Technical Information
Modifies file system
Creates the following files
- <Current directory>\tem.vbs
Sets the 'hidden' attribute to the following files
- <Current directory>\tem.vbs
Deletes the following files
- <Current directory>\tem.vbs
Deletes itself.
Network activity
Connects to
- 'no##.youdao.com':80
- 'bu#########e-online-cdn.note.youdao.com':443
- 'cr#.#igicert.cn':80
- 'oc##.#igicert.cn':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://no##.youdao.com/yws/public/note/a11fff0f38b2c2fdddd625cd0ef5c883
- http://no##.youdao.com/yws/public/note/86a7ff827b4c42f7a2e43b46f6381037?ed########################
- http://no##.youdao.com/yws/api/personal/file/WEB3d72b3e3cba43492c8dc2c6e339ba623?me###################################################################
- http://cr#.#igicert.cn/DigiCertGlobalRootCA.crl
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAsTYrbuap0%2Blokw8W4gfTk%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEA%2BGUzoqtAcsnVfyPia3jEM%3D
- http://cr#.#igicert.cn/GeoTrustRSACNCAG2.crl
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'bu#########e-online-cdn.note.youdao.com':443
UDP
- DNS ASK no##.youdao.com
- DNS ASK bu#########e-online-cdn.note.youdao.com
- DNS ASK cr#.#igicert.cn
- DNS ASK oc##.#igicert.cn
- DNS ASK microsoft.com
- DNS ASK st####.rapidssl.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\tem.vbs"
