Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wangame' = '"%ProgramFiles(x86)%\Wanyx\WYGM.exe" -background'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYFlash.exe" name="ÍæÓÎÏ·ºÐflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\tool\WYRTLFix.exe" name="ÍæÓÎÏ·ºÐÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYDLPlatform.exe" name="ÍæÓÎÏ·ºÐÏÂÔГƽ̨" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\tool\WYPluginFix.exe" name="ÍæÓÎÏ·ºÐÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYGM.exe" name="ÍæÓÎÏ·ºÐ¹ÜÀГÆ÷" mode=ENABLE scope=ALL
- %WINDIR%\explorer.exe
- %TEMP%\nsd2bb8.tmp
- %APPDATA%\wanyx\slider\slider_201907_20190710160551858.jpg
- %APPDATA%\wanyx\slider\slider_201907_20190710160713949.jpg
- %APPDATA%\wanyx\slider\slider_201907_20190710160711915.jpg
- %APPDATA%\wanyx\slider\slider_201909_20190906142253103.jpg
- %APPDATA%\wanyx\slider\slider_201909_20190906142250553.jpg
- %APPDATA%\wanyx\slider\slider_201909_20190912140209917.jpg
- %TEMP%\gm~1c2c.tmp
- %TEMP%\gm~198c.tmp
- %APPDATA%\wanyx\slider\slider_201909_20190912140207500.jpg
- %TEMP%\gm~1044.tmp
- %APPDATA%\wanyx\slider\slider_201909_20190906143317979.jpg
- %APPDATA%\wanyx\slider\slider_201907_20190710160555146.jpg
- %TEMP%\gm~fe9f.tmp
- %TEMP%\gm~fcf7.tmp
- %TEMP%\gm~fbec.tmp
- %TEMP%\gm~fac3.tmp
- %TEMP%\gm~fa45.tmp
- %TEMP%\gm~f66b.tmp
- %TEMP%\gm~e969.tmp
- %TEMP%\gm~eaa3.tmp
- %APPDATA%\wanyx\slider\slider_201909_20190906143313926.jpg
- %APPDATA%\wanyx\cache.xml
- %APPDATA%\wanyx\config\config.xml
- %APPDATA%\wanyx\data\search.gms
- %TEMP%\gm~fd37.tmp
- %APPDATA%\wanyx\slider\slider_201909_20190906143156528.jpg
- %APPDATA%\wanyx\slider\slider_201909_20190906143201202.jpg
- %APPDATA%\wanyx\slider\slider_201605_20160523162136750.gif
- %TEMP%\gm~8d50.tmp
- %TEMP%\gm~8a12.tmp
- %TEMP%\gm~8936.tmp
- %TEMP%\gm~88d7.tmp
- %TEMP%\gm~87bd.tmp
- %TEMP%\gm~8674.tmp
- %TEMP%\gm~855a.tmp
- %TEMP%\gm~8430.tmp
- %TEMP%\gm~8305.tmp
- %TEMP%\gm~8316.tmp
- %TEMP%\gm~820a.tmp
- %TEMP%\gm~7fe6.tmp
- %TEMP%\gm~7bae.tmp
- %TEMP%\gm~7767.tmp
- %APPDATA%\wanyx\slider\slider_201608_20160817130948555.gif
- %APPDATA%\wanyx\slider\slider_201609_20160912133331969.gif
- %TEMP%\gm~7449.tmp
- %TEMP%\gm~7264.tmp
- %TEMP%\gm~7253.tmp
- %TEMP%\gm~6f26.tmp
- %APPDATA%\wanyx\slider\slider_201904_20190426131612967.jpg
- %APPDATA%\wanyx\slider\slider_201906_20190621162708949.gif
- %TEMP%\gm~1d37.tmp
- %APPDATA%\wanyx\slider\slider_201908_20190819142624900.png
- %TEMP%\gm~4c7a.tmp
- %APPDATA%\wanyx\data\search.gms-journal
- %TEMP%\gm~8c55.tmp
- %APPDATA%\wanyx\data\local\user.xml
- %TEMP%\wanyxtemp\restart.gmt
- %ProgramFiles(x86)%\wanyx\tool\wymini.exe
- %ProgramFiles(x86)%\wanyx\tool\wytp.exe
- %ProgramFiles(x86)%\wanyx\tool\wydlutils.dll
- %ProgramFiles(x86)%\wanyx\tool\wyuirender.dll
- %ProgramFiles(x86)%\wanyx\tool\wycommon.dll
- %ProgramFiles(x86)%\wanyx\tool\wybubble.exe
- %ProgramFiles(x86)%\wanyx\uninstall.exe
- %ProgramFiles(x86)%\wanyx\msvcr80.dll
- %ProgramFiles(x86)%\wanyx\msvcp80.dll
- %ProgramFiles(x86)%\wanyx\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\wanyx\wyuirender.dll
- %ProgramFiles(x86)%\wanyx\tool\wyrtlfix.exe
- %ProgramFiles(x86)%\wanyx\wydlplatform.exe
- %ProgramFiles(x86)%\wanyx\wycommon.dll
- %ProgramFiles(x86)%\wanyx\wyurlencrypt.dll
- %ProgramFiles(x86)%\wanyx\wybugreport.exe
- %ProgramFiles(x86)%\wanyx\wyversion.dll
- %ProgramFiles(x86)%\wanyx\wyupdate.exe
- %ProgramFiles(x86)%\wanyx\wyweb.exe
- %ProgramFiles(x86)%\wanyx\wybrowser.exe
- %ProgramFiles(x86)%\wanyx\wyflash.exe
- %ProgramFiles(x86)%\wanyx\wygm.exe
- %TEMP%\nss2bc8.tmp\wynsisminiextend.dll
- %TEMP%\nss2bc8.tmp\system.dll
- %ProgramFiles(x86)%\wanyx\wydlutils.dll
- %ProgramFiles(x86)%\wanyx\tool\wypluginfix.exe
- %ProgramFiles(x86)%\wanyx\tool\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\wanyx\tool\msvcp80.dll
- %APPDATA%\microsoft\windows\start menu\programs\Гæóîï·ºð\ð¶ôøГæóîï·ºð.lnk
- %APPDATA%\microsoft\windows\start menu\programs\Гæóîï·ºð\Гæóîï·ò³óî´óìü.lnk
- %APPDATA%\microsoft\windows\start menu\programs\Гæóîï·ºð\Гæóîï·flash²¥·åæ÷.lnk
- %APPDATA%\microsoft\windows\start menu\programs\Гæóîï·ºð\Гæóîï·ºð.lnk
- %HOMEPATH%\desktop\Гæóîï·ò³óî´óìü.lnk
- %HOMEPATH%\desktop\Гæóîï·ºð.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\Гæóîï·ºð.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\玩游戏盒.lnk
- %APPDATA%\wanyx\update.ini
- %ProgramFiles(x86)%\wanyx\audio\complete.wav
- %APPDATA%\wanyx\data\plugin\pc.gmx
- %APPDATA%\wanyx\data\plugin\inwl.gmx
- %APPDATA%\wanyx\data\plugin\netwl.gmx
- %APPDATA%\wanyx\data\plugin\scan.gmx
- %APPDATA%\wanyx\data\plugin\top.gmx
- %APPDATA%\wanyx\data\plugin\hot.gmx
- %APPDATA%\wanyx\data\database.gmx
- %ProgramFiles(x86)%\wanyx\tool_x64\msvcr80.dll
- %ProgramFiles(x86)%\wanyx\tool_x64\msvcp80.dll
- %ProgramFiles(x86)%\wanyx\tool_x64\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\wanyx\tool_x64\wyurlencrypt.dll
- %ProgramFiles(x86)%\wanyx\tool_x64\wycommon.dll
- %ProgramFiles(x86)%\wanyx\tool_x64\wyshellicon.dll
- %ProgramFiles(x86)%\wanyx\tool_x64\wyshell.dll
- %ProgramFiles(x86)%\wanyx\tool\msvcr80.dll
- %APPDATA%\wanyx\data\local\recent.xml
- %TEMP%\gm~8e6a.tmp
- %TEMP%\nss2bc8.tmp\system.dll
- %TEMP%\nss2bc8.tmp\wynsisminiextend.dll
- %APPDATA%\wanyx\data\search.gms-journal
- %APPDATA%\wanyx\data\plugin\top.gmx
- %APPDATA%\wanyx\pic\71045.gmp
- from %TEMP%\gm~f66b.tmp to %APPDATA%\wanyx\data\plugin\icon.gmx
- from %TEMP%\gm~8c55.tmp to %APPDATA%\wanyx\pic\71063.gmp
- from %TEMP%\gm~8a12.tmp to %APPDATA%\wanyx\pic\71062.gmp
- from %TEMP%\gm~8936.tmp to %APPDATA%\wanyx\pic\70811.gmp
- from %TEMP%\gm~88d7.tmp to %APPDATA%\wanyx\pic\71060.gmp
- from %TEMP%\gm~87bd.tmp to %APPDATA%\wanyx\pic\71059.gmp
- from %TEMP%\gm~8674.tmp to %APPDATA%\wanyx\pic\71058.gmp
- from %TEMP%\gm~855a.tmp to %APPDATA%\wanyx\pic\71057.gmp
- from %TEMP%\gm~8430.tmp to %APPDATA%\wanyx\pic\71056.gmp
- from %TEMP%\gm~8316.tmp to %APPDATA%\wanyx\pic\70806.gmp
- from %TEMP%\gm~8305.tmp to %APPDATA%\wanyx\pic\71055.gmp
- from %TEMP%\gm~820a.tmp to %APPDATA%\wanyx\pic\71054.gmp
- from %TEMP%\gm~7bae.tmp to %APPDATA%\wanyx\pic\71052.gmp
- from %TEMP%\gm~7fe6.tmp to %APPDATA%\wanyx\pic\70803.gmp
- from %TEMP%\gm~8d50.tmp to %APPDATA%\wanyx\pic\70812.gmp
- from %TEMP%\gm~7767.tmp to %APPDATA%\wanyx\pic\70792.gmp
- from %TEMP%\gm~7264.tmp to %APPDATA%\wanyx\pic\70744.gmp
- from %TEMP%\gm~7253.tmp to %APPDATA%\wanyx\pic\71050.gmp
- from %TEMP%\gm~6f26.tmp to %APPDATA%\wanyx\pic\71045.gmp
- from %TEMP%\gm~1d37.tmp to %APPDATA%\wanyx\pic\71044.gmp
- from %TEMP%\gm~4c7a.tmp to %APPDATA%\wanyx\pic\70739.gmp
- from %TEMP%\gm~1c2c.tmp to %APPDATA%\wanyx\pic\71043.gmp
- from %TEMP%\gm~198c.tmp to %APPDATA%\wanyx\pic\71042.gmp
- from %TEMP%\gm~1044.tmp to %APPDATA%\wanyx\pic\71041.gmp
- from %TEMP%\gm~fe9f.tmp to %APPDATA%\wanyx\pic\71021.gmp
- from %TEMP%\gm~fd37.tmp to %APPDATA%\wanyx\pic\71020.gmp
- from %TEMP%\gm~fbec.tmp to %APPDATA%\wanyx\pic\70943.gmp
- from %TEMP%\gm~fac3.tmp to %APPDATA%\wanyx\pic\70729.gmp
- from %TEMP%\gm~eaa3.tmp to %APPDATA%\wanyx\pic\70568.gmp
- from %TEMP%\gm~7449.tmp to %APPDATA%\wanyx\pic\71051.gmp
- from %TEMP%\gm~8e6a.tmp to %APPDATA%\wanyx\pic\71067.gmp
- %APPDATA%\wanyx\data\search.gms-journal
- %APPDATA%\wanyx\data\plugin\top.gmx
- http://up####.wanyxbox.com/update_top.php?da############################################################################################
- http://ic##.#anyxbox.com/slider/201909/20190906143156528.jpg
- http://ic##.#anyxbox.com/slider/201909/20190906143201202.jpg
- http://ic##.#anyxbox.com/game_icon/gmp_64/70739.gmp
- http://ic##.#anyxbox.com/slider/201605/20160523162136750.gif
- http://ic##.#anyxbox.com/slider/201908/20190819142624900.png
- http://ic##.#anyxbox.com/slider/201906/20190621162708949.gif
- http://ic##.#anyxbox.com/slider/201904/20190426131612967.jpg
- http://ic##.#anyxbox.com/slider/201609/20160912133331969.gif
- http://ic##.#anyxbox.com/game_icon/gmp_64/71045.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71050.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/70744.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71051.gmp
- http://ic##.#anyxbox.com/slider/201608/20160817130948555.gif
- http://ic##.#anyxbox.com/game_icon/gmp_64/70792.gmp
- http://up####.wanyxbox.com/update_hot.php?da############################################################################################
- http://ic##.#anyxbox.com/game_icon/gmp_64/71067.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/70803.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71054.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71055.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/70806.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71056.gmp
- http://up####.wanyxbox.com/update_icon.php?da################################################################################
- http://ic##.#anyxbox.com/game_icon/gmp_64/71057.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71058.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71059.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71060.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/70811.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71062.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/70812.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71063.gmp
- http://ic##.#anyxbox.com/slider/201907/20190710160555146.jpg
- http://ic##.#anyxbox.com/game_icon/gmp_64/71052.gmp
- http://ic##.#anyxbox.com/slider/201907/20190710160551858.jpg
- http://gm#.##nyxbox.com/upicons/upicons_3_8.gmx
- http://up####.wanyxbox.com/update_database.php?da##############################################################################################
- http://gm#.##nyxbox.com/update_new/update_31_2/update31_1-31_2.xml
- http://st##.#anyxbox.com/stat.php?da####################################################################
- http://st##.#anyxbox.com/stat.php?da#############################################################################################################################################################...
- http://up####.wanyxbox.com/bubble_action.php?da##################################################################################################################################################...
- http://up####.wanyxbox.com/fake_iu.php?da########################################################################################################################################################...
- http://up####.wanyxbox.com/status.php?da#########################################################################################################################################################...
- http://st##.#anyxbox.com/online_stat.php?da######################################################################################################################################################...
- http://se#####.wanyxbox.com/time.php?da########
- http://ic##.#anyxbox.com/slider/201909/20190906143313926.jpg
- http://up####.wanyxbox.com/update_top.php?da########################################################################
- http://up####.wanyxbox.com/update_plugin.php?da##################################################################################################################################################...
- http://gm#.##nyxbox.com/top/top_16_1.gmx
- http://ic##.#anyxbox.com/game_icon/gmp_64/70568.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/70729.gmp
- http://ic##.#anyxbox.com/slider/201907/20190710160711915.jpg
- http://ic##.#anyxbox.com/game_icon/gmp_64/70943.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71020.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71021.gmp
- http://ic##.#anyxbox.com/slider/201909/20190906143317979.jpg
- http://ic##.#anyxbox.com/game_icon/gmp_64/71041.gmp
- http://ic##.#anyxbox.com/slider/201909/20190912140207500.jpg
- http://up####.wanyxbox.com/update/?da############################################################################################################################################################...
- http://ic##.#anyxbox.com/game_icon/gmp_64/71042.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71043.gmp
- http://ic##.#anyxbox.com/game_icon/gmp_64/71044.gmp
- http://up####.wanyxbox.com/update_icon.php?da##############################################################################
- http://ic##.#anyxbox.com/slider/201909/20190912140209917.jpg
- http://ic##.#anyxbox.com/slider/201909/20190906142250553.jpg
- http://ic##.#anyxbox.com/slider/201909/20190906142253103.jpg
- http://ic##.#anyxbox.com/slider/201907/20190710160713949.jpg
- http://ic##.#anyxbox.com/game_icon/gmp_64/14219.gmp
- http://st##.#anyxbox.com/stat/do_stat.php?da##########################################################################################################
- http://up####.wanyxbox.com/update_icon.php?da########################################################################
- DNS ASK up####.wanyxbox.com
- DNS ASK gm#.##nyxbox.com
- DNS ASK st##.#anyxbox.com
- DNS ASK se#####.wanyxbox.com
- DNS ASK ic##.#anyxbox.com
- ClassName: 'GMBubbleWnd' WindowName: ''
- ClassName: 'WanyxGMWnd' WindowName: 'ÍæÓÎÏ·ºÐ'
- ClassName: '' WindowName: 'ÍæÓÎÏ·FlashÓÎÏ·'
- ClassName: '' WindowName: 'ÍæÓÎÏ·ºÐä¯ÀÀÆ÷'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: '' WindowName: '玩游戏Flash游戏'
- ClassName: '' WindowName: '玩游戏盒浏览器'
- ClassName: '' WindowName: '玩游戏升级提示'
- ClassName: '' WindowName: '玩游戏版本更新'
- '%ProgramFiles(x86)%\wanyx\wygm.exe' -update_data
- '%ProgramFiles(x86)%\wanyx\wyupdate.exe' -install
- '%ProgramFiles(x86)%\wanyx\wygm.exe' -atonce
- '%ProgramFiles(x86)%\wanyx\tool\wybubble.exe' -query_action
- '%ProgramFiles(x86)%\wanyx\wyupdate.exe' -update -delay=3 -type=1
- '%ProgramFiles(x86)%\wanyx\tool\wymini.exe'
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYGM.exe" name="ÍæÓÎÏ·ºÐ¹ÜÀГÆ÷" mode=ENABLE scope=ALL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYFlash.exe" name="ÍæÓÎÏ·ºÐflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYDLPlatform.exe" name="ÍæÓÎÏ·ºÐÏÂÔГƽ̨" mode=ENABLE scope=ALL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\tool\WYRTLFix.exe" name="ÍæÓÎÏ·ºÐÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\tool\WYPluginFix.exe" name="ÍæÓÎÏ·ºÐÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL' (with hidden window)
- '%ProgramFiles(x86)%\wanyx\wyupdate.exe' -update -delay=3 -type=1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYGM.exe" name="ÍæÓÎÏ·ºÐ¹ÜÀГÆ÷" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYFlash.exe" name="ÍæÓÎÏ·ºÐflashÓÎÏ·³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\WYDLPlatform.exe" name="ÍæÓÎÏ·ºÐÏÂÔГƽ̨" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\tool\WYRTLFix.exe" name="ÍæÓÎÏ·ºÐÔËÐпâ¼ì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Wanyx\tool\WYPluginFix.exe" name="ÍæÓÎÏ·ºÐÏÂÔГ¹ÊÕϼì²â³ÌÐò" mode=ENABLE scope=ALL
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Wanyx\tool_x64\WYShell.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Wanyx\tool_x64\WYShell.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Wanyx\tool_x64\WYShellIcon.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Wanyx\tool_x64\WYShellIcon.dll"