Technical Information
Modifies file system
Creates the following files
- %TEMP%\aut2599.tmp
- %APPDATA%\lmt~win_7\burncd-1.itmp
- %TEMP%\aut37f6.tmp
- %APPDATA%\lmt~win_7\makeud-1.itmp
- %TEMP%\aut37d6.tmp
- %APPDATA%\lmt~win_7\browse-1.itmp
- %TEMP%\aut37b6.tmp
- %APPDATA%\lmt~win_7\btn-9-1.itmp
- %APPDATA%\lmt~win_7\btn-diy1.itmp
- %APPDATA%\lmt~win_7\modebg.itmp
- %TEMP%\aut3756.tmp
- %APPDATA%\lmt~win_7\btn-fud1.itmp
- %TEMP%\aut3736.tmp
- %APPDATA%\lmt~win_7\btn-upd1.itmp
- %TEMP%\aut3716.tmp
- %APPDATA%\lmt~win_7\btn-oku1.itmp
- %TEMP%\aut3786.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jh9rpbd1\desktop.ini
- %TEMP%\aut38a4.tmp
- %TEMP%\auta9c6.tmp
- %TEMP%\aut59e2.tmp
- %APPDATA%\lmt~win_7\btn-diy2.itmp
- %TEMP%\aut54a3.tmp
- %APPDATA%\lmt~win_7\fbinst.dll
- %TEMP%\aut41fd.tmp
- %APPDATA%\lmt~win_7\soft.itmp
- %TEMP%\aut36e6.tmp
- %TEMP%\aut3826.tmp
- %TEMP%\aut416e.tmp
- %APPDATA%\lmt~win_7\dndud.itmp
- %TEMP%\aut4110.tmp
- %APPDATA%\lmt~win_7\makeiso-1.itmp
- %TEMP%\aut3b25.tmp
- %APPDATA%\lmt~win_7\custom-1.itmp
- %TEMP%\aut3af6.tmp
- %APPDATA%\lmt~win_7\iso-bg.itmp
- %TEMP%\progress.tmp
- %APPDATA%\lmt~win_7\mode-3-1.itmp
- %TEMP%\aut36d5.tmp
- %APPDATA%\lmt~win_7\mode-2-1.itmp
- %APPDATA%\lmt~win_7\btn-close11.itmp
- %TEMP%\aut3182.tmp
- %APPDATA%\lmt~win_7\btn-iso1.itmp
- %TEMP%\aut3162.tmp
- %APPDATA%\lmt~win_7\btn-usb2.itmp
- %TEMP%\aut3142.tmp
- %APPDATA%\lmt~win_7\btn-min11.itmp
- %APPDATA%\lmt~win_7\btn-forum2.itmp
- %TEMP%\aut31a2.tmp
- %TEMP%\aut30e2.tmp
- %TEMP%\cmdtool.tmp
- %TEMP%\aut2b07.tmp
- %WINDIR%\bcdedit.dll
- %TEMP%\aut2ac8.tmp
- %TEMP%\runlog.log
- %TEMP%\lmvoufp
- %TEMP%\aut3122.tmp
- %TEMP%\aut41cd.tmp
- %APPDATA%\lmt~win_7\btn-help1.itmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\aut31b3.tmp
- %TEMP%\aut36b5.tmp
- %APPDATA%\lmt~win_7\mode-1-2.itmp
- %TEMP%\aut3647.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\zyn3f3zu\desktop.ini
- %APPDATA%\lmt~win_7\btn-forum1.itmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f6gosq81\desktop.ini
- %APPDATA%\lmt~win_7\btn-soft1.itmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %APPDATA%\lmt~win_7\mainbg.itmp
- %TEMP%\aut33a7.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\obey1o19\desktop.ini
- %TEMP%\autadfc.tmp
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jh9rpbd1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\obey1o19\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f6gosq81\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\zyn3f3zu\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %TEMP%\aut2599.tmp
- %APPDATA%\lmt~win_7\btn-fud1.itmp
- %APPDATA%\lmt~win_7\btn-help1.itmp
- %APPDATA%\lmt~win_7\btn-iso1.itmp
- %APPDATA%\lmt~win_7\btn-min11.itmp
- %APPDATA%\lmt~win_7\btn-oku1.itmp
- %APPDATA%\lmt~win_7\btn-soft1.itmp
- %APPDATA%\lmt~win_7\btn-upd1.itmp
- %APPDATA%\lmt~win_7\btn-usb2.itmp
- %APPDATA%\lmt~win_7\burncd-1.itmp
- %APPDATA%\lmt~win_7\custom-1.itmp
- %APPDATA%\lmt~win_7\mainbg.itmp
- %APPDATA%\lmt~win_7\makeiso-1.itmp
- %APPDATA%\lmt~win_7\makeud-1.itmp
- %APPDATA%\lmt~win_7\mode-2-1.itmp
- %APPDATA%\lmt~win_7\btn-forum2.itmp
- %APPDATA%\lmt~win_7\mode-3-1.itmp
- %APPDATA%\lmt~win_7\modebg.itmp
- %TEMP%\aut4110.tmp
- %TEMP%\aut416e.tmp
- %TEMP%\aut41cd.tmp
- %APPDATA%\lmt~win_7\dndud.itmp
- %APPDATA%\lmt~win_7\iso-bg.itmp
- %APPDATA%\lmt~win_7\soft.itmp
- %TEMP%\aut41fd.tmp
- %TEMP%\aut54a3.tmp
- %APPDATA%\lmt~win_7\btn-diy2.itmp
- %TEMP%\aut59e2.tmp
- %TEMP%\auta9c6.tmp
- %APPDATA%\lmt~win_7\btn-forum1.itmp
- %APPDATA%\lmt~win_7\mode-1-2.itmp
- %APPDATA%\lmt~win_7\btn-diy1.itmp
- %TEMP%\aut36b5.tmp
- %TEMP%\lmvoufp
- %TEMP%\aut2ac8.tmp
- %TEMP%\aut2b07.tmp
- %TEMP%\cmdtool.tmp
- %TEMP%\aut30e2.tmp
- %TEMP%\aut3122.tmp
- %TEMP%\aut3142.tmp
- %TEMP%\aut3162.tmp
- %TEMP%\aut3182.tmp
- %TEMP%\aut31a2.tmp
- %TEMP%\aut31b3.tmp
- %TEMP%\aut33a7.tmp
- %TEMP%\aut3647.tmp
- %TEMP%\aut36d5.tmp
- %APPDATA%\lmt~win_7\btn-9-1.itmp
- %TEMP%\aut36e6.tmp
- %TEMP%\aut3716.tmp
- %TEMP%\aut3736.tmp
- %TEMP%\aut3756.tmp
- %TEMP%\aut3786.tmp
- %TEMP%\aut37b6.tmp
- %TEMP%\aut37d6.tmp
- %TEMP%\aut37f6.tmp
- %TEMP%\aut3826.tmp
- %TEMP%\aut38a4.tmp
- %TEMP%\aut3af6.tmp
- %TEMP%\aut3b25.tmp
- %APPDATA%\lmt~win_7\browse-1.itmp
- %APPDATA%\lmt~win_7\btn-close11.itmp
- %TEMP%\autadfc.tmp
Substitutes the following files
- %APPDATA%\lmt~win_7\btn-diy1.itmp
- %APPDATA%\lmt~win_7\btn-forum1.itmp
Network activity
TCP
HTTP GET requests
- http://www.ji###zhijia.cn/SPEUpdate.txt
UDP
- DNS ASK ji###zhijia.cn
Miscellaneous
Creates and executes the following
- '%TEMP%\cmdtool.tmp' SHOW =1
- '%APPDATA%\lmt~win_7\fbinst.dll' F: info
- '%WINDIR%\syswow64\cmd.exe' /c CMDtool.tmp SHOW =1 & 0:1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c fbinst.dll F: info' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c CMDtool.tmp SHOW =1 & 0:1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c fbinst.dll F: info