Trojan-PSW.Win32.Zbot_ef4e0b4044
Trojan.Win32.Agentb.abre (Kaspersky), Virus.Win32.Sality.at (v) (VIPRE), Trojan-PWS.Win32.Zbot!IK (Emsisoft), Trojan-PSW.Win32.Zbot.6.FD, Virus.Win32.Sality.2.FD, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR, Sinowal.YR, GenericInjector.YR, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Backdoor, Virus
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: ef4e0b40447ecdc83e3818ad186b7283
SHA1: bc14a748e28008c3327d0a6b394b4acbaad44c54
SHA256: 0179a150656f4ac31d4fd00cc7df6538716f67ef2d822e8fe4ae85263d590ef2
SSDeep: 24576:jaH v6Corjqny/QP5uEaH2GKti oyQGxCiRQBQwQ3Wfitjk:jfvqjd/QP5uEaH2GKxVkiqBFQSiw
Size: 1460725 bytes
File type: PE32
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-04-16 10:47:33
Summary:
Trojan-PSW. Trojan program intended for stealing users passwords.
Payload
No specific payload has been found.
Process activity
The Trojan-PSW creates the following process(es):
flash.exe:612
flash.exe:1576
ilfex.exe:452
ilfex.exe:1592
tasklist.exe:3816
net.exe:2304
rundll32.exe:1700
ef4e0b40447ecdc83e3818ad186b7283.exe:1744
ef4e0b40447ecdc83e3818ad186b7283.exe:460
File activity
The process flash.exe:612 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%System%\OpjiwqeLmalb.dll (13 bytes)
The process ilfex.exe:1592 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\000844C2_Rar\ilfex.exe (9098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000846A7_Rar\ilfex.exe (9098 bytes)
The Trojan-PSW deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\00082767_Rar\ef4e0b40447ecdc83e3818ad186b7283.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082767_Rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B6E_Rar\ef4e0b40447ecdc83e3818ad186b7283.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B6E_Rar (0 bytes)
The process ef4e0b40447ecdc83e3818ad186b7283.exe:1744 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Iptuc\ilfex.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp04f86da7.bat (177 bytes)
The process ef4e0b40447ecdc83e3818ad186b7283.exe:460 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\00082767_Rar\ef4e0b40447ecdc83e3818ad186b7283.exe (9098 bytes)
%WinDir%\system.ini (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B6E_Rar\ef4e0b40447ecdc83e3818ad186b7283.exe (9098 bytes)
Registry activity
The process flash.exe:612 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D CB BC AA AA 70 01 95 25 48 E8 8B 73 29 CD A3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"rundll32.exe" = "Run a DLL as an App"
[HKLM\System\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders" = "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, OpjiwqeLmalb.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The process flash.exe:1576 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA BE DE 4C 8C 66 26 8A DB 59 69 8C C3 E1 B2 32"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Tuorf]
"Cicu" = "F5 46 AA 9A FC 66 D2 2B 38 A4 F9 74 84 3B 76 20"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process ilfex.exe:452 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 04 9F E3 57 1B 90 40 84 A9 77 12 29 5F 91 65"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process ilfex.exe:1592 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Aas\695404737]
"35845605" = "349"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Aas\695404737]
"50183847" = "5A98901305C54DC9BEA29B63F1F7FD191B87C97BDB2C6FEF22EBFB5686FEAF07B3DE577A87A4A01536887C3E03BC59CCA853CE7415A2526F2588A3301D3C37126B668EC3974B05D5E34FE1F509D9E79F9AC1A4BB5FE1AE7769D3EBF5625FB6C94ADCE37D638A1D06660931AC677E1B086FD7ABD392881D0B356E0DB6B8FE332C"
[HKCU\Software\Aas\695404737]
"43014726" = "0900687474703A2F2F7777772E70726F647563746F7379616E63792E636F6D2E6D782F6C6F676F2E67696600687474703A2F2F7777772E736B6F70616E69652E73616E646F6D6965727A2E6F706F6B612E6F72672E706C2F696D616765732F6C6F676F2E67696600687474703A2F2F7461626C696768626F6F6B63656E7472652E636F6D2F627574746F6E2E67696600687474703A2F2F677572617967756C2E636F6D2F6C6F676F2E67696600687474703A2F2F6D6F7665697363657074726F2E636F6D2F666F746F732F627574746F6E2E67696600687474703A2F2F6D75746C7565762E636F6D2F6C6F676F2E67696600687474703A2F2F6763676964612E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F7061682D726164696F2E636F6D2F6C6F676F2E67696600687474703A2F2F676F6B6C65726C617374696B6B61706C616D612E636F6D2F6C6F676F2E676966"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\Aas\695404737]
"7169121" = "205"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 10 BC EA CE B6 C1 E8 22 22 09 0C B7 A3 93 BC"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data\Iptuc]
"ilfex.exe" = "%Documents and Settings%\%current user%\Application Data\Iptuc\ilfex.exe:*:Enabled:ipsec"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
The process tasklist.exe:3816 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 4C C7 E9 12 2A ED FC 46 03 43 0B 65 BA 3B 33"
[HKCU\Software\Microsoft\Tuorf]
"Cicu" = "F5 46 AA 9A FC 66 D2 2B 38 A4 F9 74 84 3B 76 20"
The process net.exe:2304 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 C9 2A B5 22 35 66 5C A0 F9 C2 8D 67 F2 0A 6A"
[HKCU\Software\Microsoft\Tuorf]
"Cicu" = "F5 46 AA 9A FC 66 D2 2B 38 A4 F9 74 84 3B 76 20"
The process rundll32.exe:1700 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 5C 2E 6D B4 E0 AA CB 9D E9 FD FF 89 62 F6 13"
The process ef4e0b40447ecdc83e3818ad186b7283.exe:1744 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B B6 34 A8 C6 E4 D4 B9 77 A8 E6 59 C7 B6 CC 1A"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process ef4e0b40447ecdc83e3818ad186b7283.exe:460 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKCU\Software\Aas]
"a4_440" = "3154413240"
[HKCU\Software\Aas]
"a2_348" = "2494850563"
[HKCU\Software\Aas]
"a2_349" = "2502018938"
[HKCU\Software\Aas]
"a2_346" = "2480520233"
[HKCU\Software\Aas]
"a2_347" = "2487692858"
[HKCU\Software\Aas]
"a2_344" = "2466184259"
[HKCU\Software\Aas]
"a2_345" = "2473352144"
[HKCU\Software\Aas]
"a2_342" = "2451847882"
[HKCU\Software\Aas]
"a2_343" = "2458998845"
[HKCU\Software\Aas]
"a2_340" = "2437510137"
[HKCU\Software\Aas]
"a2_341" = "2444668136"
[HKCU\Software\Aas]
"a2_180" = "1290437467"
[HKCU\Software\Aas]
"a2_181" = "1297604801"
[HKCU\Software\Aas]
"a2_182" = "1304773286"
[HKCU\Software\Aas]
"a2_183" = "1311954928"
[HKCU\Software\Aas]
"a2_184" = "1319121607"
[HKCU\Software\Aas]
"a2_185" = "1326292339"
[HKCU\Software\Aas]
"a2_186" = "1333456938"
[HKCU\Software\Aas]
"a2_187" = "1340624710"
[HKCU\Software\Aas]
"a2_188" = "1347791306"
[HKCU\Software\Aas]
"a2_189" = "1354971868"
[HKCU\Software\Aas]
"a4_444" = "3183089724"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a3_78" = "542637991"
[HKCU\Software\Aas]
"a3_79" = "549622726"
[HKCU\Software\Aas]
"a3_72" = "533156193"
[HKCU\Software\Aas]
"a3_73" = "506656128"
[HKCU\Software\Aas]
"a3_70" = "485103791"
[HKCU\Software\Aas]
"a3_71" = "525712590"
[HKCU\Software\Aas]
"a3_76" = "561686245"
[HKCU\Software\Aas]
"a3_77" = "568613636"
[HKCU\Software\Aas]
"a3_74" = "513568291"
[HKCU\Software\Aas]
"a3_75" = "554631746"
[HKCU\Software\Aas]
"a3_259" = "1873798154"
[HKCU\Software\Aas]
"a3_258" = "1866220523"
[HKCU\Software\Aas]
"a1_435" = "653705164"
[HKCU\Software\Aas]
"a1_434" = "1220894255"
[HKCU\Software\Aas]
"a1_433" = "624126076"
[HKCU\Software\Aas]
"a1_432" = "652645621"
[HKCU\Software\Aas]
"a1_431" = "1180703605"
[HKCU\Software\Aas]
"a1_430" = "1724227413"
[HKCU\Software\Aas]
"a3_251" = "1782710578"
[HKCU\Software\Aas]
"a3_250" = "1809280147"
[HKCU\Software\Aas]
"a3_253" = "1830771188"
[HKCU\Software\Aas]
"a3_252" = "1789764949"
[HKCU\Software\Aas]
"a3_255" = "1844811446"
[HKCU\Software\Aas]
"a3_254" = "1837822487"
[HKCU\Software\Aas]
"a3_257" = "1825746760"
[HKCU\Software\Aas]
"a3_256" = "1818692393"
[HKCU\Software\Aas]
"a3_321" = "2284435336"
[HKCU\Software\Aas]
"a3_320" = "2310935401"
[HKCU\Software\Aas]
"a3_323" = "2332478538"
[HKCU\Software\Aas]
"a3_322" = "2291869739"
[HKCU\Software\Aas]
"a3_325" = "2346910988"
[HKCU\Software\Aas]
"a3_324" = "2339397869"
[HKCU\Software\Aas]
"a3_327" = "2327338446"
[HKCU\Software\Aas]
"a3_326" = "2320415151"
[HKCU\Software\Aas]
"a3_329" = "2375379584"
[HKCU\Software\Aas]
"a3_328" = "2368468577"
[HKCU\Software\Aas]
"a3_439" = "3130280062"
[HKCU\Software\Aas]
"a3_438" = "3123369951"
[HKCU\Software\Aas]
"a3_435" = "3101883130"
[HKCU\Software\Aas]
"a3_434" = "3094824539"
[HKCU\Software\Aas]
"a3_437" = "3149870012"
[HKCU\Software\Aas]
"a3_436" = "3142426397"
[HKCU\Software\Aas]
"a3_431" = "3106444646"
[HKCU\Software\Aas]
"a3_430" = "3065901255"
[HKCU\Software\Aas]
"a3_433" = "3087376952"
[HKCU\Software\Aas]
"a3_432" = "3113879961"
[HKCU\Software\Aas]
"a3_94" = "690598327"
[HKCU\Software\Aas]
"a3_95" = "698045910"
[HKCU\Software\Aas]
"a3_96" = "671534665"
[HKCU\Software\Aas]
"a3_97" = "678453992"
[HKCU\Software\Aas]
"a3_90" = "662052915"
[HKCU\Software\Aas]
"a3_91" = "669107282"
[HKCU\Software\Aas]
"a3_92" = "643004661"
[HKCU\Software\Aas]
"a3_93" = "649993492"
[HKCU\Software\Aas]
"a3_98" = "685967115"
[HKCU\Software\Aas]
"a3_99" = "726580138"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a4_151" = "1082537271"
[HKCU\Software\Aas]
"a4_150" = "1075368150"
[HKCU\Software\Aas]
"a4_153" = "1096875513"
[HKCU\Software\Aas]
"a4_152" = "1089706392"
[HKCU\Software\Aas]
"a4_155" = "1111213755"
[HKCU\Software\Aas]
"a4_154" = "1104044634"
[HKCU\Software\Aas]
"a4_157" = "1125551997"
[HKCU\Software\Aas]
"a4_156" = "1118382876"
[HKCU\Software\Aas]
"a4_159" = "1139890239"
[HKCU\Software\Aas]
"a4_158" = "1132721118"
[HKCU\Software\Aas]
"a1_185" = "2918020261"
[HKCU\Software\Aas]
"a1_184" = "2100647141"
[HKCU\Software\Aas]
"a1_183" = "519847915"
[HKCU\Software\Aas]
"a1_182" = "3980856484"
[HKCU\Software\Aas]
"a1_181" = "3920367576"
[HKCU\Software\Aas]
"a1_180" = "3971122789"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a4_392" = "2810295432"
[HKCU\Software\Aas]
"a4_391" = "2803126311"
[HKCU\Software\Aas]
"a4_390" = "2795957190"
[HKCU\Software\Aas]
"a4_397" = "2846141037"
[HKCU\Software\Aas]
"a4_396" = "2838971916"
[HKCU\Software\Aas]
"a4_395" = "2831802795"
[HKCU\Software\Aas]
"a4_394" = "2824633674"
[HKCU\Software\Aas]
"a4_399" = "2860479279"
[HKCU\Software\Aas]
"a4_398" = "2853310158"
[HKCU\Software\Aas]
"a2_405" = "2903495919"
[HKCU\Software\Aas]
"a2_404" = "2896329756"
[HKCU\Software\Aas]
"a2_407" = "2917829578"
[HKCU\Software\Aas]
"a2_406" = "2910660793"
[HKCU\Software\Aas]
"a2_401" = "2874809118"
[HKCU\Software\Aas]
"a2_400" = "2867646170"
[HKCU\Software\Aas]
"a2_403" = "2889159517"
[HKCU\Software\Aas]
"a2_402" = "2881993132"
[HKCU\Software\Aas]
"a2_409" = "2932164952"
[HKCU\Software\Aas]
"a2_408" = "2924996453"
[HKCU\Software\Aas]
"a1_222" = "262440007"
[HKCU\Software\Aas]
"a1_223" = "1939990353"
[HKCU\Software\Aas]
"a1_220" = "1182241000"
[HKCU\Software\Aas]
"a1_221" = "2835733249"
[HKCU\Software\Aas]
"a1_226" = "1855181842"
[HKCU\Software\Aas]
"a1_227" = "1670675030"
[HKCU\Software\Aas]
"a1_224" = "160035214"
[HKCU\Software\Aas]
"a1_225" = "183220363"
[HKCU\Software\Aas]
"a1_228" = "378671115"
[HKCU\Software\Aas]
"a1_229" = "419071642"
[HKCU\Software\Aas]
"a2_351" = "2516367068"
[HKCU\Software\Aas]
"a2_350" = "2509185527"
[HKCU\Software\Aas]
"a2_353" = "2530701529"
[HKCU\Software\Aas]
"a2_352" = "2523539021"
[HKCU\Software\Aas]
"a2_355" = "2545029640"
[HKCU\Software\Aas]
"a2_354" = "2537876456"
[HKCU\Software\Aas]
"a2_357" = "2559367218"
[HKCU\Software\Aas]
"a2_356" = "2552203935"
[HKCU\Software\Aas]
"a2_359" = "2573720656"
[HKCU\Software\Aas]
"a2_358" = "2566537499"
[HKCU\Software\Aas]
"a2_193" = "1383641283"
[HKCU\Software\Aas]
"a2_192" = "1376474768"
[HKCU\Software\Aas]
"a2_191" = "1369305519"
[HKCU\Software\Aas]
"a2_190" = "1362127309"
[HKCU\Software\Aas]
"a2_197" = "1412309924"
[HKCU\Software\Aas]
"a2_196" = "1405156261"
[HKCU\Software\Aas]
"a2_195" = "1397970482"
[HKCU\Software\Aas]
"a2_194" = "1390808333"
[HKCU\Software\Aas]
"a2_199" = "1426659896"
[HKCU\Software\Aas]
"a2_198" = "1419490517"
[HKCU\Software\Aas]
"a1_89" = "893058157"
[HKCU\Software\Aas]
"a1_88" = "1101326862"
[HKCU\Software\Aas]
"a1_85" = "689977673"
[HKCU\Software\Aas]
"a1_84" = "2079246733"
[HKCU\Software\Aas]
"a1_87" = "3285012796"
[HKCU\Software\Aas]
"a1_86" = "2796355547"
[HKCU\Software\Aas]
"a1_81" = "2186902287"
[HKCU\Software\Aas]
"a1_80" = "2266339592"
[HKCU\Software\Aas]
"a1_83" = "3397583658"
[HKCU\Software\Aas]
"a1_82" = "3430587578"
[HKCU\Software\Aas]
"a1_67" = "1586159385"
[HKCU\Software\Aas]
"a1_66" = "4202271582"
[HKCU\Software\Aas]
"a1_65" = "2560019967"
[HKCU\Software\Aas]
"a3_133" = "970345548"
[HKCU\Software\Aas]
"a1_63" = "2697643745"
[HKCU\Software\Aas]
"a3_135" = "950830350"
[HKCU\Software\Aas]
"a3_136" = "991836577"
[HKCU\Software\Aas]
"a1_60" = "2910239778"
[HKCU\Software\Aas]
"a3_138" = "1006335587"
[HKCU\Software\Aas]
"a3_139" = "979823234"
[HKCU\Software\Aas]
"a1_438" = "3728529990"
[HKCU\Software\Aas]
"a1_69" = "2737383712"
[HKCU\Software\Aas]
"a1_68" = "1263489473"
[HKCU\Software\Aas]
"a3_228" = "1617824845"
[HKCU\Software\Aas]
"a3_229" = "1624875244"
[HKCU\Software\Aas]
"a3_224" = "1588903625"
[HKCU\Software\Aas]
"a3_225" = "1629901672"
[HKCU\Software\Aas]
"a3_226" = "1636956043"
[HKCU\Software\Aas]
"a3_227" = "1610836010"
[HKCU\Software\Aas]
"a3_220" = "1593911669"
[HKCU\Software\Aas]
"a3_221" = "1600966036"
[HKCU\Software\Aas]
"a3_222" = "1608410679"
[HKCU\Software\Aas]
"a3_223" = "1581849174"
[HKCU\Software\Aas]
"a1_408" = "3477432278"
[HKCU\Software\Aas]
"a1_409" = "1538469028"
[HKCU\Software\Aas]
"a1_402" = "3355136543"
[HKCU\Software\Aas]
"a1_403" = "1984460527"
[HKCU\Software\Aas]
"a1_400" = "2612838086"
[HKCU\Software\Aas]
"a1_401" = "3513457576"
[HKCU\Software\Aas]
"a1_406" = "3724584335"
[HKCU\Software\Aas]
"a1_407" = "748562537"
[HKCU\Software\Aas]
"a1_404" = "2331588683"
[HKCU\Software\Aas]
"a1_405" = "3102773934"
[HKCU\Software\Aas]
"a3_354" = "2521277451"
[HKCU\Software\Aas]
"a3_355" = "2528204970"
[HKCU\Software\Aas]
"a3_356" = "2568813773"
[HKCU\Software\Aas]
"a3_357" = "2576322924"
[HKCU\Software\Aas]
"a3_350" = "2492225207"
[HKCU\Software\Aas]
"a3_351" = "2499791574"
[HKCU\Software\Aas]
"a3_352" = "2540269385"
[HKCU\Software\Aas]
"a3_353" = "2547254248"
[HKCU\Software\Aas]
"a3_358" = "2583246223"
[HKCU\Software\Aas]
"a3_359" = "2556735022"
[HKCU\Software\Aas]
"a4_37" = "265257477"
[HKCU\Software\Aas]
"a4_36" = "258088356"
[HKCU\Software\Aas]
"a4_35" = "250919235"
[HKCU\Software\Aas]
"a4_34" = "243750114"
[HKCU\Software\Aas]
"a4_33" = "236580993"
[HKCU\Software\Aas]
"a4_32" = "229411872"
[HKCU\Software\Aas]
"a4_31" = "222242751"
[HKCU\Software\Aas]
"a4_30" = "215073630"
[HKCU\Software\Aas]
"a4_144" = "1032353424"
[HKCU\Software\Aas]
"a4_39" = "279595719"
[HKCU\Software\Aas]
"a4_38" = "272426598"
[HKCU\Software\Aas]
"a3_142" = "1034864615"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKCU\Software\Aas]
"a3_448" = "3194799081"
[HKCU\Software\Aas]
"a3_449" = "3202245640"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_124" = "888971004"
[HKCU\Software\Aas]
"a4_125" = "896140125"
[HKCU\Software\Aas]
"a4_126" = "903309246"
[HKCU\Software\Aas]
"a4_127" = "910478367"
[HKCU\Software\Aas]
"a4_120" = "860294520"
[HKCU\Software\Aas]
"a4_121" = "867463641"
[HKCU\Software\Aas]
"a4_122" = "874632762"
[HKCU\Software\Aas]
"a4_123" = "881801883"
[HKCU\Software\Aas]
"a4_128" = "917647488"
[HKCU\Software\Aas]
"a4_129" = "924816609"
[HKCU\Software\Aas]
"a3_444" = "3166269973"
[HKCU\Software\Aas]
"a3_445" = "3206813364"
[HKCU\Software\Aas]
"a4_238" = "1706250798"
[HKCU\Software\Aas]
"a4_239" = "1713419919"
[HKCU\Software\Aas]
"a4_230" = "1648897830"
[HKCU\Software\Aas]
"a4_231" = "1656066951"
[HKCU\Software\Aas]
"a4_232" = "1663236072"
[HKCU\Software\Aas]
"a4_233" = "1670405193"
[HKCU\Software\Aas]
"a4_234" = "1677574314"
[HKCU\Software\Aas]
"a4_235" = "1684743435"
[HKCU\Software\Aas]
"a4_236" = "1691912556"
[HKCU\Software\Aas]
"a4_237" = "1699081677"
[HKCU\Software\Aas]
"a1_158" = "2520130807"
[HKCU\Software\Aas]
"a1_159" = "1943806818"
[HKCU\Software\Aas]
"a1_150" = "77897097"
[HKCU\Software\Aas]
"a1_151" = "2874723396"
[HKCU\Software\Aas]
"a1_152" = "4016276525"
[HKCU\Software\Aas]
"a1_153" = "4235442868"
[HKCU\Software\Aas]
"a1_154" = "2425602615"
[HKCU\Software\Aas]
"a1_155" = "73159614"
[HKCU\Software\Aas]
"a1_156" = "2926371490"
[HKCU\Software\Aas]
"a1_157" = "1861255105"
[HKCU\Software\Aas]
"a1_235" = "3461892472"
[HKCU\Software\Aas]
"a1_234" = "2417314291"
[HKCU\Software\Aas]
"a1_237" = "492718616"
[HKCU\Software\Aas]
"a1_236" = "3094621953"
[HKCU\Software\Aas]
"a1_231" = "1523632116"
[HKCU\Software\Aas]
"a1_230" = "2435859321"
[HKCU\Software\Aas]
"a1_233" = "1325202930"
[HKCU\Software\Aas]
"a1_232" = "416569771"
[HKCU\Software\Aas]
"a1_239" = "2179674583"
[HKCU\Software\Aas]
"a1_238" = "2274733968"
[HKCU\Software\Aas]
"a2_210" = "1505511715"
[HKCU\Software\Aas]
"a2_211" = "1512677708"
[HKCU\Software\Aas]
"a2_212" = "1519859456"
[HKCU\Software\Aas]
"a2_213" = "1527030143"
[HKCU\Software\Aas]
"a2_214" = "1534195669"
[HKCU\Software\Aas]
"a2_215" = "1541367997"
[HKCU\Software\Aas]
"a2_216" = "1548527683"
[HKCU\Software\Aas]
"a2_217" = "1555696678"
[HKCU\Software\Aas]
"a2_218" = "1562859959"
[HKCU\Software\Aas]
"a2_219" = "1570045829"
[HKCU\Software\Aas]
"a2_324" = "2322799907"
[HKCU\Software\Aas]
"a2_325" = "2329964714"
[HKCU\Software\Aas]
"a2_326" = "2337129511"
[HKCU\Software\Aas]
"a2_327" = "2344297116"
[HKCU\Software\Aas]
"a2_320" = "2294113254"
[HKCU\Software\Aas]
"a2_321" = "2301283326"
[HKCU\Software\Aas]
"a2_322" = "2308464563"
[HKCU\Software\Aas]
"a2_323" = "2315617896"
[HKCU\Software\Aas]
"a2_328" = "2351478833"
[HKCU\Software\Aas]
"a2_329" = "2358647362"
[HKCU\Software\Aas]
"a1_98" = "3195817955"
[HKCU\Software\Aas]
"a1_99" = "2417531985"
[HKCU\Software\Aas]
"a1_92" = "3384829862"
[HKCU\Software\Aas]
"a1_93" = "3053937172"
[HKCU\Software\Aas]
"a1_90" = "2597203052"
[HKCU\Software\Aas]
"a1_91" = "1430452262"
[HKCU\Software\Aas]
"a1_96" = "2495155759"
[HKCU\Software\Aas]
"a1_97" = "2876138135"
[HKCU\Software\Aas]
"a1_94" = "2210813999"
[HKCU\Software\Aas]
"a1_95" = "871746860"
[HKCU\Software\Aas]
"a1_74" = "4151731031"
[HKCU\Software\Aas]
"a1_75" = "2640970997"
[HKCU\Software\Aas]
"a1_76" = "1398704661"
[HKCU\Software\Aas]
"a1_77" = "1850053563"
[HKCU\Software\Aas]
"a1_70" = "536753611"
[HKCU\Software\Aas]
"a1_71" = "3679367088"
[HKCU\Software\Aas]
"a1_72" = "835434253"
[HKCU\Software\Aas]
"a1_73" = "3648432595"
[HKCU\Software\Aas]
"a3_129" = "907869896"
[HKCU\Software\Aas]
"a3_128" = "934369961"
[HKCU\Software\Aas]
"a1_78" = "1413870040"
[HKCU\Software\Aas]
"a1_79" = "4282841169"
[HKCU\Software\Aas]
"a3_239" = "1730403494"
[HKCU\Software\Aas]
"a3_238" = "1689270279"
[HKCU\Software\Aas]
"a3_237" = "1682343908"
[HKCU\Software\Aas]
"a3_236" = "1708909381"
[HKCU\Software\Aas]
"a3_235" = "1701334818"
[HKCU\Software\Aas]
"a3_234" = "1660856963"
[HKCU\Software\Aas]
"a3_233" = "1653814880"
[HKCU\Software\Aas]
"a3_232" = "1646370241"
[HKCU\Software\Aas]
"a3_231" = "1672935854"
[HKCU\Software\Aas]
"a3_230" = "1665877263"
[HKCU\Software\Aas]
"a1_419" = "3398771605"
[HKCU\Software\Aas]
"a1_418" = "3499477373"
[HKCU\Software\Aas]
"a1_415" = "4282906497"
[HKCU\Software\Aas]
"a1_414" = "1005973868"
[HKCU\Software\Aas]
"a1_417" = "1467982000"
[HKCU\Software\Aas]
"a1_416" = "2436518928"
[HKCU\Software\Aas]
"a1_411" = "1409227525"
[HKCU\Software\Aas]
"a1_410" = "3795124279"
[HKCU\Software\Aas]
"a1_413" = "1927119648"
[HKCU\Software\Aas]
"a1_412" = "1639447873"
[HKCU\Software\Aas]
"a3_347" = "2504287570"
[HKCU\Software\Aas]
"a3_346" = "2463809843"
[HKCU\Software\Aas]
"a3_345" = "2456759440"
[HKCU\Software\Aas]
"a3_344" = "2482866289"
[HKCU\Software\Aas]
"a3_343" = "2475825118"
[HKCU\Software\Aas]
"a3_342" = "2468836287"
[HKCU\Software\Aas]
"a3_341" = "2427838236"
[HKCU\Software\Aas]
"a3_340" = "2420783869"
[HKCU\Software\Aas]
"a3_349" = "2485301780"
[HKCU\Software\Aas]
"a3_348" = "2511804917"
[HKCU\Software\Aas]
"a2_360" = "2580888466"
[HKCU\Software\Aas]
"a2_361" = "2588054254"
[HKCU\Software\Aas]
"a2_362" = "2595219347"
[HKCU\Software\Aas]
"a4_24" = "172058904"
[HKCU\Software\Aas]
"a4_25" = "179228025"
[HKCU\Software\Aas]
"a4_26" = "186397146"
[HKCU\Software\Aas]
"a4_27" = "193566267"
[HKCU\Software\Aas]
"a4_20" = "143382420"
[HKCU\Software\Aas]
"a4_21" = "150551541"
[HKCU\Software\Aas]
"a4_22" = "157720662"
[HKCU\Software\Aas]
"a4_23" = "164889783"
[HKCU\Software\Aas]
"a2_364" = "2609554319"
[HKCU\Software\Aas]
"a4_28" = "200735388"
[HKCU\Software\Aas]
"a4_29" = "207904509"
[HKCU\Software\Aas]
"a2_365" = "2616721839"
[HKCU\Software\Aas]
"a2_366" = "2623902947"
[HKCU\Software\Aas]
"a2_367" = "2631059431"
[HKCU\Software\Aas]
"a2_168" = "1204406410"
[HKCU\Software\Aas]
"a2_169" = "1211585498"
[HKCU\Software\Aas]
"a2_160" = "1147053165"
[HKCU\Software\Aas]
"a2_161" = "1154235526"
[HKCU\Software\Aas]
"a4_137" = "982169577"
[HKCU\Software\Aas]
"a4_136" = "975000456"
[HKCU\Software\Aas]
"a4_135" = "967831335"
[HKCU\Software\Aas]
"a4_134" = "960662214"
[HKCU\Software\Aas]
"a4_133" = "953493093"
[HKCU\Software\Aas]
"a4_132" = "946323972"
[HKCU\Software\Aas]
"a4_131" = "939154851"
[HKCU\Software\Aas]
"a4_130" = "931985730"
[HKCU\Software\Aas]
"a4_139" = "996507819"
[HKCU\Software\Aas]
"a4_138" = "989338698"
[HKCU\Software\Aas]
"a2_455" = "3261953642"
[HKCU\Software\Aas]
"a4_229" = "1641728709"
[HKCU\Software\Aas]
"a4_228" = "1634559588"
[HKCU\Software\Aas]
"a4_223" = "1598713983"
[HKCU\Software\Aas]
"a4_222" = "1591544862"
[HKCU\Software\Aas]
"a4_221" = "1584375741"
[HKCU\Software\Aas]
"a4_220" = "1577206620"
[HKCU\Software\Aas]
"a4_227" = "1627390467"
[HKCU\Software\Aas]
"a4_226" = "1620221346"
[HKCU\Software\Aas]
"a4_225" = "1613052225"
[HKCU\Software\Aas]
"a4_224" = "1605883104"
[HKCU\Software\Aas]
"a1_149" = "1007370754"
[HKCU\Software\Aas]
"a1_148" = "1530938699"
[HKCU\Software\Aas]
"a1_143" = "3100486466"
[HKCU\Software\Aas]
"a1_142" = "2817927920"
[HKCU\Software\Aas]
"a1_141" = "1617643731"
[HKCU\Software\Aas]
"a1_140" = "2015576149"
[HKCU\Software\Aas]
"a1_147" = "3873423871"
[HKCU\Software\Aas]
"a1_146" = "1580724777"
[HKCU\Software\Aas]
"a1_145" = "1722411321"
[HKCU\Software\Aas]
"a1_144" = "4217135765"
[HKCU\Software\Aas]
"a2_203" = "1455326900"
[HKCU\Software\Aas]
"a2_202" = "1448160617"
[HKCU\Software\Aas]
"a2_201" = "1440991460"
[HKCU\Software\Aas]
"a2_200" = "1433827195"
[HKCU\Software\Aas]
"a2_207" = "1484001189"
[HKCU\Software\Aas]
"a2_206" = "1476845057"
[HKCU\Software\Aas]
"a2_205" = "1469675075"
[HKCU\Software\Aas]
"a2_204" = "1462495447"
[HKCU\Software\Aas]
"a2_209" = "1498345471"
[HKCU\Software\Aas]
"a2_208" = "1491177478"
[HKCU\Software\Aas]
"a2_337" = "2415985526"
[HKCU\Software\Aas]
"a2_336" = "2408819383"
[HKCU\Software\Aas]
"a2_335" = "2401648713"
[HKCU\Software\Aas]
"a2_334" = "2394484656"
[HKCU\Software\Aas]
"a2_333" = "2387314410"
[HKCU\Software\Aas]
"a2_332" = "2380150179"
[HKCU\Software\Aas]
"a2_331" = "2372987462"
[HKCU\Software\Aas]
"a2_330" = "2365816720"
[HKCU\Software\Aas]
"a3_242" = "1718323611"
[HKCU\Software\Aas]
"a2_339" = "2430324118"
[HKCU\Software\Aas]
"a2_338" = "2423167641"
[HKCU\Software\Aas]
"a3_243" = "1725243962"
[HKCU\Software\Aas]
"a1_398" = "3173395075"
[HKCU\Software\Aas]
"a1_399" = "1105861972"
[HKCU\Software\Aas]
"a1_392" = "1946249645"
[HKCU\Software\Aas]
"a1_393" = "2123403440"
[HKCU\Software\Aas]
"a1_390" = "2680855697"
[HKCU\Software\Aas]
"a1_391" = "2440917006"
[HKCU\Software\Aas]
"a1_396" = "2686918690"
[HKCU\Software\Aas]
"a1_397" = "663137031"
[HKCU\Software\Aas]
"a1_394" = "4020572420"
[HKCU\Software\Aas]
"a1_395" = "3113846555"
[HKCU\Software\Aas]
"a3_116" = "814879197"
[HKCU\Software\Aas]
"a3_117" = "821922428"
[HKCU\Software\Aas]
"a3_114" = "834001179"
[HKCU\Software\Aas]
"a3_115" = "807894458"
[HKCU\Software\Aas]
"a3_112" = "785940569"
[HKCU\Software\Aas]
"a3_113" = "826942712"
[HKCU\Software\Aas]
"a3_110" = "771902343"
[HKCU\Software\Aas]
"a3_111" = "778955814"
[HKCU\Software\Aas]
"a1_49" = "67554904"
[HKCU\Software\Aas]
"a1_48" = "819596864"
[HKCU\Software\Aas]
"a3_118" = "862924447"
[HKCU\Software\Aas]
"a3_119" = "869974846"
[HKCU\Software\Aas]
"a3_202" = "1465015971"
[HKCU\Software\Aas]
"a3_203" = "1472066242"
[HKCU\Software\Aas]
"a3_200" = "1416954337"
[HKCU\Software\Aas]
"a3_201" = "1424013824"
[HKCU\Software\Aas]
"a3_206" = "1493543975"
[HKCU\Software\Aas]
"a3_207" = "1500987462"
[HKCU\Software\Aas]
"a3_204" = "1445500773"
[HKCU\Software\Aas]
"a3_205" = "1452936068"
[HKCU\Software\Aas]
"a1_197" = "249186248"
[HKCU\Software\Aas]
"a3_208" = "1508041977"
[HKCU\Software\Aas]
"a3_209" = "1481480472"
[HKCU\Software\Aas]
"a1_191" = "1789003422"
[HKCU\Software\Aas]
"a2_17" = "121879710"
[HKCU\Software\Aas]
"a2_16" = "114710707"
[HKCU\Software\Aas]
"a2_15" = "107543364"
[HKCU\Software\Aas]
"a2_14" = "100361321"
[HKCU\Software\Aas]
"a2_13" = "93196123"
[HKCU\Software\Aas]
"a2_12" = "86021485"
[HKCU\Software\Aas]
"a2_11" = "78858769"
[HKCU\Software\Aas]
"a2_10" = "71682075"
[HKCU\Software\Aas]
"a2_19" = "136211811"
[HKCU\Software\Aas]
"a2_18" = "129052649"
[HKCU\Software\Aas]
"a4_11" = "78860331"
[HKCU\Software\Aas]
"a4_10" = "71691210"
[HKCU\Software\Aas]
"a4_13" = "93198573"
[HKCU\Software\Aas]
"a4_12" = "86029452"
[HKCU\Software\Aas]
"a4_15" = "107536815"
[HKCU\Software\Aas]
"a4_14" = "100367694"
[HKCU\Software\Aas]
"a4_17" = "121875057"
[HKCU\Software\Aas]
"a4_16" = "114705936"
[HKCU\Software\Aas]
"a4_19" = "136213299"
[HKCU\Software\Aas]
"a4_18" = "129044178"
[HKCU\Software\Aas]
"a3_378" = "2693094675"
[HKCU\Software\Aas]
"a3_379" = "2700145074"
[HKCU\Software\Aas]
"a3_372" = "2683746013"
[HKCU\Software\Aas]
"a3_373" = "2657102716"
[HKCU\Software\Aas]
"a3_370" = "2669182491"
[HKCU\Software\Aas]
"a3_371" = "2676691642"
[HKCU\Software\Aas]
"a3_376" = "2712142929"
[HKCU\Software\Aas]
"a3_377" = "2686171376"
[HKCU\Software\Aas]
"a3_374" = "2664681375"
[HKCU\Software\Aas]
"a3_375" = "2705154110"
[HKCU\Software\Aas]
"a3_127" = "927442486"
[HKCU\Software\Aas]
"a1_189" = "1121755998"
[HKCU\Software\Aas]
"a1_188" = "1693464575"
[HKCU\Software\Aas]
"a1_187" = "1974989494"
[HKCU\Software\Aas]
"a1_186" = "3657149387"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Aas]
"a4_218" = "1562868378"
[HKCU\Software\Aas]
"a4_219" = "1570037499"
[HKCU\Software\Aas]
"a4_216" = "1548530136"
[HKCU\Software\Aas]
"a4_217" = "1555699257"
[HKCU\Software\Aas]
"a4_214" = "1534191894"
[HKCU\Software\Aas]
"a4_215" = "1541361015"
[HKCU\Software\Aas]
"a4_212" = "1519853652"
[HKCU\Software\Aas]
"a4_213" = "1527022773"
[HKCU\Software\Aas]
"a4_210" = "1505515410"
[HKCU\Software\Aas]
"a4_211" = "1512684531"
[HKCU\Software\Aas]
"a4_108" = "774265068"
[HKCU\Software\Aas]
"a4_109" = "781434189"
[HKCU\Software\Aas]
"a4_102" = "731250342"
[HKCU\Software\Aas]
"a4_103" = "738419463"
[HKCU\Software\Aas]
"a4_100" = "716912100"
[HKCU\Software\Aas]
"a4_101" = "724081221"
[HKCU\Software\Aas]
"a4_106" = "759926826"
[HKCU\Software\Aas]
"a4_107" = "767095947"
[HKCU\Software\Aas]
"a4_104" = "745588584"
[HKCU\Software\Aas]
"a4_105" = "752757705"
[HKCU\Software\Aas]
"a1_178" = "23621889"
[HKCU\Software\Aas]
"a1_179" = "3525057384"
[HKCU\Software\Aas]
"a1_176" = "1788794636"
[HKCU\Software\Aas]
"a1_177" = "2349114176"
[HKCU\Software\Aas]
"a1_174" = "3431683667"
[HKCU\Software\Aas]
"a1_175" = "2665244294"
[HKCU\Software\Aas]
"a1_172" = "2290902880"
[HKCU\Software\Aas]
"a1_173" = "3890148052"
[HKCU\Software\Aas]
"a1_170" = "3355352273"
[HKCU\Software\Aas]
"a1_171" = "2881413254"
[HKCU\Software\Aas]
"a2_236" = "1691914587"
[HKCU\Software\Aas]
"a2_237" = "1699083744"
[HKCU\Software\Aas]
"a2_234" = "1677581261"
[HKCU\Software\Aas]
"a2_235" = "1684748312"
[HKCU\Software\Aas]
"a2_232" = "1663232317"
[HKCU\Software\Aas]
"a2_233" = "1670398366"
[HKCU\Software\Aas]
"a2_230" = "1648898085"
[HKCU\Software\Aas]
"a2_231" = "1656063264"
[HKCU\Software\Aas]
"a2_238" = "1706248328"
[HKCU\Software\Aas]
"a2_239" = "1713417944"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a2_308" = "2208095851"
[HKCU\Software\Aas]
"a2_309" = "2215260965"
[HKCU\Software\Aas]
"a2_302" = "2165076721"
[HKCU\Software\Aas]
"a2_303" = "2172246918"
[HKCU\Software\Aas]
"a2_300" = "2150742924"
[HKCU\Software\Aas]
"a2_301" = "2157908360"
[HKCU\Software\Aas]
"a2_306" = "2193744594"
[HKCU\Software\Aas]
"a2_307" = "2200912766"
[HKCU\Software\Aas]
"a2_304" = "2179409543"
[HKCU\Software\Aas]
"a2_305" = "2186579888"
[HKCU\Software\Aas]
"a1_389" = "288220971"
[HKCU\Software\Aas]
"a1_388" = "2227756586"
[HKCU\Software\Aas]
"a1_385" = "2871986868"
[HKCU\Software\Aas]
"a1_384" = "1124077040"
[HKCU\Software\Aas]
"a1_387" = "3313512838"
[HKCU\Software\Aas]
"a1_386" = "578593052"
[HKCU\Software\Aas]
"a1_381" = "66896399"
[HKCU\Software\Aas]
"a1_380" = "4045390754"
[HKCU\Software\Aas]
"a1_383" = "799706729"
[HKCU\Software\Aas]
"a1_382" = "1251210092"
[HKCU\Software\Aas]
"a1_58" = "1361444144"
[HKCU\Software\Aas]
"a1_59" = "272601355"
[HKCU\Software\Aas]
"a1_56" = "3838418030"
[HKCU\Software\Aas]
"a1_57" = "1040526272"
[HKCU\Software\Aas]
"a1_54" = "1204292655"
[HKCU\Software\Aas]
"a1_55" = "1953359882"
[HKCU\Software\Aas]
"a1_52" = "2700847370"
[HKCU\Software\Aas]
"a1_53" = "3442039886"
[HKCU\Software\Aas]
"a1_50" = "257146406"
[HKCU\Software\Aas]
"a1_51" = "965846301"
[HKCU\Software\Aas]
"a3_215" = "1524377438"
[HKCU\Software\Aas]
"a3_214" = "1517454143"
[HKCU\Software\Aas]
"a3_217" = "1572437008"
[HKCU\Software\Aas]
"a3_216" = "1565514737"
[HKCU\Software\Aas]
"a3_211" = "1529532890"
[HKCU\Software\Aas]
"a3_210" = "1488928187"
[HKCU\Software\Aas]
"a3_213" = "1510469276"
[HKCU\Software\Aas]
"a3_212" = "1536445053"
[HKCU\Software\Aas]
"a3_219" = "1553446098"
[HKCU\Software\Aas]
"a3_218" = "1545867443"
[HKCU\Software\Aas]
"a3_109" = "798021476"
[HKCU\Software\Aas]
"a3_108" = "790966981"
[HKCU\Software\Aas]
"a3_101" = "707522668"
[HKCU\Software\Aas]
"a3_100" = "733503437"
[HKCU\Software\Aas]
"a3_103" = "754977070"
[HKCU\Software\Aas]
"a3_102" = "714511503"
[HKCU\Software\Aas]
"a3_105" = "769475040"
[HKCU\Software\Aas]
"a3_104" = "762555713"
[HKCU\Software\Aas]
"a3_107" = "750493346"
[HKCU\Software\Aas]
"a3_106" = "742980099"
[HKCU\Software\Aas]
"a4_393" = "2817464553"
[HKCU\Software\Aas]
"a3_369" = "2628699640"
[HKCU\Software\Aas]
"a3_368" = "2621645145"
[HKCU\Software\Aas]
"a3_365" = "2600170596"
[HKCU\Software\Aas]
"a3_364" = "2592723909"
[HKCU\Software\Aas]
"a3_367" = "2647756070"
[HKCU\Software\Aas]
"a3_366" = "2640767111"
[HKCU\Software\Aas]
"a3_361" = "2604787424"
[HKCU\Software\Aas]
"a3_360" = "2564178497"
[HKCU\Software\Aas]
"a3_363" = "2585673634"
[HKCU\Software\Aas]
"a3_362" = "2611780355"
[HKCU\Software\Aas]
"a2_62" = "444492468"
[HKCU\Software\Aas]
"a2_63" = "451652295"
[HKCU\Software\Aas]
"a2_60" = "430149896"
[HKCU\Software\Aas]
"a2_61" = "437318961"
[HKCU\Software\Aas]
"a2_66" = "473166923"
[HKCU\Software\Aas]
"a2_67" = "480336954"
[HKCU\Software\Aas]
"a2_64" = "458817709"
[HKCU\Software\Aas]
"a2_65" = "465986875"
[HKCU\Software\Aas]
"a1_41" = "1628950199"
[HKCU\Software\Aas]
"a1_40" = "275764593"
[HKCU\Software\Aas]
"a1_43" = "423759746"
[HKCU\Software\Aas]
"a1_42" = "2224370225"
[HKCU\Software\Aas]
"a1_45" = "2983668927"
[HKCU\Software\Aas]
"a1_44" = "2669480722"
[HKCU\Software\Aas]
"a1_47" = "1265537171"
[HKCU\Software\Aas]
"a1_46" = "2730393880"
[HKCU\Software\Aas]
"a4_201" = "1440993321"
[HKCU\Software\Aas]
"a4_200" = "1433824200"
[HKCU\Software\Aas]
"a4_203" = "1455331563"
[HKCU\Software\Aas]
"a4_202" = "1448162442"
[HKCU\Software\Aas]
"a4_205" = "1469669805"
[HKCU\Software\Aas]
"a4_204" = "1462500684"
[HKCU\Software\Aas]
"a4_207" = "1484008047"
[HKCU\Software\Aas]
"a4_206" = "1476838926"
[HKCU\Software\Aas]
"a4_209" = "1498346289"
[HKCU\Software\Aas]
"a4_208" = "1491177168"
[HKCU\Software\Aas]
"a4_449" = "3218935329"
[HKCU\Software\Aas]
"a4_448" = "3211766208"
[HKCU\Software\Aas]
"a4_119" = "853125399"
[HKCU\Software\Aas]
"a4_118" = "845956278"
[HKCU\Software\Aas]
"a4_115" = "824448915"
[HKCU\Software\Aas]
"a4_114" = "817279794"
[HKCU\Software\Aas]
"a4_117" = "838787157"
[HKCU\Software\Aas]
"a4_116" = "831618036"
[HKCU\Software\Aas]
"a4_111" = "795772431"
[HKCU\Software\Aas]
"a4_110" = "788603310"
[HKCU\Software\Aas]
"a4_113" = "810110673"
[HKCU\Software\Aas]
"a4_112" = "802941552"
[HKCU\Software\Aas]
"a1_161" = "571153311"
[HKCU\Software\Aas]
"a1_160" = "39046938"
[HKCU\Software\Aas]
"a1_163" = "2381043597"
[HKCU\Software\Aas]
"a1_162" = "120963631"
[HKCU\Software\Aas]
"a1_165" = "3317776433"
[HKCU\Software\Aas]
"a1_164" = "3246699544"
[HKCU\Software\Aas]
"a1_167" = "3778233741"
[HKCU\Software\Aas]
"a1_166" = "2745087139"
[HKCU\Software\Aas]
"a1_169" = "2238344016"
[HKCU\Software\Aas]
"a1_168" = "973874324"
[HKCU\Software\Aas]
"a4_447" = "3204597087"
[HKCU\Software\Aas]
"a2_319" = "2286947653"
[HKCU\Software\Aas]
"a2_318" = "2279778457"
[HKCU\Software\Aas]
"a2_315" = "2258278998"
[HKCU\Software\Aas]
"a2_314" = "2251096182"
[HKCU\Software\Aas]
"a2_317" = "2272613506"
[HKCU\Software\Aas]
"a2_316" = "2265444547"
[HKCU\Software\Aas]
"a2_311" = "2229594448"
[HKCU\Software\Aas]
"a2_310" = "2222435479"
[HKCU\Software\Aas]
"a2_313" = "2243928898"
[HKCU\Software\Aas]
"a2_312" = "2236764131"
[HKCU\Software\Aas]
"a2_229" = "1641730217"
[HKCU\Software\Aas]
"a2_228" = "1634566083"
[HKCU\Software\Aas]
"a2_221" = "1584367386"
[HKCU\Software\Aas]
"a2_220" = "1577212161"
[HKCU\Software\Aas]
"a2_223" = "1598712348"
[HKCU\Software\Aas]
"a2_222" = "1591547817"
[HKCU\Software\Aas]
"a2_225" = "1613047778"
[HKCU\Software\Aas]
"a2_224" = "1605878032"
[HKCU\Software\Aas]
"a2_227" = "1627397634"
[HKCU\Software\Aas]
"a2_226" = "1620214227"
[HKCU\Software\Aas]
"a1_370" = "3281793636"
[HKCU\Software\Aas]
"a1_371" = "2426890022"
[HKCU\Software\Aas]
"a1_372" = "3579362746"
[HKCU\Software\Aas]
"a1_373" = "3106064652"
[HKCU\Software\Aas]
"a1_374" = "3641016045"
[HKCU\Software\Aas]
"a1_375" = "2368888143"
[HKCU\Software\Aas]
"a1_376" = "3078728469"
[HKCU\Software\Aas]
"a1_377" = "4176146055"
[HKCU\Software\Aas]
"a1_378" = "1251162405"
[HKCU\Software\Aas]
"a1_379" = "2243803168"
[HKCU\Software\Aas]
"a3_36" = "241268621"
[HKCU\Software\Aas]
"a3_37" = "248309804"
[HKCU\Software\Aas]
"a3_183" = "1328655230"
[HKCU\Software\Aas]
"a1_29" = "107388231"
[HKCU\Software\Aas]
"a1_28" = "627541159"
[HKCU\Software\Aas]
"a1_23" = "1384255400"
[HKCU\Software\Aas]
"a1_22" = "1910330082"
[HKCU\Software\Aas]
"a1_21" = "1068308396"
[HKCU\Software\Aas]
"a1_20" = "2156483935"
[HKCU\Software\Aas]
"a1_27" = "3427384930"
[HKCU\Software\Aas]
"a1_26" = "2808082026"
[HKCU\Software\Aas]
"a1_25" = "4170468043"
[HKCU\Software\Aas]
"a1_24" = "2983511639"
[HKCU\Software\Aas]
"a1_284" = "2806146498"
[HKCU\Software\Aas]
"a1_285" = "716170694"
[HKCU\Software\Aas]
"a1_286" = "3040572179"
[HKCU\Software\Aas]
"a1_287" = "3492306150"
[HKCU\Software\Aas]
"a1_280" = "3456964938"
[HKCU\Software\Aas]
"a1_281" = "2754133346"
[HKCU\Software\Aas]
"a1_282" = "1917568366"
[HKCU\Software\Aas]
"a1_283" = "249372949"
[HKCU\Software\Aas]
"a3_31" = "205278614"
[HKCU\Software\Aas]
"a1_288" = "1714444830"
[HKCU\Software\Aas]
"a1_289" = "3944119000"
[HKCU\Software\Aas]
"a3_32" = "212854281"
[HKCU\Software\Aas]
"a3_178" = "1292673371"
[HKCU\Software\Aas]
"a3_179" = "1300121082"
[HKCU\Software\Aas]
"a3_174" = "1264145351"
[HKCU\Software\Aas]
"a3_175" = "1271198822"
[HKCU\Software\Aas]
"a3_176" = "1245079705"
[HKCU\Software\Aas]
"a3_177" = "1252068664"
[HKCU\Software\Aas]
"a3_170" = "1235731011"
[HKCU\Software\Aas]
"a3_171" = "1209100002"
[HKCU\Software\Aas]
"a3_172" = "1216092933"
[HKCU\Software\Aas]
"a3_173" = "1223671716"
[HKCU\Software\Aas]
"a2_31" = "222244952"
[HKCU\Software\Aas]
"a2_30" = "215081910"
[HKCU\Software\Aas]
"a2_33" = "236580365"
[HKCU\Software\Aas]
"a2_32" = "229415338"
[HKCU\Software\Aas]
"a2_35" = "250914612"
[HKCU\Software\Aas]
"a2_34" = "243748609"
[HKCU\Software\Aas]
"a2_37" = "265264402"
[HKCU\Software\Aas]
"a2_36" = "258082637"
[HKCU\Software\Aas]
"a2_39" = "279600588"
[HKCU\Software\Aas]
"a2_38" = "272432138"
[HKCU\Software\Aas]
"a4_79" = "566360559"
[HKCU\Software\Aas]
"a4_78" = "559191438"
[HKCU\Software\Aas]
"a4_73" = "523345833"
[HKCU\Software\Aas]
"a4_72" = "516176712"
[HKCU\Software\Aas]
"a4_71" = "509007591"
[HKCU\Software\Aas]
"a4_70" = "501838470"
[HKCU\Software\Aas]
"a4_77" = "552022317"
[HKCU\Software\Aas]
"a4_76" = "544853196"
[HKCU\Software\Aas]
"a4_75" = "537684075"
[HKCU\Software\Aas]
"a4_74" = "530514954"
[HKCU\Software\Aas]
"a3_390" = "2812641775"
[HKCU\Software\Aas]
"a3_391" = "2786540046"
[HKCU\Software\Aas]
"a3_392" = "2793594529"
[HKCU\Software\Aas]
"a3_393" = "2800513728"
[HKCU\Software\Aas]
"a3_394" = "2841581411"
[HKCU\Software\Aas]
"a3_395" = "2848623490"
[HKCU\Software\Aas]
"a3_396" = "2821991461"
[HKCU\Software\Aas]
"a3_397" = "2829566020"
[HKCU\Software\Aas]
"a3_398" = "2870043879"
[HKCU\Software\Aas]
"a3_399" = "2877036806"
[HKCU\Software\Aas\695404737]
"7169121" = "205"
[HKCU\Software\Aas]
"a4_199" = "1426655079"
[HKCU\Software\Aas]
"a2_363" = "2602389404"
[HKCU\Software\Aas]
"a4_274" = "1964339154"
[HKCU\Software\Aas]
"a4_275" = "1971508275"
[HKCU\Software\Aas]
"a4_276" = "1978677396"
[HKCU\Software\Aas]
"a4_277" = "1985846517"
[HKCU\Software\Aas]
"a4_270" = "1935662670"
[HKCU\Software\Aas]
"a4_271" = "1942831791"
[HKCU\Software\Aas]
"a4_272" = "1950000912"
[HKCU\Software\Aas]
"a4_273" = "1957170033"
[HKCU\Software\Aas]
"a4_278" = "1993015638"
[HKCU\Software\Aas]
"a4_279" = "2000184759"
[HKCU\Software\Aas]
"a4_308" = "2208089268"
[HKCU\Software\Aas]
"a4_309" = "2215258389"
[HKCU\Software\Aas]
"a4_300" = "2150736300"
[HKCU\Software\Aas]
"a4_301" = "2157905421"
[HKCU\Software\Aas]
"a4_302" = "2165074542"
[HKCU\Software\Aas]
"a4_303" = "2172243663"
[HKCU\Software\Aas]
"a4_304" = "2179412784"
[HKCU\Software\Aas]
"a4_305" = "2186581905"
[HKCU\Software\Aas]
"a4_306" = "2193751026"
[HKCU\Software\Aas]
"a4_307" = "2200920147"
[HKCU\Software\Aas]
"a1_114" = "2405752965"
[HKCU\Software\Aas]
"a1_115" = "2354948557"
[HKCU\Software\Aas]
"a1_116" = "498348618"
[HKCU\Software\Aas]
"a1_117" = "482690716"
[HKCU\Software\Aas]
"a1_110" = "478439802"
[HKCU\Software\Aas]
"a1_111" = "779152219"
[HKCU\Software\Aas]
"a1_112" = "2452241866"
[HKCU\Software\Aas]
"a1_113" = "2147264621"
[HKCU\Software\Aas]
"a1_118" = "1023426539"
[HKCU\Software\Aas]
"a1_119" = "1222292809"
[HKCU\Software\Aas]
"a2_258" = "1849625327"
[HKCU\Software\Aas]
"a2_259" = "1856804793"
[HKCU\Software\Aas]
"a2_254" = "1820965027"
[HKCU\Software\Aas]
"a2_255" = "1828120316"
[HKCU\Software\Aas]
"a2_256" = "1835287754"
[HKCU\Software\Aas]
"a2_257" = "1842469526"
[HKCU\Software\Aas]
"a2_250" = "1792286101"
[HKCU\Software\Aas]
"a2_251" = "1799441228"
[HKCU\Software\Aas]
"a2_252" = "1806618924"
[HKCU\Software\Aas]
"a2_253" = "1813786522"
[HKCU\Software\Aas]
"a1_363" = "1013430841"
[HKCU\Software\Aas]
"a1_362" = "1523927365"
[HKCU\Software\Aas]
"a1_361" = "3191841936"
[HKCU\Software\Aas]
"a1_360" = "872683269"
[HKCU\Software\Aas]
"a1_367" = "4020768856"
[HKCU\Software\Aas]
"a1_366" = "3356993783"
[HKCU\Software\Aas]
"a1_365" = "1406740376"
[HKCU\Software\Aas]
"a1_364" = "888630709"
[HKCU\Software\Aas]
"a1_369" = "2590977412"
[HKCU\Software\Aas]
"a1_368" = "1276076126"
[HKCU\Software\Aas]
"a1_38" = "3940661980"
[HKCU\Software\Aas]
"a1_39" = "1517202203"
[HKCU\Software\Aas]
"a1_30" = "535316528"
[HKCU\Software\Aas]
"a1_31" = "7688934"
[HKCU\Software\Aas]
"a1_32" = "1352019021"
[HKCU\Software\Aas]
"a1_33" = "745235787"
[HKCU\Software\Aas]
"a1_34" = "2806638931"
[HKCU\Software\Aas]
"a1_35" = "4272451057"
[HKCU\Software\Aas]
"a1_36" = "1793427193"
[HKCU\Software\Aas]
"a1_37" = "1537792062"
[HKCU\Software\Aas]
"a1_297" = "4028173484"
[HKCU\Software\Aas]
"a1_296" = "975634079"
[HKCU\Software\Aas]
"a1_295" = "2444120697"
[HKCU\Software\Aas]
"a1_294" = "3041211707"
[HKCU\Software\Aas]
"a1_293" = "2056069470"
[HKCU\Software\Aas]
"a1_292" = "3698432969"
[HKCU\Software\Aas]
"a1_291" = "4249960472"
[HKCU\Software\Aas]
"a1_290" = "3535415740"
[HKCU\Software\Aas]
"a1_299" = "167857438"
[HKCU\Software\Aas]
"a1_298" = "2903700213"
[HKCU\Software\Aas]
"a4_286" = "2050368606"
[HKCU\Software\Aas]
"a2_108" = "774260351"
[HKCU\Software\Aas]
"a2_109" = "781428762"
[HKCU\Software\Aas]
"a2_100" = "716907018"
[HKCU\Software\Aas]
"a2_101" = "724077670"
[HKCU\Software\Aas]
"a2_102" = "731244581"
[HKCU\Software\Aas]
"a2_103" = "738425725"
[HKCU\Software\Aas]
"a2_104" = "745590904"
[HKCU\Software\Aas]
"a2_105" = "752762561"
[HKCU\Software\Aas]
"a2_106" = "759924549"
[HKCU\Software\Aas]
"a2_107" = "767094096"
[HKCU\Software\Aas]
"a3_169" = "1228156448"
[HKCU\Software\Aas]
"a3_168" = "1187689857"
[HKCU\Software\Aas]
"a3_167" = "1180635502"
[HKCU\Software\Aas]
"a3_166" = "1206680783"
[HKCU\Software\Aas]
"a3_165" = "1199757484"
[HKCU\Software\Aas]
"a3_164" = "1192698893"
[HKCU\Software\Aas]
"a3_163" = "1151697898"
[HKCU\Software\Aas]
"a3_162" = "1144713035"
[HKCU\Software\Aas]
"a3_161" = "1171213096"
[HKCU\Software\Aas]
"a3_160" = "1163777673"
[HKCU\Software\Aas]
"a2_28" = "200730487"
[HKCU\Software\Aas]
"a2_29" = "207897228"
[HKCU\Software\Aas]
"a2_26" = "186395867"
[HKCU\Software\Aas]
"a2_27" = "193560694"
[HKCU\Software\Aas]
"a2_24" = "172064287"
[HKCU\Software\Aas]
"a2_25" = "179229312"
[HKCU\Software\Aas]
"a2_22" = "157713820"
[HKCU\Software\Aas]
"a2_23" = "164893149"
[HKCU\Software\Aas]
"a2_20" = "143390287"
[HKCU\Software\Aas]
"a2_21" = "150542552"
[HKCU\Software\Aas]
"a4_68" = "487500228"
[HKCU\Software\Aas]
"a4_69" = "494669349"
[HKCU\Software\Aas]
"a4_60" = "430147260"
[HKCU\Software\Aas]
"a4_61" = "437316381"
[HKCU\Software\Aas]
"a4_62" = "444485502"
[HKCU\Software\Aas]
"a4_63" = "451654623"
[HKCU\Software\Aas]
"a4_64" = "458823744"
[HKCU\Software\Aas]
"a4_65" = "465992865"
[HKCU\Software\Aas]
"a4_66" = "473161986"
[HKCU\Software\Aas]
"a4_67" = "480331107"
[HKCU\Software\Aas]
"a2_7" = "50175686"
[HKCU\Software\Aas]
"a2_6" = "43024268"
[HKCU\Software\Aas]
"a2_5" = "35840143"
[HKCU\Software\Aas]
"a2_4" = "28675174"
[HKCU\Software\Aas]
"a2_3" = "21509036"
[HKCU\Software\Aas]
"a2_2" = "14341479"
[HKCU\Software\Aas]
"a2_1" = "7175294"
[HKCU\Software\Aas]
"a2_0" = "7269"
[HKCU\Software\Aas]
"a3_389" = "2805656908"
[HKCU\Software\Aas]
"a3_388" = "2765048109"
[HKCU\Software\Aas]
"a2_9" = "64526444"
[HKCU\Software\Aas]
"a2_8" = "57357637"
[HKCU\Software\Aas]
"a4_5" = "35845605"
[HKCU\Software\Aas]
"a4_4" = "28676484"
[HKCU\Software\Aas]
"a4_7" = "50183847"
[HKCU\Software\Aas]
"a4_6" = "43014726"
[HKCU\Software\Aas]
"a4_1" = "7169121"
[HKCU\Software\Aas]
"a4_0" = "0"
[HKCU\Software\Aas]
"a4_3" = "21507363"
[HKCU\Software\Aas]
"a4_2" = "14338242"
[HKCU\Software\Aas]
"a4_9" = "64522089"
[HKCU\Software\Aas]
"a4_8" = "57352968"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB F7 80 1A 48 64 B3 1A 0C 0D FF BA 10 EE B4 36"
[HKCU\Software\Aas]
"a4_267" = "1914155307"
[HKCU\Software\Aas]
"a4_266" = "1906986186"
[HKCU\Software\Aas]
"a4_265" = "1899817065"
[HKCU\Software\Aas]
"a4_264" = "1892647944"
[HKCU\Software\Aas]
"a4_263" = "1885478823"
[HKCU\Software\Aas]
"a4_262" = "1878309702"
[HKCU\Software\Aas]
"a4_261" = "1871140581"
[HKCU\Software\Aas]
"a4_260" = "1863971460"
[HKCU\Software\Aas\695404737]
"43014726" = "0900687474703A2F2F7777772E70726F647563746F7379616E63792E636F6D2E6D782F6C6F676F2E67696600687474703A2F2F7777772E736B6F70616E69652E73616E646F6D6965727A2E6F706F6B612E6F72672E706C2F696D616765732F6C6F676F2E67696600687474703A2F2F7461626C696768626F6F6B63656E7472652E636F6D2F627574746F6E2E67696600687474703A2F2F677572617967756C2E636F6D2F6C6F676F2E67696600687474703A2F2F6D6F7665697363657074726F2E636F6D2F666F746F732F627574746F6E2E67696600687474703A2F2F6D75746C7565762E636F6D2F6C6F676F2E67696600687474703A2F2F6763676964612E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F7061682D726164696F2E636F6D2F6C6F676F2E67696600687474703A2F2F676F6B6C65726C617374696B6B61706C616D612E636F6D2F6C6F676F2E676966"
[HKCU\Software\Aas]
"a4_269" = "1928493549"
[HKCU\Software\Aas]
"a4_268" = "1921324428"
[HKCU\Software\Aas]
"a4_319" = "2286949599"
[HKCU\Software\Aas]
"a4_318" = "2279780478"
[HKCU\Software\Aas]
"a4_313" = "2243934873"
[HKCU\Software\Aas]
"a4_312" = "2236765752"
[HKCU\Software\Aas]
"a4_311" = "2229596631"
[HKCU\Software\Aas]
"a4_310" = "2222427510"
[HKCU\Software\Aas]
"a4_317" = "2272611357"
[HKCU\Software\Aas]
"a4_316" = "2265442236"
[HKCU\Software\Aas]
"a4_315" = "2258273115"
[HKCU\Software\Aas]
"a4_314" = "2251103994"
[HKCU\Software\Aas]
"a3_130" = "915379051"
[HKCU\Software\Aas]
"a3_131" = "922302346"
[HKCU\Software\Aas]
"a3_132" = "962897965"
[HKCU\Software\Aas]
"a1_107" = "2159060017"
[HKCU\Software\Aas]
"a1_106" = "1481621301"
[HKCU\Software\Aas]
"a1_105" = "467952528"
[HKCU\Software\Aas]
"a1_104" = "341606437"
[HKCU\Software\Aas]
"a1_103" = "3075419057"
[HKCU\Software\Aas]
"a1_102" = "761135665"
[HKCU\Software\Aas]
"a1_101" = "165142547"
[HKCU\Software\Aas]
"a1_100" = "279580036"
[HKCU\Software\Aas]
"a3_134" = "943841519"
[HKCU\Software\Aas]
"a1_109" = "113674769"
[HKCU\Software\Aas]
"a1_62" = "592882477"
[HKCU\Software\Aas]
"a1_61" = "3522064321"
[HKCU\Software\Aas]
"a3_137" = "998890944"
[HKCU\Software\Aas]
"a3_145" = "1022800088"
[HKCU\Software\Aas]
"a3_144" = "1015749817"
[HKCU\Software\Aas]
"a3_147" = "1070844314"
[HKCU\Software\Aas]
"a3_146" = "1063277947"
[HKCU\Software\Aas]
"a3_141" = "1027810116"
[HKCU\Software\Aas]
"a3_140" = "986812197"
[HKCU\Software\Aas]
"a3_143" = "1008236550"
[HKCU\Software\Aas]
"a2_249" = "1785103102"
[HKCU\Software\Aas]
"a2_248" = "1777938351"
[HKCU\Software\Aas]
"a2_247" = "1770769500"
[HKCU\Software\Aas]
"a2_246" = "1763598913"
[HKCU\Software\Aas]
"a2_245" = "1756432845"
[HKCU\Software\Aas]
"a2_244" = "1749266851"
[HKCU\Software\Aas]
"a2_243" = "1742099700"
[HKCU\Software\Aas]
"a2_242" = "1734932094"
[HKCU\Software\Aas]
"a2_241" = "1727749762"
[HKCU\Software\Aas]
"a2_240" = "1720586199"
[HKCU\Software\Aas]
"a1_356" = "3285787873"
[HKCU\Software\Aas]
"a1_357" = "4072516634"
[HKCU\Software\Aas]
"a1_354" = "4113536234"
[HKCU\Software\Aas]
"a1_355" = "2338579519"
[HKCU\Software\Aas]
"a1_352" = "2351432511"
[HKCU\Software\Aas]
"a1_353" = "1491351692"
[HKCU\Software\Aas]
"a1_350" = "3601593296"
[HKCU\Software\Aas]
"a1_351" = "4076196515"
[HKCU\Software\Aas]
"a1_358" = "3108812402"
[HKCU\Software\Aas]
"a1_359" = "1615693650"
[HKCU\Software\Aas]
"a2_119" = "853117498"
[HKCU\Software\Aas]
"a2_118" = "845963644"
[HKCU\Software\Aas]
"a2_113" = "810118088"
[HKCU\Software\Aas]
"a2_112" = "802946991"
[HKCU\Software\Aas]
"a2_111" = "795777352"
[HKCU\Software\Aas]
"a2_110" = "788610507"
[HKCU\Software\Aas]
"a2_117" = "838794626"
[HKCU\Software\Aas]
"a2_116" = "831612324"
[HKCU\Software\Aas]
"a2_115" = "824491134"
[HKCU\Software\Aas]
"a2_114" = "817277877"
[HKCU\Software\Aas]
"a3_152" = "1106310065"
[HKCU\Software\Aas]
"a3_153" = "1080268752"
[HKCU\Software\Aas]
"a3_150" = "1092336383"
[HKCU\Software\Aas]
"a3_151" = "1099259678"
[HKCU\Software\Aas]
"a3_156" = "1135231285"
[HKCU\Software\Aas]
"a3_157" = "1108731220"
[HKCU\Software\Aas]
"a3_154" = "1087178867"
[HKCU\Software\Aas]
"a3_155" = "1127787666"
[HKCU\Software\Aas]
"a3_158" = "1115724279"
[HKCU\Software\Aas]
"a3_159" = "1123168790"
[HKCU\Software\Aas]
"a2_59" = "422984669"
[HKCU\Software\Aas]
"a2_58" = "415802797"
[HKCU\Software\Aas]
"a2_53" = "379966324"
[HKCU\Software\Aas]
"a2_52" = "372801264"
[HKCU\Software\Aas]
"a2_51" = "365617411"
[HKCU\Software\Aas]
"a2_50" = "358450839"
[HKCU\Software\Aas]
"a2_57" = "408636624"
[HKCU\Software\Aas]
"a2_56" = "401467676"
[HKCU\Software\Aas]
"a2_55" = "394301160"
[HKCU\Software\Aas]
"a2_54" = "387134896"
[HKCU\Software\Aas]
"a4_55" = "394301655"
[HKCU\Software\Aas]
"a4_54" = "387132534"
[HKCU\Software\Aas]
"a4_57" = "408639897"
[HKCU\Software\Aas]
"a4_56" = "401470776"
[HKCU\Software\Aas]
"a4_51" = "365625171"
[HKCU\Software\Aas]
"a4_50" = "358456050"
[HKCU\Software\Aas]
"a4_53" = "379963413"
[HKCU\Software\Aas]
"a4_52" = "372794292"
[HKCU\Software\Aas]
"a3_440" = "3171413137"
[HKCU\Software\Aas]
"a3_441" = "3178398000"
[HKCU\Software\Aas]
"a3_442" = "3185321299"
[HKCU\Software\Aas]
"a3_443" = "3159349746"
[HKCU\Software\Aas]
"a4_59" = "422978139"
[HKCU\Software\Aas]
"a4_58" = "415809018"
[HKCU\Software\Aas]
"a3_446" = "3214379735"
[HKCU\Software\Aas]
"a3_447" = "3187748726"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\Aas]
"a3_451" = "3249847498"
[HKCU\Software\Aas]
"a3_450" = "3242793131"
[HKCU\Software\Aas]
"a4_414" = "2968016094"
[HKCU\Software\Aas]
"a4_415" = "2975185215"
[HKCU\Software\Aas]
"a4_416" = "2982354336"
[HKCU\Software\Aas]
"a4_417" = "2989523457"
[HKCU\Software\Aas]
"a4_410" = "2939339610"
[HKCU\Software\Aas]
"a4_411" = "2946508731"
[HKCU\Software\Aas]
"a4_412" = "2953677852"
[HKCU\Software\Aas]
"a4_413" = "2960846973"
[HKCU\Software\Aas]
"a4_418" = "2996692578"
[HKCU\Software\Aas]
"a4_419" = "3003861699"
[HKCU\Software\Aas]
"a1_138" = "1529592637"
[HKCU\Software\Aas]
"a1_139" = "3105224725"
[HKCU\Software\Aas]
"a1_132" = "903333945"
[HKCU\Software\Aas]
"a1_133" = "1898413150"
[HKCU\Software\Aas]
"a1_130" = "1094852186"
[HKCU\Software\Aas]
"a1_131" = "4071000973"
[HKCU\Software\Aas]
"a1_136" = "1942975226"
[HKCU\Software\Aas]
"a1_137" = "881165396"
[HKCU\Software\Aas]
"a1_134" = "3010126778"
[HKCU\Software\Aas]
"a1_135" = "671549171"
[HKCU\Software\Aas]
"a4_328" = "2351471688"
[HKCU\Software\Aas]
"a4_329" = "2358640809"
[HKCU\Software\Aas]
"a4_326" = "2337133446"
[HKCU\Software\Aas]
"a4_327" = "2344302567"
[HKCU\Software\Aas]
"a4_324" = "2322795204"
[HKCU\Software\Aas]
"a4_325" = "2329964325"
[HKCU\Software\Aas]
"a4_322" = "2308456962"
[HKCU\Software\Aas]
"a4_323" = "2315626083"
[HKCU\Software\Aas]
"a4_320" = "2294118720"
[HKCU\Software\Aas]
"a4_321" = "2301287841"
[HKCU\Software\Aas]
"a4_258" = "1849633218"
[HKCU\Software\Aas]
"a4_259" = "1856802339"
[HKCU\Software\Aas]
"a4_252" = "1806618492"
[HKCU\Software\Aas]
"a4_253" = "1813787613"
[HKCU\Software\Aas]
"a4_250" = "1792280250"
[HKCU\Software\Aas]
"a4_251" = "1799449371"
[HKCU\Software\Aas]
"a4_256" = "1835294976"
[HKCU\Software\Aas]
"a4_257" = "1842464097"
[HKCU\Software\Aas]
"a4_254" = "1820956734"
[HKCU\Software\Aas]
"a4_255" = "1828125855"
[HKCU\Software\Aas]
"a1_349" = "2392452707"
[HKCU\Software\Aas]
"a1_348" = "709207142"
[HKCU\Software\Aas]
"a1_341" = "1955572347"
[HKCU\Software\Aas]
"a1_340" = "3407645200"
[HKCU\Software\Aas]
"a1_343" = "1871680052"
[HKCU\Software\Aas]
"a1_342" = "1553548504"
[HKCU\Software\Aas]
"a1_345" = "279619821"
[HKCU\Software\Aas]
"a1_344" = "4134116117"
[HKCU\Software\Aas]
"a1_347" = "2521076129"
[HKCU\Software\Aas]
"a1_346" = "2569228099"
[HKCU\Software\Aas]
"a2_272" = "1950006779"
[HKCU\Software\Aas]
"a2_273" = "1957171752"
[HKCU\Software\Aas]
"a2_270" = "1935657385"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a2_276" = "1978674686"
[HKCU\Software\Aas]
"a2_277" = "1985855270"
[HKCU\Software\Aas]
"a2_274" = "1964341069"
[HKCU\Software\Aas]
"a2_275" = "1971504078"
[HKCU\Software\Aas]
"a2_278" = "1993022188"
[HKCU\Software\Aas]
"a2_279" = "2000189688"
[HKCU\Software\Aas]
"a2_298" = "2136392749"
[HKCU\Software\Aas]
"a2_299" = "2143561155"
[HKCU\Software\Aas]
"a2_290" = "2079042780"
[HKCU\Software\Aas]
"a2_291" = "2086208220"
[HKCU\Software\Aas]
"a2_292" = "2093377717"
[HKCU\Software\Aas]
"a2_293" = "2100559208"
[HKCU\Software\Aas]
"a2_294" = "2107727369"
[HKCU\Software\Aas]
"a2_295" = "2114893689"
[HKCU\Software\Aas]
"a2_296" = "2122058117"
[HKCU\Software\Aas]
"a2_297" = "2129227238"
[HKCU\Software\Aas]
"a4_450" = "3226104450"
[HKCU\Software\Aas]
"a4_451" = "3233273571"
[HKCU\Software\Aas]
"a4_452" = "3240442692"
[HKCU\Software\Aas]
"a4_453" = "3247611813"
[HKCU\Software\Aas]
"a2_128" = "917645439"
[HKCU\Software\Aas]
"a2_129" = "924812262"
[HKCU\Software\Aas]
"a2_126" = "903299741"
[HKCU\Software\Aas]
"a2_127" = "910480272"
[HKCU\Software\Aas]
"a2_124" = "888979041"
[HKCU\Software\Aas]
"a2_125" = "896144544"
[HKCU\Software\Aas]
"a2_122" = "874627405"
[HKCU\Software\Aas]
"a2_123" = "881796040"
[HKCU\Software\Aas]
"a2_120" = "860303212"
[HKCU\Software\Aas]
"a2_121" = "867455732"
[HKCU\Software\Aas]
"a3_35" = "267899754"
[HKCU\Software\Aas]
"a1_12" = "3395118942"
[HKCU\Software\Aas]
"a1_13" = "1928608492"
[HKCU\Software\Aas]
"a1_10" = "3800206196"
[HKCU\Software\Aas]
"a1_11" = "775559957"
[HKCU\Software\Aas]
"a1_16" = "1639231078"
[HKCU\Software\Aas]
"a1_17" = "281495336"
[HKCU\Software\Aas]
"a1_14" = "219392279"
[HKCU\Software\Aas]
"a1_15" = "4118683539"
[HKCU\Software\Aas]
"a1_18" = "139768827"
[HKCU\Software\Aas]
"a1_19" = "3023255803"
[HKCU\Software\Aas]
"a3_149" = "1051199068"
[HKCU\Software\Aas]
"a3_148" = "1044210237"
[HKCU\Software\Aas]
"a2_48" = "344116547"
[HKCU\Software\Aas]
"a2_49" = "351285068"
[HKCU\Software\Aas]
"a2_40" = "286766344"
[HKCU\Software\Aas]
"a2_41" = "293931422"
[HKCU\Software\Aas]
"a2_42" = "301097117"
[HKCU\Software\Aas]
"a2_43" = "308274302"
[HKCU\Software\Aas]
"a2_44" = "315449727"
[HKCU\Software\Aas]
"a2_45" = "322615593"
[HKCU\Software\Aas]
"a2_46" = "329788580"
[HKCU\Software\Aas]
"a2_47" = "336952044"
[HKCU\Software\Aas]
"a4_42" = "301103082"
[HKCU\Software\Aas]
"a4_43" = "308272203"
[HKCU\Software\Aas]
"a4_40" = "286764840"
[HKCU\Software\Aas]
"a4_41" = "293933961"
[HKCU\Software\Aas]
"a4_46" = "329779566"
[HKCU\Software\Aas]
"a4_47" = "336948687"
[HKCU\Software\Aas]
"a4_44" = "315441324"
[HKCU\Software\Aas]
"a4_45" = "322610445"
[HKCU\Software\Aas]
"a3_453" = "3230791052"
[HKCU\Software\Aas]
"a3_452" = "3223736685"
[HKCU\Software\Aas]
"a4_48" = "344117808"
[HKCU\Software\Aas]
"a4_49" = "351286929"
[HKCU\Software\Aas]
"a3_455" = "3278766670"
[HKCU\Software\Aas]
"a3_454" = "3271781935"
[HKCU\Software\Aas]
"a3_18" = "112354555"
[HKCU\Software\Aas]
"a3_19" = "152901914"
[HKCU\Software\Aas]
"a3_14" = "83367783"
[HKCU\Software\Aas]
"a3_15" = "124488582"
[HKCU\Software\Aas]
"a3_16" = "131411001"
[HKCU\Software\Aas]
"a3_17" = "104906840"
[HKCU\Software\Aas]
"a3_10" = "88506851"
[HKCU\Software\Aas]
"a3_11" = "95435266"
[HKCU\Software\Aas]
"a3_12" = "69459621"
[HKCU\Software\Aas]
"a3_13" = "76378820"
[HKCU\Software\Aas]
"a3_240" = "1737322713"
[HKCU\Software\Aas]
"a3_248" = "1761236945"
[HKCU\Software\Aas]
"a2_172" = "1233086035"
[HKCU\Software\Aas]
"a4_454" = "3254780934"
[HKCU\Software\Aas]
"a4_407" = "2917832247"
[HKCU\Software\Aas]
"a4_406" = "2910663126"
[HKCU\Software\Aas]
"a4_405" = "2903494005"
[HKCU\Software\Aas]
"a4_404" = "2896324884"
[HKCU\Software\Aas]
"a4_403" = "2889155763"
[HKCU\Software\Aas]
"a4_402" = "2881986642"
[HKCU\Software\Aas]
"a4_401" = "2874817521"
[HKCU\Software\Aas]
"a4_400" = "2867648400"
[HKCU\Software\Aas]
"a4_409" = "2932170489"
[HKCU\Software\Aas]
"a4_408" = "2925001368"
[HKCU\Software\Aas]
"a1_129" = "2835962788"
[HKCU\Software\Aas]
"a1_128" = "1517241053"
[HKCU\Software\Aas]
"a1_125" = "3094994808"
[HKCU\Software\Aas]
"a1_124" = "409871237"
[HKCU\Software\Aas]
"a1_127" = "2782151370"
[HKCU\Software\Aas]
"a1_126" = "4225638912"
[HKCU\Software\Aas]
"a1_121" = "1541536471"
[HKCU\Software\Aas]
"a1_120" = "1211901116"
[HKCU\Software\Aas]
"a1_123" = "1444761121"
[HKCU\Software\Aas]
"a1_122" = "191536900"
[HKCU\Software\Aas]
"a4_331" = "2372979051"
[HKCU\Software\Aas]
"a4_330" = "2365809930"
[HKCU\Software\Aas]
"a4_333" = "2387317293"
[HKCU\Software\Aas]
"a4_332" = "2380148172"
[HKCU\Software\Aas]
"a4_335" = "2401655535"
[HKCU\Software\Aas]
"a4_334" = "2394486414"
[HKCU\Software\Aas]
"a4_337" = "2415993777"
[HKCU\Software\Aas]
"a4_336" = "2408824656"
[HKCU\Software\Aas]
"a4_339" = "2430332019"
[HKCU\Software\Aas]
"a4_338" = "2423162898"
[HKCU\Software\Aas]
"a4_249" = "1785111129"
[HKCU\Software\Aas]
"a4_248" = "1777942008"
[HKCU\Software\Aas]
"a4_245" = "1756434645"
[HKCU\Software\Aas]
"a4_244" = "1749265524"
[HKCU\Software\Aas]
"a4_247" = "1770772887"
[HKCU\Software\Aas]
"a4_246" = "1763603766"
[HKCU\Software\Aas]
"a4_241" = "1727758161"
[HKCU\Software\Aas]
"a4_240" = "1720589040"
[HKCU\Software\Aas]
"a4_243" = "1742096403"
[HKCU\Software\Aas]
"a4_242" = "1734927282"
[HKCU\Software\Aas]
"a1_338" = "3836194267"
[HKCU\Software\Aas]
"a1_339" = "273835050"
[HKCU\Software\Aas]
"a1_334" = "19941331"
[HKCU\Software\Aas]
"a1_335" = "3277662500"
[HKCU\Software\Aas]
"a1_336" = "1994143234"
[HKCU\Software\Aas]
"a1_337" = "1676908447"
[HKCU\Software\Aas]
"a1_330" = "4156339902"
[HKCU\Software\Aas]
"a1_331" = "2548325539"
[HKCU\Software\Aas]
"a1_332" = "2766221954"
[HKCU\Software\Aas]
"a1_333" = "2028713332"
[HKCU\Software\Aas]
"a3_30" = "231909751"
[HKCU\Software\Aas]
"a1_64" = "222507289"
[HKCU\Software\Aas]
"a2_265" = "1899808994"
[HKCU\Software\Aas]
"a2_264" = "1892651264"
[HKCU\Software\Aas]
"a2_267" = "1914147612"
[HKCU\Software\Aas]
"a2_266" = "1906988368"
[HKCU\Software\Aas]
"a2_261" = "1871138463"
[HKCU\Software\Aas]
"a2_260" = "1863969147"
[HKCU\Software\Aas]
"a2_263" = "1885472391"
[HKCU\Software\Aas]
"a2_262" = "1878301191"
[HKCU\Software\Aas]
"a2_269" = "1928488362"
[HKCU\Software\Aas]
"a2_268" = "1921332897"
[HKCU\Software\Aas]
"a2_289" = "2071873297"
[HKCU\Software\Aas]
"a2_288" = "2064710327"
[HKCU\Software\Aas]
"a2_283" = "2028855796"
[HKCU\Software\Aas]
"a2_282" = "2021689862"
[HKCU\Software\Aas]
"a2_281" = "2014525837"
[HKCU\Software\Aas]
"a2_280" = "2007357271"
[HKCU\Software\Aas]
"a2_287" = "2057539586"
[HKCU\Software\Aas]
"a2_286" = "2050372451"
[HKCU\Software\Aas]
"a2_285" = "2043192596"
[HKCU\Software\Aas]
"a2_284" = "2036026815"
[HKCU\Software\Aas]
"a4_446" = "3197427966"
[HKCU\Software\Aas]
"a1_240" = "2348720472"
[HKCU\Software\Aas]
"a1_241" = "1393044774"
[HKCU\Software\Aas]
"a1_242" = "945867949"
[HKCU\Software\Aas]
"a1_243" = "1201735130"
[HKCU\Software\Aas]
"a1_244" = "170912202"
[HKCU\Software\Aas]
"a1_245" = "2602977020"
[HKCU\Software\Aas]
"a1_246" = "1618788973"
[HKCU\Software\Aas]
"a1_247" = "1424685006"
[HKCU\Software\Aas]
"a1_248" = "2907754564"
[HKCU\Software\Aas]
"a1_249" = "3739665408"
[HKCU\Software\Aas]
"a4_445" = "3190258845"
[HKCU\Software\Aas]
"a2_131" = "939148716"
[HKCU\Software\Aas]
"a2_130" = "931979821"
[HKCU\Software\Aas]
"a2_133" = "953498112"
[HKCU\Software\Aas]
"a2_132" = "946330011"
[HKCU\Software\Aas]
"a2_135" = "967833095"
[HKCU\Software\Aas]
"a2_134" = "960664779"
[HKCU\Software\Aas]
"a2_137" = "982163563"
[HKCU\Software\Aas]
"a2_136" = "974996521"
[HKCU\Software\Aas]
"a2_139" = "996515196"
[HKCU\Software\Aas]
"a2_138" = "989347185"
[HKCU\Software\Aas]
"a2_79" = "566352495"
[HKCU\Software\Aas]
"a2_78" = "559188057"
[HKCU\Software\Aas]
"a3_288" = "2048100105"
[HKCU\Software\Aas]
"a3_289" = "2055027624"
[HKCU\Software\Aas]
"a3_184" = "1336102801"
[HKCU\Software\Aas]
"a3_282" = "2038692083"
[HKCU\Software\Aas]
"a3_283" = "2045680914"
[HKCU\Software\Aas]
"a3_280" = "1990631473"
[HKCU\Software\Aas]
"a3_281" = "2031109200"
[HKCU\Software\Aas]
"a3_286" = "2067091063"
[HKCU\Software\Aas]
"a3_287" = "2074141334"
[HKCU\Software\Aas]
"a3_284" = "2019045813"
[HKCU\Software\Aas]
"a3_285" = "2026624468"
[HKCU\Software\Aas]
"a3_198" = "1436076335"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\Aas]
"a3_196" = "1388556397"
[HKCU\Software\Aas]
"a3_197" = "1429034124"
[HKCU\Software\Aas]
"a3_194" = "1407548331"
[HKCU\Software\Aas]
"a3_195" = "1380982730"
[HKCU\Software\Aas]
"a3_192" = "1393042153"
[HKCU\Software\Aas]
"a3_193" = "1400620808"
[HKCU\Software\Aas]
"a3_190" = "1345525207"
[HKCU\Software\Aas]
"a3_191" = "1352568438"
[HKCU\Software\Aas]
"a3_29" = "224867540"
[HKCU\Software\Aas]
"a3_28" = "183865525"
[HKCU\Software\Aas]
"a3_21" = "167399900"
[HKCU\Software\Aas]
"a3_20" = "159956413"
[HKCU\Software\Aas]
"a3_23" = "148336286"
[HKCU\Software\Aas]
"a3_22" = "140888703"
[HKCU\Software\Aas]
"a3_25" = "195929936"
[HKCU\Software\Aas]
"a3_24" = "188875569"
[HKCU\Software\Aas]
"a3_27" = "176880658"
[HKCU\Software\Aas]
"a3_26" = "169827315"
[HKCU\Software\Aas]
"a4_438" = "3140074998"
[HKCU\Software\Aas]
"a4_439" = "3147244119"
[HKCU\Software\Aas]
"a4_432" = "3097060272"
[HKCU\Software\Aas]
"a4_433" = "3104229393"
[HKCU\Software\Aas]
"a4_430" = "3082722030"
[HKCU\Software\Aas]
"a4_431" = "3089891151"
[HKCU\Software\Aas]
"a4_436" = "3125736756"
[HKCU\Software\Aas]
"a4_437" = "3132905877"
[HKCU\Software\Aas]
"a4_434" = "3111398514"
[HKCU\Software\Aas]
"a4_435" = "3118567635"
[HKCU\Software\Aas]
"a4_344" = "2466177624"
[HKCU\Software\Aas]
"a4_345" = "2473346745"
[HKCU\Software\Aas]
"a4_346" = "2480515866"
[HKCU\Software\Aas]
"a4_347" = "2487684987"
[HKCU\Software\Aas]
"a4_340" = "2437501140"
[HKCU\Software\Aas]
"a4_341" = "2444670261"
[HKCU\Software\Aas]
"a4_342" = "2451839382"
[HKCU\Software\Aas]
"a4_343" = "2459008503"
[HKCU\Software\Aas]
"a4_348" = "2494854108"
[HKCU\Software\Aas]
"a4_349" = "2502023229"
[HKCU\Software\Aas]
"a3_383" = "2729068342"
[HKCU\Software\Aas]
"a3_382" = "2721620631"
[HKCU\Software\Aas]
"a3_381" = "2748124788"
[HKCU\Software\Aas]
"a2_454" = "3254822121"
[HKCU\Software\Aas]
"a3_380" = "2741212629"
[HKCU\Software\Aas]
"a2_452" = "3240436625"
[HKCU\Software\Aas]
"a2_453" = "3247604743"
[HKCU\Software\Aas]
"a2_450" = "3226100957"
[HKCU\Software\Aas]
"a2_451" = "3233269814"
[HKCU\Software\Aas]
"a3_387" = "2757612682"
[HKCU\Software\Aas]
"a3_386" = "2784112747"
[HKCU\Software\Aas]
"a3_385" = "2776670152"
[HKCU\Software\Aas]
"a3_384" = "2769681321"
[HKCU\Software\Aas]
"a1_329" = "2575674645"
[HKCU\Software\Aas]
"a1_328" = "971435928"
[HKCU\Software\Aas]
"a1_327" = "2545831346"
[HKCU\Software\Aas]
"a1_326" = "2874989893"
[HKCU\Software\Aas]
"a1_325" = "1984071920"
[HKCU\Software\Aas]
"a1_324" = "3724306154"
[HKCU\Software\Aas]
"a1_323" = "2391596341"
[HKCU\Software\Aas]
"a1_322" = "2113256049"
[HKCU\Software\Aas]
"a1_321" = "2341830895"
[HKCU\Software\Aas]
"a1_320" = "1473400348"
[HKCU\Software\Aas]
"a1_436" = "2192036461"
[HKCU\Software\Aas]
"a1_253" = "2606320512"
[HKCU\Software\Aas]
"a1_252" = "3259217705"
[HKCU\Software\Aas]
"a1_251" = "1078608962"
[HKCU\Software\Aas]
"a1_250" = "2797269254"
[HKCU\Software\Aas]
"a1_257" = "546057939"
[HKCU\Software\Aas]
"a1_256" = "1279826181"
[HKCU\Software\Aas]
"a1_255" = "2693517766"
[HKCU\Software\Aas]
"a1_254" = "1916331138"
[HKCU\Software\Aas]
"a1_259" = "2945428817"
[HKCU\Software\Aas]
"a1_258" = "3503683250"
[HKCU\Software\Aas]
"a2_144" = "1032350774"
[HKCU\Software\Aas]
"a2_145" = "1039530353"
[HKCU\Software\Aas]
"a2_146" = "1046684170"
[HKCU\Software\Aas]
"a2_147" = "1053867184"
[HKCU\Software\Aas]
"a2_140" = "1003680284"
[HKCU\Software\Aas]
"a2_141" = "1010851406"
[HKCU\Software\Aas]
"a2_142" = "1018016445"
[HKCU\Software\Aas]
"a2_143" = "1025182708"
[HKCU\Software\Aas]
"a2_68" = "487505509"
[HKCU\Software\Aas]
"a2_69" = "494672374"
[HKCU\Software\Aas]
"a2_148" = "1061035987"
[HKCU\Software\Aas]
"a2_149" = "1068200782"
[HKCU\Software\Aas]
"a4_455" = "3261950055"
[HKCU\Software\Aas]
"a3_299" = "2126993250"
[HKCU\Software\Aas]
"a3_298" = "2119545539"
[HKCU\Software\Aas]
"a3_295" = "2131608046"
[HKCU\Software\Aas]
"a3_294" = "2091003215"
[HKCU\Software\Aas]
"a3_297" = "2146049696"
[HKCU\Software\Aas]
"a3_296" = "2139060737"
[HKCU\Software\Aas]
"a3_291" = "2103079018"
[HKCU\Software\Aas]
"a3_290" = "2062081995"
[HKCU\Software\Aas]
"a3_293" = "2083555628"
[HKCU\Software\Aas]
"a3_292" = "2110067853"
[HKCU\Software\Aas]
"a3_181" = "1280611004"
[HKCU\Software\Aas]
"a3_180" = "1307180573"
[HKCU\Software\Aas]
"a3_34" = "260325067"
[HKCU\Software\Aas]
"a3_182" = "1288058591"
[HKCU\Software\Aas]
"a3_185" = "1309597744"
[HKCU\Software\Aas]
"a3_33" = "253401768"
[HKCU\Software\Aas]
"a3_187" = "1324038386"
[HKCU\Software\Aas]
"a3_186" = "1316586579"
[HKCU\Software\Aas]
"a3_189" = "1371566516"
[HKCU\Software\Aas]
"a3_188" = "1364647189"
[HKCU\Software\Aas]
"a3_38" = "289377359"
[HKCU\Software\Aas]
"a3_39" = "296296686"
[HKCU\Software\Aas]
"a4_282" = "2021692122"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a2_151" = "1082532720"
[HKCU\Software\Aas]
"a2_150" = "1075366350"
[HKCU\Software\Aas]
"a2_271" = "1942838157"
[HKCU\Software\Aas]
"a2_159" = "1139884880"
[HKCU\Software\Aas]
"a2_158" = "1132712081"
[HKCU\Software\Aas]
"a3_80" = "590099577"
[HKCU\Software\Aas]
"a4_429" = "3075552909"
[HKCU\Software\Aas]
"a4_428" = "3068383788"
[HKCU\Software\Aas]
"a4_425" = "3046876425"
[HKCU\Software\Aas]
"a4_424" = "3039707304"
[HKCU\Software\Aas]
"a4_427" = "3061214667"
[HKCU\Software\Aas]
"a4_426" = "3054045546"
[HKCU\Software\Aas]
"a4_421" = "3018199941"
[HKCU\Software\Aas]
"a4_420" = "3011030820"
[HKCU\Software\Aas]
"a4_423" = "3032538183"
[HKCU\Software\Aas]
"a4_422" = "3025369062"
[HKCU\Software\Aas]
"a4_357" = "2559376197"
[HKCU\Software\Aas]
"a4_356" = "2552207076"
[HKCU\Software\Aas]
"a4_355" = "2545037955"
[HKCU\Software\Aas]
"a4_354" = "2537868834"
[HKCU\Software\Aas]
"a4_353" = "2530699713"
[HKCU\Software\Aas]
"a4_352" = "2523530592"
[HKCU\Software\Aas]
"a4_351" = "2516361471"
[HKCU\Software\Aas]
"a4_350" = "2509192350"
[HKCU\Software\Aas]
"a4_359" = "2573714439"
[HKCU\Software\Aas]
"a4_358" = "2566545318"
[HKCU\Software\Aas\695404737]
"50183847" = "5A98901305C54DC9BEA29B63F1F7FD191B87C97BDB2C6FEF22EBFB5686FEAF07B3DE577A87A4A01536887C3E03BC59CCA853CE7415A2526F2588A3301D3C37126B668EC3974B05D5E34FE1F509D9E79F9AC1A4BB5FE1AE7769D3EBF5625FB6C94ADCE37D638A1D06660931AC677E1B086FD7ABD392881D0B356E0DB6B8FE332C"
[HKCU\Software\Aas]
"a1_312" = "3206061308"
[HKCU\Software\Aas]
"a1_313" = "77420533"
[HKCU\Software\Aas]
"a1_310" = "1202135242"
[HKCU\Software\Aas]
"a1_311" = "1350912771"
[HKCU\Software\Aas]
"a1_316" = "920663552"
[HKCU\Software\Aas]
"a1_317" = "1362069062"
[HKCU\Software\Aas]
"a1_314" = "2857856393"
[HKCU\Software\Aas]
"a1_315" = "2708600070"
[HKCU\Software\Aas]
"a1_318" = "2305248551"
[HKCU\Software\Aas]
"a1_319" = "825782179"
[HKCU\Software\Aas]
"a2_449" = "3218937172"
[HKCU\Software\Aas]
"a2_448" = "3211768796"
[HKCU\Software\Aas]
"a2_441" = "3161584558"
[HKCU\Software\Aas]
"a2_440" = "3154419114"
[HKCU\Software\Aas]
"a2_443" = "3175913154"
[HKCU\Software\Aas]
"a2_442" = "3168752336"
[HKCU\Software\Aas]
"a2_445" = "3190252470"
[HKCU\Software\Aas]
"a2_444" = "3183084027"
[HKCU\Software\Aas]
"a2_447" = "3204602591"
[HKCU\Software\Aas]
"a2_446" = "3197433669"
[HKCU\Software\Aas]
"a1_266" = "2332322195"
[HKCU\Software\Aas]
"a1_267" = "3608351057"
[HKCU\Software\Aas]
"a1_264" = "3923036485"
[HKCU\Software\Aas]
"a1_265" = "4061603120"
[HKCU\Software\Aas]
"a1_262" = "3757314364"
[HKCU\Software\Aas]
"a1_263" = "2064289135"
[HKCU\Software\Aas]
"a1_260" = "4127441834"
[HKCU\Software\Aas]
"a1_261" = "3491018167"
[HKCU\Software\Aas]
"a1_268" = "3502300407"
[HKCU\Software\Aas]
"a1_269" = "694589366"
[HKCU\Software\Aas]
"a2_157" = "1125558967"
[HKCU\Software\Aas]
"a2_156" = "1118385339"
[HKCU\Software\Aas]
"a2_155" = "1111219748"
[HKCU\Software\Aas]
"a2_154" = "1104036057"
[HKCU\Software\Aas]
"a2_153" = "1096869650"
[HKCU\Software\Aas]
"a2_152" = "1089701832"
[HKCU\Software\Aas]
"a2_99" = "709742453"
[HKCU\Software\Aas]
"a2_98" = "702577580"
[HKCU\Software\Aas]
"a2_97" = "695407597"
[HKCU\Software\Aas]
"a2_96" = "688239455"
[HKCU\Software\Aas]
"a2_95" = "681056821"
[HKCU\Software\Aas]
"a2_94" = "673890429"
[HKCU\Software\Aas]
"a2_93" = "666724706"
[HKCU\Software\Aas]
"a2_92" = "659557050"
[HKCU\Software\Aas]
"a2_91" = "652380792"
[HKCU\Software\Aas]
"a2_90" = "645225524"
[HKCU\Software\Aas]
"a3_260" = "1847236781"
[HKCU\Software\Aas]
"a3_261" = "1854160076"
[HKCU\Software\Aas]
"a3_262" = "1861734767"
[HKCU\Software\Aas]
"a3_263" = "1902212494"
[HKCU\Software\Aas]
"a3_264" = "1909255713"
[HKCU\Software\Aas]
"a3_265" = "1883210304"
[HKCU\Software\Aas]
"a3_266" = "1890133731"
[HKCU\Software\Aas]
"a3_267" = "1930746626"
[HKCU\Software\Aas]
"a3_268" = "1938194341"
[HKCU\Software\Aas]
"a3_269" = "1945179076"
[HKCU\Software\Aas]
"a3_404" = "2913010493"
[HKCU\Software\Aas]
"a3_405" = "2886510428"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a3_43" = "324843106"
[HKCU\Software\Aas]
"a3_42" = "284237251"
[HKCU\Software\Aas]
"a3_41" = "277248416"
[HKCU\Software\Aas]
"a3_40" = "269796609"
[HKCU\Software\Aas]
"a3_47" = "353765350"
[HKCU\Software\Aas]
"a3_46" = "313221959"
[HKCU\Software\Aas]
"a3_45" = "305778468"
[HKCU\Software\Aas]
"a3_44" = "332278405"
[HKCU\Software\Aas]
"a3_49" = "368270520"
[HKCU\Software\Aas]
"a3_48" = "360822809"
[HKCU\Software\Aas]
"a4_99" = "709742979"
[HKCU\Software\Aas]
"a4_98" = "702573858"
[HKCU\Software\Aas]
"a3_406" = "2893962239"
[HKCU\Software\Aas]
"a3_407" = "2901015582"
[HKCU\Software\Aas]
"a3_400" = "2884615609"
[HKCU\Software\Aas]
"a3_401" = "2857980376"
[HKCU\Software\Aas]
"a3_402" = "2865023611"
[HKCU\Software\Aas]
"a3_403" = "2906025626"
[HKCU\Software\Aas]
"a4_91" = "652390011"
[HKCU\Software\Aas]
"a4_90" = "645220890"
[HKCU\Software\Aas]
"a4_93" = "666728253"
[HKCU\Software\Aas]
"a4_92" = "659559132"
[HKCU\Software\Aas]
"a4_95" = "681066495"
[HKCU\Software\Aas]
"a4_94" = "673897374"
[HKCU\Software\Aas]
"a4_97" = "695404737"
[HKCU\Software\Aas]
"a4_96" = "688235616"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a1_448" = "847063957"
[HKCU\Software\Aas]
"a1_449" = "3724422664"
[HKCU\Software\Aas]
"a1_446" = "2001489218"
[HKCU\Software\Aas]
"a3_408" = "2941554865"
[HKCU\Software\Aas]
"a1_444" = "560110357"
[HKCU\Software\Aas]
"a1_445" = "3927512779"
[HKCU\Software\Aas]
"a1_442" = "1356404284"
[HKCU\Software\Aas]
"a1_443" = "2408398866"
[HKCU\Software\Aas]
"a1_440" = "882531299"
[HKCU\Software\Aas]
"a3_409" = "2949002448"
[HKCU\Software\Aas]
"a3_318" = "2262948439"
[HKCU\Software\Aas]
"a3_319" = "2303950582"
[HKCU\Software\Aas]
"a3_310" = "2239031135"
[HKCU\Software\Aas]
"a3_311" = "2246548478"
[HKCU\Software\Aas]
"a3_312" = "2219916305"
[HKCU\Software\Aas]
"a3_313" = "2226966704"
[HKCU\Software\Aas]
"a3_314" = "2267968723"
[HKCU\Software\Aas]
"a3_315" = "2275010930"
[HKCU\Software\Aas]
"a3_316" = "2248445333"
[HKCU\Software\Aas]
"a3_317" = "2255889972"
[HKCU\Software\Aas]
"a1_447" = "334531697"
[HKCU\Software\Aas]
"a1_441" = "2854196389"
[HKCU\Software\Aas\695404737]
"35845605" = "349"
[HKCU\Software\Aas]
"a4_182" = "1304780022"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_180" = "1290441780"
[HKCU\Software\Aas]
"a4_181" = "1297610901"
[HKCU\Software\Aas]
"a4_186" = "1333456506"
[HKCU\Software\Aas]
"a4_187" = "1340625627"
[HKCU\Software\Aas]
"a4_184" = "1319118264"
[HKCU\Software\Aas]
"a4_185" = "1326287385"
[HKCU\Software\Aas]
"a4_188" = "1347794748"
[HKCU\Software\Aas]
"a4_189" = "1354963869"
[HKCU\Software\Aas]
"a4_168" = "1204412328"
[HKCU\Software\Aas]
"a1_194" = "513762033"
[HKCU\Software\Aas]
"a1_195" = "3324212568"
[HKCU\Software\Aas]
"a4_160" = "1147059360"
[HKCU\Software\Aas]
"a4_161" = "1154228481"
[HKCU\Software\Aas]
"a4_162" = "1161397602"
[HKCU\Software\Aas]
"a4_163" = "1168566723"
[HKCU\Software\Aas]
"a4_164" = "1175735844"
[HKCU\Software\Aas]
"a4_165" = "1182904965"
[HKCU\Software\Aas]
"a4_166" = "1190074086"
[HKCU\Software\Aas]
"a4_167" = "1197243207"
[HKCU\Software\Aas]
"a4_296" = "2122059816"
[HKCU\Software\Aas]
"a4_297" = "2129228937"
[HKCU\Software\Aas]
"a4_294" = "2107721574"
[HKCU\Software\Aas]
"a4_295" = "2114890695"
[HKCU\Software\Aas]
"a4_292" = "2093383332"
[HKCU\Software\Aas]
"a4_293" = "2100552453"
[HKCU\Software\Aas]
"a4_290" = "2079045090"
[HKCU\Software\Aas]
"a4_291" = "2086214211"
[HKCU\Software\Aas]
"a4_142" = "1018015182"
[HKCU\Software\Aas]
"a4_298" = "2136398058"
[HKCU\Software\Aas]
"a4_299" = "2143567179"
[HKCU\Software\Aas]
"a1_192" = "3211019134"
[HKCU\Software\Aas]
"a1_193" = "2582532216"
[HKCU\Software\Aas]
"a4_368" = "2638236528"
[HKCU\Software\Aas]
"a4_369" = "2645405649"
[HKCU\Software\Aas]
"a4_362" = "2595221802"
[HKCU\Software\Aas]
"a4_363" = "2602390923"
[HKCU\Software\Aas]
"a4_360" = "2580883560"
[HKCU\Software\Aas]
"a4_361" = "2588052681"
[HKCU\Software\Aas]
"a4_366" = "2623898286"
[HKCU\Software\Aas]
"a4_367" = "2631067407"
[HKCU\Software\Aas]
"a4_364" = "2609560044"
[HKCU\Software\Aas]
"a4_365" = "2616729165"
[HKCU\Software\Aas]
"a1_305" = "405536447"
[HKCU\Software\Aas]
"a1_304" = "3428503399"
[HKCU\Software\Aas]
"a1_307" = "1619432423"
[HKCU\Software\Aas]
"a1_306" = "2417071689"
[HKCU\Software\Aas]
"a1_301" = "1782926527"
[HKCU\Software\Aas]
"a1_300" = "715061905"
[HKCU\Software\Aas]
"a1_303" = "2868058739"
[HKCU\Software\Aas]
"a1_302" = "2062853983"
[HKCU\Software\Aas]
"a1_309" = "4166275929"
[HKCU\Software\Aas]
"a1_308" = "2595099290"
[HKCU\Software\Aas]
"a2_438" = "3140069434"
[HKCU\Software\Aas]
"a2_439" = "3147249905"
[HKCU\Software\Aas]
"a2_434" = "3111401408"
[HKCU\Software\Aas]
"a2_435" = "3118565875"
[HKCU\Software\Aas]
"a2_436" = "3125735119"
[HKCU\Software\Aas]
"a2_437" = "3132899469"
[HKCU\Software\Aas]
"a2_430" = "3082729923"
[HKCU\Software\Aas]
"a2_431" = "3089885048"
[HKCU\Software\Aas]
"a2_432" = "3097067195"
[HKCU\Software\Aas]
"a2_433" = "3104232694"
[HKCU\Software\Aas]
"a1_279" = "2301953001"
[HKCU\Software\Aas]
"a1_278" = "1692787351"
[HKCU\Software\Aas]
"a1_271" = "1661106225"
[HKCU\Software\Aas]
"a1_270" = "3288815762"
[HKCU\Software\Aas]
"a1_273" = "2743461606"
[HKCU\Software\Aas]
"a1_272" = "4094938438"
[HKCU\Software\Aas]
"a1_275" = "3831106918"
[HKCU\Software\Aas]
"a1_274" = "53050479"
[HKCU\Software\Aas]
"a1_277" = "803847732"
[HKCU\Software\Aas]
"a1_276" = "2062775104"
[HKCU\Software\Aas]
"a2_382" = "2738612841"
[HKCU\Software\Aas]
"a2_383" = "2745774894"
[HKCU\Software\Aas]
"a2_380" = "2724260259"
[HKCU\Software\Aas]
"a2_381" = "2731438673"
[HKCU\Software\Aas]
"a2_386" = "2767274349"
[HKCU\Software\Aas]
"a2_387" = "2774442582"
[HKCU\Software\Aas]
"a2_384" = "2752941701"
[HKCU\Software\Aas]
"a2_385" = "2760109249"
[HKCU\Software\Aas]
"a2_388" = "2781626009"
[HKCU\Software\Aas]
"a2_389" = "2788794046"
[HKCU\Software\Aas]
"a2_368" = "2638239654"
[HKCU\Software\Aas]
"a2_369" = "2645407987"
[HKCU\Software\Aas]
"a2_88" = "630889651"
[HKCU\Software\Aas]
"a2_89" = "638043390"
[HKCU\Software\Aas]
"a2_84" = "602206523"
[HKCU\Software\Aas]
"a2_85" = "609370429"
[HKCU\Software\Aas]
"a2_86" = "616542007"
[HKCU\Software\Aas]
"a2_87" = "623722028"
[HKCU\Software\Aas]
"a2_80" = "573538147"
[HKCU\Software\Aas]
"a2_81" = "580708219"
[HKCU\Software\Aas]
"a2_82" = "587870911"
[HKCU\Software\Aas]
"a2_83" = "595040022"
[HKCU\Software\Aas]
"a3_273" = "1974165848"
[HKCU\Software\Aas]
"a3_272" = "1966722361"
[HKCU\Software\Aas]
"a3_271" = "1926113414"
[HKCU\Software\Aas]
"a3_270" = "1918678119"
[HKCU\Software\Aas]
"a3_277" = "2002712284"
[HKCU\Software\Aas]
"a3_276" = "1962103485"
[HKCU\Software\Aas]
"a3_275" = "1954659866"
[HKCU\Software\Aas]
"a3_274" = "1947600379"
[HKCU\Software\Aas]
"a2_162" = "1161402863"
[HKCU\Software\Aas]
"a2_163" = "1168570340"
[HKCU\Software\Aas]
"a3_279" = "1983582110"
[HKCU\Software\Aas]
"a3_278" = "2009623423"
[HKCU\Software\Aas]
"a2_166" = "1190071643"
[HKCU\Software\Aas]
"a2_167" = "1197239341"
[HKCU\Software\Aas]
"a2_164" = "1175736361"
[HKCU\Software\Aas]
"a2_165" = "1182903602"
[HKCU\Software\Aas]
"a3_50" = "341766363"
[HKCU\Software\Aas]
"a3_51" = "348755322"
[HKCU\Software\Aas]
"a3_52" = "389745053"
[HKCU\Software\Aas]
"a3_53" = "396796476"
[HKCU\Software\Aas]
"a3_54" = "370165343"
[HKCU\Software\Aas]
"a3_55" = "377748222"
[HKCU\Software\Aas]
"a3_56" = "384737041"
[HKCU\Software\Aas]
"a3_57" = "425210800"
[HKCU\Software\Aas]
"a3_58" = "432789459"
[HKCU\Software\Aas]
"a3_59" = "406145138"
[HKCU\Software\Aas]
"a3_417" = "3006523432"
[HKCU\Software\Aas]
"a3_416" = "2965403529"
[HKCU\Software\Aas]
"a3_415" = "2958480150"
[HKCU\Software\Aas]
"a3_414" = "2984984311"
[HKCU\Software\Aas]
"a3_413" = "2977536596"
[HKCU\Software\Aas]
"a3_412" = "2970543669"
[HKCU\Software\Aas]
"a3_411" = "2929937810"
[HKCU\Software\Aas]
"a3_410" = "2922490227"
[HKCU\Software\Aas]
"a3_419" = "2986877162"
[HKCU\Software\Aas]
"a3_418" = "3013512267"
[HKCU\Software\Aas]
"a1_451" = "193531579"
[HKCU\Software\Aas]
"a1_450" = "34561452"
[HKCU\Software\Aas]
"a1_453" = "1985733401"
[HKCU\Software\Aas]
"a1_452" = "3367047965"
[HKCU\Software\Aas]
"a1_455" = "867944232"
[HKCU\Software\Aas]
"a1_454" = "535140440"
[HKCU\Software\Aas]
"a1_456" = "3534667409"
[HKCU\Software\Aas]
"a3_309" = "2231976764"
[HKCU\Software\Aas]
"a3_308" = "2191503005"
[HKCU\Software\Aas]
"a3_303" = "2155521254"
[HKCU\Software\Aas]
"a3_302" = "2148466759"
[HKCU\Software\Aas]
"a3_301" = "2174512164"
[HKCU\Software\Aas]
"a3_300" = "2167589765"
[HKCU\Software\Aas]
"a3_307" = "2183924346"
[HKCU\Software\Aas]
"a3_306" = "2210566619"
[HKCU\Software\Aas]
"a3_305" = "2203581880"
[HKCU\Software\Aas]
"a3_304" = "2162448665"
[HKCU\Software\Aas]
"a4_86" = "616544406"
[HKCU\Software\Aas]
"a4_87" = "623713527"
[HKCU\Software\Aas]
"a4_84" = "602206164"
[HKCU\Software\Aas]
"a4_85" = "609375285"
[HKCU\Software\Aas]
"a4_82" = "587867922"
[HKCU\Software\Aas]
"a4_83" = "595037043"
[HKCU\Software\Aas]
"a4_80" = "573529680"
[HKCU\Software\Aas]
"a4_81" = "580698801"
[HKCU\Software\Aas]
"a4_88" = "630882648"
[HKCU\Software\Aas]
"a4_89" = "638051769"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\Aas]
"a4_387" = "2774449827"
[HKCU\Software\Aas]
"a2_75" = "537686526"
[HKCU\Software\Aas]
"a2_74" = "530521055"
[HKCU\Software\Aas]
"a2_77" = "552020696"
[HKCU\Software\Aas]
"a2_76" = "544855855"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Aas]
"a2_71" = "509001892"
[HKCU\Software\Aas]
"a2_70" = "501834774"
[HKCU\Software\Aas]
"a2_73" = "523352975"
[HKCU\Software\Aas]
"a2_72" = "516172907"
[HKCU\Software\Aas]
"a4_195" = "1397978595"
[HKCU\Software\Aas]
"a4_194" = "1390809474"
[HKCU\Software\Aas]
"a4_197" = "1412316837"
[HKCU\Software\Aas]
"a4_196" = "1405147716"
[HKCU\Software\Aas]
"a4_191" = "1369302111"
[HKCU\Software\Aas]
"a4_190" = "1362132990"
[HKCU\Software\Aas]
"a4_193" = "1383640353"
[HKCU\Software\Aas]
"a4_192" = "1376471232"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_198" = "1419485958"
[HKCU\Software\Aas]
"a4_179" = "1283272659"
[HKCU\Software\Aas]
"a4_178" = "1276103538"
[HKCU\Software\Aas]
"a4_173" = "1240257933"
[HKCU\Software\Aas]
"a4_172" = "1233088812"
[HKCU\Software\Aas]
"a4_171" = "1225919691"
[HKCU\Software\Aas]
"a4_170" = "1218750570"
[HKCU\Software\Aas]
"a4_177" = "1268934417"
[HKCU\Software\Aas]
"a4_176" = "1261765296"
[HKCU\Software\Aas]
"a4_175" = "1254596175"
[HKCU\Software\Aas]
"a4_174" = "1247427054"
[HKCU\Software\Aas]
"a3_123" = "898388146"
[HKCU\Software\Aas]
"a3_122" = "891468819"
[HKCU\Software\Aas]
"a3_121" = "850861040"
[HKCU\Software\Aas]
"a4_289" = "2071875969"
[HKCU\Software\Aas]
"a4_288" = "2064706848"
[HKCU\Software\Aas]
"a3_120" = "843343697"
[HKCU\Software\Aas]
"a4_281" = "2014523001"
[HKCU\Software\Aas]
"a4_280" = "2007353880"
[HKCU\Software\Aas]
"a4_283" = "2028861243"
[HKCU\Software\Aas]
"a1_108" = "125706683"
[HKCU\Software\Aas]
"a4_285" = "2043199485"
[HKCU\Software\Aas]
"a4_284" = "2036030364"
[HKCU\Software\Aas]
"a4_287" = "2057537727"
[HKCU\Software\Aas]
"a3_126" = "886312343"
[HKCU\Software\Aas]
"a3_125" = "879323508"
[HKCU\Software\Aas]
"a3_124" = "905966805"
[HKCU\Software\Aas]
"a4_379" = "2717096859"
[HKCU\Software\Aas]
"a4_378" = "2709927738"
[HKCU\Software\Aas]
"a4_375" = "2688420375"
[HKCU\Software\Aas]
"a4_374" = "2681251254"
[HKCU\Software\Aas]
"a4_377" = "2702758617"
[HKCU\Software\Aas]
"a4_376" = "2695589496"
[HKCU\Software\Aas]
"a4_371" = "2659743891"
[HKCU\Software\Aas]
"a4_370" = "2652574770"
[HKCU\Software\Aas]
"a4_373" = "2674082133"
[HKCU\Software\Aas]
"a4_372" = "2666913012"
[HKCU\Software\Aas]
"a1_437" = "1044763342"
[HKCU\Software\Aas]
"a2_429" = "3075547446"
[HKCU\Software\Aas]
"a2_428" = "3068381451"
[HKCU\Software\Aas]
"a2_427" = "3061204993"
[HKCU\Software\Aas]
"a2_426" = "3054048539"
[HKCU\Software\Aas]
"a2_425" = "3046882843"
[HKCU\Software\Aas]
"a2_424" = "3039715503"
[HKCU\Software\Aas]
"a2_423" = "3032532264"
[HKCU\Software\Aas]
"a2_422" = "3025365433"
[HKCU\Software\Aas]
"a2_421" = "3018196719"
[HKCU\Software\Aas]
"a2_420" = "3011032324"
[HKCU\Software\Aas]
"a1_208" = "255849195"
[HKCU\Software\Aas]
"a1_209" = "2661058123"
[HKCU\Software\Aas]
"a1_204" = "3437828104"
[HKCU\Software\Aas]
"a1_205" = "1049107168"
[HKCU\Software\Aas]
"a1_206" = "1089796178"
[HKCU\Software\Aas]
"a1_207" = "3874353621"
[HKCU\Software\Aas]
"a1_200" = "652075670"
[HKCU\Software\Aas]
"a1_201" = "853137230"
[HKCU\Software\Aas]
"a1_202" = "1716144325"
[HKCU\Software\Aas]
"a1_203" = "1340746392"
[HKCU\Software\Aas]
"a2_395" = "2831794796"
[HKCU\Software\Aas]
"a2_394" = "2824626400"
[HKCU\Software\Aas]
"a2_397" = "2846143441"
[HKCU\Software\Aas]
"a2_396" = "2838978031"
[HKCU\Software\Aas]
"a2_391" = "2803125690"
[HKCU\Software\Aas]
"a2_390" = "2795958689"
[HKCU\Software\Aas]
"a2_393" = "2817458767"
[HKCU\Software\Aas]
"a2_392" = "2810293341"
[HKCU\Software\Aas]
"a2_399" = "2860475585"
[HKCU\Software\Aas]
"a2_398" = "2853311593"
[HKCU\Software\Aas]
"a2_379" = "2717104310"
[HKCU\Software\Aas]
"a2_378" = "2709924332"
[HKCU\Software\Aas]
"a2_373" = "2674089733"
[HKCU\Software\Aas]
"a2_372" = "2666908555"
[HKCU\Software\Aas]
"a2_371" = "2659737983"
[HKCU\Software\Aas]
"a2_370" = "2652572223"
[HKCU\Software\Aas]
"a2_377" = "2702756203"
[HKCU\Software\Aas]
"a2_376" = "2695581413"
[HKCU\Software\Aas]
"a2_375" = "2688430045"
[HKCU\Software\Aas]
"a2_374" = "2681257199"
[HKCU\Software\Aas]
"a3_246" = "1746738975"
[HKCU\Software\Aas]
"a3_247" = "1753789374"
[HKCU\Software\Aas]
"a3_244" = "1765852765"
[HKCU\Software\Aas]
"a3_245" = "1773304572"
[HKCU\Software\Aas]
"a2_179" = "1283272780"
[HKCU\Software\Aas]
"a2_178" = "1276106116"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a3_241" = "1744311672"
[HKCU\Software\Aas]
"a2_175" = "1254591423"
[HKCU\Software\Aas]
"a2_174" = "1247420913"
[HKCU\Software\Aas]
"a2_177" = "1268940038"
[HKCU\Software\Aas]
"a2_176" = "1261773153"
[HKCU\Software\Aas]
"a2_171" = "1225923191"
[HKCU\Software\Aas]
"a2_170" = "1218743274"
[HKCU\Software\Aas]
"a2_173" = "1240254504"
[HKCU\Software\Aas]
"a3_249" = "1801832560"
[HKCU\Software\Aas]
"a3_69" = "478110732"
[HKCU\Software\Aas]
"a3_68" = "470664173"
[HKCU\Software\Aas]
"a3_65" = "449123976"
[HKCU\Software\Aas]
"a3_64" = "442135145"
[HKCU\Software\Aas]
"a3_67" = "497168202"
[HKCU\Software\Aas]
"a3_66" = "489720619"
[HKCU\Software\Aas]
"a3_61" = "454263092"
[HKCU\Software\Aas]
"a3_60" = "413199509"
[HKCU\Software\Aas]
"a3_63" = "468244982"
[HKCU\Software\Aas]
"a3_62" = "461186391"
[HKCU\Software\Aas]
"a1_424" = "909549623"
[HKCU\Software\Aas]
"a1_425" = "3242327879"
[HKCU\Software\Aas]
"a1_426" = "2958238515"
[HKCU\Software\Aas]
"a1_427" = "3270063383"
[HKCU\Software\Aas]
"a1_420" = "2551520890"
[HKCU\Software\Aas]
"a1_421" = "1820723513"
[HKCU\Software\Aas]
"a1_422" = "2403743540"
[HKCU\Software\Aas]
"a1_423" = "2236357022"
[HKCU\Software\Aas]
"a3_199" = "1409969486"
[HKCU\Software\Aas]
"a1_428" = "3760922386"
[HKCU\Software\Aas]
"a1_429" = "3378519385"
[HKCU\Software\Aas]
"a3_338" = "2439897659"
[HKCU\Software\Aas]
"a3_339" = "2446886490"
[HKCU\Software\Aas]
"a3_336" = "2391856505"
[HKCU\Software\Aas]
"a3_337" = "2432846232"
[HKCU\Software\Aas]
"a3_334" = "2411437223"
[HKCU\Software\Aas]
"a3_335" = "2384801990"
[HKCU\Software\Aas]
"a3_332" = "2363312101"
[HKCU\Software\Aas]
"a3_333" = "2403923972"
[HKCU\Software\Aas]
"a3_330" = "2348814115"
[HKCU\Software\Aas]
"a3_331" = "2356388674"
[HKCU\Software\Aas]
"a3_428" = "3084957701"
[HKCU\Software\Aas]
"a3_429" = "3058850980"
[HKCU\Software\Aas]
"a3_422" = "3041926607"
[HKCU\Software\Aas]
"a3_423" = "3049502318"
[HKCU\Software\Aas]
"a3_420" = "2994455821"
[HKCU\Software\Aas]
"a3_421" = "3001383340"
[HKCU\Software\Aas]
"a3_426" = "3070911299"
[HKCU\Software\Aas]
"a3_427" = "3077900258"
[HKCU\Software\Aas]
"a3_424" = "3022858881"
[HKCU\Software\Aas]
"a3_425" = "3029913376"
[HKCU\Software\Aas]
"a3_87" = "607024862"
[HKCU\Software\Aas]
"a3_86" = "633131711"
[HKCU\Software\Aas]
"a3_85" = "626081308"
[HKCU\Software\Aas]
"a3_84" = "585598461"
[HKCU\Software\Aas]
"a3_83" = "578085210"
[HKCU\Software\Aas]
"a3_82" = "571034939"
[HKCU\Software\Aas]
"a3_81" = "597665944"
[HKCU\Software\Aas]
"a4_183" = "1311949143"
[HKCU\Software\Aas]
"a3_89" = "654610320"
[HKCU\Software\Aas]
"a3_88" = "614067057"
[HKCU\Software\Aas]
"a1_439" = "3490982984"
[HKCU\Software\Aas]
"a1_198" = "905046087"
[HKCU\Software\Aas]
"a1_199" = "3960031786"
[HKCU\Software\Aas]
"a4_148" = "1061029908"
[HKCU\Software\Aas]
"a4_149" = "1068199029"
[HKCU\Software\Aas]
"a4_146" = "1046691666"
[HKCU\Software\Aas]
"a4_147" = "1053860787"
[HKCU\Software\Aas]
"a1_196" = "2956469015"
[HKCU\Software\Aas]
"a4_145" = "1039522545"
[HKCU\Software\Aas]
"a1_190" = "2892752284"
[HKCU\Software\Aas]
"a4_143" = "1025184303"
[HKCU\Software\Aas]
"a4_140" = "1003676940"
[HKCU\Software\Aas]
"a4_141" = "1010846061"
[HKCU\Software\Aas]
"a4_380" = "2724265980"
[HKCU\Software\Aas]
"a4_381" = "2731435101"
[HKCU\Software\Aas]
"a4_382" = "2738604222"
[HKCU\Software\Aas]
"a4_383" = "2745773343"
[HKCU\Software\Aas]
"a4_384" = "2752942464"
[HKCU\Software\Aas]
"a4_385" = "2760111585"
[HKCU\Software\Aas]
"a4_386" = "2767280706"
[HKCU\Software\Aas]
"a4_169" = "1211581449"
[HKCU\Software\Aas]
"a4_388" = "2781618948"
[HKCU\Software\Aas]
"a4_389" = "2788788069"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a1_0" = "1526963546"
[HKCU\Software\Aas]
"a1_1" = "59162323"
[HKCU\Software\Aas]
"a1_2" = "1414505627"
[HKCU\Software\Aas]
"a1_3" = "71058067"
[HKCU\Software\Aas]
"a1_4" = "2848837983"
[HKCU\Software\Aas]
"a1_5" = "1250786491"
[HKCU\Software\Aas]
"a1_6" = "1066274073"
[HKCU\Software\Aas]
"a1_7" = "1797912343"
[HKCU\Software\Aas]
"a1_8" = "3351937906"
[HKCU\Software\Aas]
"a1_9" = "1173829395"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Aas]
"a3_8" = "40388897"
[HKCU\Software\Aas]
"a3_9" = "47967552"
[HKCU\Software\Aas]
"a3_6" = "59977839"
[HKCU\Software\Aas]
"a3_7" = "67032206"
[HKCU\Software\Aas]
"a3_4" = "11991981"
[HKCU\Software\Aas]
"a3_5" = "52535244"
[HKCU\Software\Aas]
"a3_2" = "31040235"
[HKCU\Software\Aas]
"a3_3" = "4933386"
[HKCU\Software\Aas]
"a3_0" = "17001001"
[HKCU\Software\Aas]
"a3_1" = "23989832"
[HKCU\Software\Aas]
"a2_412" = "2953680570"
[HKCU\Software\Aas]
"a2_413" = "2960844322"
[HKCU\Software\Aas]
"a2_410" = "2939347063"
[HKCU\Software\Aas]
"a2_411" = "2946513438"
[HKCU\Software\Aas]
"a2_416" = "2982362839"
[HKCU\Software\Aas]
"a2_417" = "2989529834"
[HKCU\Software\Aas]
"a2_414" = "2968012857"
[HKCU\Software\Aas]
"a2_415" = "2975182552"
[HKCU\Software\Aas]
"a2_418" = "2996697825"
[HKCU\Software\Aas]
"a2_419" = "3003863800"
[HKCU\Software\Aas]
"a1_219" = "863103915"
[HKCU\Software\Aas]
"a1_218" = "3214836713"
[HKCU\Software\Aas]
"a1_217" = "45623831"
[HKCU\Software\Aas]
"a1_216" = "1511502053"
[HKCU\Software\Aas]
"a1_215" = "555109446"
[HKCU\Software\Aas]
"a1_214" = "1366768836"
[HKCU\Software\Aas]
"a1_213" = "474418924"
[HKCU\Software\Aas]
"a1_212" = "250580346"
[HKCU\Software\Aas]
"a1_211" = "3543879060"
[HKCU\Software\Aas]
"a1_210" = "3492010072"
[HKCU\Software\Aas]
"a4_443" = "3175920603"
[HKCU\Software\Aas]
"a4_442" = "3168751482"
[HKCU\Software\Aas]
"a4_441" = "3161582361"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"ef4e0b40447ecdc83e3818ad186b7283.exe" = "c:\ef4e0b40447ecdc83e3818ad186b7283.exe:*:Enabled:ipsec"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://www.google.com/webhp |  74.125.226.209 |
| hxxp://www.google.ca/webhp?gws_rd=cr | 74.125.226.215 |
| hxxp://parcamercedes.com/wp-content/plugins/hotfix/redir.php |  213.128.87.237 |
| hxxp://plus2formation.com/file/flash.exe |  213.186.33.19 |
| mta5.am0.yahoodns.net | 98.138.112.35 |
Rootkit activity
The Trojan-PSW installs the following user-mode hooks in WINMM.dll:
PlaySoundW
The Trojan-PSW installs the following user-mode hooks in WININET.dll:
HttpEndRequestW
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetSetFilePointer
InternetQueryDataAvailable
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA
The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:
PFXImportCertStore
The Trojan-PSW installs the following user-mode hooks in USER32.dll:
SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC
The Trojan-PSW installs the following user-mode hooks in ADVAPI32.dll:
CreateProcessAsUserA
CreateProcessAsUserW
The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:
WSASend
gethostbyname
send
closesocket
getaddrinfo
The Trojan-PSW installs the following user-mode hooks in kernel32.dll:
ExitProcess
GetFileAttributesExW
The Trojan-PSW installs the following user-mode hooks in ntdll.dll:
NtCreateThread
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
flash.exe:612
flash.exe:1576
ilfex.exe:452
ilfex.exe:1592
tasklist.exe:3816
net.exe:2304
rundll32.exe:1700
ef4e0b40447ecdc83e3818ad186b7283.exe:1744
ef4e0b40447ecdc83e3818ad186b7283.exe:460 - Delete the original Trojan-PSW file.
- Delete or disinfect the following files created/modified by the Trojan-PSW:
%System%\OpjiwqeLmalb.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000844C2_Rar\ilfex.exe (9098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000846A7_Rar\ilfex.exe (9098 bytes)
%Documents and Settings%\%current user%\Application Data\Iptuc\ilfex.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp04f86da7.bat (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082767_Rar\ef4e0b40447ecdc83e3818ad186b7283.exe (9098 bytes)
%WinDir%\system.ini (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B6E_Rar\ef4e0b40447ecdc83e3818ad186b7283.exe (9098 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
