\kuai8\pic\20127.gmp
from %TEMP%\gm~54ab.tmp to %APPDATA%\kuai8\pic\20101.gmp
from %TEMP%\gm~5391.tmp to %APPDATA%\kuai8\pic\17991.gmp
from %TEMP%\gm~5268.tmp to %APPDATA%\kuai8\pic\17990.gmp
from %TEMP%\gm~514e.tmp to %APPDATA%\kuai8\pic\17989.gmp
from %TEMP%\gm~5034.tmp to %APPDATA%\kuai8\pic\17988.gmp
from %TEMP%\gm~4df2.tmp to %APPDATA%\kuai8\pic\17987.gmp
from %TEMP%\gm~4bbf.tmp to %APPDATA%\kuai8\pic\17986.gmp
from %TEMP%\gm~5808.tmp to %APPDATA%\kuai8\pic\20204.gmp
from %TEMP%\gm~e80c.tmp to %APPDATA%\kuai8\pic\20055.gmp

Modifies the following files

Substitutes the following files

%APPDATA%\kuai8\data\plugin\top.gmx
%TEMP%\gmicon\40135.gmp
%TEMP%\gmicon\40134.gmp
%TEMP%\gmicon\40133.gmp
%TEMP%\gmicon\40129.gmp
%TEMP%\gmicon\40128.gmp
%TEMP%\gmicon\40127.gmp
%TEMP%\gmicon\40102.gmp
%TEMP%\gmicon\40101.gmp
%TEMP%\gmicon\40150.gmp
%TEMP%\gmicon\40149.gmp
%TEMP%\gmicon\40148.gmp
%TEMP%\gmicon\40008.gmp
%TEMP%\gmicon\20399.gmp
%TEMP%\gmicon\20323.gmp
%TEMP%\gmicon\20082.gmp
%APPDATA%\kuai8\data\search.gms
%APPDATA%\kuai8\data\search.gms-journal
%TEMP%\gmicon\40139.gmp
%TEMP%\gmicon\40140.gmp

Network activity

Connects to

'up####.kuai8.com':80
'gm#.##ai8box.com':80
'st##.kuai8.com':80
'se####e.kuai8.com':80
'up#.##ai8box.com':80
'd1.###i8game.com':80
'ic##.#uai8box.com':80

TCP

HTTP GET requests

http://up####.kuai8.com/update_top.php?da##########################################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/20025.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20023.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20022.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20021.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20020.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20019.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20018.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20026.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20017.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20013.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20010.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20009.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20007.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20006.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20005.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20004.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20016.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20042.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20053.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20031.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20052.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20051.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20049.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20048.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20047.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20046.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20044.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20002.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20043.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20039.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20038.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20036.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20035.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20034.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20033.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20032.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20027.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20030.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20001.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17988.gmp
http://up####.kuai8.com/update_icon.php?da########################################################################################
http://ic##.#uai8box.com/game_icon/gmp_64/17985.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17984.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17983.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17763.gmp
http://d1.###i8game.com/update/Kuai8_GameManager_v10.2.1.8391_Update.exe
http://up####.kuai8.com/update/index.php?da######################################################################################################################################################...
http://ic##.#uai8box.com/game_icon/gmp_64/17986.gmp
http://st##.kuai8.com/online_stat.php?da#########################################################################################################################################################...
http://up#.##ai8box.com/gmp_64/2016.09.14/40001-40100.gmz
http://up#.##ai8box.com/gmp_64/2016.12.09/20301-20400.gmz
http://up#.##ai8box.com/gmp_64/2016.12.09/20001-20100.gmz
http://st##.kuai8.com/stat.php?da####################################################################
http://gm#.##ai8box.com/database_new/database_200_6.gmx
http://up####.kuai8.com/update_database.php?da##########################################################################################
http://gm#.##ai8box.com/top/top_111_6.gmx
http://up#.##ai8box.com/gmp_64/2018.11.29/40101-40200.gmz
http://ic##.#uai8box.com/game_icon/gmp_64/20242.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/71087.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17989.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/71071.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/70932.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20457.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20447.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20445.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20401.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20299.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/71094.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20298.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20218.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20204.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20193.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20127.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20101.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17991.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17990.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/17987.gmp
http://ic##.#uai8box.com/game_icon/gmp_64/20055.gmp

HTTP POST requests

http://up####.kuai8.com/update_icon.php?da####################################################################

UDP

DNS ASK up####.kuai8.com
DNS ASK gm#.##ai8box.com
DNS ASK st##.kuai8.com
DNS ASK yx#.#uai8.com
DNS ASK v2.###ate.kuai8.com
DNS ASK se####e.kuai8.com
DNS ASK up#.##ai8box.com
DNS ASK d1.###i8game.com
DNS ASK ic##.#uai8box.com

Miscellaneous

Searches for the following windows

ClassName: 'GMBubbleWnd' WindowName: ''
ClassName: 'GMKuaiBaWnd' WindowName: '快吧游戏'
ClassName: '' WindowName: '快吧Flash游戏'
ClassName: '' WindowName: '快吧网页游戏'
ClassName: '' WindowName: '快吧游戏浏览器'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\kuai8\k8gm.exe' -update_data
'%ProgramFiles(x86)%\kuai8\k8update.exe' -install
'%ProgramFiles(x86)%\kuai8\k8gm.exe' -show=3 -atonce
'%ProgramFiles(x86)%\kuai8\tool\k8bubble.exe' -query_action
'%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1
'%ProgramFiles(x86)%\kuai8\k8update.exe' -installrun
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="快吧flash游戏程序" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL' (with hidden window)
'%ProgramFiles(x86)%\kuai8\k8update.exe' -update -delay=3 -type=1' (with hidden window)
'%ProgramFiles(x86)%\kuai8\k8update.exe' -installrun' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8Flash.exe" name="快吧flash游戏程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8Shell.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8Shell.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8ShellIcon.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Kuai8\tool_x64\K8ShellIcon.dll"

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial