Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GM3000BJCAMon' = '"%ProgramFiles(x86)%\GM3000\GM3000BJCAMon.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\bjcacertaidejob
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Security SoftSvc] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Security SoftSvc] 'ImagePath' = '%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Driver\wmControl.exe'
- [HKLM\System\CurrentControlSet\Services\ASKeyServer] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ASKeyServer] 'ImagePath' = '%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Driver\ASKeyServer.exe'
- [HKLM\System\CurrentControlSet\Services\Longmai mToken IOSVR] 'ImagePath' = '"%WINDIR%\SysWOW64\mtoken_iosvr.exe"'
- [HKLM\System\CurrentControlSet\Services\Longmai mToken IOSVR] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\XTXCoreSvr] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\XTXCoreSvr] 'ImagePath' = '%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXCoreSvr.exe'
Creates the following services
- 'Security SoftSvc' %ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Driver\wmControl.exe
- 'ASKeyServer' %ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Driver\ASKeyServer.exe
- 'Longmai mToken IOSVR' "%WINDIR%\SysWOW64\mtoken_iosvr.exe"
- 'Longmai mToken IOSVR' %WINDIR%\SysWOW64\mtoken_iosvr.exe
- 'XTXCoreSvr' %ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXCoreSvr.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "Security SoftSvc"
- '%WINDIR%\syswow64\net.exe' stop "ASKeyServer"
- '%WINDIR%\syswow64\net.exe' stop "XTXCoreSvr"
- '%WINDIR%\syswow64\taskkill.exe' /im GM3000BJCAMon.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /im GM3000BJCAPKIMgr.exe /F
- '%WINDIR%\syswow64\net.exe' stop "Longmai mToken IOSVR"
Modifies file system
Creates the following files
- %TEMP%\nsj475c.tmp\system.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjca_uninstall_mfc.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\dllsourfile\npxtxhost.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxlogproxy.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.ini
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxappcom.ini
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\dllsourfile\xtxappcom_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxversion_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxsecxv2_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxsecx_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxappcom_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\dllsourfile\xtxappcom.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\axtx5019_p1511_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\npxtxhost.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxversion.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\usbkeypnpactivex.tlb
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxsecxv2.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxsecx.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\trust.pem
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxappcom.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\driver.ini
- %TEMP%\nsj475c.tmp\enumusb.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\lgu3073_p1514_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\lgu3073_p1514_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\lgu3056_p1020_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\lgu3056_p1020_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\ft3001_p0313_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\ft3001_p0313_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\setuphelper.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\axtx5019_p1511_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjcakey_uninstall.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\data\channel.ini
- %WINDIR%\temp\~df0f0732d7d2e7a46e.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\bjca\bjca_softkey.db-journal
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\bjca\bjca_softkey.db
- C:\bjcaroot\xtxlog\xtxappcom.log
- %HOMEPATH%\desktop\bjcacertaide.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bjcaclient\certappenv\bjcacertaide.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bjcaclient\certappenv\removecertappenv.lnk
- %ProgramFiles(x86)%\gm3000\is-mvjs1.tmp
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\schedulejob.txt
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\xtx_uninstall.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\msgnoticecacheconfig.ini
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\msgnoticebusiness.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\libscpb_yzt.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\duilib.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\regsvr32_x86.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\certaidehelp.chm
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\data\component.ini
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\data\website.ini
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\data\aideinternet.ini
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\skin\default.sk
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\zlibwrap.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\xtxloglib_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\xtxloglib.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\simplechinese.xml
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\duilib_u.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\examctrlx64.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\schedulejob.xml
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjcaschedulejob.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjcacertaide.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\regsvr32_x64.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\data\keytype.ini
- %ProgramFiles(x86)%\gm3000\unins000.dat
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\gm3000\uninstall .lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\gm3000\gm3000 certificate utility.lnk
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\axtxak5018-d_hid_bjcakey_c.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\askeyserver.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\otg_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\otg_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\axtxak5018-d_bjcakey_c_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\axtxak5018-d_bjcakey_c.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\hd_gmcais.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\hd_gmcais.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\axtx5018_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\axtx5018_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\zfc3201_bjcakey_c_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\zfc3201_bjcakey_c.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\wmcontrol.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\axtx_otg_pid1513_gm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\smartctcapihid_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\smartctcapihid.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\smartctcapi.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\zfc3200_bjcakey_c_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\zfc3200_bjcakey_c.dll
- %TEMP%\nse5eb3.tmp\system.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\instcciddrv.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\ftgm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\ftgm.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\ft3kgm_bjcakey_c_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\ft3kgm_bjcakey_c.dll
- %TEMP%\nsj475c.tmp\findprocdll.dll
- C:\bjcaroot\bjca_config.xml
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\usbkeycfg.ini
- %TEMP%\nsj475c.tmp\nsexec.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\smartctcapi_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\axtx_otg_pid1513_gm_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\drivercfg\axtxak5018-d_hid_bjcakey_c_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\bjca1509_gm.dll
- <SYSTEM32>\is-hu8ht.tmp
- %ProgramFiles(x86)%\gm3000\is-l338h.tmp
- %WINDIR%\syswow64\is-fno9h.tmp
- %WINDIR%\syswow64\is-tn34n.tmp
- <SYSTEM32>\is-uccu0.tmp
- <SYSTEM32>\is-gjil4.tmp
- <SYSTEM32>\is-vnk7j.tmp
- <SYSTEM32>\is-vp3ln.tmp
- <SYSTEM32>\is-bgjmq.tmp
- <SYSTEM32>\is-mab3f.tmp
- %WINDIR%\syswow64\is-mrahf.tmp
- %WINDIR%\syswow64\is-tmqvg.tmp
- %WINDIR%\syswow64\is-mks4i.tmp
- %WINDIR%\syswow64\is-uenp7.tmp
- %WINDIR%\syswow64\is-8n16d.tmp
- %WINDIR%\syswow64\is-kb289.tmp
- %ProgramFiles(x86)%\gm3000\is-2k9mk.tmp
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\bjca1509_gm_x64.dll
- %ProgramFiles(x86)%\gm3000\languages\is-996pm.tmp
- %ProgramFiles(x86)%\gm3000\languages\is-4hqqb.tmp
- %APPDATA%\longmai\gm3000bjca\is-5e7nu.tmp
- %APPDATA%\longmai\gm3000bjca\is-7luvt.tmp
- %ProgramFiles(x86)%\gm3000\languages\is-a7cih.tmp
- %ProgramFiles(x86)%\gm3000\languages\is-2b03t.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bjcaclient\certappenv\bjcacertaidehelp.lnk
- %ProgramFiles(x86)%\gm3000\is-hv4ta.tmp
- %ProgramFiles(x86)%\gm3000\is-d00c7.tmp
- %TEMP%\is-edpn8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-q9ji3.tmp\gm3000bjca_setup.tmp
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\gm3000bjca_setup.exe
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x64\gm3000_bjca_x64.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\x86\gm3000_bjca.dll
- %LOCALAPPDATA%low\bjca\bjca_softkey.db-journal
- %LOCALAPPDATA%low\bjca\bjca_softkey.db
Deletes the following files
- %TEMP%\nse5eb3.tmp\system.dll
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\instcciddrv.exe
- %APPDATA%\longmai\gm3000bjca\mgrconfig.ini
- %ProgramFiles(x86)%\gm3000\languages\mgrconfig.ini
- %TEMP%\is-edpn8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-q9ji3.tmp\gm3000bjca_setup.tmp
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\gm3000bjca_setup.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\bjca\bjca_softkey.db-journal
- %ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\setuphelper.exe
- %TEMP%\nsj475c.tmp\enumusb.dll
- %TEMP%\nsj475c.tmp\findprocdll.dll
- %TEMP%\nsj475c.tmp\nsexec.dll
- %TEMP%\nsj475c.tmp\system.dll
- %LOCALAPPDATA%low\bjca\bjca_softkey.db-journal
Moves the following files
- from %ProgramFiles(x86)%\gm3000\is-d00c7.tmp to %ProgramFiles(x86)%\gm3000\unins000.exe
- from %WINDIR%\syswow64\is-tn34n.tmp to %WINDIR%\syswow64\mtoken_iosvr.exe
- from <SYSTEM32>\is-uccu0.tmp to <SYSTEM32>\gm3000bjcacsp.en.dll
- from <SYSTEM32>\is-gjil4.tmp to <SYSTEM32>\gm3000bjcacsp.chs.dll
- from <SYSTEM32>\is-vnk7j.tmp to <SYSTEM32>\gm3000bjcacsp.dll
- from <SYSTEM32>\is-vp3ln.tmp to <SYSTEM32>\gm3000bjcacsp.sig
- from <SYSTEM32>\is-bgjmq.tmp to <SYSTEM32>\gm3000bjcacsp_s.x64.dll
- from <SYSTEM32>\is-mab3f.tmp to <SYSTEM32>\gm3000_pkcs11_bjca.dll
- from %WINDIR%\syswow64\is-mrahf.tmp to %WINDIR%\syswow64\gm3000bjcacsp.en.dll
- from %WINDIR%\syswow64\is-tmqvg.tmp to %WINDIR%\syswow64\gm3000bjcacsp.chs.dll
- from %WINDIR%\syswow64\is-mks4i.tmp to %WINDIR%\syswow64\gm3000bjcacsp.dll
- from %WINDIR%\syswow64\is-uenp7.tmp to %WINDIR%\syswow64\gm3000bjcacsp.sig
- from %WINDIR%\syswow64\is-8n16d.tmp to %WINDIR%\syswow64\gm3000bjcacsp_s.dll
- from %WINDIR%\syswow64\is-kb289.tmp to %WINDIR%\syswow64\gm3000_pkcs11_bjca.dll
- from %ProgramFiles(x86)%\gm3000\is-l338h.tmp to %ProgramFiles(x86)%\gm3000\gm3000_pkcs11_bjca.dll
- from %ProgramFiles(x86)%\gm3000\is-2k9mk.tmp to %ProgramFiles(x86)%\gm3000\tokenmgr.dll
- from %ProgramFiles(x86)%\gm3000\languages\is-4hqqb.tmp to %ProgramFiles(x86)%\gm3000\languages\mgrconfig.ini
- from %APPDATA%\longmai\gm3000bjca\is-7luvt.tmp to %APPDATA%\longmai\gm3000bjca\mgrconfig.ini
- from %ProgramFiles(x86)%\gm3000\languages\is-a7cih.tmp to %ProgramFiles(x86)%\gm3000\languages\chs_2052.lng
- from %ProgramFiles(x86)%\gm3000\languages\is-2b03t.tmp to %ProgramFiles(x86)%\gm3000\languages\en_1033.lng
- from %ProgramFiles(x86)%\gm3000\is-mvjs1.tmp to %ProgramFiles(x86)%\gm3000\gm3000bjcamon.exe
- from %ProgramFiles(x86)%\gm3000\is-hv4ta.tmp to %ProgramFiles(x86)%\gm3000\gm3000bjcapkimgr.exe
- from %WINDIR%\syswow64\is-fno9h.tmp to %WINDIR%\syswow64\gm3000_bjca.dll
- from <SYSTEM32>\is-hu8ht.tmp to <SYSTEM32>\gm3000_bjca_x64.dll
Substitutes the following files
- %APPDATA%\longmai\gm3000bjca\mgrconfig.ini
- %ProgramFiles(x86)%\gm3000\languages\mgrconfig.ini
Network activity
UDP
- DNS ASK ti##.#jca.org.cn
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\instcciddrv.exe'
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjcaschedulejob.exe'
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\setuphelper.exe' /InstallCert
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.exe'
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.exe' /start
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.exe' /install
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXVersion_x64.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecXV2_x64.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecX_x64.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXAppCOM_x64.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxlogproxy.exe' /RegServer
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXVersion.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\setuphelper.exe' /WirteUpdateReg {BF720538-7840-4325-93CD-CF72FBF3232F}
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecXV2.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXAppCOM.dll"
- '%WINDIR%\syswow64\mtoken_iosvr.exe'
- '%WINDIR%\syswow64\mtoken_iosvr.exe' /Service
- '%ProgramFiles(x86)%\gm3000\gm3000bjcamon.exe'
- '%TEMP%\is-q9ji3.tmp\gm3000bjca_setup.tmp' /SL5="$E0248,1325858,57856,%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Driver\GM3000BJCA_Setup.exe" /SILENT /VERYSILENT
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\gm3000bjca_setup.exe' /SILENT /VERYSILENT
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\askeyserver.exe'
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\askeyserver.exe' /Service
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\wmcontrol.exe'
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\wmcontrol.exe' start
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\wmcontrol.exe' install
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecX.dll"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjcacertaide.exe' /min
Executes the following
- '%WINDIR%\syswow64\net1.exe' stop "Longmai mToken IOSVR"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\GM3000BJCACSP.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\GM3000BJCACSP.dll"
- '%WINDIR%\syswow64\net1.exe' start "Longmai mToken IOSVR"
- '%WINDIR%\syswow64\net1.exe' start "ASKeyServer"
- '%WINDIR%\syswow64\sc.exe' delete "XTXCoreSvr"
- '%WINDIR%\syswow64\net.exe' start "ASKeyServer"
- '%WINDIR%\syswow64\net1.exe' stop "ASKeyServer"
- '%WINDIR%\syswow64\net1.exe' stop "Security SoftSvc"
- '%WINDIR%\syswow64\net1.exe' stop "XTXCoreSvr"
- '%WINDIR%\syswow64\net.exe' start "Longmai mToken IOSVR"
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXAppCOM.dll"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecXV2_x64.dll"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecX_x64.dll"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXAppCOM_x64.dll"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start "Longmai mToken IOSVR"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXVersion.dll"' (with hidden window)
- '%WINDIR%\syswow64\mtoken_iosvr.exe' /Service' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecXV2.dll"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x86.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXSecX.dll"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.exe' /install' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\wmcontrol.exe' start' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\xtxcoresvr.exe' /start' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /im GM3000BJCAPKIMgr.exe /F' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /im GM3000BJCAMon.exe /F' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start "ASKeyServer"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Security SoftSvc"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\driver\wmcontrol.exe' install' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete "XTXCoreSvr"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "XTXCoreSvr"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "ASKeyServer"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Longmai mToken IOSVR"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\program\regsvr32_x64.exe' /s "%ProgramFiles(x86)%\BJCAClient\CertAppEnvV2.14.3\Program\XTXVersion_x64.dll"' (with hidden window)
- '%ProgramFiles(x86)%\bjcaclient\certappenvv2.14.3\bjcacertaide\bjcaschedulejob.exe' ' (with hidden window)
