Trojan.SalityStub.F_3106dcc157
Trojan.SalityStub.F (BitDefender), Virus:Win32/Sality.AT (Microsoft), Trojan.Win32.Small.cox (Kaspersky), Virus.Win32.Sality.at!dam (v) (VIPRE), Win32.Sector.22 (DrWeb), Trojan.SalityStub.F (B) (Emsisoft), PWS-Zbot.gen.yh (McAfee), W32.Sality.AE (Symantec), Trojan.Win32.Salrenmetie (Ikarus), Trojan.SalityStub.F (FSecure), Agent.12.C (AVG), Win32:Sality (Avast), PE_SALITY.SM-O (TrendMicro), Trojan.SalityStub.F (AdAware), Virus.Win32.Sality.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Virus, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 3106dcc157db7727bb901be2483b1122
SHA1: 958c2ef5eacbe5fe5dc14b045da9cc23bc2ab4db
SHA256: f5b2efb4c2e049f4dc120715e67a789adf4774567ccfac373102c517c24c5d20
SSDeep: 3072:IS15TRnJFHr5vKEaHr2px7PYIqcRuwD AhoYT:IM5TRJZ5vKpypxk4AwNl
Size: 99328 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 2010-11-05 02:25:00
Analyzed on: Windows7 SP1 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):
%original file name%.exe:3436
taskhost.exe:872
Dwm.exe:1376
Explorer.EXE:1440
conhost.exe:1648
TPAutoConnect.exe:2160
conhost.exe:2168
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:3436 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Windows\system.ini (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\elwtuu.exe (561 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (688 bytes)
C:\otbpu.exe (99 bytes)
C:\autorun.inf (246 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\reader_sl.exe (840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uipma.exe (561 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (20 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uipma.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\elwtuu.exe (0 bytes)
C:\Windows\56e0d (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066FF1_Rar\wincheck.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\00066FF1_Rar (0 bytes)
Registry activity
The process %original file name%.exe:3436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Stvncyfrlda]
"m1_617" = "1645903864"
"m4_529" = "3140763709"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_528" = "1405472976"
"m2_552" = "102782749"
"m2_553" = "1838067361"
"m2_550" = "927166540"
"m2_551" = "2662449858"
"m2_556" = "2748979595"
"m2_557" = "189292963"
"m2_554" = "3573366654"
"m2_555" = "1013678363"
"m2_558" = "1924581596"
"m2_559" = "3659881823"
"m4_446" = "845553638"
"m4_537" = "4138187685"
"m4_523" = "1318953903"
"m4_522" = "3878630466"
"m1_267" = "106152298"
"m1_266" = "3510384382"
"m1_265" = "2082951680"
"m1_264" = "1866945331"
"m1_263" = "519021710"
"m1_262" = "3104071594"
"m1_261" = "3103935208"
"m1_260" = "3228139023"
"m3_447" = "2564285818"
"m1_269" = "3809602194"
"m1_268" = "4265964850"
"m4_0" = "0"
"m4_1" = "1735290733"
"m4_2" = "3470581466"
"m4_3" = "910904903"
"m4_4" = "2646195636"
"m4_5" = "86519073"
"m4_6" = "1821809806"
"m4_7" = "3557100539"
"m4_8" = "997423976"
"m1_312" = "1100472508"
"m1_311" = "3959643554"
"m1_310" = "1597150787"
"m1_317" = "134936903"
"m1_316" = "1411093721"
"m1_315" = "558271790"
"m1_314" = "1636200130"
"m2_426" = "499482014"
"m2_427" = "2234762002"
"m2_424" = "1323866017"
"m2_425" = "3059150797"
"m2_422" = "2148251597"
"m2_423" = "3883533927"
"m2_420" = "2972636070"
"m2_421" = "412953778"
"m3_442" = "2511276059"
"m2_428" = "3970063757"
"m2_429" = "1410376463"
"m4_445" = "3405230201"
"m4_610" = "1965392314"
"m4_442" = "2494325298"
"m3_261" = "1922363400"
"m3_260" = "220872861"
"m3_263" = "1131877074"
"m3_262" = "3657786279"
"m4_129" = "514205165"
"m4_128" = "3073881728"
"m3_267" = "3777846406"
"m3_266" = "2042408299"
"m4_125" = "2162976825"
"m4_124" = "427686092"
"m4_127" = "1338590995"
"m4_126" = "3898267558"
"m4_121" = "3811748485"
"m4_120" = "2076457752"
"m4_123" = "2987362655"
"m4_122" = "1252071922"
"m3_467" = "2943756798"
"m3_466" = "1174781507"
"m3_465" = "3734703828"
"m3_464" = "2032836537"
"m3_463" = "297331722"
"m3_462" = "2823715999"
"m3_461" = "1088277856"
"m3_460" = "3681770997"
"m4_443" = "4229616031"
"m4_534" = "3227282782"
"m3_469" = "2085701784"
"m3_468" = "350280045"
"m4_29" = "3078791001"
"m4_28" = "1343500268"
"m4_23" = "1256981195"
"m4_22" = "3816657758"
"m4_21" = "2081367025"
"m4_20" = "346076292"
"m4_27" = "3903176831"
"m4_26" = "2167886098"
"m4_25" = "432595365"
"m4_24" = "2992271928"
"m4_440" = "3318711128"
"m4_615" = "2051911387"
"m1_24" = "85139052"
"m1_25" = "1134014422"
"m1_26" = "2184084331"
"m1_27" = "3197137701"
"m1_20" = "4077850570"
"m1_21" = "1179430356"
"m1_22" = "3865217061"
"m1_23" = "1209313722"
"m1_28" = "4223506271"
"m1_29" = "266745635"
"m3_199" = "1742469010"
"m3_198" = "4268311655"
"m4_305" = "982696157"
"m4_304" = "3542372720"
"m4_307" = "158310327"
"m4_306" = "2717986890"
"m4_301" = "2631467817"
"m4_300" = "896177084"
"m4_303" = "1807081987"
"m4_302" = "71791254"
"m4_309" = "3628891793"
"m4_308" = "1893601060"
"m4_495" = "4270420931"
"m4_494" = "2535130198"
"m4_497" = "3446035101"
"m4_496" = "1710744368"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_490" = "4183901858"
"m4_493" = "799839465"
"m4_492" = "3359516028"
"m3_513" = "1162748740"
"m3_512" = "3722293289"
"m3_511" = "1953693882"
"m3_510" = "251826447"
"m4_499" = "2621649271"
"m4_498" = "886358538"
"m3_515" = "304693870"
"m3_514" = "2864239347"
"m4_279" = "3109777355"
"m4_278" = "1374486622"
"m4_271" = "2112353379"
"m4_270" = "377062646"
"m4_273" = "1287967549"
"m4_272" = "3847644112"
"m4_275" = "463581719"
"m4_274" = "3023258282"
"m4_277" = "3934163185"
"m4_276" = "2198872452"
"m3_3" = "927474798"
"m3_2" = "3487544563"
"m3_1" = "1718420804"
"m3_0" = "17001001"
"m3_7" = "3573965266"
"m3_6" = "1838544551"
"m3_5" = "69945096"
"m3_4" = "2629490589"
"m2_314" = "3715413282"
"m2_315" = "1155728212"
"m3_9" = "2749530364"
"m3_8" = "980422977"
"m2_310" = "1069218878"
"m2_311" = "2804501399"
"m2_312" = "244831379"
"m2_313" = "1980114533"
[HKCU\Software\Stvncyfrlda\168128873]
"1735290733" = "96"
[HKCU\Software\Stvncyfrlda]
"m1_461" = "3492905719"
"m1_460" = "313882477"
"m1_463" = "1816202570"
"m1_462" = "716607495"
"m1_465" = "2528919699"
"m1_464" = "2583962848"
"m1_467" = "2805753962"
"m1_466" = "1056381908"
"m1_469" = "2705160824"
"m1_468" = "3632918381"
"m1_5" = "1273606268"
"m1_4" = "2923410575"
"m1_7" = "2827602110"
"m1_6" = "3098692146"
"m1_1" = "3489335579"
"m1_0" = "1052342873"
"m3_68" = "2018964189"
"m3_69" = "3787940424"
"m3_66" = "2877018163"
"m3_67" = "283394990"
"m3_64" = "3667439977"
"m3_65" = "1107894404"
"m3_62" = "230528591"
"m3_63" = "1965949434"
"m3_60" = "1021409189"
"m3_61" = "2756962000"
"m2_220" = "3806843496"
"m2_221" = "1247160237"
"m2_222" = "2982458514"
"m2_223" = "422780522"
"m2_224" = "2158061560"
"m2_225" = "3893361469"
"m2_226" = "1333677390"
"m2_227" = "3068976271"
"m2_228" = "509292143"
"m2_229" = "2244588923"
"m2_496" = "1710749132"
"m3_605" = "1862155952"
"m2_495" = "4270416127"
"m2_494" = "2535133553"
"m2_29" = "3078785938"
"m2_28" = "1343501092"
"m2_25" = "432601208"
"m2_24" = "2992267794"
"m2_27" = "3903186356"
"m2_26" = "2167896092"
"m2_21" = "2081372948"
"m2_20" = "346073662"
"m2_23" = "1256987457"
"m2_22" = "3816654993"
"m3_604" = "160272133"
"m2_169" = "1206360751"
"m2_168" = "3766028288"
"m2_163" = "3679517883"
"m2_162" = "1944230106"
"m2_161" = "208929227"
"m2_160" = "2768616318"
"m2_167" = "2030741258"
"m2_166" = "295457310"
"m2_165" = "2855127387"
"m2_164" = "1119845397"
"m3_438" = "4159819351"
"m3_439" = "1600289218"
"m3_436" = "689352589"
"m3_437" = "2391236408"
"m2_545" = "840641770"
"m2_544" = "3400323588"
"m2_547" = "16253963"
"m2_546" = "2575937548"
"m2_541" = "2489409965"
"m2_540" = "754130052"
"m2_543" = "1665024615"
"m2_542" = "4224711836"
"m2_549" = "3486838591"
"m2_548" = "1751553680"
"m1_258" = "2524583849"
"m1_259" = "2970741014"
"m1_252" = "2916093693"
"m1_253" = "3184802251"
"m1_250" = "818404099"
"m1_251" = "803031682"
"m1_256" = "494511988"
"m1_257" = "848000440"
"m1_254" = "581175196"
"m1_255" = "568714792"
"m1_328" = "4023083985"
"m1_329" = "3241662086"
"m1_326" = "2719331535"
"m1_327" = "62792532"
"m1_324" = "2370844307"
"m1_325" = "1657872336"
"m1_322" = "1276401514"
"m1_323" = "1512270779"
"m1_320" = "4028226973"
"m1_321" = "2698799248"
"m2_439" = "1583415319"
"m2_438" = "4143103249"
"m2_431" = "585992734"
"m2_430" = "3145675778"
"m2_433" = "4056572469"
"m2_432" = "2321290079"
"m2_435" = "3232187335"
"m2_434" = "1496904474"
"m2_437" = "2407801083"
"m2_436" = "672518411"
"m1_319" = "3390635117"
"m3_214" = "2001882935"
"m3_215" = "3703373474"
"m3_216" = "1143826897"
"m3_217" = "2912885068"
"m3_210" = "3650358595"
"m3_211" = "1090960638"
"m3_212" = "2792828013"
"m3_213" = "266461080"
"m3_218" = "352946427"
"m3_219" = "2054830102"
"m3_328" = "2222827905"
"m3_329" = "3991820604"
"m3_458" = "177222443"
"m3_459" = "1912775238"
"m1_604" = "3785706285"
"m3_320" = "1258824297"
"m3_321" = "2960842116"
"m3_322" = "434851123"
"m3_323" = "2169896110"
"m3_324" = "3871764445"
"m3_325" = "1311776584"
"m3_326" = "3080883943"
"m3_327" = "521354770"
"m4_38" = "1516538414"
"m4_39" = "3251829147"
"m1_606" = "71107256"
"m4_9" = "2732714709"
"m4_30" = "519114438"
"m4_31" = "2254405171"
"m4_32" = "3989695904"
"m4_33" = "1430019341"
"m4_34" = "3165310074"
"m4_35" = "605633511"
"m4_36" = "2340924244"
"m4_37" = "4076214977"
"m4_598" = "2616739998"
"m4_530" = "581087146"
"m1_603" = "3533139149"
"m4_599" = "57063435"
"m1_602" = "321216061"
"m1_11" = "3776623646"
"m1_10" = "1639933311"
"m1_13" = "1382878207"
"m1_12" = "859814871"
"m1_15" = "1991954398"
"m1_14" = "2049325643"
"m1_17" = "4143329633"
"m1_16" = "1424789631"
"m1_19" = "4120599404"
"m1_18" = "2967677913"
"m4_468" = "367244100"
"m4_469" = "2102534833"
"m3_528" = "1388755705"
"m3_529" = "3124177428"
"m4_460" = "3664787420"
"m4_461" = "1105110857"
"m4_462" = "2840401590"
"m4_463" = "280725027"
"m4_464" = "2016015760"
"m4_465" = "3751306493"
"m4_466" = "1191629930"
"m4_467" = "2926920663"
"m4_593" = "2530220925"
"m4_596" = "3441125828"
"m4_607" = "1054487411"
"m4_597" = "881449265"
"m4_608" = "2789778144"
"m4_609" = "230101581"
"m3_140" = "2439480757"
"m3_141" = "4140840224"
"m3_142" = "1581425759"
"m3_143" = "3350419402"
"m4_208" = "163219600"
"m4_209" = "1898510333"
"m3_146" = "4260947459"
"m3_147" = "1701482942"
"m4_204" = "1811991260"
"m4_205" = "3547281993"
"m4_206" = "987605430"
"m4_207" = "2722896163"
"m4_200" = "3460762920"
"m4_201" = "901086357"
"m4_202" = "2636377090"
"m4_203" = "76700527"
"m3_155" = "2665356502"
"m2_309" = "3628885169"
"m2_308" = "1893604144"
"m2_307" = "158304794"
"m2_306" = "2717986814"
"m2_305" = "982701507"
"m2_304" = "3542368468"
"m2_303" = "1807087127"
"m2_302" = "71788465"
"m2_301" = "2631472293"
"m2_300" = "896174360"
"m3_159" = "1016356506"
"m1_414" = "1804024119"
"m1_415" = "2162053135"
"m1_416" = "2657541631"
"m3_158" = "3609964399"
"m1_410" = "1940560133"
"m1_411" = "2465233804"
"m1_412" = "1214796151"
"m1_413" = "4056794140"
"m1_418" = "902813665"
"m1_419" = "4206064813"
"m4_510" = "235010854"
"m4_511" = "1970301587"
"m3_19" = "2888904510"
"m3_18" = "1153482627"
"m4_514" = "2881206490"
"m4_515" = "321529927"
"m4_516" = "2056820660"
"m4_517" = "3792111393"
"m3_13" = "1100530336"
"m3_12" = "3626914613"
"m3_11" = "1891476358"
"m3_10" = "190001259"
"m3_17" = "3746958356"
"m3_16" = "2011536633"
"m3_15" = "243002698"
"m3_14" = "2835971551"
"m2_233" = "595818913"
"m2_232" = "3155487295"
"m2_231" = "1420205745"
"m2_230" = "3979871572"
"m2_237" = "3242000931"
"m2_236" = "1506714143"
"m2_235" = "4066400475"
"m2_234" = "2331100010"
"m2_239" = "2417627364"
"m2_238" = "682331445"
"m2_38" = "1516540598"
"m2_39" = "3251824417"
"m2_32" = "3989700448"
"m2_33" = "1430027535"
"m2_30" = "519116914"
"m2_31" = "2254398526"
"m2_36" = "2340926054"
"m2_37" = "4076212092"
"m2_34" = "3165314626"
"m2_35" = "605629233"
"m1_528" = "1991626411"
"m1_529" = "1804785748"
"m1_520" = "3619741235"
"m1_521" = "1084595055"
"m1_522" = "554453042"
"m1_523" = "152759772"
"m1_524" = "1259990698"
"m1_525" = "853982782"
"m1_526" = "597926727"
"m1_527" = "2559985373"
"m1_638" = "1231176649"
"m1_639" = "1938614189"
"m2_158" = "3592998958"
"m2_159" = "1033317419"
"m2_156" = "122420726"
"m2_157" = "1857700307"
"m2_154" = "946803243"
"m2_155" = "2682088470"
"m2_152" = "1771190252"
"m2_153" = "3506472817"
"m2_150" = "2595575514"
"m2_151" = "35892466"
"m3_556" = "2732157589"
"m3_445" = "3421821520"
"m3_349" = "9342384"
"m1_249" = "1604882475"
"m1_248" = "367561956"
"m1_245" = "1272219662"
"m1_244" = "65491031"
"m1_247" = "929424962"
"m1_246" = "2627960590"
"m1_241" = "3340988824"
"m1_240" = "44803653"
"m1_243" = "565981454"
"m1_242" = "3690243192"
"m3_269" = "2919792544"
"m2_448" = "21161844"
"m2_449" = "1756461473"
"m3_268" = "1184877621"
"m2_444" = "1669946046"
"m2_445" = "3405226464"
"m2_446" = "845547489"
"m2_447" = "2580847130"
"m2_440" = "3318717039"
"m2_441" = "759030150"
"m2_442" = "2494329930"
"m2_443" = "4229612069"
"m4_503" = "972877611"
"m4_502" = "3532554174"
"m4_501" = "1797263441"
"m1_331" = "4116699333"
"m1_330" = "3900759789"
"m1_333" = "48292970"
"m1_332" = "639837079"
"m1_335" = "1546774481"
"m1_334" = "1152351977"
"m1_337" = "448219481"
"m1_336" = "1546220570"
"m1_339" = "801738572"
"m1_338" = "4077068017"
"m4_506" = "1883782514"
"m4_505" = "148491781"
"m4_504" = "2708168344"
"m3_207" = "2739893002"
"m3_206" = "1004454815"
"m3_205" = "3530313824"
"m3_204" = "1828954357"
"m3_203" = "93401414"
"m3_202" = "2619377195"
"m3_201" = "884348604"
"m3_200" = "3477366529"
"m4_509" = "2794687417"
"m3_209" = "1881906644"
"m3_208" = "146399929"
"m3_339" = "4131317630"
"m3_338" = "2395764675"
"m3_449" = "1773274116"
"m3_448" = "4297961"
"m3_333" = "2342886112"
"m3_332" = "574352245"
"m3_331" = "3133766598"
"m3_330" = "1431881899"
"m3_337" = "694404180"
"m3_336" = "3253818681"
"m3_335" = "1484825994"
"m3_334" = "4078307871"
"m4_402" = "1802172714"
"m4_403" = "3537463447"
"m4_400" = "2626558544"
"m4_401" = "66881981"
"m4_406" = "153401054"
"m4_407" = "1888691787"
"m4_404" = "977786884"
"m4_405" = "2713077617"
"m3_531" = "2333242686"
"m3_530" = "597804419"
"m3_533" = "1508808664"
"m3_532" = "4034716845"
"m3_535" = "650753762"
"m3_534" = "3244230519"
"m3_537" = "4154773900"
"m3_536" = "2386175505"
"m3_539" = "3297243222"
"m3_538" = "1595228475"
"m4_479" = "2275572979"
"m4_478" = "540282246"
"m4_473" = "453763173"
"m4_472" = "3013439736"
"m4_471" = "1278149003"
"m4_470" = "3837825566"
"m4_477" = "3099958809"
"m4_476" = "1364668076"
"m4_475" = "3924344639"
"m4_474" = "2189053906"
"m4_606" = "3614163974"
"m3_407" = "1905282146"
"m3_291" = "2475410126"
"m3_153" = "3489919500"
"m3_152" = "1754350225"
"m3_151" = "52482914"
"m3_150" = "2612405239"
"m3_157" = "1874411504"
"m3_156" = "105417797"
"m4_219" = "2071548479"
"m3_154" = "963407291"
"m4_217" = "2895934309"
"m4_216" = "1160643576"
"m4_215" = "3720320139"
"m4_214" = "1985029406"
"m4_213" = "249738673"
"m4_212" = "2809415236"
"m4_211" = "1074124503"
"m4_210" = "3633801066"
"m4_563" = "2011106487"
"m3_409" = "1047752460"
"m1_407" = "1078503778"
"m1_406" = "3375282169"
"m1_405" = "1019348054"
"m1_404" = "3725373550"
"m1_403" = "2796878428"
"m1_402" = "2787272285"
"m1_401" = "2254695347"
"m1_400" = "516760885"
"m1_409" = "3801886752"
"m1_408" = "3289471161"
"m2_332" = "590910264"
"m2_333" = "2326192528"
"m2_330" = "1415297249"
"m2_331" = "3150578215"
"m2_336" = "3237095735"
"m2_337" = "677427009"
"m2_334" = "4061491702"
"m2_335" = "1501814612"
"m2_338" = "2412708773"
"m2_339" = "4148009145"
"m2_206" = "987609146"
"m2_207" = "2722891898"
"m2_204" = "1811993345"
"m2_205" = "3547275975"
"m2_202" = "2636381531"
"m2_203" = "76709541"
"m2_200" = "3460767871"
"m2_201" = "901081121"
"m2_208" = "163221922"
"m2_209" = "1898506567"
"m3_197" = "2532889800"
"m3_196" = "831399261"
"m3_195" = "3357379118"
"m1_539" = "3277095940"
"m3_194" = "1622350515"
"m1_533" = "8829039"
"m3_193" = "4215368452"
"m1_531" = "1557213552"
"m1_530" = "3195080619"
"m1_537" = "1888255701"
"m1_536" = "309479561"
"m1_535" = "1776866254"
"m3_192" = "2479946729"
"m2_475" = "3924337502"
"m3_191" = "711346298"
"m1_629" = "2164533493"
"m2_474" = "2189057028"
"m1_627" = "3490532655"
"m1_626" = "3273467971"
"m1_625" = "3076979623"
"m3_190" = "3270891727"
"m1_623" = "2890824220"
"m1_622" = "1453312346"
"m1_621" = "3078548243"
"m1_620" = "128997709"
"m2_141" = "4157832975"
"m2_140" = "2422537840"
"m2_143" = "3333433309"
"m2_142" = "1598152126"
"m2_145" = "2509048655"
"m2_144" = "773764767"
"m2_147" = "1684662355"
"m2_146" = "4244345881"
"m2_149" = "860275093"
"m2_148" = "3419962746"
"m2_479" = "2275568983"
"m2_478" = "540285869"
"m1_532" = "3539907918"
"m1_534" = "4273382112"
"m3_643" = "3412243694"
"m1_628" = "525611481"
"m3_519" = "2984284114"
"m3_518" = "1215700135"
"m4_491" = "1624225295"
"m1_182" = "524143641"
"m1_183" = "4096039894"
"m1_180" = "1316032277"
"m1_181" = "141732715"
"m1_186" = "136138561"
"m1_187" = "2047069854"
"m1_184" = "940893731"
"m1_185" = "2334790132"
"m1_188" = "2693311543"
"m1_189" = "3997384615"
"m2_459" = "1929500027"
"m2_458" = "194202885"
"m2_457" = "2753886562"
"m2_456" = "1018587886"
"m2_455" = "3578270566"
"m2_454" = "1842970836"
"m2_453" = "107685037"
"m2_452" = "2667357858"
"m2_451" = "932077542"
"m2_450" = "3491745550"
"m3_517" = "3808718088"
"m3_516" = "2073820573"
"m1_344" = "665797399"
"m1_345" = "954087251"
"m1_346" = "2482516819"
"m1_347" = "1614531019"
"m1_340" = "3365646491"
"m1_341" = "4293317184"
"m1_342" = "1910979514"
"m1_343" = "1496857207"
"m1_348" = "2334238042"
"m1_349" = "1610280446"
"m1_296" = "942121766"
"m1_297" = "1310302040"
"m1_294" = "3823676134"
"m1_295" = "47441246"
"m1_292" = "2608673099"
"m1_293" = "1028737919"
"m1_290" = "62223560"
"m1_291" = "3560601902"
"m3_232" = "3172438241"
"m3_233" = "578813980"
"m3_230" = "3963318727"
"m3_231" = "1436934514"
"m3_236" = "1489883733"
"m3_237" = "3225308608"
"m1_298" = "565700906"
"m1_299" = "1952118150"
"m3_308" = "1910334733"
"m3_309" = "3645838520"
"m3_306" = "2734840419"
"m3_307" = "141358494"
"m3_304" = "3525786457"
"m3_305" = "999402228"
"m3_302" = "88348863"
"m3_303" = "1790347306"
"m3_300" = "879360405"
"m3_301" = "2648336640"
"m4_12" = "3643619612"
"m4_13" = "1083943049"
"m4_10" = "173038146"
"m4_11" = "1908328879"
"m4_16" = "1994847952"
"m4_17" = "3730138685"
"m4_14" = "2819233782"
"m4_15" = "259557219"
"m4_18" = "1170462122"
"m4_19" = "2905752855"
"m4_447" = "2580844371"
"m3_544" = "3417288073"
"m3_545" = "857234724"
"m3_546" = "2559233107"
"m3_547" = "33259470"
"m3_540" = "770728901"
"m3_541" = "2506232688"
"m3_542" = "4207706863"
"m3_543" = "1648177690"
"m3_548" = "1768288125"
"m3_549" = "3470237416"
"m4_198" = "4285148750"
"m4_199" = "1725472187"
"m4_448" = "21167808"
"m4_449" = "1756458541"
"m4_194" = "1638953114"
"m4_195" = "3374243847"
"m4_196" = "814567284"
"m4_197" = "2549858017"
"m4_190" = "3287724774"
"m4_191" = "728048211"
"m4_192" = "2463338944"
"m4_193" = "4198629677"
"m3_496" = "1693747481"
"m3_497" = "3429185716"
"m3_494" = "2518183551"
"m3_495" = "4287240682"
"m3_492" = "3376238421"
"m3_493" = "783285952"
"m3_490" = "4167183499"
"m3_491" = "1640815654"
"m3_498" = "903325731"
"m3_499" = "2638240606"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Stvncyfrlda]
"m4_222" = "2982453382"
"m4_223" = "422776819"
"m1_79" = "1874202905"
"m1_78" = "3995044632"
"m4_226" = "1333681722"
"m4_227" = "3068972455"
"m4_224" = "2158067552"
"m4_225" = "3893358285"
"m1_73" = "3199329595"
"m1_72" = "2956200873"
"m1_71" = "354207369"
"m1_70" = "957513361"
"m1_77" = "153922960"
"m1_76" = "4141585249"
"m1_75" = "1884927826"
"m1_74" = "2794815805"
"m3_166" = "278866567"
"m3_167" = "2013911602"
"m3_164" = "1136397309"
"m3_165" = "2871966568"
"m3_162" = "1927407827"
"m3_163" = "3662911566"
"m3_160" = "2751909385"
"m3_161" = "225933732"
"m3_168" = "3782899105"
"m3_169" = "1189405916"
"m3_641" = "4203189700"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Stvncyfrlda]
"m4_444" = "1669939468"
"m1_438" = "2001688077"
"m1_439" = "3450418098"
"m1_432" = "797906133"
"m1_433" = "844982248"
"m1_430" = "3728081577"
"m1_431" = "552818696"
"m1_436" = "1032255182"
"m1_437" = "780186836"
"m1_434" = "1726131648"
"m1_435" = "1522048067"
"m3_35" = "622481870"
"m3_34" = "3182011987"
"m3_37" = "4092948712"
"m3_36" = "2323956093"
"m3_31" = "2270958618"
"m3_30" = "535979247"
"m3_33" = "1413429028"
"m3_32" = "3972958089"
"m3_39" = "3234960306"
"m3_38" = "1533534215"
"m4_538" = "1578511122"
"m4_539" = "3313801855"
"m2_219" = "2071545948"
"m2_218" = "336262750"
"m2_211" = "1074120715"
"m2_210" = "3633805570"
"m2_213" = "249733177"
"m2_212" = "2809417981"
"m2_215" = "3720315628"
"m2_214" = "1985036157"
"m2_217" = "2895933391"
"m2_216" = "1160647260"
"m3_636" = "4150245605"
"m3_637" = "1556621328"
"m3_634" = "645700059"
"m3_635" = "2414676342"
"m1_508" = "1516066930"
"m1_509" = "737343496"
"m1_506" = "398885825"
"m1_507" = "3087623962"
"m1_504" = "1828359467"
"m1_505" = "1506923705"
"m1_502" = "2950915075"
"m1_503" = "3114422172"
"m1_500" = "3548904599"
"m1_501" = "759625260"
"m3_630" = "2294635543"
"m3_631" = "4030189442"
"m2_134" = "600722266"
"m2_135" = "2336023243"
"m2_136" = "4071302973"
"m2_137" = "1511633119"
"m2_130" = "2249492334"
"m2_131" = "3984792679"
"m2_132" = "1425107220"
"m2_133" = "3160406652"
"m1_618" = "2594274535"
"m1_619" = "1603017152"
"m2_138" = "3246919288"
"m2_139" = "687251093"
"m2_318" = "2066643858"
"m2_319" = "3801926782"
"m2_316" = "2891026795"
"m2_317" = "331343761"
"m2_598" = "2616744298"
"m2_599" = "57060981"
"m2_596" = "3441115338"
"m2_597" = "881444759"
"m2_594" = "4265513870"
"m2_595" = "1705829715"
"m2_592" = "794933554"
"m2_593" = "2530214174"
"m2_590" = "1619319089"
"m2_591" = "3354601860"
"m1_195" = "897157303"
"m1_194" = "2176657350"
"m1_197" = "594726362"
"m1_196" = "3325341979"
"m1_191" = "3342687237"
"m1_190" = "702401277"
"m1_193" = "1478779479"
"m1_192" = "4223005370"
"m2_468" = "367241572"
"m2_469" = "2102541164"
"m1_199" = "1975299045"
"m1_198" = "1299246389"
"m1_357" = "2459158528"
"m1_356" = "138704356"
"m1_355" = "4205397033"
"m1_354" = "4227083231"
"m1_353" = "4081464888"
"m1_352" = "2194345605"
"m1_351" = "1433137568"
"m1_350" = "1034103418"
"m1_359" = "2019016734"
"m1_358" = "2682289775"
"m1_289" = "2894507043"
"m1_288" = "840527465"
"m3_229" = "2227881640"
"m3_228" = "525883197"
"m1_281" = "1994130715"
"m1_280" = "1098785440"
"m3_227" = "3085936526"
"m3_226" = "1316828179"
"m1_285" = "3711699612"
"m1_284" = "4246323237"
"m3_223" = "405824986"
"m3_222" = "2965883567"
"m1_380" = "562099975"
"m3_520" = "424755009"
"m1_381" = "3562052112"
"m1_382" = "1457233035"
"m1_383" = "2108376399"
"m1_384" = "2165954791"
"m1_385" = "3328269788"
"m1_386" = "3170349877"
"m1_387" = "2807698377"
"m3_311" = "2787784514"
"m3_310" = "1052346327"
"m3_313" = "1996838508"
"m3_312" = "261400305"
"m3_315" = "1172336950"
"m3_314" = "3698835867"
"m3_317" = "314348496"
"m3_316" = "2907889829"
"m3_319" = "3818894074"
"m3_318" = "2049770319"
"m4_451" = "932072711"
"m2_255" = "117501909"
"m4_453" = "107686881"
"m4_452" = "2667363444"
"m4_455" = "3578268347"
"m4_454" = "1842977614"
"m4_457" = "2753882517"
"m2_254" = "2677183695"
"m4_459" = "1929496687"
"m4_458" = "194205954"
"m3_559" = "3676710186"
"m3_558" = "1941288383"
"m4_189" = "1552434041"
"m4_188" = "4112110604"
"m4_187" = "2376819871"
"m4_186" = "641529138"
"m4_185" = "3201205701"
"m4_184" = "1465914968"
"m4_183" = "4025591531"
"m4_182" = "2290300798"
"m4_181" = "555010065"
"m4_180" = "3114686628"
"m3_489" = "2431761692"
"m3_401" = "50324372"
"m1_3" = "3712065021"
"m3_400" = "2643292281"
"m3_481" = "1467757028"
"m3_480" = "3994256969"
"m3_483" = "610226318"
"m1_2" = "1635502089"
"m3_485" = "4114248616"
"m3_403" = "3554280126"
"m3_487" = "3256259186"
"m3_486" = "1520755399"
"m3_402" = "1785303811"
"m3_405" = "2696228184"
"m3_404" = "994357805"
"m1_68" = "4220346759"
"m1_69" = "2858478102"
"m4_237" = "3242010601"
"m4_236" = "1506719868"
"m4_231" = "1420200795"
"m4_230" = "3979877358"
"m4_233" = "595814965"
"m4_232" = "3155491528"
"m1_60" = "1618412535"
"m1_61" = "4125625711"
"m1_62" = "1217784535"
"m1_63" = "1316251044"
"m1_64" = "1449302418"
"m1_65" = "3849420905"
"m1_66" = "1736503106"
"m1_67" = "909575257"
"m3_179" = "1395950366"
"m3_178" = "3955889123"
"m3_408" = "3640852369"
"m3_171" = "398919654"
"m3_170" = "2924909643"
"m3_173" = "3835831936"
"m3_172" = "2133964565"
"m3_175" = "3044884906"
"m3_174" = "1275909695"
"m3_177" = "2186829940"
"m3_176" = "451932377"
"m3_566" = "2938712279"
"m3_567" = "345743426"
"m1_429" = "4267872867"
"m1_428" = "1280123277"
"m1_425" = "2318226751"
"m1_424" = "2192437470"
"m1_427" = "3121161883"
"m1_426" = "172124839"
"m1_421" = "48489861"
"m1_420" = "521132501"
"m1_423" = "90684448"
"m1_422" = "745256924"
"m3_22" = "3799972215"
"m3_23" = "1273981154"
"m3_20" = "363060909"
"m3_21" = "2097957336"
"m3_26" = "2150906683"
"m3_27" = "3920013910"
"m3_24" = "3008960529"
"m3_25" = "415992716"
"m4_521" = "2143339733"
"m4_520" = "408049000"
"m3_28" = "1360479685"
"m3_29" = "3061970288"
"m4_525" = "494568073"
"m4_524" = "3054244636"
"m4_527" = "3965149539"
"m4_526" = "2229858806"
"m2_268" = "1201454841"
"m2_269" = "2936733921"
"m2_264" = "2850222705"
"m2_265" = "290539149"
"m2_266" = "2025837528"
"m2_267" = "3761122425"
"m2_260" = "204026726"
"m2_261" = "1939312035"
"m2_262" = "3674611491"
"m2_263" = "1114923412"
"m1_511" = "4026431528"
"m1_510" = "3539046768"
"m1_513" = "3686838068"
"m1_512" = "546167436"
"m1_515" = "688944527"
"m1_514" = "2996561170"
"m1_517" = "4005431272"
"m1_516" = "2304263149"
"m1_519" = "1282286149"
"m1_518" = "3497527605"
"m2_493" = "799836849"
"m2_492" = "3359521024"
"m2_127" = "1338595753"
"m2_126" = "3898263295"
"m2_125" = "2162981950"
"m2_124" = "427682392"
"m2_123" = "2987366379"
"m2_122" = "1252068202"
"m2_121" = "3811750484"
"m2_120" = "2076454458"
"m1_609" = "2694598807"
"m1_608" = "1698151047"
"m2_129" = "514196916"
"m2_128" = "3073877492"
[HKCU\Software\Stvncyfrlda\168128873]
"-824385830" = "0"
[HKCU\Software\Stvncyfrlda]
"m4_441" = "759034565"
"m2_490" = "4183905224"
"m2_497" = "3446030464"
"m2_581" = "3181573749"
"m2_580" = "1446275775"
"m2_583" = "2357189664"
"m2_582" = "621888987"
"m2_585" = "1532804366"
"m2_584" = "4092470620"
"m2_587" = "708402866"
"m2_586" = "3268089748"
"m2_589" = "4178985623"
"m2_588" = "2443705336"
"m1_168" = "1537895488"
"m1_169" = "2848689390"
"m2_477" = "3099953628"
"m2_476" = "1364671147"
"m2_471" = "1278152915"
"m2_470" = "3837821322"
"m2_473" = "453767663"
"m2_472" = "3013437736"
"m1_160" = "1386161916"
"m1_161" = "3115928631"
"m1_162" = "254132811"
"m1_163" = "4208658522"
"m1_164" = "4078022941"
"m1_165" = "3243205754"
"m1_166" = "3699838224"
"m1_167" = "1375036370"
"m1_368" = "1784542426"
"m1_369" = "436659206"
"m1_362" = "599083807"
"m1_363" = "71696608"
"m1_360" = "3754677062"
"m1_361" = "2475981786"
"m1_366" = "1374301144"
"m1_367" = "3495959865"
"m1_364" = "2926513906"
"m1_365" = "4259654682"
"m1_641" = "1613348816"
"m1_640" = "711220443"
"m1_643" = "3307800693"
"m1_642" = "1061121345"
"m1_644" = "3672947686"
"m3_364" = "268764373"
"m3_365" = "2037888064"
"m3_366" = "3739232255"
"m3_367" = "1179834218"
"m3_360" = "1917836129"
"m3_361" = "3686288028"
"m3_362" = "1126889995"
"m3_363" = "2828309926"
"m1_388" = "1362137671"
"m1_389" = "3368940926"
"m3_368" = "2948810393"
"m3_369" = "388888116"
"m4_424" = "1323863176"
"m4_425" = "3059153909"
"m4_426" = "499477346"
"m4_427" = "2234768079"
"m4_420" = "2972634836"
"m4_421" = "412958273"
"m4_422" = "2148249006"
"m4_423" = "3883539739"
"m3_562" = "292812643"
"m3_563" = "1994155678"
"m3_560" = "1083233369"
"m3_561" = "2818656244"
"m4_428" = "3970058812"
"m4_429" = "1410382249"
"m3_564" = "3729659405"
"m3_565" = "1203274168"
"m1_55" = "2007402812"
"m1_54" = "250074547"
"m1_57" = "3231346228"
"m1_56" = "2893866416"
"m1_51" = "3543553816"
"m1_50" = "2564190849"
"m1_53" = "629039103"
"m1_52" = "3661874802"
"m1_59" = "3811132280"
"m1_58" = "859533761"
"m3_108" = "2744413141"
"m3_109" = "184949568"
"m3_104" = "98446945"
"m3_105" = "1833490844"
"m3_106" = "3535358219"
"m3_107" = "975960230"
"m3_100" = "1713433789"
"m3_101" = "3482491944"
"m3_102" = "922947399"
"m3_103" = "2624438002"
"m3_580" = "1463228637"
"m3_581" = "3164702792"
"m3_582" = "605174759"
"m3_583" = "2373757714"
"m3_584" = "4075641473"
"m3_585" = "1516227132"
"m3_586" = "3284690347"
"m3_587" = "725226694"
"m3_588" = "2426700917"
"m3_589" = "4162140128"
"m3_610" = "1948707731"
"m3_611" = "3717241614"
"m3_612" = "1157696189"
"m3_613" = "2859711016"
"m4_558" = "1924587414"
"m4_559" = "3659878147"
"m3_616" = "3770643553"
"m3_617" = "1210705820"
"m4_554" = "3573359074"
"m4_555" = "1013682511"
"m4_556" = "2748973244"
"m4_557" = "189296681"
"m4_550" = "927163438"
"m4_551" = "2662454171"
"m4_552" = "102777608"
"m4_553" = "1838068341"
"m2_279" = "3109779169"
"m2_278" = "1374492920"
"m2_277" = "3934160643"
"m2_276" = "2198877993"
"m2_275" = "463578627"
"m2_274" = "3023265446"
"m2_273" = "1287965801"
"m2_272" = "3847647615"
"m2_271" = "2112349826"
"m2_270" = "377068544"
"m3_421" = "429806696"
"m1_564" = "474468949"
"m1_565" = "4037488356"
"m1_566" = "1522014915"
"m1_567" = "2595358944"
"m1_560" = "2470797679"
"m1_561" = "274408362"
"m1_562" = "1230608941"
"m1_563" = "3546825086"
"m1_568" = "819544463"
"m1_569" = "3963800372"
"m3_238" = "698940799"
"m2_118" = "2900837322"
"m2_119" = "341172064"
"m2_112" = "1079027309"
"m2_113" = "2814328433"
"m2_110" = "1903426978"
"m2_111" = "3638706390"
"m2_116" = "3725223097"
"m2_117" = "1165556743"
"m2_114" = "254643278"
"m2_115" = "1989941731"
"m3_234" = "2347938699"
"m3_614" = "333206855"
"m3_235" = "4083360550"
"m3_615" = "2068759794"
"m3_618" = "2979763979"
"m3_619" = "419694246"
"m2_488" = "713326446"
"m2_489" = "2448609065"
"m1_179" = "2616292860"
"m1_178" = "3000870915"
"m1_173" = "496169754"
"m1_172" = "1286024787"
"m1_171" = "1028237937"
"m1_170" = "124700849"
"m1_177" = "3391125003"
"m1_176" = "2406135257"
"m1_175" = "3299124213"
"m1_174" = "1669366638"
"m2_644" = "835743286"
"m2_642" = "1660112670"
"m2_643" = "3395407331"
"m2_640" = "2484503436"
"m2_641" = "4219791901"
"m1_9" = "3515848174"
"m4_218" = "336257746"
"m1_379" = "3506507651"
"m1_378" = "3183300568"
"m1_375" = "3645197200"
"m1_8" = "3166165529"
"m1_377" = "2588325108"
"m1_376" = "3480873013"
"m1_371" = "1551375353"
"m1_370" = "4024086500"
"m1_373" = "447059873"
"m1_372" = "1394889294"
"m4_566" = "2922011390"
"m3_377" = "1352760748"
"m3_376" = "3945841201"
"m3_375" = "2210812546"
"m3_374" = "441819927"
"m3_373" = "3001758712"
"m3_372" = "1299873869"
"m3_371" = "3825733854"
"m3_370" = "2090754467"
"m1_399" = "362466285"
"m1_398" = "3883561752"
"m3_379" = "561880182"
"m3_378" = "3088313563"
"m4_437" = "2407806225"
"m4_436" = "672515492"
"m4_435" = "3232192055"
"m4_434" = "1496901322"
"m4_433" = "4056577885"
"m4_432" = "2321287152"
"m4_431" = "585996419"
"m4_430" = "3145672982"
"m3_575" = "1343172602"
"m3_574" = "3902717007"
"m3_577" = "518672004"
"m3_576" = "3111772009"
"m3_571" = "2991710774"
"m3_570" = "1256682139"
"m4_439" = "1583420395"
"m4_438" = "4143096958"
"m1_42" = "3955418771"
"m1_43" = "1253029771"
"m1_40" = "1802096066"
"m1_41" = "1505108846"
"m1_46" = "3072602343"
"m1_47" = "3930066549"
"m1_44" = "1438417618"
"m1_45" = "338388629"
"m1_48" = "3508603847"
"m1_49" = "1715434996"
"m3_119" = "357998978"
"m3_118" = "2917414423"
"m3_117" = "1148946168"
"m3_116" = "3741914957"
"m3_115" = "2006935518"
"m3_114" = "237958307"
"m3_113" = "2797356340"
"m3_112" = "1096013209"
"m3_111" = "3655416426"
"m3_110" = "1886423807"
"m3_593" = "2547216724"
"m3_592" = "778225209"
"m3_591" = "3337639562"
"m3_590" = "1636280095"
"m3_597" = "898282264"
"m3_596" = "3424125933"
"m3_595" = "1689227390"
"m3_594" = "4282245315"
"m2_95" = "1643859723"
"m3_598" = "2600149687"
"m3_603" = "2686656406"
"m3_602" = "951151739"
"m3_601" = "3544251596"
"m3_600" = "1809206609"
"m3_607" = "1071208794"
"m3_606" = "3597184559"
"m4_549" = "3486840001"
"m4_548" = "1751549268"
"m4_547" = "16258535"
"m4_546" = "2575935098"
"m4_545" = "840644365"
"m4_544" = "3400320928"
"m4_543" = "1665030195"
"m4_542" = "4224706758"
"m4_541" = "2489416025"
"m4_540" = "754125292"
"m1_576" = "3984148990"
"m1_575" = "1909605820"
"m1_574" = "1932343325"
"m1_573" = "391278384"
"m1_572" = "56362750"
"m1_571" = "2079454370"
"m1_570" = "1232813820"
"m1_579" = "2293127229"
"m1_578" = "568779881"
"m2_242" = "3328524302"
"m2_243" = "768859915"
"m2_89" = "4117014978"
"m2_241" = "1593242542"
"m2_246" = "1679753258"
"m2_247" = "3415054504"
"m2_244" = "2504139798"
"m2_245" = "4239427227"
"m2_83" = "2295214739"
"m2_82" = "559917424"
"m2_248" = "855368895"
"m2_249" = "2590667900"
"m2_87" = "646433517"
"m2_86" = "3206115926"
"m2_85" = "1470822386"
"m2_84" = "4030503664"
"m2_627" = "1400566050"
"m2_109" = "168125632"
"m2_108" = "2727810129"
"m2_105" = "1816896089"
"m2_104" = "81616045"
"m2_107" = "992513403"
"m2_106" = "3552196528"
"m2_101" = "3465666948"
"m2_100" = "1730384165"
"m2_103" = "2641281807"
"m2_102" = "905998547"
"m3_423" = "3866720050"
"m3_422" = "2164836231"
"m3_393" = "3381290108"
"m3_420" = "2955781373"
"m3_427" = "2217783526"
"m3_426" = "482738507"
"m3_425" = "3075838428"
"m3_424" = "1340860065"
"m2_8" = "997419111"
"m2_9" = "2732672485"
"m2_2" = "3470575718"
"m2_3" = "910906243"
"m2_0" = "7046"
"m2_1" = "1735292325"
"m2_6" = "1821804001"
"m2_7" = "3557109296"
"m2_4" = "2646189817"
"m2_5" = "86523001"
"m2_499" = "2621647687"
"m2_498" = "886365994"
"m1_148" = "965611445"
"m1_149" = "686719435"
"m1_146" = "3265189602"
"m1_147" = "1451369642"
"m1_144" = "2156039320"
"m1_145" = "1691048192"
"m1_142" = "2288030654"
"m1_143" = "1754593885"
"m1_140" = "2518437873"
"m1_141" = "1992928366"
"m1_158" = "465933323"
"m4_220" = "3806839212"
"m3_348" = "2602308101"
"m4_221" = "1247162649"
[HKCU\Software\Stvncyfrlda\168128873]
"910904903" = "0"
[HKCU\Software\Stvncyfrlda]
"m3_342" = "747352503"
"m3_343" = "2515804450"
"m3_340" = "1604884205"
"m3_341" = "3340305944"
"m3_346" = "3393319803"
"m3_347" = "867328662"
"m3_344" = "4251373649"
"m3_345" = "1658274764"
"m4_158" = "3592996166"
"m4_159" = "1033319603"
"m4_408" = "3623982520"
"m4_409" = "1064305957"
"m4_150" = "2595572190"
"m4_151" = "35895627"
"m4_152" = "1771186360"
"m4_153" = "3506477093"
"m4_154" = "946800530"
"m4_155" = "2682091263"
"m4_156" = "122414700"
"m4_157" = "1857705433"
"m3_298" = "1737416395"
"m3_299" = "3439283814"
"m3_294" = "3385892103"
"m3_295" = "826346674"
"m3_296" = "2528361505"
"m3_297" = "4263259996"
"m3_290" = "706302803"
"m4_228" = "509295892"
"m3_292" = "4176769661"
"m3_293" = "1617358312"
"m4_229" = "2244586625"
"m4_398" = "3450944374"
"m4_399" = "891267811"
"m4_392" = "1629134568"
"m4_393" = "3364425301"
"m4_390" = "2453520398"
"m4_391" = "4188811131"
"m4_396" = "4275330204"
"m4_397" = "1715653641"
"m4_394" = "804748738"
"m4_395" = "2540039471"
"m3_122" = "1268937691"
"m3_123" = "3003966326"
"m3_120" = "2059882801"
"m3_121" = "3794911404"
"m3_126" = "3914972559"
"m3_127" = "1321872698"
"m3_124" = "410948325"
"m3_125" = "2179924496"
"m3_128" = "3056917673"
"m3_129" = "530927556"
"m1_99" = "4162208933"
"m1_98" = "4271332622"
"m1_91" = "1915040709"
"m1_90" = "1327325196"
"m1_93" = "3506603559"
"m1_92" = "2532717655"
"m1_95" = "2080487168"
"m1_94" = "1104321619"
"m1_97" = "2652994207"
"m1_96" = "26225187"
"m4_613" = "2876297217"
"m4_612" = "1141006484"
"m4_611" = "3700683047"
"m4_572" = "448853900"
"m4_573" = "2184144633"
"m4_570" = "1273239730"
"m4_571" = "3008530463"
"m4_576" = "3095049536"
"m4_577" = "535372973"
"m4_574" = "3919435366"
"m4_575" = "1359758803"
"m4_617" = "1227525557"
"m4_578" = "2270663706"
"m4_579" = "4005954439"
"m4_616" = "3787202120"
"m4_370" = "2107444106"
"m4_371" = "3842734839"
"m4_372" = "1283058276"
"m4_373" = "3018349009"
"m4_374" = "458672446"
"m4_375" = "2193963179"
"m4_376" = "3929253912"
"m4_377" = "1369577349"
"m4_378" = "3104868082"
"m4_379" = "545191519"
"m4_614" = "316620654"
"m3_638" = "3292191631"
"m3_639" = "766200634"
"m3_93" = "2451378352"
"m3_92" = "716398853"
"m3_91" = "3309498774"
"m3_90" = "1573930619"
"m3_97" = "836457060"
"m3_96" = "3362431689"
"m3_95" = "1626878810"
"m3_94" = "4220485679"
"m3_99" = "4273372430"
"m3_98" = "2571488659"
"m1_548" = "4014835101"
"m1_549" = "147869872"
"m1_542" = "3878743421"
"m1_543" = "2413439497"
"m1_540" = "2663737754"
"m1_541" = "3067812195"
"m1_546" = "3124202431"
"m1_547" = "3226211932"
"m1_544" = "3983776282"
"m1_545" = "1946072755"
"m2_98" = "2554773350"
"m2_99" = "4290067001"
"m2_257" = "3588081994"
"m2_256" = "1852798173"
"m2_251" = "1766272331"
"m2_250" = "30984721"
"m2_253" = "941898611"
"m2_252" = "3501570362"
"m2_90" = "1557342611"
"m2_91" = "3292627275"
"m2_92" = "732962564"
"m2_93" = "2468241658"
"m2_94" = "4203542782"
"m2_258" = "1028415969"
"m2_96" = "3379155322"
"m2_97" = "819470894"
"m1_498" = "1908266427"
"m1_499" = "2271770624"
"m1_494" = "4040318955"
"m1_495" = "3457897853"
"m1_496" = "76767910"
"m1_497" = "604308547"
"m1_490" = "2833000843"
"m1_491" = "392289495"
"m1_492" = "2559739182"
"m1_493" = "1976370648"
"m3_265" = "273825276"
"m3_264" = "2833351233"
[HKCU\Software\Stvncyfrlda\168128873]
"-1648771660" = "30"
[HKCU\Software\Stvncyfrlda]
"m2_628" = "3135851704"
"m2_629" = "576180269"
"m2_624" = "489652863"
"m2_625" = "2224954240"
"m2_626" = "3960234588"
"m2_259" = "2763696845"
"m2_620" = "2138423841"
"m2_621" = "3873726109"
"m2_622" = "1314038539"
"m2_623" = "3049338509"
"m2_325" = "1328770668"
"m2_324" = "3888454914"
"m4_416" = "326439200"
"m2_327" = "504383032"
"m1_151" = "2375760093"
"m1_150" = "3144849174"
"m1_153" = "3431118817"
"m1_152" = "228710351"
"m1_155" = "2065618626"
"m1_154" = "1842841092"
"m1_157" = "2840445416"
"m1_156" = "3529656598"
"m1_159" = "1163063747"
"m2_321" = "2977539177"
"m2_320" = "1242256192"
"m2_326" = "3064069834"
"m2_323" = "2153155803"
"m2_322" = "417871790"
"m2_530" = "581088713"
"m2_531" = "2316370444"
"m2_532" = "4051672593"
"m2_533" = "1491986643"
"m2_534" = "3227286011"
"m2_535" = "667601735"
"m2_536" = "2402905450"
"m2_537" = "4138180207"
"m2_538" = "1578513590"
"m2_539" = "3313811381"
"m2_329" = "3974966907"
"m2_328" = "2239680652"
"m4_415" = "2886115763"
"m4_414" = "1150825030"
"m4_417" = "2061729933"
"m4_413" = "3710501593"
"m4_411" = "239920127"
"m4_410" = "2799596690"
"m3_359" = "182266866"
"m3_358" = "2775365703"
"m3_355" = "1864887822"
"m3_354" = "129334931"
"m3_357" = "1006766376"
"m3_356" = "3566311869"
"m3_351" = "3513363546"
"m3_350" = "1778335023"
"m3_353" = "2655309668"
"m3_352" = "920281033"
"m4_412" = "1975210860"
"m4_149" = "860281457"
"m4_148" = "3419958020"
"m4_419" = "1237344103"
"m4_418" = "3797020666"
"m4_143" = "3333438947"
"m4_142" = "1598148214"
"m4_141" = "4157824777"
"m4_140" = "2422534044"
"m4_147" = "1684667287"
"m4_146" = "4244343850"
"m4_145" = "2509053117"
"m4_144" = "773762384"
"m3_289" = "3265830948"
"m3_288" = "1564356745"
"m3_287" = "4123885850"
"m3_286" = "2355302895"
"m3_285" = "619800176"
"m3_284" = "3212900037"
"m3_283" = "1444300630"
"m3_282" = "4003845179"
"m3_281" = "2302354572"
"m3_280" = "566932753"
"m4_389" = "718229665"
"m4_388" = "3277906228"
"m4_385" = "2367001325"
"m4_384" = "631710592"
"m4_387" = "1542615495"
"m4_386" = "4102292058"
"m4_381" = "4015772985"
"m4_380" = "2280482252"
"m4_383" = "3191387155"
"m4_382" = "1456096422"
"m3_135" = "2319427666"
"m3_134" = "583874855"
"m3_137" = "1528482684"
"m3_136" = "4087897025"
"m4_89" = "4117019877"
"m3_130" = "2266496883"
"m3_133" = "3176958344"
"m3_132" = "1441930781"
"m4_85" = "1470824241"
"m4_84" = "4030500804"
"m4_87" = "646438411"
"m4_86" = "3206114974"
"m4_81" = "3119595901"
"m4_80" = "1384305168"
"m4_83" = "2295210071"
"m4_82" = "559919338"
"m3_406" = "136830199"
"m1_86" = "3830297527"
"m1_87" = "716871613"
"m1_84" = "2426271391"
"m1_85" = "2680627304"
"m1_82" = "2050666580"
"m1_83" = "1596283367"
"m1_80" = "4190167073"
"m1_81" = "3485776351"
"m1_88" = "4046547143"
"m1_89" = "1359730847"
"m2_394" = "804741064"
"m2_395" = "2540041726"
"m2_396" = "4275325430"
"m2_397" = "1715657006"
"m2_390" = "2453524887"
"m2_391" = "4188813640"
"m2_392" = "1629128671"
"m2_393" = "3364428100"
"m2_398" = "3450939320"
"m2_399" = "891270043"
"m4_363" = "2845310863"
"m4_362" = "1110020130"
"m4_361" = "3669696693"
"m4_360" = "1934405960"
"m4_367" = "1196539203"
"m4_366" = "3756215766"
"m4_365" = "2020925033"
"m4_364" = "285634300"
"m3_621" = "3890684224"
"m3_620" = "2121707989"
"m4_369" = "372153373"
"m4_368" = "2931829936"
"m3_625" = "2241684276"
"m3_624" = "472707993"
"m3_627" = "1383697886"
"m3_626" = "3977188003"
"m4_535" = "667606219"
"m3_80" = "1401010233"
"m3_81" = "3102878548"
"m3_82" = "542956227"
"m3_83" = "2311932542"
"m3_84" = "4047496685"
"m3_85" = "1453954328"
"m3_86" = "3189376183"
"m3_87" = "663008290"
"m3_88" = "2364876625"
"m3_89" = "4100445900"
"m4_532" = "4051668612"
"m1_559" = "3535462261"
"m1_558" = "2648771302"
"m1_555" = "758046282"
"m1_554" = "1057005881"
"m1_557" = "1120084856"
"m1_556" = "1568788365"
"m1_551" = "1946744613"
"m1_550" = "77055064"
"m1_553" = "3081695435"
"m1_552" = "3627773265"
"m4_533" = "1491992049"
"m1_489" = "1697608355"
"m1_488" = "4216749428"
"m1_487" = "1534018017"
"m1_486" = "3846999893"
"m1_485" = "3738960186"
"m1_484" = "3913885905"
"m1_483" = "599471642"
"m1_482" = "3523510404"
"m1_481" = "3200646782"
"m1_480" = "3941681505"
"m2_49" = "3424865639"
"m2_48" = "1689568470"
"m2_47" = "4249251837"
"m2_46" = "2513967862"
"m2_45" = "778667708"
"m2_44" = "3338352391"
"m2_43" = "1603054471"
"m2_42" = "4162739650"
"m2_41" = "2427440020"
"m2_40" = "692156338"
"m2_480" = "4010867222"
"m2_481" = "1451181203"
"m4_531" = "2316377879"
"m2_482" = "3186483013"
"m2_483" = "626795549"
"m2_484" = "2362095638"
"m2_485" = "4097378107"
"m2_486" = "1537711427"
"m3_131" = "3967839982"
"m2_487" = "3272991669"
"m4_88" = "2381729144"
"m3_446" = "862287311"
"m3_139" = "703982086"
"m3_138" = "3230366443"
"m3_239" = "2434362602"
"m3_526" = "2246810591"
"m2_639" = "749220432"
"m3_527" = "3981708106"
"m2_637" = "1573606842"
"m2_636" = "4133275823"
"m2_635" = "2397979398"
"m2_634" = "662692613"
"m2_633" = "3222377213"
"m3_524" = "3071244597"
"m2_631" = "4046762079"
"m2_630" = "2311463588"
"m3_525" = "477751456"
"m3_522" = "3861667435"
"m3_523" = "1335806342"
"m1_124" = "676998114"
"m1_125" = "1879034184"
"m1_126" = "2805592088"
"m1_127" = "2043425755"
"m1_120" = "1189464273"
"m1_121" = "1794844299"
"m1_122" = "2134263110"
"m1_123" = "2445141715"
"m3_521" = "2126753532"
"m1_128" = "487358547"
"m1_129" = "2493868957"
"m1_238" = "1196369639"
"m1_239" = "1918106022"
"m1_230" = "286663627"
"m1_231" = "4262323947"
"m1_232" = "4044018833"
"m1_233" = "3769569379"
"m1_234" = "955087523"
"m1_235" = "1682008953"
"m1_236" = "2573653218"
"m1_237" = "68929741"
"m2_523" = "1318959279"
"m2_522" = "3878629052"
"m2_521" = "2143346113"
"m2_520" = "408047370"
"m2_527" = "3965154588"
"m2_526" = "2229857651"
"m2_525" = "494572869"
"m2_524" = "3054242833"
"m2_529" = "3140769995"
"m2_528" = "1405472240"
"m4_620" = "2138430460"
"m1_374" = "1969438792"
"m4_178" = "3939072458"
"m4_179" = "1379395895"
"m4_176" = "468490992"
"m4_177" = "2203781725"
"m4_174" = "1292876822"
"m4_175" = "3028167555"
"m4_172" = "2117262652"
"m4_173" = "3852553385"
"m4_170" = "2941648482"
"m4_171" = "381971919"
"m1_309" = "2737749792"
"m3_579" = "4022692270"
"m1_612" = "3996347066"
"m4_98" = "2554767290"
"m4_99" = "4290058023"
"m3_440" = "3301763441"
"m1_613" = "56535639"
"m4_92" = "732957484"
"m4_93" = "2468248217"
"m4_90" = "1557343314"
"m4_91" = "3292634047"
"m4_96" = "3379153120"
"m4_97" = "819476557"
"m4_94" = "4203538950"
"m4_95" = "1643862387"
"m3_386" = "4119292019"
"m3_387" = "1525750766"
"m3_384" = "614746537"
"m3_385" = "2350315716"
"m3_382" = "1472802447"
"m3_383" = "3208371770"
"m3_380" = "2263748581"
"m3_381" = "3998793488"
"m3_430" = "3128705855"
"m3_431" = "602862250"
"m3_432" = "2338287065"
"m3_433" = "4039712116"
"m3_434" = "1480297699"
"m3_435" = "3248765982"
"m3_388" = "3261303581"
"m3_389" = "734804616"
"m4_565" = "1186720657"
"m1_614" = "95283"
"m4_621" = "3873721193"
"m4_564" = "3746397220"
"m1_615" = "467001445"
"m4_567" = "362334827"
"m4_284" = "3196296428"
"m4_285" = "636619865"
"m4_286" = "2371910598"
"m4_287" = "4107201331"
"m4_280" = "550100792"
"m4_281" = "2285391525"
"m4_282" = "4020682258"
"m4_283" = "1461005695"
"m4_561" = "2835492317"
"m4_288" = "1547524768"
"m4_289" = "3282815501"
"m4_560" = "1100201584"
"m2_387" = "1542612608"
"m2_386" = "4102295966"
"m2_385" = "2366996505"
"m2_384" = "631714455"
"m2_383" = "3191382506"
"m2_382" = "1456100750"
"m2_381" = "4015768453"
"m2_380" = "2280486408"
"m4_590" = "1619316022"
"m4_591" = "3354606755"
"m4_592" = "794930192"
"m4_562" = "275815754"
"m4_594" = "4265511658"
"m4_595" = "1705835095"
"m2_389" = "718228162"
"m2_388" = "3277912667"
"m4_356" = "3583177620"
"m4_357" = "1023501057"
"m4_354" = "112596154"
"m4_355" = "1847886887"
"m4_352" = "936981984"
"m4_353" = "2672272717"
"m4_350" = "1761367814"
"m4_351" = "3496658547"
"m4_600" = "1792354168"
"m4_601" = "3527644901"
"m4_602" = "967968338"
"m4_603" = "2703259071"
"m4_604" = "143582508"
"m4_605" = "1878873241"
"m4_358" = "2758791790"
"m4_359" = "199115227"
"m4_569" = "3832916293"
"m4_568" = "2097625560"
"m3_629" = "592751864"
"m3_628" = "3152690509"
"m4_500" = "61972708"
"m3_144" = "790480761"
"m4_644" = "835735092"
"m3_145" = "2492364436"
"m4_507" = "3619073247"
"m3_148" = "3403350317"
"m2_58" = "1862606856"
"m2_59" = "3597908170"
"m3_149" = "843427928"
"m2_54" = "3511392426"
"m2_55" = "951706520"
"m2_56" = "2686996050"
"m2_57" = "127324671"
"m2_50" = "865195674"
"m2_51" = "2600477794"
"m2_52" = "40808476"
"m2_53" = "1776094007"
"m3_622" = "1330761983"
"m1_586" = "2002813244"
"m1_587" = "388101784"
"m1_584" = "1862866198"
"m1_585" = "2328616107"
"m1_582" = "2595595169"
"m1_583" = "235572109"
"m1_580" = "578656645"
"m1_581" = "1024542816"
"m1_588" = "1026732595"
"m1_589" = "4217166033"
"m2_602" = "967974726"
"m2_603" = "2703254843"
"m2_600" = "1792359663"
"m2_601" = "3527609665"
"m2_606" = "3614168334"
"m2_607" = "1054485961"
"m2_604" = "143587999"
"m2_605" = "1878870563"
"m2_608" = "2789782581"
"m2_609" = "230104151"
"m4_643" = "3395411655"
"m4_508" = "1059396684"
"m1_137" = "112521988"
"m1_136" = "1785971296"
"m1_135" = "4109198919"
"m1_134" = "917013460"
"m1_133" = "3055101215"
"m1_132" = "82009643"
"m1_131" = "760803484"
"m1_130" = "2014964236"
"m1_139" = "2855295125"
"m1_138" = "3255580793"
"m1_229" = "4280131998"
"m1_228" = "1474962863"
"m1_223" = "818488746"
"m1_222" = "3027781710"
"m1_221" = "1877532930"
"m1_220" = "1256578014"
"m1_227" = "68793481"
"m1_226" = "3059481429"
"m1_225" = "3372543978"
"m1_224" = "2016546117"
"m2_516" = "2056814873"
"m2_517" = "3792114661"
"m2_514" = "2881203118"
"m1_417" = "3783414591"
"m2_512" = "3705589677"
"m2_513" = "1145920273"
"m2_510" = "235007962"
"m2_511" = "1970306255"
"m2_518" = "1232431946"
"m2_519" = "2967729807"
"m1_393" = "759709262"
"m1_318" = "2463797852"
"m1_392" = "4281867942"
"m1_391" = "1199160190"
"m1_390" = "519780705"
"m1_397" = "803352698"
"m1_396" = "2289703608"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m1_395" = "3394801441"
"m1_394" = "159786669"
"m4_512" = "3705592320"
"m4_513" = "1145915757"
"m4_161" = "208933773"
"m4_160" = "2768610336"
"m4_163" = "3679515239"
"m4_162" = "1944224506"
"m4_165" = "2855129409"
"m4_164" = "1119838676"
"m4_167" = "2030743579"
"m4_166" = "295452846"
"m4_169" = "1206357749"
"m4_168" = "3766034312"
"m3_578" = "2253717043"
"m4_67" = "300362119"
"m4_66" = "2860038682"
"m4_65" = "1124747949"
"m4_64" = "3684424512"
"m4_63" = "1949133779"
"m4_62" = "213843046"
"m4_61" = "2773519609"
"m4_60" = "1038228876"
"m4_69" = "3770943585"
"m4_68" = "2035652852"
"m3_399" = "874299594"
"m3_398" = "3434238303"
"m3_429" = "1427362688"
"m3_428" = "3986759701"
"m3_391" = "4172236114"
"m3_390" = "2470357543"
"m1_313" = "3933719424"
"m3_392" = "1612313793"
"m3_395" = "2523301638"
"m3_394" = "787748843"
"m3_397" = "1732355616"
"m3_396" = "4292294325"
"m4_297" = "4280239477"
"m4_296" = "2544948744"
"m4_295" = "809658011"
"m4_294" = "3369334574"
"m4_293" = "1634043841"
"m4_292" = "4193720404"
"m4_291" = "2458429671"
"m4_290" = "723138938"
"m2_491" = "1624221776"
"m1_624" = "3703027832"
"m3_572" = "465804709"
"m4_299" = "3455853647"
"m4_298" = "1720562914"
"m4_589" = "4178992585"
"m4_588" = "2443701852"
"m4_583" = "2357182779"
"m4_582" = "621892046"
"m4_581" = "3181568609"
"m4_580" = "1446277876"
"m4_587" = "708411119"
"m4_586" = "3268087682"
"m4_585" = "1532796949"
"m4_584" = "4092473512"
"m4_349" = "26077081"
"m4_348" = "2585753644"
"m4_619" = "403139727"
"m4_618" = "2962816290"
"m4_341" = "3323620401"
"m4_340" = "1588329668"
"m4_343" = "2499234571"
"m4_342" = "763943838"
"m4_345" = "1674848741"
"m4_344" = "4234525304"
"m4_347" = "850462911"
"m4_346" = "3410139474"
[HKCU\Software\Stvncyfrlda\168128873]
"-737866757" = "4B278A835FE92988F90F7C3CA41943E954C2A3E5F485BE927C19BB1BE3A4606DACD30115F9A5DFCC9A54A9CBC970B3F5552946D7DCA330D47DB444FE33A74E4F3934F853C78E0DC6D9EEE227165CFE1E5F4DF951B4E949E9FD58BC2F492F3A5FE47491DA52289271F36B555070B2FE3D61BD99AA79CD32B302250EFC3B19E5BA5983117001ACB3CC3315F4E8A6E14E431831F637A045E8B2E9D85E4FE4BB17441E184C36D2CE87AFD142CC126B0B44025A35802EFB7597B96B29F209B5C200ABEF3AD8D9E89ED2BD716737EA3531C319A48A0859A5D987B1F40AD720852CD4BAEEFF0335C753F5B39E9B397C689313439635D8144E674989A2B7C1E13F1E2F2E"
[HKCU\Software\Stvncyfrlda]
"m2_288" = "1547521238"
"m2_289" = "3282825159"
"m2_286" = "2371904210"
"m2_287" = "4107205111"
"m2_284" = "3196303654"
"m2_285" = "636623230"
"m2_282" = "4020677424"
"m2_283" = "1461006513"
"m2_280" = "550096336"
"m2_281" = "2285394217"
"m2_350" = "1761362872"
"m2_351" = "3496664218"
"m2_352" = "936977363"
"m2_353" = "2672265035"
"m2_354" = "112592680"
"m2_355" = "1847893261"
"m2_356" = "3583172823"
"m2_357" = "1023507445"
"m2_358" = "2758790448"
"m2_359" = "199120743"
"m2_69" = "3770951783"
"m2_68" = "2035650003"
"m2_61" = "2773522752"
"m2_60" = "1038237070"
"m2_63" = "1949135239"
"m2_62" = "213836443"
"m2_65" = "1124749991"
"m2_64" = "3684417827"
"m2_67" = "300361409"
"m2_66" = "2860030749"
"m3_644" = "819143709"
"m1_599" = "342411712"
"m1_598" = "240657867"
"m1_591" = "140269179"
"m1_590" = "541120394"
"m1_593" = "1453517861"
"m1_592" = "1140416217"
"m1_595" = "3922136813"
"m1_594" = "2591019600"
"m1_597" = "1113705445"
"m1_596" = "2137079997"
"m1_37" = "1615009538"
"m1_36" = "428324399"
"m1_35" = "2987992732"
"m1_34" = "3828293477"
"m1_33" = "2032667068"
"m1_32" = "3893417322"
"m2_462" = "2840399745"
"m1_31" = "3362044747"
"m2_463" = "280730347"
"m1_30" = "1018429050"
"m2_460" = "3664784892"
"m2_461" = "1105115635"
"m2_466" = "1191628647"
"m2_467" = "2926924525"
"m2_464" = "2016013444"
"m4_536" = "2402896952"
"m3_640" = "2501245609"
"m2_465" = "3751309979"
"m4_518" = "1232434830"
"m2_615" = "2051914658"
"m2_614" = "316614505"
"m2_617" = "1227528338"
"m2_616" = "3787196983"
"m2_611" = "3700679283"
"m2_610" = "1965397706"
"m2_613" = "2876294037"
"m2_612" = "1140999518"
"m2_619" = "403130693"
"m2_618" = "2962808100"
[HKCU\Software\Stvncyfrlda\168128873]
"1821809806" = "0200687474703A2F2F736C776F6366642F736F62616B61312E67696600687474703A2F2F34362E3130352E3130332E3231392F736F62616B61766F6C6F732E676966"
[HKCU\Software\Stvncyfrlda]
"m4_519" = "2967725563"
"m4_640" = "2484506752"
"m4_641" = "4219797485"
"m4_642" = "1660120922"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\Stvncyfrlda]
"m1_108" = "1552734517"
"m1_109" = "2604843283"
"m1_102" = "3994916775"
"m1_103" = "1604004001"
"m1_100" = "2928987439"
"m1_101" = "2269810284"
"m1_106" = "2995607986"
"m1_107" = "4095822067"
"m1_104" = "1468215837"
"m1_105" = "3914654468"
"m1_218" = "3196969141"
"m1_219" = "3141871504"
"m1_216" = "1927018023"
"m1_217" = "237063038"
"m1_214" = "2100458432"
"m1_215" = "2174876848"
"m1_212" = "2730835199"
"m1_213" = "882900856"
"m1_210" = "405432276"
"m1_211" = "346459501"
"m2_509" = "2794696307"
"m2_508" = "1059389988"
"m2_501" = "1797261166"
"m2_500" = "61968200"
"m2_503" = "972879039"
"m2_502" = "3532549565"
"m2_505" = "148495349"
"m2_504" = "2708162593"
"m2_507" = "3619075676"
"m2_506" = "1883777383"
"m3_508" = "1042708069"
"m3_509" = "2811290000"
"m3_599" = "40227362"
"m1_634" = "1697022382"
"m1_538" = "2720099940"
"m1_635" = "1114762645"
"m1_636" = "3272111290"
"m1_637" = "2712239347"
"m1_630" = "525012355"
"m1_631" = "2294667920"
"m1_632" = "1919223505"
"m1_633" = "3329955920"
"m3_502" = "3549238679"
"m3_258" = "1011818995"
"m3_259" = "2780418414"
"m3_503" = "956269826"
"m3_250" = "14400091"
"m3_251" = "1749308918"
"m3_252" = "3518416229"
"m3_253" = "958887056"
"m3_254" = "2660361231"
"m3_255" = "100898746"
"m3_256" = "1869350697"
"m3_257" = "3571365444"
"m4_114" = "254647946"
"m4_115" = "1989938679"
"m4_116" = "3725229412"
"m4_117" = "1165552849"
"m4_110" = "1903419606"
"m4_111" = "3638710339"
"m4_112" = "1079033776"
"m4_113" = "2814324509"
"m4_118" = "2900843582"
"m4_119" = "341167019"
"m4_74" = "3857462658"
"m4_75" = "1297786095"
"m4_76" = "3033076828"
"m4_77" = "473400265"
"m4_70" = "1211267022"
"m4_71" = "2946557755"
"m4_72" = "386881192"
"m4_73" = "2122171925"
"m4_78" = "2208690998"
"m4_79" = "3943981731"
"m3_418" = "3813836243"
"m3_419" = "1220752718"
"m3_416" = "309754633"
"m3_417" = "2078337700"
"m3_414" = "1167808623"
"m3_415" = "2902838170"
"m3_412" = "1958230341"
"m3_413" = "3693783280"
"m3_410" = "2816286395"
"m3_411" = "256870870"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_338" = "2412715498"
"m4_339" = "4148006231"
"m4_628" = "3135854436"
"m4_629" = "576177873"
"m4_334" = "4061487158"
"m4_335" = "1501810595"
"m4_336" = "3237101328"
"m4_337" = "677424765"
"m4_330" = "1415291522"
"m4_331" = "3150582255"
"m4_332" = "590905692"
"m4_333" = "2326196425"
"m2_291" = "2458434276"
"m2_290" = "723133274"
"m2_293" = "1634046648"
"m2_292" = "4193717816"
"m2_295" = "809648977"
"m2_294" = "3369329754"
"m2_297" = "4280242449"
"m2_296" = "2544946755"
"m2_299" = "3455857970"
"m2_298" = "1720559398"
"m4_240" = "4152915504"
"m4_241" = "1593238941"
"m4_242" = "3328529674"
"m4_243" = "768853111"
"m4_244" = "2504143844"
"m4_245" = "4239434577"
"m4_246" = "1679758014"
"m4_247" = "3415048747"
"m4_248" = "855372184"
"m4_249" = "2590662917"
"m2_343" = "2499238575"
"m2_342" = "763937110"
"m2_341" = "3323624222"
"m2_340" = "1588324749"
"m2_347" = "850466309"
"m2_346" = "3410136303"
"m2_345" = "1674853009"
"m2_344" = "4234518450"
"m2_349" = "26081479"
"m2_348" = "2585747878"
"m2_76" = "3033072478"
"m2_77" = "473406279"
"m2_74" = "3857457317"
"m2_75" = "1297789950"
"m2_72" = "386875412"
"m2_73" = "2122177243"
"m2_70" = "1211264510"
"m2_71" = "2946563497"
"m2_78" = "2208687967"
"m2_79" = "3943987331"
"m3_57" = "110470508"
"m3_56" = "2703963633"
"m3_55" = "968530498"
"m3_54" = "3494439639"
"m3_53" = "1759411128"
"m3_52" = "57526285"
"m3_51" = "2583910558"
"m3_50" = "848472419"
"m3_59" = "3614491702"
"m3_58" = "1845908635"
"m1_458" = "2484932796"
"m1_459" = "1013506014"
"m1_450" = "3220353066"
"m1_451" = "3034060751"
"m1_452" = "3286910414"
"m1_453" = "679723717"
"m1_454" = "3327469053"
"m1_455" = "4255076609"
"m1_456" = "980148158"
"m1_457" = "2931650399"
"m3_225" = "3909911780"
"m3_224" = "2174883145"
"m1_283" = "1829307174"
"m1_282" = "3070425004"
"m3_221" = "1263885104"
"m3_220" = "3823414149"
"m1_287" = "2495489896"
"m1_286" = "939722128"
"m2_192" = "2463338383"
"m2_193" = "4198633979"
"m2_190" = "3287722117"
"m2_191" = "728054759"
"m2_196" = "814568727"
"m2_197" = "2549853589"
"m2_194" = "1638950574"
"m2_195" = "3374250011"
"m2_198" = "4285151938"
"m2_199" = "1725464960"
"m3_609" = "213153892"
"m3_608" = "2806761673"
"m3_632" = "1503690545"
"m3_573" = "2200702160"
"m1_119" = "1588735130"
"m1_118" = "3362993074"
"m1_115" = "4035317820"
"m1_114" = "1043131823"
"m1_117" = "2122720111"
"m1_116" = "1048278189"
"m1_111" = "3417884792"
"m1_110" = "3340368877"
"m1_113" = "3450703468"
"m1_112" = "680753856"
"m2_578" = "2270672196"
"m2_579" = "4005958366"
"m2_574" = "3919433052"
"m2_575" = "1359764663"
"m2_576" = "3095044199"
"m2_577" = "535367075"
"m2_570" = "1273235977"
"m2_571" = "3008532789"
"m2_572" = "448849429"
"m2_573" = "2184150820"
"m1_201" = "3499829540"
"m1_200" = "225530203"
"m1_203" = "118843508"
"m1_202" = "513057212"
"m1_205" = "1032357114"
"m1_204" = "315622242"
"m1_207" = "2133802653"
"m1_206" = "2389566468"
"m1_209" = "3333414726"
"m1_208" = "524045792"
"m3_633" = "3239243436"
"m2_400" = "2626553931"
"m2_401" = "66883593"
"m2_402" = "1802170270"
"m2_403" = "3537467261"
"m2_404" = "977784636"
"m2_405" = "2713077815"
"m2_406" = "153396014"
"m2_407" = "1888696957"
"m2_408" = "3623980630"
"m2_409" = "1064309570"
"m3_249" = "2607352620"
"m3_248" = "871930801"
"m3_243" = "751873630"
"m3_242" = "3345366819"
"m3_241" = "1609928628"
"m3_240" = "4136311833"
"m3_247" = "3398363138"
"m3_246" = "1696364695"
"m3_245" = "4256418168"
"m3_244" = "2487310797"
"m1_577" = "824261086"
"m4_107" = "992514703"
"m4_106" = "3552191266"
"m4_105" = "1816900533"
"m4_104" = "81609800"
"m4_103" = "2641286363"
"m4_102" = "905995630"
"m4_101" = "3465672193"
"m4_100" = "1730381460"
"m4_109" = "168128873"
"m4_108" = "2727805436"
"m4_41" = "2427443317"
"m4_40" = "692152584"
"m4_43" = "1603057487"
"m4_42" = "4162734050"
"m4_45" = "778671657"
"m4_44" = "3338348220"
"m4_47" = "4249253123"
"m4_46" = "2513962390"
"m4_49" = "3424867293"
"m4_48" = "1689576560"
"m3_444" = "1653222181"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Stvncyfrlda]
"m4_631" = "4046759339"
"m4_630" = "2311468606"
"m4_633" = "3222373509"
"m4_632" = "1487082776"
"m4_635" = "2397987679"
"m4_634" = "662696946"
"m4_637" = "1573601849"
"m4_636" = "4133278412"
"m4_639" = "749216019"
"m4_638" = "3308892582"
"m2_240" = "4152909981"
"m2_88" = "2381730754"
"m4_329" = "3974968085"
"m4_328" = "2239677352"
"m4_327" = "504386619"
"m4_326" = "3064063182"
"m4_325" = "1328772449"
"m4_324" = "3888449012"
"m4_323" = "2153158279"
"m4_322" = "417867546"
"m4_321" = "2977544109"
"m4_320" = "1242253376"
"m3_557" = "172694016"
"m3_568" = "2080658417"
"m4_450" = "3491749274"
"m3_642" = "1676674419"
"m3_555" = "1030290278"
"m3_554" = "3590212555"
"m3_441" = "742299884"
"m2_81" = "3119603125"
"m3_552" = "119744801"
"m2_80" = "1384302914"
"m3_551" = "2679290290"
"m4_456" = "1018591784"
"m4_253" = "941891257"
"m4_252" = "3501567820"
"m4_251" = "1766277087"
"m4_250" = "30986354"
"m4_257" = "3588086893"
"m4_256" = "1852796160"
"m4_255" = "117505427"
"m4_254" = "2677181990"
"m4_259" = "2763701063"
"m4_258" = "1028410330"
"m1_605" = "511763752"
"m2_376" = "3929245726"
"m2_377" = "1369574384"
"m2_374" = "458681588"
"m2_375" = "2193959791"
"m2_372" = "1283063625"
"m2_373" = "3018342501"
"m2_370" = "2107448411"
"m2_371" = "3842730927"
"m2_638" = "3308885100"
"m2_378" = "3104872226"
"m2_379" = "545188991"
"m3_443" = "4246322102"
"m3_44" = "3354938517"
"m3_45" = "795540480"
"m3_46" = "2497408959"
"m3_47" = "4232388394"
"m3_40" = "675414817"
"m3_41" = "2444014172"
"m3_42" = "4179439051"
"m3_43" = "1586486630"
"m3_48" = "1706528345"
"m3_49" = "3441441268"
"m2_632" = "1487077663"
"m1_449" = "2813395460"
"m1_448" = "1267506894"
"m1_443" = "975111470"
"m1_442" = "3029970179"
"m1_441" = "888723897"
"m1_440" = "302047842"
"m1_447" = "2763911941"
"m1_446" = "3046299275"
"m1_445" = "1600878535"
"m1_444" = "63710821"
"m3_569" = "3849765740"
"m3_623" = "3032629354"
"m1_601" = "344178088"
"m2_185" = "3201208513"
"m2_184" = "1465909311"
"m2_187" = "2376825150"
"m2_186" = "641524254"
"m2_181" = "555012422"
"m2_180" = "3114681886"
"m2_183" = "4025594828"
"m2_182" = "2290296425"
"m2_189" = "1552439972"
"m2_188" = "4112105573"
"m1_607" = "97754043"
"m1_600" = "2930392863"
"m3_482" = "3169755411"
"m3_484" = "2378809405"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_626" = "3960240266"
"m3_457" = "2770830268"
"m4_627" = "1400563703"
"m2_569" = "3832919624"
"m2_568" = "2097618978"
"m2_567" = "362340099"
"m2_566" = "2922008537"
"m2_565" = "1186724167"
"m2_564" = "3746393057"
"m2_563" = "2011108051"
"m2_562" = "275810816"
"m2_561" = "2835494793"
"m2_560" = "1100197884"
"m4_624" = "489658800"
"m1_274" = "397239795"
"m1_275" = "710984778"
"m1_276" = "1020242418"
"m1_277" = "23605916"
"m1_270" = "2857823145"
"m1_271" = "3831163442"
"m1_272" = "387622309"
"m1_273" = "2425180664"
"m1_278" = "2413393928"
"m1_279" = "3763667064"
"m1_308" = "468830618"
"m4_235" = "4066396431"
"m4_625" = "2224949533"
"m4_234" = "2331105698"
"m1_300" = "2899942009"
"m1_301" = "969305856"
"m1_302" = "2253317304"
"m1_303" = "580698059"
"m1_304" = "4180647093"
"m1_305" = "4183277195"
"m1_306" = "1658896629"
"m1_307" = "2683543355"
"m2_413" = "3710508131"
"m2_412" = "1975209432"
"m2_411" = "239924827"
"m2_410" = "2799592408"
"m2_417" = "2061736563"
"m2_416" = "326437562"
"m2_415" = "2886120327"
"m2_414" = "1150822437"
"m2_419" = "1237338452"
"m2_418" = "3797023303"
"m3_278" = "1357802103"
"m3_279" = "3092776418"
"m3_276" = "2182302637"
"m3_277" = "3950901976"
"m3_274" = "3039832195"
"m3_275" = "446879806"
"m3_272" = "3830778361"
"m3_273" = "1304934676"
"m3_270" = "393932511"
"m3_271" = "2095357514"
"m2_515" = "321533693"
"m4_239" = "2417624771"
"m4_238" = "682334038"
"m4_138" = "3246919874"
"m4_139" = "687243311"
"m4_132" = "1425110068"
"m4_133" = "3160400801"
"m4_130" = "2249495898"
"m4_131" = "3984786631"
"m4_136" = "4071305704"
"m4_137" = "1511629141"
"m4_134" = "600724238"
"m4_135" = "2336014971"
"m3_474" = "2205754875"
"m3_475" = "3907769622"
"m3_476" = "1347699845"
"m3_477" = "3116823600"
"m3_470" = "3854825527"
"m3_471" = "1294756770"
"m3_472" = "2996706001"
"m3_473" = "436767308"
"m3_478" = "557279151"
"m3_479" = "2258704090"
"m4_58" = "1862614706"
"m4_59" = "3597905439"
"m4_56" = "2687000536"
"m4_57" = "127323973"
"m4_54" = "3511386366"
"m4_55" = "951709803"
"m4_52" = "40804900"
"m4_53" = "1776095633"
"m4_50" = "865190730"
"m4_51" = "2600481463"
"m3_452" = "2684343901"
"m3_184" = "1449360497"
"m3_185" = "3217944556"
"m3_186" = "658480923"
"m3_187" = "2359824054"
"m3_180" = "3097834125"
"m3_181" = "538419768"
"m3_182" = "2306891095"
"m3_183" = "4008889538"
"m3_188" = "4095393317"
"m3_189" = "1569401168"
"m1_39" = "2332766241"
"m1_38" = "3345017840"
"m4_312" = "244829400"
"m4_313" = "1980120133"
"m4_310" = "1069215230"
"m4_311" = "2804505963"
"m4_316" = "2891025036"
"m4_317" = "331348473"
"m4_314" = "3715410866"
"m4_315" = "1155734303"
"m4_622" = "1314044630"
"m4_318" = "2066639206"
"m4_319" = "3801929939"
"m3_453" = "124273096"
"m4_623" = "3049335363"
"m4_482" = "3186477882"
"m4_483" = "626801319"
"m4_480" = "4010863712"
"m4_481" = "1451187149"
"m4_486" = "1537706222"
"m4_487" = "3272996955"
"m4_484" = "2362092052"
"m4_485" = "4097382785"
"m3_500" = "45271757"
"m3_501" = "1780710008"
"m4_488" = "713320392"
"m4_489" = "2448611125"
"m3_504" = "2691183793"
"m3_505" = "165323820"
"m3_506" = "1900762971"
"m3_507" = "3602237174"
"m3_450" = "3508320179"
"m3_451" = "915220270"
"m4_266" = "2025834306"
"m4_267" = "3761125039"
"m4_264" = "2850220136"
"m4_265" = "290543573"
"m4_262" = "3674605966"
"m4_263" = "1114929403"
"m4_260" = "204024500"
"m4_261" = "1939315233"
"m4_268" = "1201448476"
"m4_269" = "2936739209"
"m2_369" = "372147838"
"m2_368" = "2931830810"
"m3_456" = "1035276289"
"m2_361" = "3669702457"
"m2_360" = "1934404456"
"m2_363" = "2845304783"
"m2_362" = "1110019094"
"m2_365" = "2020918968"
"m2_364" = "285635112"
"m2_367" = "1196532729"
"m2_366" = "3756218182"
"m2_10" = "173032438"
"m2_11" = "1908332239"
"m2_12" = "3643613334"
"m2_13" = "1083948413"
"m2_14" = "2819227764"
"m2_15" = "259565105"
"m2_16" = "1994842177"
"m2_17" = "3730144350"
"m2_18" = "1170458334"
"m2_19" = "2905758835"
"m3_71" = "2929954066"
"m3_70" = "1227955687"
"m3_73" = "2139008060"
"m3_72" = "369900673"
"m3_75" = "1280954054"
"m3_74" = "3840892843"
"m3_77" = "490007008"
"m3_76" = "3049946741"
"m3_79" = "3927378058"
"m3_78" = "2191956255"
"m1_478" = "1228820796"
"m1_479" = "3387274039"
"m1_476" = "1253324603"
"m1_477" = "648397219"
"m1_474" = "1549107738"
"m1_475" = "626597890"
"m1_472" = "929045321"
"m1_473" = "3369485811"
"m1_470" = "3535218852"
"m1_471" = "2125714401"
"m3_454" = "1826287975"
"m3_553" = "1821235292"
"m3_455" = "3561709714"
"m1_610" = "16088076"
"m2_178" = "3939066139"
"m2_179" = "1379399459"
"m1_611" = "164916820"
"m2_170" = "2941644198"
"m2_171" = "381973589"
"m2_172" = "2117258680"
"m2_173" = "3852557406"
"m2_174" = "1292871920"
"m2_175" = "3028172078"
"m2_176" = "468484795"
"m2_177" = "2203786719"
"m3_488" = "730271201"
"m1_616" = "169039862"
"m3_550" = "910167559"
[HKCU\Software\Stvncyfrlda\168128873]
"86519073" = "67"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
Dropped PE files
| MD5 | File path |
|---|---|
| 369a41bb69205b33fd62e5142fe74d8d | c:\otbpu.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 69632 | 66048 | 5.53533 | 1831703b78895ddfc6e1fbe88ae5ade7 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 57
11ee70e90d137a73149f6fa76b503f56
979d51d64535324c7afa4f15049f85ce
4069fd76b6ded746d3d5bbe199d1683c
16334c8f6b893ef026e336413458d998
93d9483d641be20b5ea6bd023f3ad1b3
d287254a4099c8e59bcd9198c9fce030
077e061afb447f9028ab306c931eb31a
17d5db7fb6fc1f41406162a92013a4ec
9ee6eb5d127fc5e7dae96c58a922791f
25cfdfbbc68c0d5b5a8704fa12a2f063
ef5100305a01c39cccbb7bb288208fb3
d5834f652d8f6a5f22730f99c1131349
ab04c8095fd22499f1597036dda5da2d
72dbcf43f729cc84fdb80ec008a69df2
1f8ade0e3639c3a50eaf290aac10244b
6bc285d453908192286d142b779437cf
409e8b80381cf75a85344af4973390f1
1409a7bd2613e655ae1ba998242cc203
e51ac907ac05efe0ef1683d9e561b615
89fbcf9b3b01f93d27eb21d237c743ba
673535a9af9ce7c7d226d317d1de46c0
d03400eb353ddb9e1796baea024fbf10
e3b93ae08fef6294e964aa01afe99190
a0d0d38dc7dc058689f6717a8df24090
2f4eb9b3af6ede2b59ed7b7bb43e0090
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
.text
KERNEL32.dll
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
%original file name%.exe
106dcc157db7727bb901be2483b1122.exe
hXXp://slwocfd/sobaka1.gif
hXXp://46.105.103.219/sobakavolos.gif
hXXp://89.11
.info/home.gifIh
bW.text
JKERNEL32.dll
%x.exe
h.rdla&
mH.MN8
T4.At%
S.twa
.klkjw:9fqwiBumW
.sysa
Zc.pBTa
~%s:*:yd:
.!.VF*
.d&?%x=
GUrlA'
"\'Web%w}
HTTP)s'PS
2GUARDCMD
o.ENHCDM
wWEBWUPD
MM.PF
%xn'[
>>?456789:;
!"#$%&'()* ,-./4
qn%CXf
UP*dB.PPd@.
%FoAN-x
ÄEW
%F" *" a
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
SHFileOperationA
%original file name%.exe_3436_rwx_00401000_00011000:
KERNEL32.dll
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
%original file name%.exe
.text
106dcc157db7727bb901be2483b1122.exe
hXXp://slwocfd/sobaka1.gif
hXXp://46.105.103.219/sobakavolos.gif
hXXp://89.11
.info/home.gifIh
bW.text
JKERNEL32.dll
%x.exe
h.rdla&
mH.MN8
T4.At%
S.twa
.klkjw:9fqwiBumW
.sysa
Zc.pBTa
~%s:*:yd:
.!.VF*
.d&?%x=
GUrlA'
"\'Web%w}
HTTP)s'PS
2GUARDCMD
o.ENHCDM
wWEBWUPD
MM.PF
%xn'[
>>?456789:;
!"#$%&'()* ,-./4
qn%CXf
UP*dB.PPd@.
%FoAN-x
ÄEW
%F" *" a
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
SHFileOperationA
%original file name%.exe_3436_rwx_00420000_010BA000:
hXXp://89.11
.info/home.gifIh
bW.text
JKERNEL32.dll
%x.exe
hXXp://89.119.67.154/testo5/
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet987.info/home.gif
.text
KERNEL32.dll
.reloc
USER32.dll
h.rdata
H.data
ntoskrnl.exe
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
hXXp://
ipfltdrv.sys
VVV.microsoft.com
?%x=%d
&%x=%d
SYSTEM.INI
USER32.DLL
.%c%s
\\.\amsint32
NTDLL.DLL
autorun.inf
ADVAPI32.DLL
win%s.exe
%s.exe
WININET.DLL
InternetOpenUrlA
avast! Web Scanner
Avira AntiVir Premium WebGuard
cmdGuard
cmdAgent
Eset HTTP Server
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootFirewall
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
KERNEL32.DLL
Explorer.exe
A2CMD.
ASHWEBSV.
AVGCC.AVGCHSVX.
DRWEB
DWEBLLIO
DWEBIO
FSGUIEXE.
MCVSSHLD.
NPFMSG.
SYMSPORT.
WEBSCANX.
%c%d_%d
purity_control_%x
.adata
M_%d_
?456789:;<=
!"#$%&'()* ,-./0123
mongC:\Windows\
C:\Windows\hywjfubtsnl.log
hXXp://slwocfd/sobaka1.gif
hXXp://46.105.103.219/sobakavolos.gif
C:\Windows\system32\drivers\lrvmn.sys
356899725
SHELL32.DLL
ShellExecuteA
GetProcessHeap
GetWindowsDirectoryA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
SHFileOperationA
&3&3&3&389
%F" *" a
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
WS2_32.dll
taskhost.exe_872_rwx_00580000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
%original file name%.exe_3436_rwx_03780000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
%original file name%.exe_3436_rwx_03890000_00001000:
u%original file name%.exeM_3436_
taskhost.exe_872_rwx_00590000_00001000:
utaskhost.exeM_872_
Dwm.exe_1376_rwx_00110000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
Dwm.exe_1376_rwx_00120000_00001000:
udwm.exeM_1376_
Explorer.EXE_1440_rwx_01C50000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
Explorer.EXE_1440_rwx_02D70000_00001000:
uexplorer.exeM_1440_
conhost.exe_1648_rwx_000F0000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
conhost.exe_1648_rwx_00100000_00001000:
uconhost.exeM_1648_
TPAutoConnect.exe_2160_rwx_002F0000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
TPAutoConnect.exe_2160_rwx_00310000_00001000:
utpautoconnect.exeM_2160_
conhost.exe_2168_rwx_000B0000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
conhost.exe_2168_rwx_000C0000_00001000:
uconhost.exeM_2168_
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Windows\system.ini (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\elwtuu.exe (561 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (688 bytes)
C:\otbpu.exe (99 bytes)
C:\autorun.inf (246 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\reader_sl.exe (840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uipma.exe (561 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (20 bytes) - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
