Trojan.Generic.16756639_ae3318944f – Adaware

Trojan.BAT.StartPage.cu (Kaspersky), Trojan.Generic.16756639 (B) (Emsisoft), Trojan.Generic.16756639 (AdAware), Trojan.Win32.IEDummy.FD, Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Trojan, Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: ae3318944fdd27487fb60e38fa33b443

SHA1: 80ff9b73a1b98583d2095b238101e19f88041fcc

SHA256: d66cc2d04ce25c7ed741f94dc382cb59a0891cc2d9e993cd7ac31f55b727721e

SSDeep: 24576:taHMv6Corjqnyi8iYlaVWHAHQUpoEpmw6NIj7tg8gMxcc4v5gv312bYi :t1vqjdi83acHAHVpS3NIPO836h

Size: 1594614 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2010-04-16 10:47:33

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:824
attrib.exe:444
tasklist.exe:592
regedit.exe:1992
regedit.exe:1432
regedit.exe:1716
regedit.exe:1540
regedit.exe:1800
regedit.exe:484
regedit.exe:1088
regedit.exe:420
regedit.exe:932
regedit.exe:660
regedit.exe:1868
regedit.exe:2012
%original file name%.exe:312
find.exe:1304

The Trojan injects its code into the following process(es):

forqd340.exe:588

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutex

File activity

The process tasklist.exe:592 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\tasklist.txt (152367 bytes)

The process %original file name%.exe:312 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\d.tmp (91 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (2897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\location[1].htm (91 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (3089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pi3603.exe (254330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gou3603.exe (320269 bytes)
%Documents and Settings%\All Users\Application Data\vcry\kswbc.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\shishuoxinci[1].htm (13466 bytes)
%Documents and Settings%\%current user%\Desktop\okregreg.reg (229 bytes)
%Documents and Settings%\%current user%\Desktop\Internat Explorer.OQW (37 bytes)
%Documents and Settings%\All Users\Desktop\forqd340.exe (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (3185 bytes)
%Documents and Settings%\All Users\Application Data\vcry\kswebshield.dll (4025 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\All Users\Application Data\vcry\kwssp.dll (3641 bytes)
%Program Files%\Microsoft Cdobe Emulator\Internat Explorer\Desktop.ini (75 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\Administrator\Application Data\Tencent\AXSEF\AXSEF.exe (1477492 bytes)
%Documents and Settings%\%current user%\Application Data\360se\360se.ini (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (3185 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Desktop\okregreg.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)

The process find.exe:1304 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\find.txt (27 bytes)

The process forqd340.exe:588 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\PPTV(pplive)_forqd340[1].exe (1675692 bytes)

Registry activity

The process attrib.exe:824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 A1 DF 10 6C A4 46 12 FD E1 88 52 44 49 B4 88"

The process attrib.exe:444 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE E6 DD E9 AF C1 A5 5C 01 99 AD 4A B5 31 4E 51"

The process tasklist.exe:592 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 73 E1 A1 FF 2D 6E 85 85 E1 18 32 4D F5 65 27"

The process regedit.exe:1992 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 E0 2F D5 B6 AF 33 93 55 A7 E6 15 70 9E BD B1"

The process regedit.exe:1432 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 9B B5 4A 8E 97 0F B5 06 EE 7B B4 6D 2B 09 A6"

The process regedit.exe:1716 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 0E BC 80 FC 76 B8 3D 37 3A 71 C5 0F 62 56 C5"

The process regedit.exe:1540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 78 85 0E 4D 28 40 5F 94 A0 F6 6A 3A E7 74 84"

The process regedit.exe:1800 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 2F 97 10 32 B3 24 43 92 09 CF D4 62 28 15 6C"

The process regedit.exe:484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 58 76 07 04 15 41 B6 D3 D2 3F 39 CF 37 57 A0"

The process regedit.exe:1088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 27 35 F0 45 BF C5 9F B3 27 48 AE 6C 7C E2 76"

The process regedit.exe:420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 24 55 6B 0C F7 B5 E4 BE BE A0 72 7A 44 BF 33"

The process regedit.exe:932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 AC 5F 43 C0 14 AD 44 CB 5F 71 B5 B8 2A 21 90"

The process regedit.exe:660 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F F3 04 4B 4B 7E 45 6C 0B 41 7D 26 49 1C 43 90"

The process regedit.exe:1868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 FD 9D 00 18 A7 18 C3 5D 88 1D 3A F5 CD 14 2E"

The process regedit.exe:2012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 E4 3F D6 54 DF 02 8F AE 57 C1 2B 75 FE FD CA"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Atfmon.exe" = "D:\Stion\tmp....................................\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}.. hh.exe"

The process %original file name%.exe:312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\.OQW]
"(Default)" = "HUJB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\HUJB\shell\open\command]
"(Default)" = "explorer %Program Files%\Microsoft %C%8o›Ž Emulator\Internat Explorer"

[HKCR\HUJB\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\IEXPLORE.EXE"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 07 9E 5A 41 42 4B 35 24 46 8D 1D 5F E6 F0 DA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process find.exe:1304 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 02 09 0A 90 24 1D EA 18 E7 3C 7D 1F F8 EA 0E"

The process forqd340.exe:588 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
db4c4a52949fca582206dbc9e383f929	c:\Documents and Settings\Administrator\Application Data\Tencent\AXSEF\AXSEF.exe
76d1736f2bd7405598ddaa7146defdd4	c:\Documents and Settings\All Users\Application Data\vcry\kswbc.dll
7851449473178f9782263d51bc5e3bbc	c:\Documents and Settings\All Users\Application Data\vcry\kswebshield.dll
bf5dcfd9da0514334d41cbd80d2a9138	c:\Documents and Settings\All Users\Application Data\vcry\kwssp.dll
f56a9f4fb234f8e9d99d0d1f5df7a7c8	c:\Documents and Settings\All Users\Desktop\forqd340.exe
ad70c21a978613f0d8436476f051c451	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\gou3603.exe
525bf0271b6ef28762b778aade8e4b78	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\pi3603.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
attrib.exe:824
attrib.exe:444
tasklist.exe:592
regedit.exe:1992
regedit.exe:1432
regedit.exe:1716
regedit.exe:1540
regedit.exe:1800
regedit.exe:484
regedit.exe:1088
regedit.exe:420
regedit.exe:932
regedit.exe:660
regedit.exe:1868
regedit.exe:2012
%original file name%.exe:312
find.exe:1304
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%System%\tasklist.txt (152367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\d.tmp (91 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (2897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\location[1].htm (91 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (3089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pi3603.exe (254330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gou3603.exe (320269 bytes)
%Documents and Settings%\All Users\Application Data\vcry\kswbc.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\shishuoxinci[1].htm (13466 bytes)
%Documents and Settings%\%current user%\Desktop\okregreg.reg (229 bytes)
%Documents and Settings%\%current user%\Desktop\Internat Explorer.OQW (37 bytes)
%Documents and Settings%\All Users\Desktop\forqd340.exe (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (3185 bytes)
%Documents and Settings%\All Users\Application Data\vcry\kswebshield.dll (4025 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\All Users\Application Data\vcry\kwssp.dll (3641 bytes)
%Program Files%\Microsoft Cdobe Emulator\Internat Explorer\Desktop.ini (75 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\Administrator\Application Data\Tencent\AXSEF\AXSEF.exe (1477492 bytes)
%Documents and Settings%\%current user%\Application Data\360se\360se.ini (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (3185 bytes)
%System%\find.txt (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\PPTV(pplive)_forqd340[1].exe (1675692 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Atfmon.exe" = "D:\Stion\tmp....................................\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}.. hh.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 6, 1
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 6, 1File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	524311	524800	4.59884	be1208f841dc92012d5f6bbdd832e6d9
.rdata	532480	55644	55808	3.15707	f6f8c907d8737bc8580a33fc54f93268
.data	589824	107800	26624	1.52615	e5d77411f751d28c6eee48a743606795
.rsrc	700416	12144	12288	3.42739	d00bce8ffb9d256f404c92a7bee6d555

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 2
288f63ed926a2dfea22c60a24d8e5c26
d086269a5ff40ddca8307ee837524399

Network Activity

URLs

URL	IP
hxxp://www.81830.info/tg14.html	199.59.243.120
hxxp://c01.i07.rpnic.lv3.cloudglb.com/PPTV(pplive)_forqd340.exe
hxxp://api.liqwei.com/location/	119.254.0.9
hxxp://www.3929.cn/?tn=sun	122.114.60.218
hxxp://www.a.shifen.com/buzz/shishuoxinci.html
hxxp://download.pplive.com/PPTV(pplive)_forqd340.exe	27.209.182.8
hxxp://top.baidu.com/buzz/shishuoxinci.html

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /location/ HTTP/1.1

User-Agent: AutoIt

Host: api.liqwei.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 91

Content-Type: text/html

Content-Location: hXXp://api.liqwei.com/404.html?404;hXXp://api.liqwei.com:80/location/

Last-Modified: Fri, 25 Feb 2011 05:13:24 GMT

Accept-Ranges: bytes

ETag: "ccf928baaad4cb1:46bfb"

Server: Microsoft-IIS/6.0

Date: Wed, 01 Jun 2016 15:50:56 GMT

<html><head><meta http-equiv="refresh" content="0;url=http://VVV.ibicn.com/"></head></html>HTTP/1.1 200 OK..Content-Length: 91..Content-Type: text/html..Content-Location: hXXp://api.liqwei.com/404.html?404;hXXp://api.liqwei.com:80/location/..Last-Modified: Fri, 25 Feb 2011 05:13:24 GMT..Accept-Ranges: bytes..ETag: "ccf928baaad4cb1:46bfb"..Server: Microsoft-IIS/6.0..Date: Wed, 01 Jun 2016 15:50:56 GMT..<html><head><meta http-equiv="refresh" content="0;url=hXXp://VVV.ibicn.com/"></head></html>..

GET /PPTV(pplive)_forqd340.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: download.pplive.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 01 Jun 2016 15:50:55 GMT

Expires: Fri, 01 Jul 2016 15:50:55 GMT

Content-Length: 11553192

Accept-Ranges: bytes

Content-Type: application/octet-stream

Last-Modified: Mon, 13 Jun 2011 09:44:21 GMT

Cache-Control: max-age=2592000

Connection: Keep-Alive

Fw-Via: MISS from 222.175.101.31, URefresh MISS from 222.88.95.250, DISK HIT from 27.209.182.28, Configured MISS from 27.209.182.26

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h.....X...X...X.q$X...X...X...X.q4X...X.[#X...X.q&X...XRich...X................PE..L......M.................f..........d8............@..................................y..................................................(........... 4...............................................................................................text....d.......f.................. ..`.rdata..p........ ...j..............@..@.data...............................@....ndata.......`...........................rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....SB..H.P.u..u..u...h.@..K...SV.5.SB.W.E.P.u...l.@..e...E..E.P.u...p.@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u...t.@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h.KB.W..x.@..u.W...u....E.P.u...|.@._^3.[.....L$...SB...i......T.....tUVW.q.3.;5.SB.sD..i......D..S.....t.G.....t...O..t .....u...3....3...F.....;5.SB.r.[_^...U..QQ.U.

<<< skipped >>>

GET /tg14.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.81830.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Last-Modified: Thu, 26 May 2016 17:47:24 GMT

Accept-Ranges: bytes

ETag: "09e2a976b7d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 01 Jun 2016 15:50:50 GMT

Content-Length: 2407

<!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title></title><meta name="viewport" content="width=device-width, initial-scale=1"><noscript><meta HTTP-EQUIV="REFRESH" content="0; url=/legacy"></noscript><meta name="description" content="See related links to what you are looking for."/></head><body><script type="text/javascript">g_oV=(function(){var.Dv=document,ayG=location,C_=Dv.createElement('script'),azM=false,LE;C_.defer=true;C_.async=true;C_.src="//VVV.google.com/adsense/domains/caf.js";C_.onerror=function(){ayG.href='/legacy';};C_.onload=C_.onreadystatechange=function(){if(!azM&&LE){if(!window['googleNDT_']){ayG.replace('/legacy');}.LE(google.ads.domains.Caf);}.azM=true;};Dv.body.appendChild(C_);return{ayv:function(oe){if(azM).oe(google.ads.domains.Caf);else.LE=oe;},bq:function(){if(!azM){Dv.body.removeChild(C_);}}};})();g_oX=(function(){var.ayG=window.location,nB={},bH,ayF=ayG.search.substring(1),azE,azG;if(!ayF).return nB;azE=ayF.split("&");for(bH=0;bH<azE.length;bH ){azG=azE[bH].split('=');nB[azG[0]]=azG[1]?azG[1]:"";}.return nB;})();(function(){var azy=screen,QW=window,ayG=QW.locatio

<<< skipped >>>

GET /?tn=sun HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.3929.cn

Connection: Keep-Alive

HTTP/1.1 404 Object not found

Content-Type: text/html; charset=utf-8

Connection: close

Server: Knstat/2.1.1(rssn@163.com)

Content-Length: 584

...................................................................................................... ....

GET /buzz/shishuoxinci.html HTTP/1.1

User-Agent: AutoIt

Host: top.baidu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 01 Jun 2016 15:51:22 GMT

Content-Type: text/html;

Transfer-Encoding: chunked

Connection: Keep-Alive

Set-Cookie: BAIDUID=3F7CF7D7C8DF82AFEE1FBC9304A02172:FG=1; expires=Thu, 01-Jun-17 15:51:22 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Server: PS-DSP/1.0

10d4..<!DOCTYPE html>.<html>. <head>. <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />. <title>..................--..............</title>. ..<base href="hXXp://top.baidu.com/" /> . <style>. .icon-xiang-imp {background:url(hXXp://top.bdimg.com/frontend/static/common/images/xiang.png) center center no-repeat !important;}. </style>. <script>. var href_ps_tn = 'SE_baiduhomet8_jmjb7mjw';. var href_ps_prep = 'hXXp://VVV.baidu.com/baidu?cl=3&tn=SE_baiduhomet8_jmjb7mjw&fr=top1000&wd=';. var boardIdsLikeYeYou = ',173,1393,1394,';. function checkLikeYeYou(boardId) {. if (boardId && boardIdsLikeYeYou.indexOf(',' boardId ',') >= 0) {. return 1;. } else {. return 0;. }. }.. . var baidu;. </script>.......<script>var BASE_URL = "http://top.baidu.com/", BASEURL = "hXXp://top.bdimg.com/frontend", FLASH_URL= "hXXp://top.baidu.com/frontend";</script>. <link rel="stylesheet" href="hXXp://top.bdimg.com/frontend/static/common/common.min.css" />. <script type="text/javascript" src="hXXp://top.bdimg.com/frontend/build/common/lib.js?v=150709"></script>. .<script>var bt = baidu.template;</script>.. ... <link rel="stylesheet" href

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_312:

.text

`.rdata

@.data

.rsrc

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

zcÁ

mscoree.dll

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

HCan pass constants by reference only to parameters with "Const" keyword.

IEXPLORE.EXE_1328:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

IEXPLORE.EXE_1988:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

IEXPLORE.EXE_784:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

forqd340.exe_588:

.text

`.rdata

@.data

.rsrc

FC02893F-0B1D-4095-B49E-1BFF2A1C5CB5

[Loader] Comments:%s

\StringFileInfo\xx\Comments

[Loader] GetFileVersionInfo error:%d

[Loader] nVersionLen:%d

Common Files\PPLiveNetwork\PPAP.exe

PPLiveNetwork\PPAP.exe

"%s" /LoadModule MngModule.dll /T 2 /A "%s "

hXXp://%s/%s?%s

&%s=%s

%s=%s

interface/down_submit.aspx

/Product %s /Custom %s /Channel %s /SoftID %s

ins-stat.pplive.com

interface/load_submit.aspx

[Loader] VerComments:%d

[Loader] StartDownload installURL:%s

[Loader] StartDownload pszUrl:%s

hXXp://

[Loader] Product:%s Custom:%s Channel:%s SoftID:%s

[Loader] argc:%s

[Loader] pszUrl:%s

hXXp://download.pplive.com/PPTV(pplive)_forqd340.exe

kernel32.dll

URLDownloadToFileA

urlmon.dll

[Loader] CreateProcess error %d

[Loader] download successfully runpath:%s

[Loader] pszSleepTime %d

hXXp://127.0.0.1:%d/ppvadownloadbyurl?url=%s

MFC42.DLL

MSVCRT.dll

_acmdln

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

RegDeleteKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CreateURLMoniker

MSVCP60.dll

InternetCrackUrlA

WININET.dll

SHLWAPI.dll

VERSION.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PPTV(pplive)_forqd340.exe

1, 0, 0, 1

Loader.exe

regedit.exe_1800:

.text

`.data

.rsrc

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

COMCTL32.dll

comdlg32.dll

SHELL32.dll

AUTHZ.dll

ACLUI.dll

ole32.dll

ulib.dll

clb.dll

hhctrl.ocx

CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32

regedit.pdb

udPj

WSSSSh

WSSSShA

mSSh\

u=SSSShH

uKSSh

_acmdln

RegCloseKey

RegOpenKeyW

RegCreateKeyW

RegEnumKeyW

RegUnLoadKeyW

RegLoadKeyW

RegOpenKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegRestoreKeyW

RegSaveKeyW

RegFlushKey

GetProcessHeap

SetViewportOrgEx

GetKeyState

ntdll.dll

RegOpenKeyExA

version="1.0.0.0"

name="Microsoft.Windows.Regedit" type="win32" />

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

LastKey

regedit.chm

Software\Microsoft\Windows\CurrentVersion\Policies\System

.classes

Windows Registry Editor Version

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

REGEDIT: CreateFile failed, GetLastError() = %d

x x x x x x x x x - x x x x x x x x %c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c

riched20.dll

0xx

0xxx

x x x x x x x x x

x x x x x

%#08xx

5.1.2600.5512 (xpsp.080413-2111)

REGEDIT.EXE

Windows

Operating System

5.1.2600.5512

Export range

&Keys

Import Registry File

&Key Name:

Channel;Port

Port:

Port

&Import...

&Export...

&Copy Key Name

&Export

New Key #%%u

New Value #%%u

regedit.hlp

Registration Files (*.reg)#*.reg#Registry Hive Files (*.*)#*.#Text Files (*.txt)#*.txt#Win9x/NT4 Registration Files (*.reg)#*.reg#All Files#*.*#

If you still see this message, try restarting Windows.

Export Registry FileMRegistration Files (*.reg)#*.reg#Registry Hive Files (*.*)#*.*#All Files#*.*#

All Files#*.*#

9Registry editing has been disabled by your administrator.(Finished searching through the registry.*Click the computer you want to connect to.ACommand line argument requires a filename and none was specified.

@Are you sure you want to delete this key and all of its subkeys?

Confirm Key Delete-Are you sure you want to delete these values?

Confirm Value Delete Are you sure you want to delete this value?GAre you sure you want to unload the current key and all of its subkeys?

The key will be restored on top of key: %1.

All value entries and subkeys of this key will be deleted.

Do you want to continue the operation?

Confirm Restore Key

Error Renaming Key

?The Registry Editor cannot rename %1. Error while renaming key.lThe Registry Editor cannot rename %1. The specified key name is too long. Type a shorter name and try again.mThe Registry Editor cannot rename %1. The specified key name already exists. Type another name and try again.QThe Registry Editor cannot rename %1. Specify a key name without a backslash (\).gThe Registry Editor cannot rename %1. The specified key name is empty. Type another name and try again.

Error Renaming ValueAThe Registry Editor cannot rename %1. Error while renaming value.oThe Registry Editor cannot rename %1. The specified value name already exists. Type another name and try again.iThe Registry Editor cannot rename %1. The specified value name is empty. Type another name and try again.

Error Deleting Key

,Cannot delete %1: Error while deleting key.

Error Opening Key)Cannot open %1: Error while opening key.

4Cannot edit %1: Error reading the value's contents.8Cannot edit %1: Error writing the value's new contents.lData of type REG_MULTI_SZ cannot contain empty strings.

Registry Editor will remove the empty string found.mData of type REG_MULTI_SZ cannot contain empty strings.

If you still see this message, try restarting Windows.|The decimal value entered is greater than the maximum value of a DWORD.

Cannot import %1: The specified file is not a registry script.

You can only import binary registry files from within the registry editor.

.Cannot import %1: The key selected is invalid.*Cannot import %1: Insufficient privileges.

HInformation in %1 has been successfully entered into the registry on %2.SCannot import %1: Error opening the file. There may be a disk or file system error._Cannot import %1: Error reading the file. There may be a disk error or the file may be corrupt.5Cannot import %1: Error accessing the registry on %2.~Cannot import %1: Not all data was successfully written to the registry. Some keys are open by the system or other processes.`Cannot import %1: The specified file is not a registry file. You can import only registry files.ZCannot import %1: The specified file is not intended for use with this version of Windows.:Cannot import %1: The file specified does not exist on %2.

SCannot export %1: Error opening the file. There may be a disk or file system error.

SCannot export %1: Error writing the file. There may be a disk or file system error.*Cannot export %1: Insufficient privileges..Cannot export %1: The key selected is invalid.

/Cannot import %1: Error accessing the registry.

4Cannot import %1: The file specified does not exist.

Cannot print: Insufficient memory to begin job. Try closing down some applications, and try again. If you still see this message, try restarting Windows.|Cannot print: An error occurred during printing. Check your printer and your printer's settings for problems, and try again.9Cannot print: Error reading a registry value's contents.

Unable to connect to all of the roots of the computer's registry. Disconnect from the remote registry and then reconnect before trying again.TUnable to connect to %1. Make sure you have permission to administer this computer.

Cannot save subtree: Insufficient memory. Try closing down some applications, and try again. If you still see this message, try restarting Windows.@Cannot save subtree: Error reading a registry value's contents.\Cannot save subtree to %1: Error writing the file. There may be a disk or file system error.\Cannot save subtree to %1: Error opening the file. There may be a disk or file system error.

Error Creating Key2Cannot create key: Error while opening the key %1.1Cannot create key: Error writing to the registry.4Cannot create key: Unable to generate a unique name.

Adds a new DWORD value.5Copies the name of the selected key to the Clipboard.

Adds a new multi-string value.#Adds a new expandable string value.#Displays the permissions for a key.'Displays a value's data as binary data."Loads a hive file to the registry.!Unloads a hive from the registry.

)Connects to a remote computer's registry.!Imports a file into the registry..Exports all or part of the registry to a file.#Prints all or part of the registry.

Quits the Registry Editor.-Finds a text string in a key, value, or data.

Adds a new key.

.Disconnects from a remote computer's registry.

%Removes keys from the Favorites list. Adds keys to the Favorites list.

6Contains commands for working with the whole registry.-Contains commands for editing values or keys.6Contains commands for customizing the registry window.PContains commands for displaying Help for and information about Registry Editor.2Contains commands for creating new keys or values.5Contains commands for accessing frequently used keys.

Enumerate Subkeys

Create Subkey

Registry &Key'R&eplace Permission on Existing Subkeys$Audit Permission on Existing SubkeysHDo you want to replace the permission on all existing subkeys within %1?4Do you want to audit all existing subkeys within %1?

This key only

This key and subkeys

Subkeys only

The key currently selected does not give you access to retrieve such information.pRegistry Editor could not retrieve the security information.

The key currently selected is marked for deletion.kRegistry Editor could not retrieve the security information.

The key currently selected is not accessible.

The key currently selected does not give you access to save such information.lRegistry Editor could not save the security information.

The key currently selected is marked for deletion.

^Registry Editor could not set security in the key currently selected, or some of its subkeys. [Registry Editor could not set owner on the key currently selected, or some of its subkeys.

Registry Editor could not set security in the key currently selected, or some of its subkeys.

These keys do not give you access to change security information.

Registry Editor could not set security in all subkeys.

The key currently selected contains one or more subkeys marked for deletion.}Registry Editor could not set security in all subkeys.

The key currently selected contains one or more inaccessible subkeys.

Key Name:

Port:

regedit.exe_932: