Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UClient' = '<Full path to file> /s'
- [<HKCU>\Software\Classes\uclient\shell\open\command] '' = '<Full path to file> "%1"'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\uclient\.l
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\pt-pt.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\pt-br.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\pl.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\nl.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\nb.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ms.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\mr.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ml.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\lv.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\lt.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ko.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\kn.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ja.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\it.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\id.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\hu.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\hr.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\hi.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\he.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\gu.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\fr.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\fi.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\fil.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ro.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ru.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\app.esc
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\v8_context_snapshot.bin
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\uclient_ipc.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\ubrowserie.exe
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\ubrowser.exe
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\swiftshader\libegl.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\snapshot_blob.bin
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\resources.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\zh-tw.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\vi.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\am.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\uk.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\tr.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\th.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\te.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ta.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\sw.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\sv.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\sr.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\sl.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\sk.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\fa.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\et.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\es.pak
- %LOCALAPPDATA%\uclient\apps\uclient_agent\app.esc
- %LOCALAPPDATA%\uclient\apps\uclient_agent\agent\uclient_loader.jar
- %LOCALAPPDATA%\uclient\apps\uclient_agent\agent\bindingui.jar
- %LOCALAPPDATA%\uclient\apps\uclient_agent\agent\inceptor.jar
- %LOCALAPPDATA%\uclient\downloads\uclient_agent\agent.zip.dg
- %LOCALAPPDATA%\uclient\downloads\ubrowser\app.esc
- %LOCALAPPDATA%\uclient\downloads\uclient_agent\agent.zip
- %LOCALAPPDATA%\uclient\downloads\uclient_agent\app.esc
- %LOCALAPPDATA%\uclient\appgroup.xml
- %LOCALAPPDATA%\uclient\apporder.xml
- %LOCALAPPDATA%\uclient\uclient.db
- %LOCALAPPDATA%\uclient\uclient.db-journal
- %LOCALAPPDATA%\uclient\share\.l
- %LOCALAPPDATA%\uclient\setting.cfg
- %LOCALAPPDATA%\uclient\temp\uclient_new.exe
- %LOCALAPPDATA%\uclient\clientid
- %LOCALAPPDATA%\uclient\log\main.log
- %APPDATA%\microsoft\windows\start menu\programs\uclient\卸载uclient.lnk
- %APPDATA%\microsoft\windows\start menu\programs\uclient\uclient.lnk
- %LOCALAPPDATA%\uclient\procid
- %LOCALAPPDATA%\uclient\apps\uclient_agent\logo.png
- %LOCALAPPDATA%\uclient\downloads\banners\a42deaf0.png
- %LOCALAPPDATA%\uclient\apps\uclient_agent\client.esc
- %LOCALAPPDATA%\uclient\downloads\ubrowser\ubrowser.zip
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\es-419.pak
- %LOCALAPPDATA%\uclient\downloads\banners\d703fe18.png
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\en-us.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\en-gb.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\el.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\de.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\da.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\cs.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ca.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\bn.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\bg.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\zh-cn.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\client.esc
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\libglesv2.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\libegl.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\libcef.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\icudtl.dat
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\d3dcompiler_47.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\chrome_elf.dll
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\chrome_200_percent.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\chrome_100_percent.pak
- %LOCALAPPDATA%\uclient\downloads\ubrowser\ubrowser.zip.dg
- %LOCALAPPDATA%\uclient\downloads\banners\bannersanonymous_v2.json
- %LOCALAPPDATA%\uclient\apps\ubrowser\ubrowser\locales\ar.pak
- %LOCALAPPDATA%\uclient\apps\ubrowser\logo.png
Deletes the following files
- %LOCALAPPDATA%\uclient\uclient.db-journal
- %APPDATA%\microsoft\windows\start menu\programs\uclient\卸载uclient.lnk
- %APPDATA%\microsoft\windows\start menu\programs\uclient\uclient.lnk
Substitutes the following files
- %LOCALAPPDATA%\uclient\uclient.db-journal
- %APPDATA%\microsoft\windows\start menu\programs\uclient\uclient.lnk
- %APPDATA%\microsoft\windows\start menu\programs\uclient\卸载uclient.lnk
Network activity
Connects to
- 'uc####t.yonyou.com':80
- 'cd#.##nyoucloud.com':443
- 'uc#####.yonyoucloud.com':443
- 'um####ge.yonyou.com':80
TCP
HTTP GET requests
- http://uc####t.yonyou.com/update.xml
HTTP POST requests
- http://uc####t.yonyou.com/rest/uclientinfo/operateinfo/addbatch
Other
- 'cd#.##nyoucloud.com':443
- 'uc#####.yonyoucloud.com':443
UDP
- DNS ASK uc####t.yonyou.com
- DNS ASK cd#.##nyoucloud.com
- DNS ASK uc#####.yonyoucloud.com
- DNS ASK um####ge.yonyou.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\uclient\temp\uclient_new.exe' /d <Full path to file>