Technical Information
Modifies file system
Creates the following files
- %APPDATA%\00861fab
Network activity
Connects to
- 'no##.youdao.com':443
- '10#.#48.190.161':8899
TCP
Other
- 'no##.youdao.com':443
- '10#.#48.190.161':8899
UDP
- DNS ASK no##.youdao.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc stop BEService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop BEDaisy' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop ucldr_battlegrounds_gl' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop xhunter1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zksvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop navagio' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BEService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BEDaisy' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete ucldr_battlegrounds_gl' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete xhunter1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zksvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete navagio' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc stop BEService
- '%WINDIR%\syswow64\sc.exe' delete zksvc
- '%WINDIR%\syswow64\cmd.exe' /c sc delete zksvc
- '%WINDIR%\syswow64\sc.exe' delete xhunter1
- '%WINDIR%\syswow64\cmd.exe' /c sc delete xhunter1
- '%WINDIR%\syswow64\sc.exe' delete ucldr_battlegrounds_gl
- '%WINDIR%\syswow64\cmd.exe' /c sc delete ucldr_battlegrounds_gl
- '%WINDIR%\syswow64\sc.exe' delete BEDaisy
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BEDaisy
- '%WINDIR%\syswow64\sc.exe' delete BEService
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BEService
- '%WINDIR%\syswow64\sc.exe' stop navagio
- '%WINDIR%\syswow64\cmd.exe' /c sc stop navagio
- '%WINDIR%\syswow64\sc.exe' stop zksvc
- '%WINDIR%\syswow64\cmd.exe' /c sc stop zksvc
- '%WINDIR%\syswow64\sc.exe' stop xhunter1
- '%WINDIR%\syswow64\cmd.exe' /c sc stop xhunter1
- '%WINDIR%\syswow64\sc.exe' stop ucldr_battlegrounds_gl
- '%WINDIR%\syswow64\cmd.exe' /c sc stop ucldr_battlegrounds_gl
- '%WINDIR%\syswow64\sc.exe' stop BEDaisy
- '%WINDIR%\syswow64\cmd.exe' /c sc stop BEDaisy
- '%WINDIR%\syswow64\sc.exe' stop BEService
- '%WINDIR%\syswow64\cmd.exe' /c sc delete navagio
- '%WINDIR%\syswow64\sc.exe' delete navagio
