# What it checks The tool checks five kinds of locations: NIKKE installs, launcher data folders, user profiles, Wine prefixes and the launcher's login browser profile. [Where it looks](locations.md) explains how it finds them. Every scan, a folder scan included, also checks the running programs and the hosts file, and on Windows the DLLs that running programs have loaded. Each finding has one of three severities: - `CRITICAL`: the agent was downloaded or ran, the launcher contacted analytics.insightjs.com, or the agent left persistence. A running launcher is critical too when the same scan found one of these signs. - `WARNING`: the launcher loaded the malicious script or contacted insightjs.com. - `INFO`: context, such as an install that was found, a location that could not be checked, or a file that looks related but does not change the verdict. A finding quotes at most 5 evidence lines, each cut to 240 characters. Folder and file names along the paths below are matched without regard to letter case, except the three network-state file names, which must match exactly. ## NIKKE install An install is a folder that holds `Launcher/nikke_launcher.exe`, `Launcher/nikke_launcher_google.exe` (the Google Play Games build, installed in `C:\NIKKE_GOOGLE`) or `Launcher/intl_service/debug.log`. `Launcher/intl_service/debug.log` is read line by line, whatever its size. A line longer than 64 KiB is cut. - A line with `k2f_chan` means the agent ran (critical). The report quotes the `k2f_chan registered`, `adopted `, `resuming `, `agent started as `, `lua downloaded to ...` and `startup failed: ...` lines. - On a Windows user name that is not valid UTF-8 in the system code page, the agent's `sysinfo` fails and `l.js` logs `startup failed: EIO: invalid UTF-8 in string` after `k2f_chan registered` (issues #16 and #21). When every `k2f_chan` line is followed by a `startup failed` line before any `adopted`, `resuming` or `agent started as` line, the finding stays critical but is titled "The malware agent loaded, but its startup failed". No line shows the attacker's server taking over, so the operator most likely never had a session. The log cannot confirm it, and the steps for an infected computer still apply. A launch with one of those three lines, or with neither kind of line before the next `k2f_chan` or the end of the log, gives "The malware agent ran". - A line with `analytics.insightjs.com` or `insight.bundle` is critical: the launcher asked the server that sends the agent. - A line that names `insightjs` without them is a warning. Only the loader ran. One case is the launcher falling back to `insightjs.org`, whose current script fails with a `SyntaxError` at line 61. - The install is listed as info, with the time `debug.log` was last written, or a note that the file is missing. The launcher appends to `debug.log` at each launch, so the file holds every launch since it was created. - A `debug.log` that exists but cannot be read is an info finding under "What this scan could not check". The first answer then shows "No" in orange, because the scan could not tell whether the agent ran. Every file under `Launcher/log/`, up to 8 levels down and 64 MiB, is read too. This includes the `tinyget` logs, one file per launch. - A file that starts with LuaJIT bytecode (the bytes `1B 4C 4A`) is the downloaded agent itself (critical). The launcher saves the agent under a `tinyget` log name. The report gives the file size. The known builds are 205,135 bytes, and an Oct 23 build saved as `k2f.lua` was 165,108 bytes. - `insight.bundle` in a file with a finished download means the launcher downloaded the agent (critical). A finished download is an `OnDownloadResult` line for `insight.bundle` with `result=0` and a `total=` above 0, or a `curl perform success` line for it. The report names the file and gives the time from the log line. - `insight.bundle` with no finished download is a warning: the loader asked for the agent, but the request failed (for example `curl_error=7`, `result=2`, `total=0` once the server stopped answering), so it does not show that the agent arrived. - In a file without `insight.bundle`, `analytics.insightjs.com` is critical, and `insightjs` alone is a warning, as in `debug.log`. ### Agent runs and payload builds These lines do not change the verdict. They make up the agent runs and the payload build of the first answer. - Runs come from the `debug.log` lines `lua downloaded to log\tinyget\` (the download, saved as `tinyget.