KUALA LUMPUR • The woman with the letters "LOL" on her shirt, who was arrested in connection with Mr Kim Jong Nam's murder, stayed in cheap hotels, carried a wad of cash and cut her hair a day before the brazen attack at Kuala Lumpur International Airport 2.

The receptionist at one of the hotels said a woman who had checked in under the Vietnamese name of Doan Thi Huong on Sunday left early on Monday morning, the day of the assassination, and returned later, showing no signs of stress.

Police believe she was the person who, at around 8.20am that day, had approached the estranged half- brother of North Korean leader Kim Jong Un from behind at the budget airline terminal and thrust a deadly poisonous substance onto his face.

According to Malaysian media reports, both Doan and an Indonesian woman called Siti Aisyah, who has also been detained, thought they were involved in a prank.

However, staff at two hotels in a rundown area near the airport gave details of Doan's movements, which appeared both calm and deliberate, before the killing.

A private investigator said her behaviour bore the hallmarks of an intelligence operative. Doan first checked into the two-star Qlassic Hotel last Saturday, choosing to stay in the cheapest room with no windows.

Another hotel employee, who works at the front desk, said: "I remember she had wanted to extend her stay here, and was ready to pay with a stack of money in her hand."

After one night, she checked into the CityView Hotel with a suitcase, a backpack and a large teddy bear, the receptionist said.

Doan borrowed a pair of scissors from the front desk on Sunday. The next morning, a housekeeping employee found hair on the floor and in the waste basket.

The receptionist also said Doan had on the shirt she was seen wearing in airport security footage that has earned her the nickname "LOL Girl" in Malaysian media.

Doan was out for much of the morning and, on her return, she seemed "relaxed" and "didn't look angry or worried". She checked out and left.

She then checked into the SkyStar Hotel, also nearby, and left after one night, an employee said.

It is not known where Doan went next. She was arrested on Wednesday morning, about 48 hours after the murder, in the same terminal where Mr Kim was attacked.

"If you ask me, do her movements indicate that she was an intelligence operative, then I would say yes," said a private investigator in Kuala Lumpur who asked not to be named. "That is how they operate. Change of appearance, cash transactions, no paper trail and constantly on the move."

Second suspect Siti Aisyah had lived in a slum district of Jakarta before going to find work in Malaysia. She had worked in a tailoring business in the house of her former husband's family, former neighbours in the Tambora district said.

The couple moved to Malaysia several years ago, but separated in 2012.

Aisyah's former father-in-law said she had returned to Jakarta on Jan 28 to see her seven-year-old son. She had looked thinner than usual and had a cough.

Ms Ida Anisafitri, a neighbour, said Aisyah kept a low profile when she visited there.

"We would see her briefly with the child, and then she would go back inside the house," she said.

REUTERS