Trojan.DownLoader21.30957

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\.IEX\shell\open\command] '' = '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE http://hao.sb173.com/?0422'
[<HKLM>\SOFTWARE\Classes\ppfilm\shell\open\command] '' = '%ProgramFiles%\pipi\jfCacheMgr.exe %1'
[<HKLM>\SOFTWARE\Classes\.zei\shell\open\command] '' = '%WINDIR%\System\svchost.exe "%WINDIR%\explorer.exe:1998166001.jse"'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '%ProgramFiles%\Coopen\Coopen.scr'
[<HKLM>\SOFTWARE\Classes\KmMediaPlayer\shell\open\command] '' = '"%ProgramFiles%\pipi\PIPIPlayer.exe" "%L"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\CoopenІҐ·ЕЖч.lnk

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\pipi\KmLiveUpdate.exe' = '%ProgramFiles%\pipi\KmLiveUpd...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\pipi\HttpDownLoad.exe' = '%ProgramFiles%\pipi\HttpDownL...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\pipi\jfCacheMgr.exe' = '%ProgramFiles%\pipi\jfCacheMgr....
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\pipi\PIPIPlayer.exe' = '%ProgramFiles%\pipi\PIPIPlayer....

Creates and executes the following:

'%TEMP%\is-9CNES.tmp\pipi_setup_476.tmp' /SL5="$200E6,5624161,71168,%ProgramFiles%\winrar32\pipi_setup_476.exe" /verysilent
'%WINDIR%\system\SVCHOST.EXE' <SYSTEM32>\smss.exe:1998166001.jse
'%ProgramFiles%\winrar32\pipi_setup_476.exe' /verysilent
'%ProgramFiles%\winrar32\coopen_setup_100180.exe'
'%ProgramFiles%\winrar32\pipi_dae_476.exe'

Executes the following:

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\pipi\PIPIWebPlayer.ocx"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\pipi\codec\CoreAAC.ax"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\pipi\MCCKMPlayerX.dll"
'<SYSTEM32>\wscript.exe' "%ProgramFiles%\winrar32\20160422453.jse"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\pipi\JfCheck.dll"

Modifies file system:

Creates the following files:

%ProgramFiles%\pipi\codec\rm\is-H55E3.tmp
%ProgramFiles%\pipi\codec\rm\is-2OBAP.tmp
%ProgramFiles%\pipi\codec\rm\is-GJ77T.tmp
%ProgramFiles%\pipi\codec\rm\is-PDMB7.tmp
%ProgramFiles%\pipi\codec\rm\is-VGKN8.tmp
%ProgramFiles%\pipi\codec\rm\is-V3OUV.tmp
%ProgramFiles%\pipi\is-2HSSM.tmp
%ProgramFiles%\pipi\is-B6SN0.tmp
%ProgramFiles%\pipi\codec\is-L8F8D.tmp
%ProgramFiles%\pipi\codec\is-B8NER.tmp
%ProgramFiles%\pipi\codec\is-TEAF9.tmp
%ProgramFiles%\pipi\codec\rm\is-0VTJA.tmp
%ProgramFiles%\pipi\codec\rm\is-1813S.tmp
%ProgramFiles%\pipi\codec\rm\is-B5HTB.tmp
%ProgramFiles%\pipi\codec\rm\is-2UNHQ.tmp
%ProgramFiles%\pipi\codec\rm\is-VJLCG.tmp
%ProgramFiles%\pipi\codec\rm\is-NP3PN.tmp
%ProgramFiles%\pipi\codec\rm\is-CBMKS.tmp
%ProgramFiles%\pipi\codec\rm\is-DS7FA.tmp
%ProgramFiles%\pipi\codec\rm\is-CC5GU.tmp
%ProgramFiles%\pipi\codec\rm\is-8SSQG.tmp
%ProgramFiles%\pipi\codec\rm\is-Q8RCK.tmp
%ProgramFiles%\pipi\codec\rm\is-4D9IK.tmp
%ProgramFiles%\pipi\is-3TPOK.tmp
%ProgramFiles%\pipi\is-JKCPR.tmp
%ProgramFiles%\pipi\is-6JLOO.tmp
%ProgramFiles%\pipi\is-90LKU.tmp
%ProgramFiles%\pipi\is-FHHOO.tmp
%ProgramFiles%\pipi\is-LM8DH.tmp
%ProgramFiles%\pipi\is-24TVS.tmp
%ProgramFiles%\pipi\is-IE0JC.tmp
%ProgramFiles%\pipi\is-JI12K.tmp
%ProgramFiles%\pipi\is-7GKUA.tmp
%ProgramFiles%\pipi\is-H495H.tmp
%ProgramFiles%\pipi\is-0H8F5.tmp
%ProgramFiles%\pipi\is-V3N5J.tmp
%ProgramFiles%\pipi\is-JP39R.tmp
%ProgramFiles%\pipi\is-CM9AM.tmp
%ProgramFiles%\pipi\is-RRP74.tmp
%ProgramFiles%\pipi\is-68M7C.tmp
%ProgramFiles%\pipi\is-UREUU.tmp
%ProgramFiles%\pipi\is-58SQA.tmp
%ProgramFiles%\pipi\is-FIBKF.tmp
%ProgramFiles%\pipi\is-721FM.tmp
%ProgramFiles%\pipi\is-69P76.tmp
%ProgramFiles%\pipi\is-5AAJT.tmp
<SYSTEM32>\smss.exe:1998166001.jse
%WINDIR%\explorer.exe:1998166001.jse
<SYSTEM32>\dllcache\explorer.exe.new
<SYSTEM32>\config\mcckmplayervod.ini
<SYSTEM32>\dllcache\smss.exe.new
%ProgramFiles%\pipi\config\partner.ini
%HOMEPATH%\Desktop\PIPI Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Uninstall PIPI.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\PIPI Player.lnk
%ProgramFiles%\pipi\unins000.dat
%ProgramFiles%\pipi\jfCacheMgr.url
%TEMP%\jfcheck.conf.new
%HOMEPATH%\Templates\==淘宝购物==.bak
%HOMEPATH%\Templates\==网址导航==2.bak
%HOMEPATH%\Templates\==淘宝购物==2.bak
%HOMEPATH%\Templates\==玩小游戏==2.bak
%HOMEPATH%\Templates\==玩小游戏==.bak
%HOMEPATH%\Templates\==网址导航==.bak
<SYSTEM32>\pncrt.dll
%ProgramFiles%\pipi\config\skin.ini
%ProgramFiles%\pipi\config\config.ini
%ProgramFiles%\pipi\FileAssocBak.cfg
%ProgramFiles%\pipi\pipisp.url
%ProgramFiles%\pipi\config\is-589MR.tmp
%ProgramFiles%\pipi\config\is-69US6.tmp
%ProgramFiles%\pipi\config\is-H41CD.tmp
%ProgramFiles%\pipi\config\is-76QHA.tmp
%ProgramFiles%\pipi\config\is-NR79H.tmp
%ProgramFiles%\pipi\config\is-IRTNG.tmp
%ProgramFiles%\pipi\config\is-S14B6.tmp
%ProgramFiles%\pipi\config\is-OSR2O.tmp
%ProgramFiles%\pipi\config\is-T7QJI.tmp
%ProgramFiles%\pipi\config\is-H9BF0.tmp
%ProgramFiles%\pipi\config\is-55PKO.tmp
%ProgramFiles%\pipi\config\is-8LF7G.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Online Shopping.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI WebPlayer.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI on the web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\88488 Web Directory.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\FAQ on the web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Media File Association.lnk
%ProgramFiles%\pipi\Plugins\is-7G280.tmp
%ProgramFiles%\pipi\config\is-ET52N.tmp
%ProgramFiles%\pipi\Plugins\is-2IBKN.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI Player.lnk
%ProgramFiles%\pipi\Plugins\is-OAOFG.tmp
%ProgramFiles%\pipi\is-ALCV4.tmp
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Prev.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Play.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Widget.png
%ProgramFiles%\Coopen\Resource\SkinFormal\CheckU.png
%ProgramFiles%\Coopen\Resource\SkinFormal\CheckC.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Pause.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Channel.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Background.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Close.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Next.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Button_Commit.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Indicator1.png
%WINDIR%\smssrun.jse
%ProgramFiles%\Coopen\Resource\SkinFormal\Push_Cancel.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Push_Config.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Push_Folder.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Push_Confirm.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Progress.png
%ProgramFiles%\Coopen\Resource\SkinFormal\MainIcon.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Indicator2.png
%ProgramFiles%\Coopen\Resource\SkinFormal\Message.png
%WINDIR%\winnode32.dll
%ProgramFiles%\Coopen\Resource\SkinFormal\Notify.png
%TEMP%\nss3.tmp\System.dll
%TEMP%\nsn2.tmp
C:\CCPMachineInfo.dll
%ProgramFiles%\winrar32\pipi_dae_476.exe
%TEMP%\nss3.tmp\KillProcDLL.dll
%ProgramFiles%\winrar32\20160422453.jse
%ProgramFiles%\winrar32\coopen_setup_100180.exe
C:\7ACCBF2E.log
<SYSTEM32>\fswf.ico
%ProgramFiles%\winrar32\winrar32.jse
<SYSTEM32>\tbao.ico
%ProgramFiles%\Coopen\Coopen.exe
%ProgramFiles%\Coopen\Templete\ModeC.tpl
%ProgramFiles%\Coopen\licence.txt
%ProgramFiles%\Coopen\Templete\ModeB.tpl
%ProgramFiles%\Coopen\Templete\CoopenPhoto.jpg
%ProgramFiles%\Coopen\Templete\ModeB_logo.jpg
%ProgramFiles%\Coopen\CoopenActiveControl109.dll
%ProgramFiles%\Coopen\conf\PluginConfig.ini
%ProgramFiles%\Coopen\conf\ChannelListReal.txt
%TEMP%\nss3.tmp\install.bmp
%ProgramFiles%\Coopen\CoopenMainManager.dll
%ProgramFiles%\Coopen\CoopenAir.exe
%TEMP%\is-0L5SU.tmp\wizard_recommand.jpg
%TEMP%\is-0L5SU.tmp\baidu_logo.jpg
%TEMP%\is-0L5SU.tmp\topWizardSmallImageFile.jpg
%TEMP%\is-0L5SU.tmp\google_logo.bmp
%TEMP%\is-0L5SU.tmp\setupwelcome.bmp
%TEMP%\is-0L5SU.tmp\google_logo.jpg
%TEMP%\is-0L5SU.tmp\jpg2bmp.dll
%TEMP%\is-0L5SU.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0L5SU.tmp\PIPIRecommend.dll
%TEMP%\is-0L5SU.tmp\setupwelcome.jpg
%TEMP%\is-0L5SU.tmp\gtapi_signed.dll
%TEMP%\is-0L5SU.tmp\baidu_logo.bmp
%ProgramFiles%\pipi\is-58H2N.tmp
%ProgramFiles%\pipi\is-MON4R.tmp
%ProgramFiles%\pipi\is-C5SA7.tmp
%ProgramFiles%\pipi\is-BCRNH.tmp
%ProgramFiles%\pipi\is-6QCB2.tmp
%ProgramFiles%\pipi\is-593UB.tmp
%TEMP%\is-0L5SU.tmp\topWizardSmallImageFile.bmp
%TEMP%\is-0L5SU.tmp\wizard_recommand.bmp
%ProgramFiles%\pipi\is-TL0QQ.tmp
%ProgramFiles%\pipi\is-LS9P3.tmp
%ProgramFiles%\pipi\is-AJ11F.tmp
%ProgramFiles%\Coopen\Templete\DefaultCoopenWallpaper.jpg
%ProgramFiles%\Coopen\Resource\SkinFormal\Synopsis1.ini
%ProgramFiles%\Coopen\Coopen.scr
%ProgramFiles%\Coopen\image\Wallpaper\local wallpaper\ModeAList.ini
%ProgramFiles%\Coopen\image\Wallpaper\local wallpaper\DefaultCoopenWallpaper.jpg
%ProgramFiles%\Coopen\Resource\SkinFormal\SkinClose.ini
%ProgramFiles%\Coopen\Resource\SkinFormal\RadioU.png
%ProgramFiles%\Coopen\Resource\SkinFormal\RadioC.png
%ProgramFiles%\winrar32\pipi_setup_476.exe
%ProgramFiles%\Coopen\Resource\SkinFormal\SkinClient.ini
%ProgramFiles%\Coopen\Resource\SkinFormal\Synopsis1.png
%ProgramFiles%\Coopen\image\Wallpaper\coopen wallpaper\DefaultCoopenWallpaper.jpg
%ProgramFiles%\Coopen\conf\All Users.ini
%ProgramFiles%\Coopen\uninst.exe
%ProgramFiles%\Coopen\conf\%USERNAME%.ini
%HOMEPATH%\Desktop\Coopen.lnk
%TEMP%\is-0L5SU.tmp\_isetup\_RegDLL.tmp
%HOMEPATH%\Start Menu\Programs\Coopen\CoopenІҐ·ЕЖч.lnk
%ProgramFiles%\Coopen\image\Photo\local Photo\B_0.jpg
%ProgramFiles%\Coopen\image\Wallpaper\coopen wallpaper\PicList.ini
%ProgramFiles%\Coopen\image\Photo\local Photo\B_1.jpg
%TEMP%\is-9CNES.tmp\pipi_setup_476.tmp
%ProgramFiles%\Coopen\image\Photo\local Photo\ModeBList.ini

Sets the 'hidden' attribute to the following files:

%WINDIR%\system\SVCHOST.EXE
%ProgramFiles%\winrar32\20160422453.jse
%ProgramFiles%\winrar32\winrar32.jse

Deletes the following files:

%TEMP%\nss3.tmp\System.dll
%ProgramFiles%\pipi\jfCacheMgr.exe
%TEMP%\nss3.tmp\install.bmp
%TEMP%\nss3.tmp\KillProcDLL.dll

Moves the following files:

from %ProgramFiles%\pipi\codec\rm\is-4D9IK.tmp to %ProgramFiles%\pipi\codec\rm\pncrt.dll
from %ProgramFiles%\pipi\codec\rm\is-Q8RCK.tmp to %ProgramFiles%\pipi\codec\rm\raac.dll
from %ProgramFiles%\pipi\codec\rm\is-DS7FA.tmp to %ProgramFiles%\pipi\codec\rm\drvc.dll
from %ProgramFiles%\pipi\codec\rm\is-8SSQG.tmp to %ProgramFiles%\pipi\codec\rm\hxltcolor.dll
from %ProgramFiles%\pipi\codec\rm\is-CBMKS.tmp to %ProgramFiles%\pipi\codec\rm\ralf.dll
from %ProgramFiles%\pipi\codec\rm\is-2UNHQ.tmp to %ProgramFiles%\pipi\codec\rm\rv30.dll
from %ProgramFiles%\pipi\codec\rm\is-NP3PN.tmp to %ProgramFiles%\pipi\codec\rm\rv40.dll
from %ProgramFiles%\pipi\codec\rm\is-B5HTB.tmp to %ProgramFiles%\pipi\codec\rm\rv10.dll
from %ProgramFiles%\pipi\codec\rm\is-1813S.tmp to %ProgramFiles%\pipi\codec\rm\rv20.dll
from %ProgramFiles%\pipi\codec\rm\is-2OBAP.tmp to %ProgramFiles%\pipi\codec\rm\28_83260.dll
from %ProgramFiles%\pipi\codec\rm\is-H55E3.tmp to %ProgramFiles%\pipi\codec\rm\atrc.dll
from %ProgramFiles%\pipi\codec\is-B8NER.tmp to %ProgramFiles%\pipi\codec\MPCVideoDec.ax
from %ProgramFiles%\pipi\codec\rm\is-V3OUV.tmp to %ProgramFiles%\pipi\codec\rm\14_43260.dll
from %ProgramFiles%\pipi\codec\rm\is-GJ77T.tmp to %ProgramFiles%\pipi\codec\rm\cook.dll
from %ProgramFiles%\pipi\codec\rm\is-0VTJA.tmp to %ProgramFiles%\pipi\codec\rm\drv1.dll
from %ProgramFiles%\pipi\codec\rm\is-CC5GU.tmp to %ProgramFiles%\pipi\codec\rm\drv2.dll
from %ProgramFiles%\pipi\codec\rm\is-VGKN8.tmp to %ProgramFiles%\pipi\codec\rm\ddnt3260.dll
from %ProgramFiles%\pipi\codec\rm\is-PDMB7.tmp to %ProgramFiles%\pipi\codec\rm\dnet3260.dll
from %ProgramFiles%\pipi\config\is-76QHA.tmp to %ProgramFiles%\pipi\config\tab2_down.bmp
from %ProgramFiles%\pipi\config\is-8LF7G.tmp to %ProgramFiles%\pipi\config\tab2_norm.bmp
from %ProgramFiles%\pipi\config\is-H41CD.tmp to %ProgramFiles%\pipi\config\enumwindow.ini
from %ProgramFiles%\pipi\config\is-NR79H.tmp to %ProgramFiles%\pipi\config\partner.ini
from %ProgramFiles%\pipi\config\is-ET52N.tmp to %ProgramFiles%\pipi\config\tab2_over.bmp
from %ProgramFiles%\pipi\Plugins\is-OAOFG.tmp to %ProgramFiles%\pipi\Plugins\KmUdx.dll
from %TEMP%\jfcheck.conf.new to %APPDATA%\PIPI\jfcheck.conf
from %ProgramFiles%\pipi\Plugins\is-7G280.tmp to %ProgramFiles%\pipi\Plugins\KmHashFile.dll
from %ProgramFiles%\pipi\Plugins\is-2IBKN.tmp to %ProgramFiles%\pipi\Plugins\KmTransmit.dll
from %ProgramFiles%\pipi\config\is-S14B6.tmp to %ProgramFiles%\pipi\config\acl.cnc.conf
from %ProgramFiles%\pipi\config\is-T7QJI.tmp to %ProgramFiles%\pipi\config\acl.crtc.conf
from %ProgramFiles%\pipi\codec\rm\is-VJLCG.tmp to %ProgramFiles%\pipi\codec\rm\sipr.dll
from %ProgramFiles%\pipi\config\is-OSR2O.tmp to %ProgramFiles%\pipi\config\acl.cmcc.conf
from %ProgramFiles%\pipi\config\is-55PKO.tmp to %ProgramFiles%\pipi\config\acl.edu.conf
from %ProgramFiles%\pipi\config\is-69US6.tmp to %ProgramFiles%\pipi\config\clienttype.ini
from %ProgramFiles%\pipi\config\is-589MR.tmp to %ProgramFiles%\pipi\config\config.ini
from %ProgramFiles%\pipi\config\is-H9BF0.tmp to %ProgramFiles%\pipi\config\acl.greatwall.conf
from %ProgramFiles%\pipi\config\is-IRTNG.tmp to %ProgramFiles%\pipi\config\acl.telecom.conf
from %ProgramFiles%\pipi\is-JI12K.tmp to %ProgramFiles%\pipi\KmBugslayerUtil.dll
from %ProgramFiles%\pipi\is-H495H.tmp to %ProgramFiles%\pipi\KmFileTypeSetting.exe
from %ProgramFiles%\pipi\is-IE0JC.tmp to %ProgramFiles%\pipi\jfres_plug.dll
from %ProgramFiles%\pipi\is-24TVS.tmp to %ProgramFiles%\pipi\jpg2bmp.dll
from %ProgramFiles%\pipi\is-7GKUA.tmp to %ProgramFiles%\pipi\KmLiveUpdate.exe
from %ProgramFiles%\pipi\is-3TPOK.tmp to %ProgramFiles%\pipi\MFC71.dll
from %ProgramFiles%\pipi\is-6JLOO.tmp to %ProgramFiles%\pipi\msvcp71.dll
from %ProgramFiles%\pipi\is-LM8DH.tmp to %ProgramFiles%\pipi\libdb43.dll
from %ProgramFiles%\pipi\is-JKCPR.tmp to %ProgramFiles%\pipi\MCCKMPlayerX.dll
from %ProgramFiles%\pipi\is-LS9P3.tmp to %ProgramFiles%\pipi\baidu_logo.JPG
from %ProgramFiles%\pipi\is-593UB.tmp to %ProgramFiles%\pipi\dbghelp.dll
from %ProgramFiles%\pipi\is-TL0QQ.tmp to %ProgramFiles%\pipi\unins000.exe
from %ProgramFiles%\pipi\is-AJ11F.tmp to %ProgramFiles%\pipi\jfCacheMgr.exe
from %ProgramFiles%\pipi\is-MON4R.tmp to %ProgramFiles%\pipi\google_logo.JPG
from %ProgramFiles%\pipi\is-BCRNH.tmp to %ProgramFiles%\pipi\jfcheck.conf
from %ProgramFiles%\pipi\is-ALCV4.tmp to %ProgramFiles%\pipi\JfCheck.dll
from %ProgramFiles%\pipi\is-58H2N.tmp to %ProgramFiles%\pipi\gtapi_signed.dll
from %ProgramFiles%\pipi\is-C5SA7.tmp to %ProgramFiles%\pipi\HttpDownLoad.exe
from %ProgramFiles%\pipi\is-CM9AM.tmp to %ProgramFiles%\pipi\sqlite3.dll
from %ProgramFiles%\pipi\is-68M7C.tmp to %ProgramFiles%\pipi\topWizardSmallImageFile.jpg
from %ProgramFiles%\pipi\is-JP39R.tmp to %ProgramFiles%\pipi\ppwebnav.url
from %ProgramFiles%\pipi\is-V3N5J.tmp to %ProgramFiles%\pipi\setupwelcome.JPG
from %ProgramFiles%\pipi\is-RRP74.tmp to %ProgramFiles%\pipi\uninstall.ico
from %ProgramFiles%\pipi\codec\is-L8F8D.tmp to %ProgramFiles%\pipi\codec\CoreAAC.ax
from %ProgramFiles%\pipi\codec\is-TEAF9.tmp to %ProgramFiles%\pipi\codec\CoreAVC.ax
from %ProgramFiles%\pipi\is-B6SN0.tmp to %ProgramFiles%\pipi\webplayer.url
from %ProgramFiles%\pipi\is-2HSSM.tmp to %ProgramFiles%\pipi\wizard_recommand.JPG
from %ProgramFiles%\pipi\is-0H8F5.tmp to %ProgramFiles%\pipi\PIPIRecommend.dll
from %ProgramFiles%\pipi\is-FIBKF.tmp to %ProgramFiles%\pipi\pipisp.ico
from %ProgramFiles%\pipi\is-FHHOO.tmp to %ProgramFiles%\pipi\msvcr71.dll
from %ProgramFiles%\pipi\is-90LKU.tmp to %ProgramFiles%\pipi\PIPIPlayer.exe
from %ProgramFiles%\pipi\is-58SQA.tmp to %ProgramFiles%\pipi\pipisp.url
from %ProgramFiles%\pipi\is-69P76.tmp to %ProgramFiles%\pipi\player.swf
from %ProgramFiles%\pipi\is-UREUU.tmp to %ProgramFiles%\pipi\pphelp.url
from %ProgramFiles%\pipi\is-721FM.tmp to %ProgramFiles%\pipi\PIPIStartSvr.exe
from %ProgramFiles%\pipi\is-5AAJT.tmp to %ProgramFiles%\pipi\PIPIWebPlayer.ocx

Network activity:

Connects to:

'ha#.#b173.com':80
'localhost':1046
'www.pi#i.cn':80

TCP:

HTTP GET requests:

http://ha#.#b173.com/?
http://www.pi#i.cn/pfup/jfcheck/jfcheck.conf

UDP:

DNS ASK ha#.#b173.com
DNS ASK www.pi#i.cn

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''
ClassName: '' WindowName: 'ppfilm_class_cachemgr_title'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: '' WindowName: 'Coopen@wwwcoopencn'
ClassName: '' WindowName: 'cool66byCool66comcn123'
ClassName: 'progman' WindowName: 'Program Manager'
ClassName: 'ppfilm_class' WindowName: ''
ClassName: 'CoopenPlayer' WindowName: '*їЄЖБґ«ГЅ*'
ClassName: 'CoopenPlayer' WindowName: '*????????*'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней