Trojan.Siggen9.51714

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYFlash.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђflashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYDLPlatform.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool\WYPluginFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool\WYRTLFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГ”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYGM.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђВ№ГњГЂГГ†Г·" mode=ENABLE scope=ALL

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nskde23.tmp
%APPDATA%\wanyx\slider\slider_201907_20190710160551858.jpg
%TEMP%\gm~1b3d.tmp
%APPDATA%\wanyx\slider\slider_201907_20190710160555146.jpg
%TEMP%\gm~203f.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162607210.jpg
%TEMP%\gm~2b21.tmp
%TEMP%\gm~161c.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162455512.jpg
%TEMP%\gm~268b.tmp
%APPDATA%\wanyx\slider\slider_201912_20191202165721550.gif
%TEMP%\gm~28af.tmp
%APPDATA%\wanyx\slider\slider_201912_20191202165732877.jpg
%APPDATA%\wanyx\slider\slider_202003_20200318101817313.jpg
%TEMP%\gm~2570.tmp
%APPDATA%\wanyx\slider\slider_201605_20160523162136750.gif
%TEMP%\gm~f8b5.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162614144.jpg
%TEMP%\gm~a5e.tmp
%TEMP%\gm~fe82.tmp
%TEMP%\gm~51b.tmp
%TEMP%\gm~52b.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162327655.jpg
%TEMP%\gm~740.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162401448.jpg
%TEMP%\gm~1407.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162452269.jpg
%APPDATA%\wanyx\slider\slider_201911_20191101162639705.jpg
%TEMP%\gm~d9c.tmp
%TEMP%\gm~fcf.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162358754.jpg
%TEMP%\gm~11f3.tmp
%APPDATA%\wanyx\slider\slider_201911_20191101162633286.jpg
%TEMP%\gm~c91.tmp
%APPDATA%\wanyx\slider\slider_202006_20200603162323534.jpg
%APPDATA%\wanyx\slider\slider_201609_20160912133331969.gif
%TEMP%\gm~2f79.tmp
%TEMP%\gm~45a3.tmp
%TEMP%\gm~4612.tmp
%TEMP%\gm~472c.tmp
%TEMP%\gm~48f2.tmp
%TEMP%\gm~4a1c.tmp
%TEMP%\gm~435f.tmp
%TEMP%\gm~43fc.tmp
%TEMP%\gm~5ebe.tmp
%TEMP%\gm~61af.tmp
%TEMP%\gm~675e.tmp
%TEMP%\gm~6878.tmp
%TEMP%\gm~6327.tmp
%TEMP%\gm~6993.tmp
%TEMP%\gm~5fa9.tmp
%TEMP%\gm~60e3.tmp
%APPDATA%\wanyx\slider\slider_201608_20160817130948555.gif
%TEMP%\gm~2d16.tmp
%TEMP%\gm~4021.tmp
%TEMP%\gm~30a3.tmp
%TEMP%\gm~31ad.tmp
%TEMP%\gm~31be.tmp
%TEMP%\gm~32d8.tmp
%TEMP%\gm~3fb3.tmp
%TEMP%\gm~2e6e.tmp
%TEMP%\gm~41d7.tmp
%TEMP%\gm~33f3.tmp
%TEMP%\gm~3956.tmp
%TEMP%\gm~3966.tmp
%TEMP%\gm~3ca4.tmp
%TEMP%\gm~3a71.tmp
%TEMP%\gm~3403.tmp
%TEMP%\gm~3732.tmp
%TEMP%\gm~3731.tmp
%TEMP%\gm~f7aa.tmp
%TEMP%\gm~f690.tmp
%TEMP%\gm~f576.tmp
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wycommon.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wyuirender.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wydlutils.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wytips.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wymini.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\uninstall.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\wyurlencrypt.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\msvcr80.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\msvcp80.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\msvcr80.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\wyshell.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\wyshellicon.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\wycommon.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wypluginfix.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wyrtlfix.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wybugreport.exe
%TEMP%\nszde33.tmp\wynsisminiextend.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wygm.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wyflash.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wybrowser.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wyweb.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\msvcp80.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\microsoft.vc80.crt.manifest
%TEMP%\nszde33.tmp\system.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wyurlencrypt.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wycommon.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wydlutils.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wydlplatform.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wyuirender.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wyversion.dll
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\wyupdate.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool\wybubble.exe
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\msvcp80.dll
%APPDATA%\wanyx\data\local\recent.xml
%APPDATA%\wanyx\data\search.gms-journal
%APPDATA%\wanyx\data\search.gms
%APPDATA%\wanyx\config\config.xml
%APPDATA%\wanyx\cache.xml
%TEMP%\wanyxtemp\restart.gmt
%APPDATA%\microsoft\windows\start menu\programs\ГГ¦ГіГ®ГЇВ·В°Г©\ГГ¦ГіГ®ГЇВ·ГІВіГіГ®ВґГіГ¬Гј.lnk
%APPDATA%\wanyx\data\local\user.xml
%TEMP%\gm~daa3.tmp
%TEMP%\gm~e380.tmp
%TEMP%\gm~e6dc.tmp
%TEMP%\gm~e854.tmp
%TEMP%\gm~e9bd.tmp
%TEMP%\gm~d6f9.tmp
%TEMP%\gm~e15b.tmp
%TEMP%\gm~e275.tmp
%APPDATA%\microsoft\windows\start menu\programs\ГГ¦ГіГ®ГЇВ·В°Г©\Г°В¶ГґГёГГ¦ГіГ®ГЇВ·ВєГ°.lnk
%APPDATA%\microsoft\windows\start menu\programs\ГГ¦ГіГ®ГЇВ·В°Г©\ГГ¦ГіГ®ГЇВ·flashВІВҐВ·ГҐГ¦Г·.lnk
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\tool_x64\msvcr80.dll
%APPDATA%\wanyx\data\plugin\hot.gmx
%APPDATA%\wanyx\data\plugin\top.gmx
%APPDATA%\wanyx\data\plugin\scan.gmx
%APPDATA%\wanyx\data\plugin\netwl.gmx
%APPDATA%\wanyx\data\plugin\inwl.gmx
%APPDATA%\wanyx\data\plugin\pc.gmx
%APPDATA%\wanyx\data\database.gmx
%ProgramFiles(x86)%\ГГ¦ГіГ®ГЇВ·В°Г©\audio\complete.wav
%APPDATA%\wanyx\update.ini
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\玩游戏盒.lnk
%APPDATA%\microsoft\internet explorer\quick launch\ГГ¦ГіГ®ГЇВ·В°Г©.lnk
%HOMEPATH%\desktop\ГГ¦ГіГ®ГЇВ·В°Г©.lnk
%HOMEPATH%\desktop\ГГ¦ГіГ®ГЇВ·ГІВіГіГ®ВґГіГ¬Гј.lnk
%APPDATA%\microsoft\windows\start menu\programs\ГГ¦ГіГ®ГЇВ·В°Г©\ГГ¦ГіГ®ГЇВ·В°Г©.lnk
%TEMP%\gm~3d97.tmp
%TEMP%\gm~6ba7.tmp
%TEMP%\gm~6bf6.tmp

Удаляет следующие файлы

%APPDATA%\wanyx\data\plugin\hot.gmx
%TEMP%\nszde33.tmp\system.dll
%TEMP%\nszde33.tmp\wynsisminiextend.dll
%APPDATA%\wanyx\data\search.gms-journal
%APPDATA%\wanyx\data\plugin\top.gmx

Перемещает следующие файлы

%TEMP%\gm~d6f9.tmp в %APPDATA%\wanyx\pic\70568.gmp
%TEMP%\gm~32d8.tmp в %APPDATA%\wanyx\pic\15585.gmp
%TEMP%\gm~33f3.tmp в %APPDATA%\wanyx\pic\70811.gmp
%TEMP%\gm~3403.tmp в %APPDATA%\wanyx\pic\16373.gmp
%TEMP%\gm~3731.tmp в %APPDATA%\wanyx\pic\70812.gmp
%TEMP%\gm~3732.tmp в %APPDATA%\wanyx\pic\03838.gmp
%TEMP%\gm~3956.tmp в %APPDATA%\wanyx\pic\16388.gmp
%TEMP%\gm~3966.tmp в %APPDATA%\wanyx\pic\70813.gmp
%TEMP%\gm~3ca4.tmp в %APPDATA%\wanyx\pic\70815.gmp
%TEMP%\gm~3a71.tmp в %APPDATA%\wanyx\pic\16423.gmp
%TEMP%\gm~3fb3.tmp в %APPDATA%\wanyx\pic\16541.gmp
%TEMP%\gm~4021.tmp в %APPDATA%\wanyx\pic\70819.gmp
%TEMP%\gm~41d7.tmp в %APPDATA%\wanyx\pic\16700.gmp
%TEMP%\gm~435f.tmp в %APPDATA%\wanyx\pic\70827.gmp
%TEMP%\gm~43fc.tmp в %APPDATA%\wanyx\pic\16714.gmp
%TEMP%\gm~4612.tmp в %APPDATA%\wanyx\pic\16720.gmp
%TEMP%\gm~45a3.tmp в %APPDATA%\wanyx\pic\70830.gmp
%TEMP%\gm~472c.tmp в %APPDATA%\wanyx\pic\16748.gmp
%TEMP%\gm~48f2.tmp в %APPDATA%\wanyx\pic\70834.gmp
%TEMP%\gm~4a1c.tmp в %APPDATA%\wanyx\pic\16757.gmp
%TEMP%\gm~5ebe.tmp в %APPDATA%\wanyx\pic\70835.gmp
%TEMP%\gm~5fa9.tmp в %APPDATA%\wanyx\pic\16766.gmp
%TEMP%\gm~60e3.tmp в %APPDATA%\wanyx\pic\70836.gmp
%TEMP%\gm~61af.tmp в %APPDATA%\wanyx\pic\16770.gmp
%TEMP%\gm~675e.tmp в %APPDATA%\wanyx\pic\16796.gmp
%TEMP%\gm~6878.tmp в %APPDATA%\wanyx\pic\16842.gmp
%TEMP%\gm~6327.tmp в %APPDATA%\wanyx\pic\70837.gmp
%TEMP%\gm~6993.tmp в %APPDATA%\wanyx\pic\16852.gmp
%TEMP%\gm~31ad.tmp в %APPDATA%\wanyx\pic\14219.gmp
%TEMP%\gm~6ba7.tmp в %APPDATA%\wanyx\pic\16855.gmp
%TEMP%\gm~31be.tmp в %APPDATA%\wanyx\pic\70806.gmp
%TEMP%\gm~2f79.tmp в %APPDATA%\wanyx\pic\70803.gmp
%TEMP%\gm~e15b.tmp в %APPDATA%\wanyx\pic\70729.gmp
%TEMP%\gm~e380.tmp в %APPDATA%\wanyx\pic\70943.gmp
%TEMP%\gm~e6dc.tmp в %APPDATA%\wanyx\pic\71021.gmp
%TEMP%\gm~e9bd.tmp в %APPDATA%\wanyx\pic\71045.gmp
%TEMP%\gm~f576.tmp в %APPDATA%\wanyx\pic\71054.gmp
%TEMP%\gm~f690.tmp в %APPDATA%\wanyx\pic\71055.gmp
%TEMP%\gm~f7aa.tmp в %APPDATA%\wanyx\pic\71056.gmp
%TEMP%\gm~f8b5.tmp в %APPDATA%\wanyx\pic\71057.gmp
%TEMP%\gm~fe82.tmp в %APPDATA%\wanyx\pic\71058.gmp
%TEMP%\gm~52b.tmp в %APPDATA%\wanyx\data\plugin\icon.gmx
%TEMP%\gm~51b.tmp в %APPDATA%\wanyx\pic\71059.gmp
%TEMP%\gm~740.tmp в %APPDATA%\wanyx\pic\71060.gmp
%TEMP%\gm~a5e.tmp в %APPDATA%\wanyx\pic\71063.gmp
%TEMP%\gm~c91.tmp в %APPDATA%\wanyx\pic\70710.gmp
%TEMP%\gm~d9c.tmp в %APPDATA%\wanyx\pic\00005.gmp
%TEMP%\gm~fcf.tmp в %APPDATA%\wanyx\pic\70716.gmp
%TEMP%\gm~11f3.tmp в %APPDATA%\wanyx\pic\00011.gmp
%TEMP%\gm~1407.tmp в %APPDATA%\wanyx\pic\70721.gmp
%TEMP%\gm~161c.tmp в %APPDATA%\wanyx\pic\00056.gmp
%TEMP%\gm~1b3d.tmp в %APPDATA%\wanyx\pic\70735.gmp
%TEMP%\gm~203f.tmp в %APPDATA%\wanyx\pic\00126.gmp
%TEMP%\gm~2570.tmp в %APPDATA%\wanyx\pic\70739.gmp
%TEMP%\gm~268b.tmp в %APPDATA%\wanyx\pic\00130.gmp
%TEMP%\gm~28af.tmp в %APPDATA%\wanyx\pic\70744.gmp
%TEMP%\gm~2b21.tmp в %APPDATA%\wanyx\pic\00141.gmp
%TEMP%\gm~2d16.tmp в %APPDATA%\wanyx\pic\70792.gmp
%TEMP%\gm~2e6e.tmp в %APPDATA%\wanyx\pic\00148.gmp
%TEMP%\gm~30a3.tmp в %APPDATA%\wanyx\pic\00151.gmp
%TEMP%\gm~6bf6.tmp в %APPDATA%\wanyx\pic\70838.gmp

Подменяет следующие файлы

%APPDATA%\wanyx\data\plugin\hot.gmx
%APPDATA%\wanyx\data\search.gms-journal
%APPDATA%\wanyx\data\plugin\top.gmx

Сетевая активность

TCP

Запросы HTTP GET

http://up####.wanyxbox.com/update_hot.php?da######################################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/70811.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/15585.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70806.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/14219.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00151.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70803.gmp
http://up####.wanyxbox.com/update_database.php?da##########################################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/00148.gmp
http://ic##.#anyxbox.com/slider/201608/20160817130948555.gif
http://ic##.#anyxbox.com/game_icon/gmp_64/16373.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70792.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00141.gmp
http://ic##.#anyxbox.com/slider/202003/20200318101817313.jpg
http://ic##.#anyxbox.com/slider/201912/20191202165732877.jpg
http://up####.wanyxbox.com/update_icon.php?da############################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/70744.gmp
http://ic##.#anyxbox.com/slider/201912/20191202165721550.gif
http://ic##.#anyxbox.com/slider/201605/20160523162136750.gif
http://ic##.#anyxbox.com/game_icon/gmp_64/00130.gmp
http://ic##.#anyxbox.com/slider/202006/20200603162614144.jpg
http://ic##.#anyxbox.com/slider/201609/20160912133331969.gif
http://ic##.#anyxbox.com/game_icon/gmp_64/70812.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/03838.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16388.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16852.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16842.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16796.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70837.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16770.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70836.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16766.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70835.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16757.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70834.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16748.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16720.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70830.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16714.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70827.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16700.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70819.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16541.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70815.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16423.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70813.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70739.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16855.gmp
http://ic##.#anyxbox.com/slider/202006/20200603162607210.jpg
http://ic##.#anyxbox.com/slider/201907/20190710160555146.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71057.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71056.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71055.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71054.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71045.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71021.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70943.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70729.gmp
http://up####.wanyxbox.com/update_plugin.php?da##################################################################################################################################################...
http://ic##.#anyxbox.com/game_icon/gmp_64/71058.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70568.gmp
http://se#####.wanyxbox.com/time.php?da########
http://up####.wanyxbox.com/update_top.php?da####################################################################
http://up####.wanyxbox.com/fake_iu.php?da########################################################################################################################################################...
http://st##.#anyxbox.com/stat.php?da#############################################################################################################################################################...
http://st##.#anyxbox.com/stat.php?da####################################################################
http://gm#.##nyxbox.com/update_new/update_32_3/update32_1-32_3.xml
http://up####.wanyxbox.com/update_database.php?da######################################################################################
http://up####.wanyxbox.com/update_top.php?da######################################################################################
http://gm#.##nyxbox.com/hot_20/hot_20_28_7.gmx
http://gm#.##nyxbox.com/top/top_16_3.gmx
http://ic##.#anyxbox.com/slider/202006/20200603162323534.jpg
http://st##.#anyxbox.com/online_stat.php?da######################################################################################################################################################...
http://up####.wanyxbox.com/update/?da############################################################################################################################################################...
http://ic##.#anyxbox.com/game_icon/gmp_64/70735.gmp
http://ic##.#anyxbox.com/slider/201907/20190710160551858.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/00056.gmp
http://ic##.#anyxbox.com/slider/202006/20200603162455512.jpg
http://ic##.#anyxbox.com/slider/202006/20200603162452269.jpg
http://ic##.#anyxbox.com/slider/202006/20200603162401448.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70721.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00011.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70716.gmp
http://ic##.#anyxbox.com/slider/202006/20200603162358754.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/00005.gmp
http://ic##.#anyxbox.com/slider/201911/20191101162639705.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70710.gmp
http://up####.wanyxbox.com/update_icon.php?da##########################################################################
http://up####.wanyxbox.com/update_icon.php?da########################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/71063.gmp
http://ic##.#anyxbox.com/slider/201911/20191101162633286.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71060.gmp
http://ic##.#anyxbox.com/slider/202006/20200603162327655.jpg
http://gm#.##nyxbox.com/upicons/upicons_3_8.gmx
http://ic##.#anyxbox.com/game_icon/gmp_64/71059.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00126.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70838.gmp

Запросы HTTP POST

http://up####.wanyxbox.com/update_icon.php?da####################################################################
http://st##.#anyxbox.com/stat/do_stat.php?da##########################################################################################################

UDP

DNS ASK up####.wanyxbox.com
DNS ASK gm#.##nyxbox.com
DNS ASK st##.#anyxbox.com
DNS ASK se#####.wanyxbox.com
DNS ASK ic##.#anyxbox.com

Другое

Ищет следующие окна

ClassName: 'GMBubbleWnd' WindowName: ''
ClassName: 'WanyxGMWnd' WindowName: 'ГЌГ¦Г“ГЋГЏВ·ВєГђ'
ClassName: '' WindowName: 'ГЌГ¦Г“ГЋГЏВ·FlashГ“ГЋГЏВ·'
ClassName: '' WindowName: 'ГЌГ¦Г“ГЋГЏВ·ВєГђГ¤ВЇГЂГЂГ†Г·'
ClassName: '' WindowName: '玩游戏Flash游戏'
ClassName: '' WindowName: '玩游戏盒浏览器'
ClassName: '' WindowName: '玩游戏升级提示'
ClassName: '' WindowName: '玩游戏版本更新'

Создает и запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYGM.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђВ№ГњГЂГГ†Г·" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYFlash.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђflashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYDLPlatform.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool\WYRTLFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГ”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool\WYPluginFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYGM.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђВ№ГњГЂГГ†Г·" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYFlash.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђflashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\WYDLPlatform.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool\WYRTLFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГ”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool\WYPluginFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool_x64\WYShell.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool_x64\WYShell.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool_x64\WYShellIcon.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\ГЌГ¦Г“ГЋГЏВ·В°Г‰\tool_x64\WYShellIcon.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней