Trojan.Siggen11.48680

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYGM.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђВ№ГњГЂГГ†Г·" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYFlash.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђflashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYDLPlatform.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool\WYRTLFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГ”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool\WYPluginFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL

Modifies file system

Creates the following files

%TEMP%\nsreabc.tmp
%TEMP%\gm~3cbe.tmp
%TEMP%\gm~3b75.tmp
%TEMP%\gm~3a3c.tmp
%APPDATA%\wanyx\slider\slider_202007_20200723164813866.jpg
%TEMP%\gm~3684.tmp
%TEMP%\gm~3654.tmp
%TEMP%\gm~3412.tmp
%APPDATA%\wanyx\slider\slider_202007_20200723164807831.jpg
%TEMP%\gm~2d2e.tmp
%APPDATA%\wanyx\slider\slider_202011_20201123163555858.png
%TEMP%\gm~2d2d.tmp
%TEMP%\gm~2994.tmp
%TEMP%\gm~286a.tmp
%TEMP%\gm~24c1.tmp
%TEMP%\gm~3cfd.tmp
%APPDATA%\wanyx\slider\slider_202011_20201123163552534.png
%APPDATA%\wanyx\slider\slider_202011_20201113153948959.jpg
%TEMP%\gm~224f.tmp
%TEMP%\gm~1fee.tmp
%TEMP%\gm~1ca2.tmp
%TEMP%\gm~1a41.tmp
%TEMP%\gm$d.624.1832\wanyx_gamebox_v5.7.1.8342_silent_force_update.exe
%APPDATA%\wanyx\slider\slider_202011_20201113153943308.jpg
%TEMP%\gm~1705.tmp
%APPDATA%\wanyx\slider\slider_201911_20191101162639705.jpg
%TEMP%\gm~15eb.tmp
%TEMP%\gm~15db.tmp
%TEMP%\gm~1156.tmp
%TEMP%\gm~1251.tmp
%TEMP%\gm~101d.tmp
%TEMP%\gm~23e6.tmp
%APPDATA%\wanyx\slider\slider_202007_20200723164836906.jpg
%TEMP%\gm~3e08.tmp
%TEMP%\gm~404a.tmp
%APPDATA%\wanyx\slider\slider_201608_20160817130948555.gif
%TEMP%\gm~5b35.tmp
%TEMP%\gm~5dd5.tmp
%TEMP%\gm~5f2d.tmp
%TEMP%\gm~61ae.tmp
%TEMP%\gm~622c.tmp
%TEMP%\gm~65d6.tmp
%TEMP%\gm~770c.tmp
%TEMP%\gm~68e3.tmp
%TEMP%\gm~699f.tmp
%TEMP%\gm~6d58.tmp
%TEMP%\gm~6f5b.tmp
%TEMP%\gm~6fca.tmp
%TEMP%\gm~7334.tmp
%APPDATA%\wanyx\slider\slider_201609_20160912133331969.gif
%TEMP%\gm~58a5.tmp
%TEMP%\gm~5569.tmp
%APPDATA%\wanyx\slider\slider_202011_20201113154158760.jpg
%TEMP%\gm~5327.tmp
%APPDATA%\wanyx\slider\slider_201912_20191202165732877.jpg
%TEMP%\gm~4f8e.tmp
%APPDATA%\wanyx\slider\slider_202007_20200722170412151.jpg
%TEMP%\gm~4d3c.tmp
%TEMP%\gm~4c03.tmp
%APPDATA%\wanyx\slider\slider_201605_20160523162136750.gif
%TEMP%\gm~453d.tmp
%TEMP%\gm~47ce.tmp
%APPDATA%\wanyx\slider\slider_202007_20200723164842618.jpg
%TEMP%\gm~453c.tmp
%TEMP%\gm~42ac.tmp
%TEMP%\gm~404b.tmp
%APPDATA%\wanyx\slider\slider_201911_20191101162633286.jpg
%TEMP%\gm~6548.tmp
%TEMP%\gm~dcc.tmp
%APPDATA%\wanyx\config\config.xml
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wydlutils.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wyuirender.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\msvcr80.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\msvcp80.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\msvcr80.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\msvcp80.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\wyurlencrypt.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\wycommon.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\wyshellicon.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool_x64\wyshell.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyuirender.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wydlplatform.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wytips.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wydlutils.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyurlencrypt.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wybugreport.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyversion.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyupdate.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyweb.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wybrowser.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyflash.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\msvcr80.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\msvcp80.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\uninstall.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wygm.exe
%TEMP%\nsheacd.tmp\wynsisminiextend.dll
%TEMP%\nsheacd.tmp\system.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wycommon.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wybubble.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wycommon.dll
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wymini.exe
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦ГґГЇВєГ°Г—Гі\Г°В¶ГґГёГГ¦ГіГ®ГЇВ·ВєГ°.lnk
%TEMP%\wanyxtemp\restart.gmt
%APPDATA%\wanyx\data\local\recent.xml
%APPDATA%\wanyx\data\local\user.xml
%APPDATA%\wanyx\data\search.gms-journal
%APPDATA%\wanyx\data\search.gms
%APPDATA%\wanyx\cache.xml
%APPDATA%\wanyx\slider\slider_202011_20201123163458583.jpg
%APPDATA%\wanyx\slider\slider_202011_20201123163451126.jpg
%TEMP%\gm~6d3.tmp
%TEMP%\gm~81c.tmp
%TEMP%\gm~916.tmp
%TEMP%\gm~b1a.tmp
%TEMP%\gm~b79.tmp
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦ГґГЇВєГ°Г—Гі\ГГ¦ГіГ®ГЇВ·ГІВіГіГ®ВґГіГ¬Гј.lnk
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦ГґГЇВєГ°Г—Гі\ГГ¦ГіГ®ГЇВ·flashВІВҐВ·ГҐГ¦Г·.lnk
%APPDATA%\microsoft\windows\start menu\programs\ГґГ¦ГґГЇВєГ°Г—Гі\ГґГ¦ГґГЇВєГ°Г—Гі.lnk
%HOMEPATH%\desktop\ГГ¦ГіГ®ГЇВ·ГІВіГіГ®ВґГіГ¬Гј.lnk
%HOMEPATH%\desktop\ГГ¦ГіГ®ГЇВ·ВєГ°.lnk
%APPDATA%\wanyx\update.ini
%TEMP%\gm~4d74.tmp
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\audio\complete.wav
%APPDATA%\wanyx\data\plugin\pc.gmx
%APPDATA%\wanyx\data\plugin\inwl.gmx
%APPDATA%\wanyx\data\plugin\netwl.gmx
%APPDATA%\wanyx\data\plugin\scan.gmx
%APPDATA%\wanyx\data\plugin\top.gmx
%APPDATA%\wanyx\data\plugin\hot.gmx
%APPDATA%\wanyx\data\database.gmx
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wypluginfix.exe
%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\tool\wyrtlfix.exe
%TEMP%\gm~d7d.tmp
%TEMP%\gm~7b41.tmp

Deletes the following files

%APPDATA%\wanyx\data\plugin\hot.gmx
%TEMP%\nsheacd.tmp\system.dll
%TEMP%\nsheacd.tmp\wynsisminiextend.dll
%APPDATA%\wanyx\data\search.gms-journal
%APPDATA%\wanyx\data\plugin\top.gmx

Moves the following files

from %TEMP%\gm~81c.tmp to %APPDATA%\wanyx\data\plugin\icon.gmx
from %TEMP%\gm~404b.tmp to %APPDATA%\wanyx\pic\70803.gmp
from %TEMP%\gm~42ac.tmp to %APPDATA%\wanyx\pic\71087.gmp
from %TEMP%\gm~453c.tmp to %APPDATA%\wanyx\pic\70806.gmp
from %TEMP%\gm~453d.tmp to %APPDATA%\wanyx\pic\14219.gmp
from %TEMP%\gm~47ce.tmp to %APPDATA%\wanyx\pic\70811.gmp
from %TEMP%\gm~4c03.tmp to %APPDATA%\wanyx\pic\16373.gmp
from %TEMP%\gm~4d3c.tmp to %APPDATA%\wanyx\pic\70812.gmp
from %TEMP%\gm~4f8e.tmp to %APPDATA%\wanyx\pic\16388.gmp
from %TEMP%\gm~5327.tmp to %APPDATA%\wanyx\pic\70813.gmp
from %TEMP%\gm~5569.tmp to %APPDATA%\wanyx\pic\00011.gmp
from %TEMP%\gm~58a5.tmp to %APPDATA%\wanyx\pic\70815.gmp
from %TEMP%\gm~5dd5.tmp to %APPDATA%\wanyx\pic\70819.gmp
from %TEMP%\gm~770c.tmp to %APPDATA%\wanyx\pic\70837.gmp
from %TEMP%\gm~5f2d.tmp to %APPDATA%\wanyx\pic\00126.gmp
from %TEMP%\gm~61ae.tmp to %APPDATA%\wanyx\pic\70827.gmp
from %TEMP%\gm~622c.tmp to %APPDATA%\wanyx\pic\00130.gmp
from %TEMP%\gm~6548.tmp to %APPDATA%\wanyx\pic\70830.gmp
from %TEMP%\gm~65d6.tmp to %APPDATA%\wanyx\pic\00141.gmp
from %TEMP%\gm~68e3.tmp to %APPDATA%\wanyx\pic\70834.gmp
from %TEMP%\gm~699f.tmp to %APPDATA%\wanyx\pic\00148.gmp
from %TEMP%\gm~6d58.tmp to %APPDATA%\wanyx\pic\00151.gmp
from %TEMP%\gm~6f5b.tmp to %APPDATA%\wanyx\pic\70835.gmp
from %TEMP%\gm~6fca.tmp to %APPDATA%\wanyx\pic\16423.gmp
from %TEMP%\gm~7334.tmp to %APPDATA%\wanyx\pic\70836.gmp
from %TEMP%\gm~404a.tmp to %APPDATA%\wanyx\pic\71086.gmp
from %TEMP%\gm~5b35.tmp to %APPDATA%\wanyx\pic\00056.gmp
from %TEMP%\gm~3e08.tmp to %APPDATA%\wanyx\pic\71085.gmp
from %TEMP%\gm~1fee.tmp to %APPDATA%\wanyx\pic\71074.gmp
from %TEMP%\gm~916.tmp to %APPDATA%\wanyx\pic\70729.gmp
from %TEMP%\gm~b79.tmp to %APPDATA%\wanyx\pic\70943.gmp
from %TEMP%\gm~dcc.tmp to %APPDATA%\wanyx\pic\71021.gmp
from %TEMP%\gm~101d.tmp to %APPDATA%\wanyx\pic\71054.gmp
from %TEMP%\gm~1251.tmp to %APPDATA%\wanyx\pic\70710.gmp
from %TEMP%\gm~1156.tmp to %APPDATA%\wanyx\pic\71055.gmp
from %TEMP%\gm~15db.tmp to %APPDATA%\wanyx\pic\71056.gmp
from %TEMP%\gm~15eb.tmp to %APPDATA%\wanyx\pic\70716.gmp
from %TEMP%\gm~1705.tmp to %APPDATA%\wanyx\pic\71058.gmp
from %TEMP%\gm~1a41.tmp to %APPDATA%\wanyx\pic\71059.gmp
from %TEMP%\gm~1ca2.tmp to %APPDATA%\wanyx\pic\71073.gmp
from %TEMP%\gm~224f.tmp to %APPDATA%\wanyx\pic\71075.gmp
from %TEMP%\gm~3cbe.tmp to %APPDATA%\wanyx\pic\71084.gmp
from %TEMP%\gm~23e6.tmp to %APPDATA%\wanyx\pic\70721.gmp
from %TEMP%\gm~24c1.tmp to %APPDATA%\wanyx\pic\71077.gmp
from %TEMP%\gm~286a.tmp to %APPDATA%\wanyx\pic\70735.gmp
from %TEMP%\gm~2994.tmp to %APPDATA%\wanyx\pic\71078.gmp
from %TEMP%\gm~2d2d.tmp to %APPDATA%\wanyx\pic\70739.gmp
from %TEMP%\gm~2d2e.tmp to %APPDATA%\wanyx\pic\71079.gmp
from %TEMP%\gm~3412.tmp to %APPDATA%\wanyx\pic\71080.gmp
from %TEMP%\gm~3654.tmp to %APPDATA%\wanyx\pic\70744.gmp
from %TEMP%\gm~3684.tmp to %APPDATA%\wanyx\pic\71081.gmp
from %TEMP%\gm~3a3c.tmp to %APPDATA%\wanyx\pic\71082.gmp
from %TEMP%\gm~3b75.tmp to %APPDATA%\wanyx\pic\71083.gmp
from %TEMP%\gm~3cfd.tmp to %APPDATA%\wanyx\pic\70792.gmp
from %TEMP%\gm~7b41.tmp to %APPDATA%\wanyx\pic\70838.gmp

Substitutes the following files

%APPDATA%\wanyx\data\plugin\hot.gmx
%APPDATA%\wanyx\data\search.gms-journal
%APPDATA%\wanyx\data\plugin\top.gmx

Network activity

TCP

HTTP GET requests

http://up####.wanyxbox.com/update_hot.php?da######################################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/70812.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16373.gmp
http://ic##.#anyxbox.com/slider/201605/20160523162136750.gif
http://ic##.#anyxbox.com/game_icon/gmp_64/14219.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70811.gmp
http://up####.wanyxbox.com/update_icon.php?da############################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/70806.gmp
http://ic##.#anyxbox.com/slider/202007/20200723164842618.jpg
http://ic##.#anyxbox.com/slider/202007/20200722170412151.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71087.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71086.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71085.gmp
http://ic##.#anyxbox.com/slider/202007/20200723164836906.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70792.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71084.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71083.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71082.gmp
http://ic##.#anyxbox.com/slider/202007/20200723164813866.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70803.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16388.gmp
http://ic##.#anyxbox.com/slider/201912/20191202165732877.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70813.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70836.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/16423.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70835.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00151.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00148.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70834.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00141.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70830.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00130.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70827.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00126.gmp
http://up####.wanyxbox.com/update_hot.php?da########################################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/70819.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00056.gmp
http://ic##.#anyxbox.com/slider/201608/20160817130948555.gif
http://ic##.#anyxbox.com/slider/201609/20160912133331969.gif
http://ic##.#anyxbox.com/game_icon/gmp_64/70815.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/00011.gmp
http://ic##.#anyxbox.com/slider/202011/20201113154158760.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71081.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70837.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70744.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71079.gmp
http://up####.wanyxbox.com/update_icon.php?da########################################################################
http://ic##.#anyxbox.com/game_icon/gmp_64/71054.gmp
http://ic##.#anyxbox.com/slider/201911/20191101162633286.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71021.gmp
http://ic##.#anyxbox.com/slider/202011/20201123163458583.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70943.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70729.gmp
http://gm#.##nyxbox.com/upicons/upicons_3_8.gmx
http://ic##.#anyxbox.com/game_icon/gmp_64/70710.gmp
http://gm#.##nyxbox.com/top/top_16_5.gmx
http://se#####.wanyxbox.com/time.php?da########
http://up####.wanyxbox.com/update_top.php?da####################################################################
http://up####.wanyxbox.com/update_plugin.php?da##################################################################################################################################################...
http://st##.#anyxbox.com/online_stat.php?da######################################################################################################################################################...
http://gm#.##nyxbox.com/update_new/update_33_3/update32_4-33_3.xml
http://up####.wanyxbox.com/update_database.php?da######################################################################################
http://up####.wanyxbox.com/update_top.php?da######################################################################################
http://gm#.##nyxbox.com/hot_20/hot_20_29_3.gmx
http://ic##.#anyxbox.com/slider/202011/20201123163451126.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71055.gmp
http://up####.wanyxbox.com/update/?da############################################################################################################################################################...
http://ic##.#anyxbox.com/game_icon/gmp_64/71056.gmp
http://ic##.#anyxbox.com/slider/202007/20200723164807831.jpg
http://ic##.#anyxbox.com/slider/202011/20201123163555858.png
http://ic##.#anyxbox.com/game_icon/gmp_64/70739.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71078.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70735.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71077.gmp
http://ic##.#anyxbox.com/slider/202011/20201123163552534.png
http://ic##.#anyxbox.com/game_icon/gmp_64/70721.gmp
http://ic##.#anyxbox.com/slider/202011/20201113153948959.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71075.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71074.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71073.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71059.gmp
http://d1.##nyxbox.com/update/Wanyx_GameBox_v5.7.1.8342_Silent_Force_Update.exe
http://ic##.#anyxbox.com/slider/202011/20201113153943308.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/71058.gmp
http://up####.wanyxbox.com/update_icon.php?da##########################################################################
http://ic##.#anyxbox.com/slider/201911/20191101162639705.jpg
http://ic##.#anyxbox.com/game_icon/gmp_64/70716.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/71080.gmp
http://ic##.#anyxbox.com/game_icon/gmp_64/70838.gmp

HTTP POST requests

http://up####.wanyxbox.com/update_icon.php?da####################################################################

UDP

DNS ASK up####.wanyxbox.com
DNS ASK gm#.##nyxbox.com
DNS ASK st##.#anyxbox.com
DNS ASK se#####.wanyxbox.com
DNS ASK ic##.#anyxbox.com
DNS ASK d1.##nyxbox.com

Miscellaneous

Searches for the following windows

ClassName: 'GMBubbleWnd' WindowName: ''
ClassName: 'WanyxGMWnd' WindowName: 'ГЌГ¦Г“ГЋГЏВ·ВєГђ'
ClassName: '' WindowName: 'ГЌГ¦Г“ГЋГЏВ·FlashГ“ГЋГЏВ·'
ClassName: '' WindowName: 'ГЌГ¦Г“ГЋГЏВ·ВєГђГ¤ВЇГЂГЂГ†Г·'
ClassName: '' WindowName: '玩游戏Flash游戏'
ClassName: '' WindowName: '玩游戏盒浏览器'
ClassName: '' WindowName: '玩游戏升级提示'
ClassName: '' WindowName: '玩游戏版本更新'

Creates and executes the following

'%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wygm.exe' -update_data
'%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyupdate.exe' -install
'%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wygm.exe'
'%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyupdate.exe' -update -delay=3 -type=1
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYGM.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђВ№ГњГЂГГ†Г·" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYFlash.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђflashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYDLPlatform.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool\WYRTLFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГ”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool\WYPluginFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL' (with hidden window)
'%ProgramFiles(x86)%\ГґГ¦ГґГЇВєГ°Г—Гі\wyupdate.exe' -update -delay=3 -type=1' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYGM.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђВ№ГњГЂГГ†Г·" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYFlash.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђflashГ“ГЋГЏВ·ВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\WYDLPlatform.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГГ†ВЅГЊВЁ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool\WYRTLFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГ”Г‹ГђГђВїГўВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool\WYPluginFix.exe" name="ГЌГ¦Г“ГЋГЏВ·ВєГђГЏГ‚Г”ГВ№ГЉГ•ГЏВјГ¬ВІГўВіГЊГђГІ" mode=ENABLE scope=ALL
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool_x64\WYShell.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool_x64\WYShell.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool_x64\WYShellIcon.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Г”Г†Г”ГЏВєГђГ—Г“\tool_x64\WYShellIcon.dll"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial