Technical Information
Modifies file system
Creates the following files
- %WINDIR%\madc_eclx\exuikrnln_win32.lib
- %WINDIR%\madc_eclx\madc.exe
- %WINDIR%\madc_eclx\config.ini
Moves the following files
- from %WINDIR%\madc_eclx\madc.exe to %TEMP%\1059250\....\temporaryfile
Network activity
Connects to
- 'no##.youdao.com':443
- 'no##.youdao.com':80
- 'oc##.##ctigochina.com':80
- '11#.#.43.165':61268
TCP
HTTP GET requests
- http://no##.youdao.com/yws/api/personal/file/WEB6b79fbed1ba821c1eae956b62f489bc0?me###################################################################
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31##############
- http://oc##.##ctigochina.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVphVa8zQh6Zxn0hISd66zlb70OAQUxlReWmSYhsP71A9IiStbK%2FOxIK8CEEmZVXu3WaxImhZBwT6NPFg%3D
- http://no##.youdao.com/yws/api/personal/file/WEBac84c9c288961d5f39252b0690cd572d?me###################################################################
Other
- 'no##.youdao.com':443
- 'bu#########e-online-cdn.note.youdao.com':443
- '11#.#.43.165':61268
UDP
- DNS ASK no##.youdao.com
- DNS ASK bu#########e-online-cdn.note.youdao.com
- DNS ASK sh###.#ote.youdao.com
- DNS ASK oc##.##ctigochina.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\madc_eclx\madc.exe'
