Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\ppfilm\shell\open\command] '' = '%ProgramFiles(x86)%\pipi\jfCacheMgr.exe %1'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'jfproc' = '%ProgramFiles(x86)%\pipi\jfCacheMgr.exe'
- [<HKLM>\Software\Classes\KmMediaPlayer\shell\open\command] '' = '"%ProgramFiles(x86)%\pipi\PIPIPlayer.exe" "%L"'
- [<HKLM>\Software\Classes\JiaFilm.Document\shell\open\command] '' = '%ProgramFiles(x86)%\pipi\jfCacheMgr.exe %1'
Modifies file system
Creates the following files
- <Current directory>\pipi_setup_clean_585.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pipi\pipi player.lnk
- %ProgramFiles(x86)%\pipi\plugins\is-igbgo.tmp
- %ProgramFiles(x86)%\pipi\plugins\is-giq9t.tmp
- %ProgramFiles(x86)%\pipi\config\is-krpj0.tmp
- %ProgramFiles(x86)%\pipi\config\is-u3568.tmp
- %ProgramFiles(x86)%\pipi\config\is-70c3c.tmp
- %ProgramFiles(x86)%\pipi\config\is-ki3r1.tmp
- %ProgramFiles(x86)%\pipi\config\is-0k6b1.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pipi\pipi webplayer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pipi\media file association.lnk
- %ProgramFiles(x86)%\pipi\config\is-5bab8.tmp
- %ProgramFiles(x86)%\pipi\config\is-5ff62.tmp
- %ProgramFiles(x86)%\pipi\config\is-kb2uf.tmp
- %ProgramFiles(x86)%\pipi\config\is-g7ab0.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-4jmdo.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-3e7ec.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-m2ov4.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-8pr4h.tmp
- %ProgramFiles(x86)%\pipi\config\is-d99t9.tmp
- %ProgramFiles(x86)%\pipi\is-4topl.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pipi\pipi on the web.lnk
- %APPDATA%\microsoft\windows\cookies\user@.pipi[1].txt
- %APPDATA%\microsoft\windows\cookies\user@.ppfilm[1].txt
- %APPDATA%\microsoft\windows\cookies\user@.ppmovie[1].txt
- %APPDATA%\microsoft\windows\cookies\user@.pps[1].txt
- %APPDATA%\microsoft\windows\cookies\user@.kamun[1].txt
- %APPDATA%\microsoft\windows\cookies\user@www.pipi[1].txt
- %HOMEPATH%\local settings\application data\google\chrome\user data\default\cookies-journal
- %ProgramFiles(x86)%\pipi\machineinfo.cfg
- %ProgramFiles(x86)%\pipi\fileassocbak.cfg
- %WINDIR%\syswow64\config\mcckmplayervod.ini
- %ProgramFiles(x86)%\pipi\config\config.ini
- %WINDIR%\syswow64\pncrt.dll
- %ProgramFiles(x86)%\pipi\config\skin.ini
- %ProgramFiles(x86)%\pipi\config\partner.ini
- %ProgramFiles(x86)%\pipi\unins000.dat
- %ProgramFiles(x86)%\pipi\jfcachemgr.url
- %APPDATA%\microsoft\internet explorer\quick launch\pipi player.lnk
- %HOMEPATH%\desktop\pipi player.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pipi\uninstall pipi.lnk
- %ProgramFiles(x86)%\pipi\codec\rm\is-jcj9s.tmp
- %ProgramFiles(x86)%\pipi\config\is-8rg1c.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-15si6.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-9u08g.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-uihm7.tmp
- %ProgramFiles(x86)%\pipi\is-p0gu3.tmp
- %ProgramFiles(x86)%\pipi\is-efm3q.tmp
- %ProgramFiles(x86)%\pipi\is-crc4c.tmp
- %ProgramFiles(x86)%\pipi\is-tdkeo.tmp
- %ProgramFiles(x86)%\pipi\is-0smis.tmp
- %ProgramFiles(x86)%\pipi\is-p3chh.tmp
- %ProgramFiles(x86)%\pipi\is-74v5a.tmp
- %ProgramFiles(x86)%\pipi\is-i4nan.tmp
- %ProgramFiles(x86)%\pipi\is-ebbel.tmp
- %ProgramFiles(x86)%\pipi\is-86pm1.tmp
- %ProgramFiles(x86)%\pipi\is-rvnle.tmp
- %ProgramFiles(x86)%\pipi\is-dov6l.tmp
- %ProgramFiles(x86)%\pipi\is-n420r.tmp
- %ProgramFiles(x86)%\pipi\is-pduon.tmp
- %ProgramFiles(x86)%\pipi\is-mfcco.tmp
- %TEMP%\is-k1qjq.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-k1qjq.tmp\_isetup\_setup64.tmp
- %TEMP%\is-k1qjq.tmp\_isetup\_regdll.tmp
- %TEMP%\is-9op12.tmp\pipi_setup_clean_585.tmp
- %ProgramFiles(x86)%\pipi\0\__db.user.db
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pipi\faq on the web.lnk
- %ProgramFiles(x86)%\pipi\is-70u0u.tmp
- %ProgramFiles(x86)%\pipi\is-2r7lk.tmp
- %ProgramFiles(x86)%\pipi\is-nui16.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-2l8qq.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-i483p.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-ko2nq.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-2cec9.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-f1lfq.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-bk1pc.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-b19ub.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-mp4mv.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-u68c5.tmp
- %ProgramFiles(x86)%\pipi\codec\rm\is-dihd8.tmp
- %ProgramFiles(x86)%\pipi\is-n391a.tmp
- %ProgramFiles(x86)%\pipi\is-tktai.tmp
- %ProgramFiles(x86)%\pipi\is-s8r72.tmp
- %ProgramFiles(x86)%\pipi\is-b60tk.tmp
- %ProgramFiles(x86)%\pipi\is-5i6q0.tmp
- %ProgramFiles(x86)%\pipi\is-73nva.tmp
- %ProgramFiles(x86)%\pipi\is-06cbq.tmp
- %ProgramFiles(x86)%\pipi\is-85ecp.tmp
- %ProgramFiles(x86)%\pipi\is-a7dhe.tmp
- %ProgramFiles(x86)%\pipi\0\user.db
Deletes the following files
- %ProgramFiles(x86)%\pipi\jfcachemgr.exe
- %ProgramFiles(x86)%\pipi\wizard_recommand.bmp
- %ProgramFiles(x86)%\pipi\baidu_logo.bmp
- %ProgramFiles(x86)%\pipi\google_logo.bmp
- %TEMP%\is-k1qjq.tmp\_isetup\_regdll.tmp
- %TEMP%\is-k1qjq.tmp\_isetup\_setup64.tmp
- %TEMP%\is-k1qjq.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9op12.tmp\pipi_setup_clean_585.tmp
- <Current directory>\pipi_setup_clean_585.exe
- %HOMEPATH%\local settings\application data\google\chrome\user data\default\cookies-journal
Moves the following files
- from %ProgramFiles(x86)%\pipi\is-mfcco.tmp to %ProgramFiles(x86)%\pipi\unins000.exe
- from %ProgramFiles(x86)%\pipi\codec\rm\is-bk1pc.tmp to %ProgramFiles(x86)%\pipi\codec\rm\ddnt3260.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-f1lfq.tmp to %ProgramFiles(x86)%\pipi\codec\rm\dnet3260.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-2cec9.tmp to %ProgramFiles(x86)%\pipi\codec\rm\drv1.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-ko2nq.tmp to %ProgramFiles(x86)%\pipi\codec\rm\drv2.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-i483p.tmp to %ProgramFiles(x86)%\pipi\codec\rm\drvc.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-2l8qq.tmp to %ProgramFiles(x86)%\pipi\codec\rm\hxltcolor.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-uihm7.tmp to %ProgramFiles(x86)%\pipi\codec\rm\pncrt.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-9u08g.tmp to %ProgramFiles(x86)%\pipi\codec\rm\raac.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-15si6.tmp to %ProgramFiles(x86)%\pipi\codec\rm\ralf.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-jcj9s.tmp to %ProgramFiles(x86)%\pipi\codec\rm\rv10.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-8pr4h.tmp to %ProgramFiles(x86)%\pipi\codec\rm\rv20.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-m2ov4.tmp to %ProgramFiles(x86)%\pipi\codec\rm\rv30.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-4jmdo.tmp to %ProgramFiles(x86)%\pipi\codec\rm\sipr.dll
- from %ProgramFiles(x86)%\pipi\plugins\is-igbgo.tmp to %ProgramFiles(x86)%\pipi\plugins\kmtransmit.dll
- from %ProgramFiles(x86)%\pipi\config\is-g7ab0.tmp to %ProgramFiles(x86)%\pipi\config\acl.cmcc.conf
- from %ProgramFiles(x86)%\pipi\config\is-kb2uf.tmp to %ProgramFiles(x86)%\pipi\config\acl.cnc.conf
- from %ProgramFiles(x86)%\pipi\config\is-5ff62.tmp to %ProgramFiles(x86)%\pipi\config\acl.crtc.conf
- from %ProgramFiles(x86)%\pipi\config\is-5bab8.tmp to %ProgramFiles(x86)%\pipi\config\acl.edu.conf
- from %ProgramFiles(x86)%\pipi\config\is-8rg1c.tmp to %ProgramFiles(x86)%\pipi\config\acl.greatwall.conf
- from %ProgramFiles(x86)%\pipi\config\is-d99t9.tmp to %ProgramFiles(x86)%\pipi\config\acl.telecom.conf
- from %ProgramFiles(x86)%\pipi\config\is-0k6b1.tmp to %ProgramFiles(x86)%\pipi\config\clienttype.ini
- from %ProgramFiles(x86)%\pipi\config\is-ki3r1.tmp to %ProgramFiles(x86)%\pipi\config\config.ini
- from %ProgramFiles(x86)%\pipi\config\is-70c3c.tmp to %ProgramFiles(x86)%\pipi\config\enumwindow.ini
- from %ProgramFiles(x86)%\pipi\config\is-u3568.tmp to %ProgramFiles(x86)%\pipi\config\partner.ini
- from %ProgramFiles(x86)%\pipi\config\is-krpj0.tmp to %ProgramFiles(x86)%\pipi\config\server.cfg
- from %ProgramFiles(x86)%\pipi\plugins\is-giq9t.tmp to %ProgramFiles(x86)%\pipi\plugins\kmrelay.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-b19ub.tmp to %ProgramFiles(x86)%\pipi\codec\rm\cook.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-3e7ec.tmp to %ProgramFiles(x86)%\pipi\codec\rm\rv40.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-mp4mv.tmp to %ProgramFiles(x86)%\pipi\codec\rm\atrc.dll
- from %ProgramFiles(x86)%\pipi\is-nui16.tmp to %ProgramFiles(x86)%\pipi\libdb43.dll
- from %ProgramFiles(x86)%\pipi\is-pduon.tmp to %ProgramFiles(x86)%\pipi\jfcachemgr.exe
- from %ProgramFiles(x86)%\pipi\is-n420r.tmp to %ProgramFiles(x86)%\pipi\baidu_logo.bmp
- from %ProgramFiles(x86)%\pipi\is-dov6l.tmp to %ProgramFiles(x86)%\pipi\dbghelp.dll
- from %ProgramFiles(x86)%\pipi\is-86pm1.tmp to %ProgramFiles(x86)%\pipi\google_logo.bmp
- from %ProgramFiles(x86)%\pipi\is-p0gu3.tmp to %ProgramFiles(x86)%\pipi\gtapi_signed.dll
- from %ProgramFiles(x86)%\pipi\is-ebbel.tmp to %ProgramFiles(x86)%\pipi\httpdownload.exe
- from %ProgramFiles(x86)%\pipi\is-74v5a.tmp to %ProgramFiles(x86)%\pipi\jfcheck.conf
- from %ProgramFiles(x86)%\pipi\is-p3chh.tmp to %ProgramFiles(x86)%\pipi\jfcheck.dll
- from %ProgramFiles(x86)%\pipi\is-0smis.tmp to %ProgramFiles(x86)%\pipi\jfres_plug.dll
- from %ProgramFiles(x86)%\pipi\is-tdkeo.tmp to %ProgramFiles(x86)%\pipi\kmbugslayerutil.dll
- from %ProgramFiles(x86)%\pipi\is-crc4c.tmp to %ProgramFiles(x86)%\pipi\kmfiletypesetting.exe
- from %ProgramFiles(x86)%\pipi\is-efm3q.tmp to %ProgramFiles(x86)%\pipi\kmliveupdate.exe
- from %ProgramFiles(x86)%\pipi\is-rvnle.tmp to %ProgramFiles(x86)%\pipi\mcckmplayerx.dll
- from %ProgramFiles(x86)%\pipi\codec\rm\is-dihd8.tmp to %ProgramFiles(x86)%\pipi\codec\rm\14_43260.dll
- from %ProgramFiles(x86)%\pipi\is-70u0u.tmp to %ProgramFiles(x86)%\pipi\mfc71.dll
- from %ProgramFiles(x86)%\pipi\is-4topl.tmp to %ProgramFiles(x86)%\pipi\msvcp71.dll
- from %ProgramFiles(x86)%\pipi\is-a7dhe.tmp to %ProgramFiles(x86)%\pipi\msvcr71.dll
- from %ProgramFiles(x86)%\pipi\is-2r7lk.tmp to %ProgramFiles(x86)%\pipi\pipiplayer.exe
- from %ProgramFiles(x86)%\pipi\is-85ecp.tmp to %ProgramFiles(x86)%\pipi\pipirecommend.dll
- from %ProgramFiles(x86)%\pipi\is-06cbq.tmp to %ProgramFiles(x86)%\pipi\pipiwebplayer.ocx
- from %ProgramFiles(x86)%\pipi\is-73nva.tmp to %ProgramFiles(x86)%\pipi\player.swf
- from %ProgramFiles(x86)%\pipi\is-5i6q0.tmp to %ProgramFiles(x86)%\pipi\pphelp.url
- from %ProgramFiles(x86)%\pipi\is-b60tk.tmp to %ProgramFiles(x86)%\pipi\sqlite3.dll
- from %ProgramFiles(x86)%\pipi\is-s8r72.tmp to %ProgramFiles(x86)%\pipi\vsfilterr.dll
- from %ProgramFiles(x86)%\pipi\is-tktai.tmp to %ProgramFiles(x86)%\pipi\webplayer.url
- from %ProgramFiles(x86)%\pipi\is-n391a.tmp to %ProgramFiles(x86)%\pipi\wizard_recommand.bmp
- from %ProgramFiles(x86)%\pipi\codec\rm\is-u68c5.tmp to %ProgramFiles(x86)%\pipi\codec\rm\28_83260.dll
- from %ProgramFiles(x86)%\pipi\0\__db.user.db to %ProgramFiles(x86)%\pipi\0\user.db
Substitutes the following files
- %ProgramFiles(x86)%\pipi\jfcachemgr.exe
- %HOMEPATH%\local settings\application data\google\chrome\user data\default\cookies-journal
Network activity
UDP
- DNS ASK st##.pipi.cn
- DNS ASK qu###.pipi.cn
- DNS ASK ud###ho.pipi.cn
- DNS ASK ne####ate.dvd88.cn
- DNS ASK re###.dvd88.cn
- DNS ASK re#.pipi.cn
- DNS ASK di##.kamun.com
- DNS ASK di##.dvd88.cn
Miscellaneous
Searches for the following windows
- ClassName: 'ppfilm_class' WindowName: ''
- ClassName: '' WindowName: 'ppfilm_class_cachemgr_title'
Creates and executes the following
- '<Current directory>\pipi_setup_clean_585.exe' /verysilent
- '%TEMP%\is-9op12.tmp\pipi_setup_clean_585.tmp' /SL5="$D0178,4161673,56320,<Current directory>\pipi_setup_clean_585.exe" /verysilent
- '%ProgramFiles(x86)%\pipi\jfcachemgr.exe'
- '<Current directory>\pipi_setup_clean_585.exe' /verysilent' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\pipi\JfCheck.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\pipi\PIPIWebPlayer.ocx"
