692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
Size

1.4MB
MD5

f5aa29925130f2f8176431ac481e896c
SHA1

6718884acd2b6d1a6a19b3ab8568b863b8b17efa
SHA256

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd
SHA512

52583336f3225b686cd4f701110f04e08689feab2e152c704ec589c947f937b98f5b34f90b4564b1106370874abcfbd823d603b68f2cca8e5934c2a4b55d0fb7
SSDEEP

24576:fitV0IsFKeOMMM5ge8sfqJDWw0CXryLtmx5kvJDDmZg1uXmTiG069fK+ay25LUmR:fitV1YKeOMMM58sfsDrtyLtBJ2ZLXmTU

Score

10^/10

bootkit discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe

Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

~GMFE0C.exekua1250.tmpK8GM.exeK8Update.exeK8GM.exeK8Bubble.exeK8Update.exeK8Update.exe

pid process

3536 ~GMFE0C.exe
3336 kua1250.tmp
844 K8GM.exe
1908 K8Update.exe
4504 K8GM.exe
1100 K8Bubble.exe
5004 K8Update.exe
1180 K8Update.exe
Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

756 netsh.exe
4312 netsh.exe
4056 netsh.exe
364 netsh.exe

pid	process
3536	~GMFE0C.exe
3336	kua1250.tmp
844	K8GM.exe
1908	K8Update.exe
4504	K8GM.exe
1100	K8Bubble.exe
5004	K8Update.exe
1180	K8Update.exe

pid	process
756	netsh.exe
4312	netsh.exe
4056	netsh.exe
364	netsh.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8Shell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8ShellIcon.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~GMFE0C.exe	upx
C:\Users\Admin\AppData\Local\Temp\~GMFE0C.exe	upx
behavioral2/memory/3536-135-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-138-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-140-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-139-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-142-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-137-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-144-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-146-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-148-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-150-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-151-0x0000000000400000-0x00000000005E3000-memory.dmp	upx
behavioral2/memory/3536-154-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-156-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-158-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-164-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-162-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-160-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-172-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-176-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-182-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-180-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-178-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-174-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-170-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-168-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-166-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3536-183-0x0000000000400000-0x00000000005E3000-memory.dmp	upx
behavioral2/memory/3536-184-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

kua1250.tmpK8GM.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	kua1250.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	K8GM.exe

Loads dropped DLL 48 IoCs

Processes:

kua1250.tmpK8GM.exeK8Update.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeK8GM.exeK8Bubble.exeK8Update.exeK8Update.exe

pid	process
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
3336	kua1250.tmp
844	K8GM.exe
844	K8GM.exe
844	K8GM.exe
844	K8GM.exe
844	K8GM.exe
844	K8GM.exe
844	K8GM.exe
1908	K8Update.exe
1908	K8Update.exe
1908	K8Update.exe
1908	K8Update.exe
1908	K8Update.exe
1648	regsvr32.exe
2716	regsvr32.exe
3984	regsvr32.exe
2400	regsvr32.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
1100	K8Bubble.exe
1100	K8Bubble.exe
1100	K8Bubble.exe
1100	K8Bubble.exe
1100	K8Bubble.exe
4504	K8GM.exe
4504	K8GM.exe
5004	K8Update.exe
5004	K8Update.exe
5004	K8Update.exe
1180	K8Update.exe
1180	K8Update.exe
1180	K8Update.exe
1180	K8Update.exe
1180	K8Update.exe
5004	K8Update.exe
5004	K8Update.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

K8Bubble.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\K8box = "\"C:\\Program Files (x86)\\Kuai8\\K8GM.exe\" -background"	K8Bubble.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

kua1250.tmp

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kua1250.tmp

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kua1250.tmp

Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

K8GM.exeK8Update.exeK8GM.exeK8Bubble.exeK8Update.exeK8Update.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	K8GM.exe
File opened for modification	\??\PhysicalDrive0	K8Update.exe
File opened for modification	\??\PhysicalDrive0	K8GM.exe
File opened for modification	\??\PhysicalDrive0	K8Bubble.exe
File opened for modification	\??\PhysicalDrive0	K8Update.exe
File opened for modification	\??\PhysicalDrive0	K8Update.exe

Drops file in Program Files directory 37 IoCs

Processes:

kua1250.tmp

description	ioc	process
File created	C:\Program Files (x86)\Kuai8\audio\complete.wav	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8GM.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8Update.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8UIRender.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8External.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\msvcp80.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\Microsoft.VC80.CRT.manifest	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\msvcp80.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\msvcr80.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8TaskBar.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8NetDetect.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\Microsoft.VC80.CRT.manifest	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\msvcr80.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8Common.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8GameShell64.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8RestoreWindow.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8ShellIcon.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8DLUtils.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8Common.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8Tray.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8MiniPage.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8Web.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8Version.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8BugReport.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8Shell.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\Uninstall.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8DLPlatform.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool\K8DLUtils.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8Browser.exe	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8UIRender.dll	kua1250.tmp
File created	C:\Program Files (x86)\Kuai8\K8GameShell32.dll	kua1250.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4652 3536 WerFault.exe ~GMFE0C.exe
2228 3536 WerFault.exe ~GMFE0C.exe

pid	pid_target	process	target process
4652	3536	WerFault.exe	~GMFE0C.exe
2228	3536	WerFault.exe	~GMFE0C.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

K8GM.exekua1250.tmp

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8MiniPage.exe = "11000"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\kuai8box.com	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8GM.exe = "11000"	kua1250.tmp
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING\K8MiniPage.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8Browser.exe = "11000"	kua1250.tmp
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kuai8box.com	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kuai8box.com\NumberOfSubdomains = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\K8Web.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\K8MiniPage.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kuai8box.com\Total = "63"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yxh.kuai8box.com\ = "63"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\yxh.kuai8box.com	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\K8MiniPage.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	K8GM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8Web.exe = "11000"	kua1250.tmp
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\K8Web.exe = "1"	K8GM.exe

Modifies registry class 32 IoCs

Processes:

regsvr32.exeregsvr32.exekua1250.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\AppID = "{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\K8Shell.DLL\AppID = "{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\K8Shell.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\ = "¿ì°ÉÓÎÏ·Ä¿Â¼Í¼±ê"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GMShellIcon.DLL\AppID = "{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	kua1250.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\ = "¿ì°ÉÓÎÏ·ÓÒ¼ü²Ëµ¥À©Õ¹"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers\K8Shell	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8Shell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8ShellIcon.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}\ = "K8Shell"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\AppID = "{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}\ = "K8ShellIcon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GMShellIcon.DLL	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

kua1250.tmpK8GM.exeK8Update.exe

pid	process
3336	kua1250.tmp
3336	kua1250.tmp
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
5004	K8Update.exe
5004	K8Update.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exeK8GM.exeK8GM.exe

description	pid	process
Token: SeDebugPrivilege	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
Token: SeManageVolumePrivilege	844	K8GM.exe
Token: SeManageVolumePrivilege	4504	K8GM.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

K8GM.exe

pid process

4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
Suspicious use of SendNotifyMessage 9 IoCs

Processes:

K8GM.exe

pid process

4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
4504 K8GM.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

~GMFE0C.exeK8GM.exe

pid process

3536 ~GMFE0C.exe
3536 ~GMFE0C.exe
3536 ~GMFE0C.exe
3536 ~GMFE0C.exe
3536 ~GMFE0C.exe
4504 K8GM.exe
4504 K8GM.exe

pid	process
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe

pid	process
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe
4504	K8GM.exe

pid	process
3536	~GMFE0C.exe
3536	~GMFE0C.exe
3536	~GMFE0C.exe
3536	~GMFE0C.exe
3536	~GMFE0C.exe
4504	K8GM.exe
4504	K8GM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exekua1250.tmpcmd.execmd.execmd.execmd.exeregsvr32.exeregsvr32.exeK8Bubble.exe

description	pid	process	target process
PID 400 wrote to memory of 3536	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GMFE0C.exe
PID 400 wrote to memory of 3536	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GMFE0C.exe
PID 400 wrote to memory of 3536	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	~GMFE0C.exe
PID 400 wrote to memory of 3336	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	kua1250.tmp
PID 400 wrote to memory of 3336	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	kua1250.tmp
PID 400 wrote to memory of 3336	400	692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe	kua1250.tmp
PID 3336 wrote to memory of 3120	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3120	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3120	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3872	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3872	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3872	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3524	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3524	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 3524	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 2872	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 2872	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 2872	3336	kua1250.tmp	cmd.exe
PID 3336 wrote to memory of 844	3336	kua1250.tmp	K8GM.exe
PID 3336 wrote to memory of 844	3336	kua1250.tmp	K8GM.exe
PID 3336 wrote to memory of 844	3336	kua1250.tmp	K8GM.exe
PID 3120 wrote to memory of 364	3120	cmd.exe	netsh.exe
PID 3120 wrote to memory of 364	3120	cmd.exe	netsh.exe
PID 3120 wrote to memory of 364	3120	cmd.exe	netsh.exe
PID 3872 wrote to memory of 756	3872	cmd.exe	netsh.exe
PID 3872 wrote to memory of 756	3872	cmd.exe	netsh.exe
PID 3872 wrote to memory of 756	3872	cmd.exe	netsh.exe
PID 2872 wrote to memory of 4312	2872	cmd.exe	netsh.exe
PID 2872 wrote to memory of 4312	2872	cmd.exe	netsh.exe
PID 2872 wrote to memory of 4312	2872	cmd.exe	netsh.exe
PID 3524 wrote to memory of 4056	3524	cmd.exe	netsh.exe
PID 3524 wrote to memory of 4056	3524	cmd.exe	netsh.exe
PID 3524 wrote to memory of 4056	3524	cmd.exe	netsh.exe
PID 3336 wrote to memory of 1908	3336	kua1250.tmp	K8Update.exe
PID 3336 wrote to memory of 1908	3336	kua1250.tmp	K8Update.exe
PID 3336 wrote to memory of 1908	3336	kua1250.tmp	K8Update.exe
PID 3336 wrote to memory of 1648	3336	kua1250.tmp	regsvr32.exe
PID 3336 wrote to memory of 1648	3336	kua1250.tmp	regsvr32.exe
PID 3336 wrote to memory of 1648	3336	kua1250.tmp	regsvr32.exe
PID 1648 wrote to memory of 2716	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 2716	1648	regsvr32.exe	regsvr32.exe
PID 3336 wrote to memory of 3984	3336	kua1250.tmp	regsvr32.exe
PID 3336 wrote to memory of 3984	3336	kua1250.tmp	regsvr32.exe
PID 3336 wrote to memory of 3984	3336	kua1250.tmp	regsvr32.exe
PID 3984 wrote to memory of 2400	3984	regsvr32.exe	regsvr32.exe
PID 3984 wrote to memory of 2400	3984	regsvr32.exe	regsvr32.exe
PID 3336 wrote to memory of 4504	3336	kua1250.tmp	K8GM.exe
PID 3336 wrote to memory of 4504	3336	kua1250.tmp	K8GM.exe
PID 3336 wrote to memory of 4504	3336	kua1250.tmp	K8GM.exe
PID 3336 wrote to memory of 1100	3336	kua1250.tmp	K8Bubble.exe
PID 3336 wrote to memory of 1100	3336	kua1250.tmp	K8Bubble.exe
PID 3336 wrote to memory of 1100	3336	kua1250.tmp	K8Bubble.exe
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE
PID 1100 wrote to memory of 2440	1100	K8Bubble.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe
"C:\Users\Admin\AppData\Local\Temp\692c19600eea6780871ff14efd422558d5493a2ddf435a7433fc2d0bda23d1cd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\~GMFE0C.exe
"C:\Users\Admin\AppData\Local\Temp\~GMFE0C.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1552
3⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1624
3⤵
- Program crash
PID:2228

C:\Users\Admin\AppData\Local\Temp\kua1250.tmp
C:\Users\Admin\AppData\Local\Temp\kua1250.tmp
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
4⤵
- Modifies Windows Firewall
PID:756

C:\Program Files (x86)\Kuai8\K8GM.exe
"C:\Program Files (x86)\Kuai8\K8GM.exe" -update_data
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:3120

C:\Program Files (x86)\Kuai8\K8Update.exe
"C:\Program Files (x86)\Kuai8\K8Update.exe" -install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1908

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll"
4⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2716

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll"
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2400

C:\Program Files (x86)\Kuai8\K8GM.exe
"C:\Program Files (x86)\Kuai8\K8GM.exe" -show=3 -atonce
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Program Files (x86)\Kuai8\K8Update.exe
"C:\Program Files (x86)\Kuai8\K8Update.exe" -update -delay=3 -type=1
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:5004

C:\Program Files (x86)\Kuai8\K8Update.exe
"C:\Program Files (x86)\Kuai8\K8Update.exe" -installrun
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1180

C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe
"C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe" -query_action
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3536 -ip 3536
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3536 -ip 3536
1⤵
PID:3836

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
1⤵
- Modifies Windows Firewall
PID:364

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
1⤵
- Modifies Windows Firewall
PID:4312

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
1⤵
- Modifies Windows Firewall
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Kuai8\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\K8DLPlatform.exe
Filesize
1.9MB

MD5
fbf0dbcabfa89252e91d9c0e958d154f

SHA1
9c987ecb1d15549422f195575e39be170bfdf278

SHA256
2a3155ac36d457d6122e5e7e2cc4213433338c1dec9ac3dc7ae138a7a7c633ce

SHA512
8122e2f8612a25f5a0e6e4b433c8719cba99261ef093e83620cfeb2c8a09fefa66a3eb84efc8863426cc6d657725ed98487357ceab045f4209f947d9769d15b3

Download Submit
C:\Program Files (x86)\Kuai8\K8DLUtils.dll
Filesize
860KB

MD5
9632c62399f6361537a64f341f33e459

SHA1
bf1a075b2410d866043a926945b51056b27c36c6

SHA256
f7456214786dfdeeeee79c83101f5a00f4ab4c72dadd438b988f9547efae4723

SHA512
ee32be1248828dfd32d278b8fea6912a7b8265eaad25e7ca3db7624e05fe3937621bc5e36160691aff3a090cb7346bbf3074ced27c8a16589957ee7a0faee16f

Download Submit
C:\Program Files (x86)\Kuai8\K8DLUtils.dll
Filesize
860KB

MD5
9632c62399f6361537a64f341f33e459

SHA1
bf1a075b2410d866043a926945b51056b27c36c6

SHA256
f7456214786dfdeeeee79c83101f5a00f4ab4c72dadd438b988f9547efae4723

SHA512
ee32be1248828dfd32d278b8fea6912a7b8265eaad25e7ca3db7624e05fe3937621bc5e36160691aff3a090cb7346bbf3074ced27c8a16589957ee7a0faee16f

Download Submit
C:\Program Files (x86)\Kuai8\K8DLUtils.dll
Filesize
860KB

MD5
9632c62399f6361537a64f341f33e459

SHA1
bf1a075b2410d866043a926945b51056b27c36c6

SHA256
f7456214786dfdeeeee79c83101f5a00f4ab4c72dadd438b988f9547efae4723

SHA512
ee32be1248828dfd32d278b8fea6912a7b8265eaad25e7ca3db7624e05fe3937621bc5e36160691aff3a090cb7346bbf3074ced27c8a16589957ee7a0faee16f

Download Submit
C:\Program Files (x86)\Kuai8\K8DLUtils.dll
Filesize
860KB

MD5
9632c62399f6361537a64f341f33e459

SHA1
bf1a075b2410d866043a926945b51056b27c36c6

SHA256
f7456214786dfdeeeee79c83101f5a00f4ab4c72dadd438b988f9547efae4723

SHA512
ee32be1248828dfd32d278b8fea6912a7b8265eaad25e7ca3db7624e05fe3937621bc5e36160691aff3a090cb7346bbf3074ced27c8a16589957ee7a0faee16f

Download Submit
C:\Program Files (x86)\Kuai8\K8GM.exe
Filesize
6.9MB

MD5
dd3248d784e363318e9a08c4f9353981

SHA1
e4e81a1e9757c165f57ed2adf310041ce9e93ee2

SHA256
e21342382c664d3c9c3a1180bee8c3289e00fb04ff91072abdfc376d3db6f31b

SHA512
a87ce1fa2b9b2e4e4744c5abaf3ffaab4760b61782d79011602abd72f195733aea90412a54e2b551f14ee126916e96a97f216625a82f527d1b3eeeea8a5231f0

Download Submit
C:\Program Files (x86)\Kuai8\K8GM.exe
Filesize
6.9MB

MD5
dd3248d784e363318e9a08c4f9353981

SHA1
e4e81a1e9757c165f57ed2adf310041ce9e93ee2

SHA256
e21342382c664d3c9c3a1180bee8c3289e00fb04ff91072abdfc376d3db6f31b

SHA512
a87ce1fa2b9b2e4e4744c5abaf3ffaab4760b61782d79011602abd72f195733aea90412a54e2b551f14ee126916e96a97f216625a82f527d1b3eeeea8a5231f0

Download Submit
C:\Program Files (x86)\Kuai8\K8GM.exe
Filesize
6.9MB

MD5
dd3248d784e363318e9a08c4f9353981

SHA1
e4e81a1e9757c165f57ed2adf310041ce9e93ee2

SHA256
e21342382c664d3c9c3a1180bee8c3289e00fb04ff91072abdfc376d3db6f31b

SHA512
a87ce1fa2b9b2e4e4744c5abaf3ffaab4760b61782d79011602abd72f195733aea90412a54e2b551f14ee126916e96a97f216625a82f527d1b3eeeea8a5231f0

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\K8Update.exe
Filesize
368KB

MD5
95d49848066ab1ccfea86cd300d02dbd

SHA1
17647630d602bb5fa27a8ff5d6fdec9bb786e544

SHA256
62983a47759956dc0dd7b7950caaed0deb63869c2c9849178b7e4700a38f9622

SHA512
81f9d5aa02b838f5e97c3072ec248218e56da92312464e66a0095ba969424b8ac689c05d44d14cf3790a4250786331ed732135c97ce6b2d9964285d8921c7cb9

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll
Filesize
45KB

MD5
7e6bc8d673455e1c8aca65995fc587db

SHA1
814ddae0c3f4bb155197b93edc90ee3d2d8225a2

SHA256
89922da0fa862c02aa0245f9e75ce76dee6a06c9cd8f7c4f42934dd2adbcf783

SHA512
03e720bbfa8848a1def64694c2def70f704f1da5992f36e7490172204610e7a058483dbd93b476ed73356a4ff2e3e65a189ba5980e0c20a64b5c82e663d4a405

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe
Filesize
196KB

MD5
0940b7c4de82c7281ad93b34a060a465

SHA1
9bb2ad71a06ccc8c839ea1aa022afbad46e5b770

SHA256
412ebc64babf46c938c0ae9f0054b88b31318ae19760b131ae2395daa85845ae

SHA512
fdbcc5f16c3e203f903f5fb72547876717bb19498bd08a8305ad3548bba4c8d633900a4f2428b8456c674456697ffc859a9831011aa1e6c567c045fccedeca5a

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8Common.dll
Filesize
3.3MB

MD5
d9e0dcc91cff9421f21b953e5658f451

SHA1
325bac769751b6fd82527d86d1d62f8383cbf2a1

SHA256
8cf8fb3b0398daf38b8797004ea01cc0a3e4edd32a31c9b40a7d1e9d67782cbc

SHA512
9e76413e00f6c034307343b4bba4f75003bf4a56a7e7d56777aa5cc6c9f0bc1699ee6d5ac888835224d27bc3490b27239ad39de8c4e0da583e8a9796f9b154e3

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe
Filesize
232KB

MD5
646af4feafbc0726b7f7377b65878984

SHA1
1a89bdb85fcc6f484f9bb392c76ea8703e12d33d

SHA256
8cf9855c67b443a3d3b547a5b7bce6dd7f6f3f7ba340c8d4011fbb0c5e13696a

SHA512
431721177423af50af9c6242f485b48e465b13b3bc3605d36e2d9907a85db11a7b61691296501fc3d77088d1f5bf727d9305a28d0b5eea6b69255cb8ee6a8af0

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe
Filesize
508KB

MD5
ec9b921c5af3bbbde0fc180dab987e59

SHA1
91668a6737716d3b0d302201266cd87e6ec3b91c

SHA256
01b80e06404afdd50d1c7606c171ec7987a12febed064594b591e63ac3918f20

SHA512
c0c8e57ca16bb03f8f2e97e8d654418b31a52ed4e54f8b7309d6c51f579ef07d7832add39d3a8e74a61addc6b411e461e0fffcad721e0a660d163b355829073a

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8UIRender.dll
Filesize
1.1MB

MD5
cf856cfedbacc6f4a1bc8a6b2b8d7d7f

SHA1
f2d4e4ffec48a86905413e94e5c27e228df311bb

SHA256
9ab18f5ba803f3625519945f0814635c789fbb8927728d4f1405439e78bb91c2

SHA512
54e6a4a6d5a030f483255bb896d163bbaf47eb60d3e30f6c3b7c9753c236a2db19d27daa4d6d88cdd2ffb181a22842cae39a010f749bf2160400147eda8d3af4

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll
Filesize
1.1MB

MD5
ed42649f34d6793a22b07c8100b29565

SHA1
932c9bc65452861bc7d2224085f8ed22a3d71431

SHA256
cfd266e6240fcab22d9dcb6619bd865c817bf087f40dc08589af6df55bc59325

SHA512
95d87a0f357710795b754ce8704b91a410bdd08d29b65dca2f7739f359773c1e7283a607d9209a3749215f82ceba37ddac0f622768afc106b8906c7cfc86b2ba

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll
Filesize
1.1MB

MD5
ed42649f34d6793a22b07c8100b29565

SHA1
932c9bc65452861bc7d2224085f8ed22a3d71431

SHA256
cfd266e6240fcab22d9dcb6619bd865c817bf087f40dc08589af6df55bc59325

SHA512
95d87a0f357710795b754ce8704b91a410bdd08d29b65dca2f7739f359773c1e7283a607d9209a3749215f82ceba37ddac0f622768afc106b8906c7cfc86b2ba

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll
Filesize
1.1MB

MD5
ed42649f34d6793a22b07c8100b29565

SHA1
932c9bc65452861bc7d2224085f8ed22a3d71431

SHA256
cfd266e6240fcab22d9dcb6619bd865c817bf087f40dc08589af6df55bc59325

SHA512
95d87a0f357710795b754ce8704b91a410bdd08d29b65dca2f7739f359773c1e7283a607d9209a3749215f82ceba37ddac0f622768afc106b8906c7cfc86b2ba

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll
Filesize
1.1MB

MD5
e57e46a3edc4f15363ea8a2c06ca0e45

SHA1
34d6769288c1e0ccd4e78076a4135190fcf7cf93

SHA256
a0768ae5db707705bbfebc0d4c272df6390f8fa0dfb0eef19553cf229417c5a7

SHA512
4358e8c148b7814a525772795bad78475e2cd5b4e8493a1b4c94a95558af0f379248a27fb8fd4edef483f23f4e0cf15eb44bfa19162e4576be9f7754317d623f

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll
Filesize
1.1MB

MD5
e57e46a3edc4f15363ea8a2c06ca0e45

SHA1
34d6769288c1e0ccd4e78076a4135190fcf7cf93

SHA256
a0768ae5db707705bbfebc0d4c272df6390f8fa0dfb0eef19553cf229417c5a7

SHA512
4358e8c148b7814a525772795bad78475e2cd5b4e8493a1b4c94a95558af0f379248a27fb8fd4edef483f23f4e0cf15eb44bfa19162e4576be9f7754317d623f

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll
Filesize
1.1MB

MD5
e57e46a3edc4f15363ea8a2c06ca0e45

SHA1
34d6769288c1e0ccd4e78076a4135190fcf7cf93

SHA256
a0768ae5db707705bbfebc0d4c272df6390f8fa0dfb0eef19553cf229417c5a7

SHA512
4358e8c148b7814a525772795bad78475e2cd5b4e8493a1b4c94a95558af0f379248a27fb8fd4edef483f23f4e0cf15eb44bfa19162e4576be9f7754317d623f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kua1250.tmp
Filesize
10.9MB

MD5
99f6bee1877dba83d4379de73fcd88f7

SHA1
11ecd3f579c938aa1dafeee0ca3c7cbf8995ffae

SHA256
4ec33557cdd2aae2bbac1203e04a21cd9dfa064e5be3fc25d5f86465b514e140

SHA512
61976035ecdb3581f088357da4613d4bb0e2e7f1794488fdc49d39f6a4a8dd50e78a7ce70ea7be57ae3a48d49c4b112df715880837bc029630e4cd24ecf5f58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kua1250.tmp
Filesize
10.9MB

MD5
99f6bee1877dba83d4379de73fcd88f7

SHA1
11ecd3f579c938aa1dafeee0ca3c7cbf8995ffae

SHA256
4ec33557cdd2aae2bbac1203e04a21cd9dfa064e5be3fc25d5f86465b514e140

SHA512
61976035ecdb3581f088357da4613d4bb0e2e7f1794488fdc49d39f6a4a8dd50e78a7ce70ea7be57ae3a48d49c4b112df715880837bc029630e4cd24ecf5f58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\K8NsisMiniExtend.dll
Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa4836.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~GMFE0C.exe
Filesize
1.1MB

MD5
55dac6b4a708ec613fff6a69f1871be2

SHA1
d029cc81e652a4e86d4052be3d13b496337d66ce

SHA256
9b23fbd66fbfc71705383c2e75ba1eb1ed6af881d4d554dbcf2d2c3cea11ff16

SHA512
58e74c7e43e9e5710f6203a4335e6c509cc9cf11e0630be6442c5edce0885151e88844315c9e7e0debf04a143f570ff8401cefe29aeefabd66c41676a40dacfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~GMFE0C.exe
Filesize
1.1MB

MD5
55dac6b4a708ec613fff6a69f1871be2

SHA1
d029cc81e652a4e86d4052be3d13b496337d66ce

SHA256
9b23fbd66fbfc71705383c2e75ba1eb1ed6af881d4d554dbcf2d2c3cea11ff16

SHA512
58e74c7e43e9e5710f6203a4335e6c509cc9cf11e0630be6442c5edce0885151e88844315c9e7e0debf04a143f570ff8401cefe29aeefabd66c41676a40dacfd

Download Submit
C:\Users\Admin\AppData\Roaming\Kuai8\data\database.gmx
Filesize
2.6MB

MD5
8cc834b34b663ea0cb2e3aa0ade74eb8

SHA1
d4e8b97e4bd5862bb7b9f2106b8f25b348c82307

SHA256
ac19137c53bc6bb43f22bcb5eab01d8ba042598657f1c6a5f5cb480499d7ebe1

SHA512
b7d3bc7c3b7a1b5ca8a49719e65c0c2199a580cb0dc7d6c9f13e22d4235049522e219b08dbf092aadf53cfecb60b84b0eed82b89f59045141e5a0244ca959156

Download Submit
C:\Users\Admin\AppData\Roaming\Kuai8\data\plugin\scan.gmx
Filesize
642KB

MD5
d190f1a6943c0aa71c378173aedc8545

SHA1
2bdaa0c1099341b77bcb64c71e4f764a078fe94c

SHA256
ae45c93318620540e89d40800dd2120f6ee4782813c557dae1a8035758d67fd9

SHA512
b068f62420e75f2b04683bc8d752895006b8f21d825e60ce768889103d3513343ea4e045255a941baf51c4326164bbd8989e06a00876ce37b0bf13a8e67217bd

Download Submit
C:\Users\Admin\AppData\Roaming\Kuai8\data\plugin\search.gmx
Filesize
1016B

MD5
b8490c1c39dfb7bc9b998545190c6803

SHA1
5257c23d3915197ac3d84ffc2233adbc5e9f5abf

SHA256
232b7292e81fb2f2a26fe5fed26355d839411172cf09113a0d1c9b741c5ff918

SHA512
0b0221d850d86e5a5ade3ac59f7dbfa53e25183e3ea66e2f11f06bdf85dc01daa9c0c7c344211af155fbf676f3c6ce81f9fb8ba5501ff77fb7a0dff51d4dd7b8

Download Submit
C:\Users\Admin\AppData\Roaming\Kuai8\data\plugin\top.gmx
Filesize
1KB

MD5
0cdb4d571f2ddc52f5fb7936b5ce54bd

SHA1
83351729e5b203f229816747f2679e3e6da7e1ff

SHA256
3b4d8c525dfdf31ae8a02cd22b5042340a18442035648c100b3459e0f710561e

SHA512
cffe12924a95b965c353c4d483059ec32b51fe23c41b15e49bc50a99516edc826ee85678a19f535464c516654564822388acb5939048be9d20d852908e864311

Download Submit
memory/364-203-0x0000000000000000-mapping.dmp

Download
memory/756-208-0x0000000000000000-mapping.dmp

Download
memory/844-202-0x0000000000000000-mapping.dmp

Download
memory/844-218-0x0000000001200000-0x0000000001547000-memory.dmp

Filesize
3.3MB

Download
memory/844-214-0x00000000010E0000-0x00000000011F4000-memory.dmp

Filesize
1.1MB

Download
memory/844-217-0x0000000001201000-0x0000000001456000-memory.dmp

Filesize
2.3MB

Download
memory/844-224-0x0000000002D51000-0x0000000002D54000-memory.dmp

Filesize
12KB

Download
memory/1100-269-0x0000000000760000-0x0000000000874000-memory.dmp

Filesize
1.1MB

Download
memory/1100-273-0x00000000023E1000-0x00000000023E4000-memory.dmp

Filesize
12KB

Download
memory/1100-262-0x0000000000000000-mapping.dmp

Download
memory/1180-281-0x00000000007A0000-0x00000000008B4000-memory.dmp

Filesize
1.1MB

Download
memory/1180-280-0x0000000000000000-mapping.dmp

Download
memory/1180-283-0x0000000002241000-0x0000000002244000-memory.dmp

Filesize
12KB

Download
memory/1648-239-0x0000000000000000-mapping.dmp

Download
memory/1908-238-0x0000000000A91000-0x0000000000A94000-memory.dmp

Filesize
12KB

Download
memory/1908-229-0x0000000000000000-mapping.dmp

Download
memory/1908-234-0x00000000008E0000-0x00000000009F4000-memory.dmp

Filesize
1.1MB

Download
memory/2400-247-0x0000000000000000-mapping.dmp

Download
memory/2716-242-0x0000000000000000-mapping.dmp

Download
memory/2872-201-0x0000000000000000-mapping.dmp

Download
memory/3120-198-0x0000000000000000-mapping.dmp

Download
memory/3336-185-0x0000000000000000-mapping.dmp

Download
memory/3524-200-0x0000000000000000-mapping.dmp

Download
memory/3536-170-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-146-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-162-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-184-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-164-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-172-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-176-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-182-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-183-0x0000000000400000-0x00000000005E3000-memory.dmp

Filesize
1.9MB

Download
memory/3536-158-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-156-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-154-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-151-0x0000000000400000-0x00000000005E3000-memory.dmp

Filesize
1.9MB

Download
memory/3536-150-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-148-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-132-0x0000000000000000-mapping.dmp

Download
memory/3536-180-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-178-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-174-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-160-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-144-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-137-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-142-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-139-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-140-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-168-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-138-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-135-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3536-166-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3872-199-0x0000000000000000-mapping.dmp

Download
memory/3984-244-0x0000000000000000-mapping.dmp

Download
memory/4056-220-0x0000000000000000-mapping.dmp

Download
memory/4312-212-0x0000000000000000-mapping.dmp

Download
memory/4504-249-0x0000000000000000-mapping.dmp

Download
memory/5004-277-0x0000000000000000-mapping.dmp

Download
memory/5004-278-0x0000000000890000-0x00000000009A4000-memory.dmp

Filesize
1.1MB

Download
memory/5004-284-0x0000000000651000-0x0000000000654000-memory.dmp

Filesize
12KB

Download