Virus.Win32.Sality_0df23b2368
Trojan-Dropper.Win32.Dapato.bhqx (Kaspersky), Virus.Win32.Sality.at (v) (VIPRE), P2P-Worm.Win32.Palevo!IK (Emsisoft), GenericUSBInfector.YR, GenericProxy.YR, GenericSYNFlooder.YR, GenericUDPFlooder.YR, GenericDNSBlocker.YR, GenericMSNWorm.YR, GenericIRCBot.YR, GenericAutorunWorm.YR, VirusSality.YR, WormDorkbot.YR, GenericPhysicalDrive0.YR, GenericInjector.YR, BankerGeneric.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Banker, Trojan, Flooder, Worm, P2P-Worm, Virus, WormAutorun, IRCBot, MSNWorm, DNSBlocker, UDPFlooder, SYNFlooder, Trojan-Proxy, USBInfector
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 0df23b236896bd103bda905d61633c33
SHA1: a5b986198018c4998509ff25d0de079e8ad6b4a8
SHA256: 2aaa845d8c08c97b4808316dc158fdc8babac21217138a669fc9ee5c6c3d8388
SSDeep: 6144:mO0bgt5Nh8Xi0oc9wToz6GyGg2LYawMrMbYWSAHzE3lbkFf2s:m9Ih6np7z6GyELYAQVSaE3lbkFOs
Size: 329728 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: RealTimeGaming Software
Created at: 2011-09-03 07:53:36
Summary:
Virus. A program that recursively replicates a possibly evolved copy of itself.
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer. |
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
| MSNWorm | A worm can spread its copies through the MSN Messanger. |
| DNSBlocker | A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet. |
| UDPFlooder | This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host. |
| SYNFlooder | This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. |
| Trojan-Proxy | This program can launch a proxy server (SOCKS4) on a designated TCP port. |
| USBInfector | A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer. |
Process activity
The Virus creates the following process(es):
TELNET.EXE:2724
TELNET.EXE:840
TELNET.EXE:2328
TELNET.EXE:2436
TELNET.EXE:2632
TELNET.EXE:3140
TELNET.EXE:2380
TELNET.EXE:3144
TELNET.EXE:3652
TELNET.EXE:3076
TELNET.EXE:3268
TELNET.EXE:2072
TELNET.EXE:3292
NOTEPAD.EXE:3596
NOTEPAD.EXE:2292
NOTEPAD.EXE:664
NOTEPAD.EXE:2968
NOTEPAD.EXE:3416
NOTEPAD.EXE:3008
NOTEPAD.EXE:2804
NOTEPAD.EXE:2524
NOTEPAD.EXE:3236
NOTEPAD.EXE:3380
NOTEPAD.EXE:1772
NOTEPAD.EXE:3512
NOTEPAD.EXE:2888
NOTEPAD.EXE:3792
NOTEPAD.EXE:2152
NOTEPAD.EXE:1292
NOTEPAD.EXE:1464
NOTEPAD.EXE:2112
NOTEPAD.EXE:2364
NOTEPAD.EXE:2668
NOTEPAD.EXE:2604
NOTEPAD.EXE:2872
NOTEPAD.EXE:2456
NOTEPAD.EXE:3764
NOTEPAD.EXE:2916
NOTEPAD.EXE:2628
NOTEPAD.EXE:2608
NOTEPAD.EXE:3624
NOTEPAD.EXE:2764
NOTEPAD.EXE:2696
NOTEPAD.EXE:3368
NOTEPAD.EXE:3176
NOTEPAD.EXE:2212
NOTEPAD.EXE:3204
NOTEPAD.EXE:3540
NOTEPAD.EXE:3472
NOTEPAD.EXE:3564
NOTEPAD.EXE:2272
NOTEPAD.EXE:3500
NOTEPAD.EXE:3444
NOTEPAD.EXE:2408
NOTEPAD.EXE:2256
NOTEPAD.EXE:3252
0df23b236896bd103bda905d61633c33.exe:640
0df23b236896bd103bda905d61633c33.exe:404
0df23b236896bd103bda905d61633c33.exe:1748
Ctkmko.exe:744
Ctkmko.exe:1576
Ctkmko.exe:940
File activity
The process 0df23b236896bd103bda905d61633c33.exe:404 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\J7ygghyk6L1AItgfM1t.tmp (3 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
The process 0df23b236896bd103bda905d61633c33.exe:1748 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Ctkmko.exe (2105 bytes)
The process Ctkmko.exe:744 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\J7ygghyk6L1AItgfM1t.tmp (3 bytes)
The Virus deletes the following file(s):
C:\7edd8 (0 bytes)
Registry activity
The process TELNET.EXE:2724 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 4D 48 1D 6E FF 6E DF E5 08 30 12 92 C2 C6 47"
The process TELNET.EXE:840 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 32 5A 54 C1 1D 45 CD 92 28 A9 C5 75 94 94 7D"
The process TELNET.EXE:2328 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 17 76 92 9B 92 E0 7A 3B B0 23 C9 30 DD 72 4E"
The process TELNET.EXE:2436 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 38 93 35 8B 1D 93 91 B9 AD 20 BF F9 54 AD 8E"
The process TELNET.EXE:2632 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC F5 51 E3 40 44 C7 BD F3 C9 23 01 11 6E B6 47"
The process TELNET.EXE:3140 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 6A 91 05 DC 18 7A C4 02 B7 B7 D8 A5 5B 56 7B"
The process TELNET.EXE:2380 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 8F 7D 08 E5 83 78 D9 72 BC 48 90 75 2F 17 5E"
The process TELNET.EXE:3144 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 12 47 AF 7C 9C B4 6C 29 19 FA 07 D5 DD 1F F5"
The process TELNET.EXE:3652 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 81 5A B4 06 12 FD 44 33 D3 A0 4D 24 31 CD 4D"
The process TELNET.EXE:3076 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 7A CB 0C 58 7A 11 B6 08 0D 35 E2 AF 60 24 CB"
The process TELNET.EXE:3268 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 64 12 87 D5 28 B8 E3 72 E4 92 DB 12 61 9E 6C"
The process TELNET.EXE:2072 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 67 42 72 96 5D 32 E1 0C A7 E5 95 0D B5 D2 D0"
The process TELNET.EXE:3292 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 31 3D A3 93 41 17 63 70 87 51 C7 CC CA 70 10"
The process NOTEPAD.EXE:3596 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B A7 8C 70 41 40 71 09 E4 1A 1E 9B F3 FE AD B2"
The process NOTEPAD.EXE:2292 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 66 39 AD 76 96 C4 B2 BA 2B 0C D3 CE 2A 67 91"
The process NOTEPAD.EXE:664 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 B7 65 98 1E 8F 41 90 5B 04 1B 8D 1C 41 DA 22"
The process NOTEPAD.EXE:2968 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 6B ED 87 DC A8 C9 EE 62 A6 B9 49 38 7B E8 22"
The process NOTEPAD.EXE:3416 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 C4 3A AE B9 09 D8 3D E5 9F 19 12 69 DC E0 D9"
The process NOTEPAD.EXE:3008 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 F7 06 19 8A 29 B8 BC E9 14 EF 60 D9 F6 ED 4C"
The process NOTEPAD.EXE:2804 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 E5 7F F1 E1 FA B3 D9 A0 11 E1 E6 AA 3E 0E BC"
The process NOTEPAD.EXE:2524 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 79 B6 3D F5 60 3E F2 77 59 9D D8 51 7F ED 8E"
The process NOTEPAD.EXE:3236 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 A3 92 67 8C 8D 9D 93 39 C5 6E 73 96 4C 10 B9"
The process NOTEPAD.EXE:3380 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 2D 8B C4 18 DC C9 18 2F 4E FF 0B A4 4C 2D 76"
The process NOTEPAD.EXE:1772 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 A2 02 61 02 9D 04 64 EB 15 27 38 A6 62 BA 53"
The process NOTEPAD.EXE:3512 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 58 EB 40 3A 60 7A 71 33 86 31 20 58 BE AD AF"
The process NOTEPAD.EXE:2888 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 E6 68 84 7D 1A CA B6 1B 4E C3 B6 10 6D A2 82"
The process NOTEPAD.EXE:3792 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 14 4F 1F D5 A1 FF 4F F2 6C 41 A4 92 96 66 6E"
The process NOTEPAD.EXE:2152 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 17 0C 71 AD 42 D4 8F 57 02 C1 12 73 48 CF 50"
The process NOTEPAD.EXE:1292 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 50 BB 19 3A 02 12 78 B3 FD 3F 04 64 AC C9 8D"
The process NOTEPAD.EXE:1464 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 B4 5A 26 99 BF B7 68 57 B3 14 36 24 57 00 29"
The process NOTEPAD.EXE:2112 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D F9 92 EF A5 7E 97 FE 68 49 A6 65 B1 B8 2D 91"
The process NOTEPAD.EXE:2364 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 3C E3 E5 00 1E D0 68 1B 12 20 40 6F 59 31 99"
The process NOTEPAD.EXE:2668 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD AF 73 E7 C7 B4 88 E0 F8 A5 A2 B6 31 26 D9 55"
The process NOTEPAD.EXE:2604 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 13 8B 57 E0 11 D3 D1 BB 3F DF 0B 88 9C E2 CC"
The process NOTEPAD.EXE:2872 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 55 37 B6 6E C1 37 B4 09 69 49 4F EE 50 5A F4"
The process NOTEPAD.EXE:2456 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED A3 67 EF 40 EC 14 43 CB D7 EE 17 C9 29 7B FB"
The process NOTEPAD.EXE:3764 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 9D 49 FA 99 A9 A1 0E A7 F9 15 53 22 52 2E BB"
The process NOTEPAD.EXE:2916 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 83 30 9D EC 41 98 1D 38 0D AE 0B 9E F5 40 38"
The process NOTEPAD.EXE:2628 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 00 F5 63 9A 90 4F FB D2 BC C2 0F E9 FD 82 21"
The process NOTEPAD.EXE:2608 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 92 5F 48 2F F4 0B 7D 5E 75 D9 03 1C 87 A5 A0"
The process NOTEPAD.EXE:3624 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA E6 51 13 40 1E 74 19 62 A6 C1 8D 80 76 02 BA"
The process NOTEPAD.EXE:2764 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 EA A9 94 B0 27 AF 1B 2E 79 A6 79 15 78 3D 27"
The process NOTEPAD.EXE:2696 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 27 FC 3F A3 A3 7A 72 9D EE 0D D8 8F 1C 24 00"
The process NOTEPAD.EXE:3368 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 F8 1B EA 56 0B 2D 27 8F 2E C1 62 D3 78 A7 00"
The process NOTEPAD.EXE:3176 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 D7 36 91 1F 06 8E 2F B5 89 E6 89 B6 2E DB 62"
The process NOTEPAD.EXE:2212 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 79 17 74 41 62 B4 DE 70 40 EA FE 75 93 85 6F"
The process NOTEPAD.EXE:3204 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 5E E7 A0 87 00 C1 D3 B7 94 C8 D1 6B 43 FB 73"
The process NOTEPAD.EXE:3540 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED AA 62 99 9E AE 06 2D 74 2D E0 C8 6B 50 4A 83"
The process NOTEPAD.EXE:3472 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 2E DA 7B 79 BC 47 BC D2 D0 0C C6 D5 E8 EC 60"
The process NOTEPAD.EXE:3564 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8B CE 06 6A 83 23 D5 51 DD A2 3B 49 D7 D9 7F"
The process NOTEPAD.EXE:2272 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 4F 34 43 CA 01 0A FD B7 68 70 C4 A4 3D DE CE"
The process NOTEPAD.EXE:3500 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 A2 F2 87 14 A2 DD 64 D7 16 8F 03 90 DE 56 6A"
The process NOTEPAD.EXE:3444 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 3B 16 CC B7 82 0D C9 5C A0 3B 58 99 7A 3C C7"
The process NOTEPAD.EXE:2408 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 28 2B 5D F0 12 6B BA D6 8B C0 97 AF B0 1B CB"
The process NOTEPAD.EXE:2256 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 4D EA A0 69 01 BF A1 DD 69 56 F8 24 60 22 6C"
The process NOTEPAD.EXE:3252 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 60 61 56 51 D1 77 DC D3 48 4F 14 5B BA 9F 9C"
The process 0df23b236896bd103bda905d61633c33.exe:640 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 14 68 9C 85 A2 A6 86 59 30 8E 1E DB 0D 97 39"
The process 0df23b236896bd103bda905d61633c33.exe:404 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKCU\Software\adm914]
"a2_15" = "107543312"
[HKCU\Software\adm914]
"a2_14" = "100363151"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKCU\Software\adm914]
"a2_16" = "114709912"
[HKCU\Software\adm914]
"a2_11" = "78857559"
[HKCU\Software\adm914]
"a2_10" = "71696266"
[HKCU\Software\adm914]
"a2_13" = "93193583"
[HKCU\Software\adm914]
"a2_12" = "86026876"
[HKCU\Software\adm914]
"a2_19" = "136211138"
[HKCU\Software\adm914]
"a2_18" = "129054174"
[HKCU\Software\Aas]
"a3_78" = "542637991"
[HKCU\Software\Aas]
"a3_79" = "549622726"
[HKCU\Software\Aas]
"a3_72" = "533156193"
[HKCU\Software\Aas]
"a3_73" = "506656128"
[HKCU\Software\Aas]
"a3_70" = "485103791"
[HKCU\Software\Aas]
"a3_71" = "525712590"
[HKCU\Software\Aas]
"a3_76" = "561686245"
[HKCU\Software\Aas]
"a3_77" = "568613636"
[HKCU\Software\Aas]
"a3_74" = "513568291"
[HKCU\Software\Aas]
"a3_75" = "554631746"
[HKCU\Software\adm914]
"a4_119" = "853125399"
[HKCU\Software\adm914]
"a4_118" = "845956278"
[HKCU\Software\adm914]
"a4_117" = "838787157"
[HKCU\Software\adm914]
"a4_116" = "831618036"
[HKCU\Software\adm914]
"a4_115" = "824448915"
[HKCU\Software\adm914]
"a4_114" = "817279794"
[HKCU\Software\adm914]
"a4_113" = "810110673"
[HKCU\Software\adm914]
"a4_112" = "802941552"
[HKCU\Software\adm914]
"a4_111" = "795772431"
[HKCU\Software\adm914]
"a4_110" = "788603310"
[HKCU\Software\adm914]
"a2_160" = "1147056472"
[HKCU\Software\adm914]
"a2_161" = "1154234543"
[HKCU\Software\adm914]
"a2_162" = "1161403562"
[HKCU\Software\adm914]
"a2_163" = "1168571250"
[HKCU\Software\adm914]
"a2_164" = "1175737890"
[HKCU\Software\adm914]
"a2_165" = "1182903889"
[HKCU\Software\adm914]
"a2_166" = "1190071476"
[HKCU\Software\adm914]
"a2_167" = "1197236939"
[HKCU\Software\adm914]
"a2_168" = "1204407238"
[HKCU\Software\adm914]
"a2_169" = "1211585321"
[HKCU\Software\adm914]
"a2_17" = "121877337"
[HKCU\Software\adm914]
"a4_337" = "2415993777"
[HKCU\Software\adm914]
"a4_336" = "2408824656"
[HKCU\Software\adm914]
"a4_335" = "2401655535"
[HKCU\Software\adm914]
"a4_334" = "2394486414"
[HKCU\Software\adm914]
"a4_333" = "2387317293"
[HKCU\Software\adm914]
"a4_332" = "2380148172"
[HKCU\Software\adm914]
"a4_331" = "2372979051"
[HKCU\Software\adm914]
"a4_330" = "2365809930"
[HKCU\Software\adm914]
"a4_339" = "2430332019"
[HKCU\Software\adm914]
"a4_338" = "2423162898"
[HKCU\Software\Aas]
"a3_94" = "690598327"
[HKCU\Software\Aas]
"a3_95" = "698045910"
[HKCU\Software\Aas]
"a3_96" = "671534665"
[HKCU\Software\Aas]
"a3_97" = "678453992"
[HKCU\Software\Aas]
"a3_90" = "662052915"
[HKCU\Software\Aas]
"a3_91" = "669107282"
[HKCU\Software\Aas]
"a3_92" = "643004661"
[HKCU\Software\Aas]
"a3_93" = "649993492"
[HKCU\Software\Aas]
"a3_98" = "685967115"
[HKCU\Software\Aas]
"a3_99" = "726580138"
[HKCU\Software\adm914]
"a1_138" = "3171167751"
[HKCU\Software\adm914]
"a1_139" = "2341783782"
[HKCU\Software\adm914]
"a2_304" = "2179410504"
[HKCU\Software\adm914]
"a2_305" = "2186577562"
[HKCU\Software\adm914]
"a2_306" = "2193743886"
[HKCU\Software\adm914]
"a2_307" = "2200925371"
[HKCU\Software\adm914]
"a2_300" = "2150741924"
[HKCU\Software\adm914]
"a2_301" = "2157911883"
[HKCU\Software\adm914]
"a2_302" = "2165078270"
[HKCU\Software\adm914]
"a2_303" = "2172246219"
[HKCU\Software\adm914]
"a2_308" = "2208095467"
[HKCU\Software\adm914]
"a2_309" = "2215261475"
[HKCU\Software\adm914]
"a4_249" = "1785111129"
[HKCU\Software\adm914]
"a4_248" = "1777942008"
[HKCU\Software\adm914]
"a4_243" = "1742096403"
[HKCU\Software\adm914]
"a4_242" = "1734927282"
[HKCU\Software\adm914]
"a4_241" = "1727758161"
[HKCU\Software\adm914]
"a4_240" = "1720589040"
[HKCU\Software\adm914]
"a4_247" = "1770772887"
[HKCU\Software\adm914]
"a4_246" = "1763603766"
[HKCU\Software\adm914]
"a4_245" = "1756434645"
[HKCU\Software\adm914]
"a4_244" = "1749265524"
[HKCU\Software\adm914]
"a3_8" = "40387913"
[HKCU\Software\adm914]
"a3_9" = "47964456"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\adm914]
"a3_189" = "1371569628"
[HKCU\Software\adm914]
"a3_188" = "1364644221"
[HKCU\Software\adm914]
"a3_187" = "1324037274"
[HKCU\Software\adm914]
"a3_186" = "1316587579"
[HKCU\Software\adm914]
"a3_185" = "1309600856"
[HKCU\Software\adm914]
"a3_184" = "1336099833"
[HKCU\Software\adm914]
"a3_183" = "1328654102"
[HKCU\Software\adm914]
"a3_182" = "1288059575"
[HKCU\Software\adm914]
"a3_181" = "1280614100"
[HKCU\Software\adm914]
"a3_180" = "1307177589"
[HKCU\Software\adm914]
"a2_238" = "1706247957"
[HKCU\Software\adm914]
"a2_239" = "1713415629"
[HKCU\Software\adm914]
"a4_39" = "279595719"
[HKCU\Software\adm914]
"a4_38" = "272426598"
[HKCU\Software\adm914]
"a4_35" = "250919235"
[HKCU\Software\adm914]
"a4_34" = "243750114"
[HKCU\Software\adm914]
"a4_37" = "265257477"
[HKCU\Software\adm914]
"a4_36" = "258088356"
[HKCU\Software\adm914]
"a4_31" = "222242751"
[HKCU\Software\adm914]
"a4_30" = "215073630"
[HKCU\Software\adm914]
"a4_33" = "236580993"
[HKCU\Software\adm914]
"a4_32" = "229411872"
[HKCU\Software\adm914]
"a2_326" = "2337130055"
[HKCU\Software\adm914]
"a2_327" = "2344298123"
[HKCU\Software\adm914]
"a2_324" = "2322794254"
[HKCU\Software\adm914]
"a2_325" = "2329965885"
[HKCU\Software\adm914]
"a2_322" = "2308460798"
[HKCU\Software\adm914]
"a2_323" = "2315630381"
[HKCU\Software\adm914]
"a2_320" = "2294115624"
[HKCU\Software\adm914]
"a2_321" = "2301283115"
[HKCU\Software\adm914]
"a3_323" = "2332475426"
[HKCU\Software\adm914]
"a3_322" = "2291868739"
[HKCU\Software\adm914]
"a1_279" = "3333054149"
[HKCU\Software\adm914]
"a1_278" = "3396303332"
[HKCU\Software\adm914]
"a1_277" = "1535034522"
[HKCU\Software\adm914]
"a1_276" = "2161660610"
[HKCU\Software\adm914]
"a1_275" = "653172334"
[HKCU\Software\adm914]
"a1_274" = "2809140328"
[HKCU\Software\adm914]
"a1_273" = "2513820068"
[HKCU\Software\adm914]
"a1_272" = "713187758"
[HKCU\Software\adm914]
"a1_271" = "2470656250"
[HKCU\Software\adm914]
"a1_270" = "3203378195"
[HKCU\Software\adm914]
"a1_69" = "863327213"
[HKCU\Software\adm914]
"a1_68" = "1139659412"
[HKCU\Software\adm914]
"a1_65" = "1253200888"
[HKCU\Software\adm914]
"a1_64" = "2263005744"
[HKCU\Software\adm914]
"a1_67" = "3917127482"
[HKCU\Software\adm914]
"a1_66" = "1122324168"
[HKCU\Software\adm914]
"a1_61" = "526944451"
[HKCU\Software\adm914]
"a1_60" = "216298613"
[HKCU\Software\adm914]
"a1_63" = "705891456"
[HKCU\Software\adm914]
"a1_62" = "3408893221"
[HKCU\Software\adm914]
"a3_27" = "176877690"
[HKCU\Software\adm914]
"a3_26" = "169826203"
[HKCU\Software\adm914]
"a3_25" = "195930936"
[HKCU\Software\adm914]
"a3_24" = "188878681"
[HKCU\Software\adm914]
"a3_23" = "148333302"
[HKCU\Software\adm914]
"a3_22" = "140887575"
[HKCU\Software\adm914]
"a3_21" = "167402932"
[HKCU\Software\adm914]
"a3_20" = "159953365"
[HKCU\Software\adm914]
"a1_309" = "415457451"
[HKCU\Software\adm914]
"a1_308" = "4117673960"
[HKCU\Software\adm914]
"a3_29" = "224868540"
[HKCU\Software\adm914]
"a3_28" = "183868637"
[HKCU\Software\adm914\695404737]
"21507363" = "0"
[HKCU\Software\adm914]
"a2_28" = "200731438"
[HKCU\Software\adm914]
"a2_29" = "207897738"
[HKCU\Software\Aas]
"a1_89" = "2071781484"
[HKCU\Software\Aas]
"a1_88" = "491780109"
[HKCU\Software\adm914]
"a2_20" = "143380476"
[HKCU\Software\adm914]
"a2_21" = "150547569"
[HKCU\Software\adm914]
"a2_22" = "157726065"
[HKCU\Software\adm914]
"a2_23" = "164893607"
[HKCU\Software\adm914]
"a2_24" = "172061464"
[HKCU\Software\adm914]
"a2_25" = "179229623"
[HKCU\Software\adm914]
"a2_26" = "186393229"
[HKCU\Software\adm914]
"a2_27" = "193561806"
[HKCU\Software\adm914]
"a2_212" = "1519858722"
[HKCU\Software\adm914]
"a1_349" = "3729119627"
[HKCU\Software\adm914]
"a2_213" = "1527027297"
[HKCU\Software\adm914]
"a1_348" = "2091554144"
[HKCU\Software\adm914]
"a2_210" = "1505513445"
[HKCU\Software\Aas]
"a1_67" = "4119458877"
[HKCU\Software\Aas]
"a1_66" = "93695069"
[HKCU\Software\Aas]
"a1_65" = "1852518166"
[HKCU\Software\Aas]
"a1_64" = "1717919766"
[HKCU\Software\Aas]
"a1_63" = "246012800"
[HKCU\Software\Aas]
"a1_62" = "1477084113"
[HKCU\Software\Aas]
"a1_61" = "62762562"
[HKCU\Software\Aas]
"a1_60" = "757761128"
[HKCU\Software\adm914]
"a2_216" = "1548525874"
[HKCU\Software\adm914]
"a4_198" = "1419485958"
[HKCU\Software\adm914]
"a1_345" = "1754163460"
[HKCU\Software\Aas]
"a1_69" = "204564083"
[HKCU\Software\Aas]
"a1_68" = "3305735837"
[HKCU\Software\adm914]
"a1_344" = "4246894853"
[HKCU\Software\adm914]
"a2_214" = "1534193757"
[HKCU\Software\adm914]
"a2_215" = "1541364727"
[HKCU\Software\adm914]
"a4_108" = "774265068"
[HKCU\Software\adm914]
"a4_109" = "781434189"
[HKCU\Software\adm914]
"a4_104" = "745588584"
[HKCU\Software\adm914]
"a4_105" = "752757705"
[HKCU\Software\adm914]
"a4_106" = "759926826"
[HKCU\Software\adm914]
"a4_107" = "767095947"
[HKCU\Software\adm914]
"a4_100" = "716912100"
[HKCU\Software\adm914]
"a4_101" = "724081221"
[HKCU\Software\adm914]
"a4_102" = "731250342"
[HKCU\Software\adm914]
"a4_103" = "738419463"
[HKCU\Software\adm914]
"a2_155" = "1111220115"
[HKCU\Software\adm914]
"a2_154" = "1104050978"
[HKCU\Software\Aas]
"a4_35" = "250919235"
[HKCU\Software\adm914]
"a2_156" = "1118386199"
[HKCU\Software\adm914]
"a2_151" = "1082533341"
[HKCU\Software\adm914]
"a2_150" = "1075364232"
[HKCU\Software\adm914]
"a2_153" = "1096870095"
[HKCU\Software\adm914]
"a2_152" = "1089703344"
[HKCU\Software\adm914]
"a2_159" = "1139887126"
[HKCU\Software\adm914]
"a2_158" = "1132718388"
[HKCU\Software\Aas]
"a4_39" = "279595719"
[HKCU\Software\Aas]
"a4_38" = "272426598"
[HKCU\Software\adm914]
"a4_324" = "2322795204"
[HKCU\Software\adm914]
"a4_325" = "2329964325"
[HKCU\Software\adm914]
"a4_326" = "2337133446"
[HKCU\Software\adm914]
"a4_327" = "2344302567"
[HKCU\Software\adm914]
"a4_320" = "2294118720"
[HKCU\Software\adm914]
"a4_321" = "2301287841"
[HKCU\Software\adm914]
"a4_322" = "2308456962"
[HKCU\Software\adm914]
"a4_323" = "2315626083"
[HKCU\Software\adm914]
"a4_328" = "2351471688"
[HKCU\Software\adm914]
"a4_329" = "2358640809"
[HKCU\Software\adm914]
"a3_268" = "1938191309"
[HKCU\Software\adm914]
"a3_269" = "1945182124"
[HKCU\Software\adm914]
"a3_262" = "1861737735"
[HKCU\Software\adm914]
"a3_263" = "1902213606"
[HKCU\Software\adm914]
"a3_260" = "1847235781"
[HKCU\Software\adm914]
"a3_261" = "1854156964"
[HKCU\Software\adm914]
"a3_266" = "1890134667"
[HKCU\Software\adm914]
"a3_267" = "1930745706"
[HKCU\Software\adm914]
"a3_264" = "1909252681"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKCU\Software\adm914]
"a4_258" = "1849633218"
[HKCU\Software\adm914]
"a4_259" = "1856802339"
[HKCU\Software\adm914]
"a4_250" = "1792280250"
[HKCU\Software\adm914]
"a4_251" = "1799449371"
[HKCU\Software\adm914]
"a4_252" = "1806618492"
[HKCU\Software\adm914]
"a4_253" = "1813787613"
[HKCU\Software\adm914]
"a4_254" = "1820956734"
[HKCU\Software\adm914]
"a4_255" = "1828125855"
[HKCU\Software\adm914]
"a4_256" = "1835294976"
[HKCU\Software\adm914]
"a4_257" = "1842464097"
[HKCU\Software\adm914]
"a4_184" = "1319118264"
[HKCU\Software\adm914]
"a4_185" = "1326287385"
[HKCU\Software\adm914]
"a4_186" = "1333456506"
[HKCU\Software\adm914]
"a4_187" = "1340625627"
[HKCU\Software\adm914]
"a3_198" = "1436075335"
[HKCU\Software\adm914]
"a3_199" = "1409966374"
[HKCU\Software\adm914]
"a3_194" = "1407547331"
[HKCU\Software\adm914]
"a4_180" = "1290441780"
[HKCU\Software\adm914]
"a3_196" = "1388559365"
[HKCU\Software\adm914]
"a3_197" = "1429035236"
[HKCU\Software\adm914]
"a3_190" = "1345526207"
[HKCU\Software\adm914]
"a3_191" = "1352565278"
[HKCU\Software\adm914]
"a3_192" = "1393045121"
[HKCU\Software\adm914]
"a3_193" = "1400621920"
[HKCU\Software\adm914]
"a2_209" = "1498342833"
[HKCU\Software\adm914]
"a2_208" = "1491180608"
[HKCU\Software\adm914]
"a2_205" = "1469675498"
[HKCU\Software\adm914]
"a2_204" = "1462495236"
[HKCU\Software\adm914]
"a2_207" = "1484013127"
[HKCU\Software\adm914]
"a2_206" = "1476843175"
[HKCU\Software\adm914]
"a2_201" = "1440991623"
[HKCU\Software\adm914]
"a2_200" = "1433827399"
[HKCU\Software\adm914]
"a2_203" = "1455328763"
[HKCU\Software\adm914]
"a2_202" = "1448158542"
[HKCU\Software\Aas]
"a4_124" = "888971004"
[HKCU\Software\Aas]
"a4_125" = "896140125"
[HKCU\Software\Aas]
"a4_126" = "903309246"
[HKCU\Software\Aas]
"a4_127" = "910478367"
[HKCU\Software\Aas]
"a4_120" = "860294520"
[HKCU\Software\Aas]
"a4_121" = "867463641"
[HKCU\Software\Aas]
"a4_122" = "874632762"
[HKCU\Software\Aas]
"a4_123" = "881801883"
[HKCU\Software\Aas]
"a4_128" = "917647488"
[HKCU\Software\Aas]
"a4_129" = "924816609"
[HKCU\Software\adm914]
"a4_188" = "1347794748"
[HKCU\Software\adm914]
"a2_259" = "1856806241"
[HKCU\Software\adm914]
"a4_189" = "1354963869"
[HKCU\Software\adm914]
"a1_268" = "2812747517"
[HKCU\Software\adm914]
"a1_269" = "4136284573"
[HKCU\Software\adm914]
"a1_264" = "2202286417"
[HKCU\Software\adm914]
"a1_265" = "2631068218"
[HKCU\Software\adm914]
"a1_266" = "3984715384"
[HKCU\Software\adm914]
"a1_267" = "1876077034"
[HKCU\Software\adm914]
"a1_260" = "2343665496"
[HKCU\Software\adm914]
"a1_261" = "2409181081"
[HKCU\Software\adm914]
"a1_262" = "2913063979"
[HKCU\Software\adm914]
"a1_263" = "3724924636"
[HKCU\Software\adm914]
"a1_50" = "3037244495"
[HKCU\Software\adm914]
"a1_51" = "84923402"
[HKCU\Software\adm914]
"a1_52" = "3532743143"
[HKCU\Software\adm914]
"a1_53" = "1380953928"
[HKCU\Software\adm914]
"a1_54" = "2895274536"
[HKCU\Software\adm914]
"a1_55" = "898188062"
[HKCU\Software\adm914]
"a1_56" = "1305042517"
[HKCU\Software\adm914]
"a1_57" = "2134548263"
[HKCU\Software\adm914]
"a1_58" = "3220039986"
[HKCU\Software\adm914]
"a1_59" = "1346469779"
[HKCU\Software\adm914]
"a1_310" = "808116161"
[HKCU\Software\adm914]
"a1_311" = "1679132056"
[HKCU\Software\adm914]
"a1_312" = "2039064701"
[HKCU\Software\adm914]
"a1_313" = "3141014309"
[HKCU\Software\adm914]
"a1_314" = "185096225"
[HKCU\Software\adm914]
"a1_315" = "3061113621"
[HKCU\Software\adm914]
"a1_316" = "2414973683"
[HKCU\Software\adm914]
"a1_317" = "1784097870"
[HKCU\Software\adm914]
"a1_318" = "4191349444"
[HKCU\Software\adm914]
"a1_319" = "704336039"
[HKCU\Software\Aas]
"a1_98" = "2882187097"
[HKCU\Software\Aas]
"a1_99" = "210035629"
[HKCU\Software\adm914]
"a2_39" = "279600646"
[HKCU\Software\adm914]
"a2_38" = "272430984"
[HKCU\Software\Aas]
"a1_92" = "3493780652"
[HKCU\Software\Aas]
"a1_93" = "261033320"
[HKCU\Software\Aas]
"a1_90" = "3338953283"
[HKCU\Software\Aas]
"a1_91" = "1630638117"
[HKCU\Software\Aas]
"a1_96" = "2566002270"
[HKCU\Software\adm914]
"a2_32" = "229414769"
[HKCU\Software\Aas]
"a1_94" = "374296148"
[HKCU\Software\Aas]
"a1_95" = "229793713"
[HKCU\Software\adm914]
"a3_338" = "2439900755"
[HKCU\Software\adm914]
"a4_350" = "2509192350"
[HKCU\Software\Aas]
"a1_74" = "935266911"
[HKCU\Software\Aas]
"a1_75" = "2706934840"
[HKCU\Software\Aas]
"a1_76" = "1244824946"
[HKCU\Software\Aas]
"a1_77" = "1825708404"
[HKCU\Software\Aas]
"a1_70" = "1480917211"
[HKCU\Software\Aas]
"a1_71" = "3891553977"
[HKCU\Software\Aas]
"a1_72" = "1345938947"
[HKCU\Software\Aas]
"a1_73" = "2906370183"
[HKCU\Software\Aas]
"a3_129" = "907869896"
[HKCU\Software\Aas]
"a3_128" = "934369961"
[HKCU\Software\Aas]
"a1_78" = "3192889554"
[HKCU\Software\Aas]
"a1_79" = "4113178550"
[HKCU\Software\Aas]
"a4_50" = "358456050"
[HKCU\Software\adm914]
"a4_131" = "939154851"
[HKCU\Software\adm914]
"a4_130" = "931985730"
[HKCU\Software\adm914]
"a4_133" = "953493093"
[HKCU\Software\adm914]
"a4_132" = "946323972"
[HKCU\Software\adm914]
"a4_135" = "967831335"
[HKCU\Software\adm914]
"a4_134" = "960662214"
[HKCU\Software\adm914]
"a4_137" = "982169577"
[HKCU\Software\adm914]
"a4_136" = "975000456"
[HKCU\Software\adm914]
"a4_139" = "996507819"
[HKCU\Software\adm914]
"a4_138" = "989338698"
[HKCU\Software\Aas]
"a4_24" = "172058904"
[HKCU\Software\Aas]
"a4_25" = "179228025"
[HKCU\Software\Aas]
"a4_26" = "186397146"
[HKCU\Software\Aas]
"a4_27" = "193566267"
[HKCU\Software\Aas]
"a4_20" = "143382420"
[HKCU\Software\Aas]
"a4_21" = "150551541"
[HKCU\Software\Aas]
"a4_22" = "157720662"
[HKCU\Software\Aas]
"a4_23" = "164889783"
[HKCU\Software\Aas]
"a4_28" = "200735388"
[HKCU\Software\Aas]
"a4_29" = "207904509"
[HKCU\Software\adm914]
"a2_148" = "1061034316"
[HKCU\Software\adm914]
"a2_149" = "1068201133"
[HKCU\Software\adm914]
"a2_142" = "1018017840"
[HKCU\Software\adm914]
"a2_143" = "1025181643"
[HKCU\Software\adm914]
"a2_140" = "1003682430"
[HKCU\Software\adm914]
"a2_141" = "1010854469"
[HKCU\Software\adm914]
"a2_146" = "1046686266"
[HKCU\Software\adm914]
"a2_147" = "1053865339"
[HKCU\Software\adm914]
"a2_144" = "1032348936"
[HKCU\Software\adm914]
"a2_145" = "1039518621"
[HKCU\Software\adm914]
"a3_273" = "1974168880"
[HKCU\Software\adm914]
"a3_272" = "1966719313"
[HKCU\Software\adm914]
"a3_219" = "1553447098"
[HKCU\Software\adm914]
"a3_218" = "1545870555"
[HKCU\Software\adm914]
"a3_217" = "1572434040"
[HKCU\Software\adm914]
"a3_216" = "1565513625"
[HKCU\Software\adm914]
"a3_215" = "1524378422"
[HKCU\Software\adm914]
"a3_214" = "1517457239"
[HKCU\Software\adm914]
"a3_213" = "1510466292"
[HKCU\Software\adm914]
"a3_212" = "1536443925"
[HKCU\Software\adm914]
"a3_211" = "1529535922"
[HKCU\Software\adm914]
"a3_210" = "1488925139"
[HKCU\Software\adm914]
"a3_279" = "1983579126"
[HKCU\Software\adm914]
"a3_278" = "2009622295"
[HKCU\Software\adm914]
"a4_269" = "1928493549"
[HKCU\Software\adm914]
"a4_268" = "1921324428"
[HKCU\Software\adm914]
"a2_328" = "2351466867"
[HKCU\Software\adm914]
"a2_329" = "2358645417"
[HKCU\Software\adm914]
"a4_265" = "1899817065"
[HKCU\Software\adm914]
"a4_264" = "1892647944"
[HKCU\Software\adm914]
"a4_267" = "1914155307"
[HKCU\Software\adm914]
"a4_266" = "1906986186"
[HKCU\Software\adm914]
"a4_261" = "1871140581"
[HKCU\Software\adm914]
"a4_260" = "1863971460"
[HKCU\Software\adm914]
"a4_263" = "1885478823"
[HKCU\Software\adm914]
"a4_262" = "1878309702"
[HKCU\Software\adm914]
"a4_319" = "2286949599"
[HKCU\Software\adm914]
"a4_318" = "2279780478"
[HKCU\Software\adm914]
"a3_321" = "2284436448"
[HKCU\Software\adm914]
"a3_320" = "2310938369"
[HKCU\Software\adm914]
"a3_327" = "2327335334"
[HKCU\Software\adm914]
"a3_326" = "2320414151"
[HKCU\Software\adm914]
"a3_325" = "2346912100"
[HKCU\Software\adm914]
"a3_324" = "2339400837"
[HKCU\Software\adm914]
"a4_311" = "2229596631"
[HKCU\Software\adm914]
"a4_310" = "2222427510"
[HKCU\Software\adm914]
"a4_313" = "2243934873"
[HKCU\Software\adm914]
"a4_312" = "2236765752"
[HKCU\Software\adm914]
"a4_315" = "2258273115"
[HKCU\Software\adm914]
"a4_314" = "2251103994"
[HKCU\Software\adm914]
"a4_317" = "2272611357"
[HKCU\Software\adm914]
"a4_316" = "2265442236"
[HKCU\Software\adm914]
"a4_17" = "121875057"
[HKCU\Software\adm914]
"a4_16" = "114705936"
[HKCU\Software\adm914]
"a4_15" = "107536815"
[HKCU\Software\adm914]
"a4_14" = "100367694"
[HKCU\Software\adm914]
"a4_13" = "93198573"
[HKCU\Software\adm914]
"a4_12" = "86029452"
[HKCU\Software\adm914]
"a4_11" = "78860331"
[HKCU\Software\adm914]
"a4_10" = "71691210"
[HKCU\Software\adm914]
"a2_218" = "1562862801"
[HKCU\Software\adm914]
"a2_219" = "1570032971"
[HKCU\Software\adm914]
"a4_19" = "136213299"
[HKCU\Software\adm914]
"a4_18" = "129044178"
[HKCU\Software\adm914]
"a3_149" = "1051200052"
[HKCU\Software\adm914]
"a3_148" = "1044213333"
[HKCU\Software\Aas]
"a4_132" = "946323972"
[HKCU\Software\Aas]
"a4_131" = "939154851"
[HKCU\Software\Aas]
"a4_130" = "931985730"
[HKCU\Software\adm914]
"a3_143" = "1008235630"
[HKCU\Software\adm914]
"a3_142" = "1034865551"
[HKCU\Software\adm914]
"a3_141" = "1027813164"
[HKCU\Software\adm914]
"a3_140" = "986809165"
[HKCU\Software\adm914]
"a3_147" = "1070843378"
[HKCU\Software\adm914]
"a3_146" = "1063278867"
[HKCU\Software\adm914]
"a3_145" = "1022803120"
[HKCU\Software\adm914]
"a3_144" = "1015746769"
[HKCU\Software\adm914]
"a1_251" = "2919043682"
[HKCU\Software\adm914]
"a1_250" = "3084023169"
[HKCU\Software\adm914]
"a1_253" = "1528101542"
[HKCU\Software\adm914]
"a1_252" = "1114212034"
[HKCU\Software\adm914]
"a1_255" = "2000788710"
[HKCU\Software\adm914]
"a1_254" = "992275817"
[HKCU\Software\adm914]
"a1_257" = "1922436168"
[HKCU\Software\adm914]
"a1_256" = "3055552863"
[HKCU\Software\adm914]
"a1_259" = "3807333454"
[HKCU\Software\adm914]
"a1_258" = "4146909054"
[HKCU\Software\adm914]
"a1_47" = "465783481"
[HKCU\Software\adm914]
"a1_46" = "4000112082"
[HKCU\Software\adm914]
"a1_45" = "1726306644"
[HKCU\Software\adm914]
"a1_44" = "995960538"
[HKCU\Software\adm914]
"a1_43" = "2052613637"
[HKCU\Software\adm914]
"a1_42" = "340920785"
[HKCU\Software\adm914]
"a1_41" = "2436737764"
[HKCU\Software\adm914]
"a1_40" = "3972802422"
[HKCU\Software\adm914]
"a1_49" = "2655932100"
[HKCU\Software\adm914]
"a1_48" = "98244193"
[HKCU\Software\adm914]
"a1_325" = "169846171"
[HKCU\Software\adm914]
"a1_324" = "767784856"
[HKCU\Software\adm914]
"a1_327" = "3103198648"
[HKCU\Software\adm914]
"a1_326" = "3435600886"
[HKCU\Software\adm914]
"a1_321" = "268661353"
[HKCU\Software\adm914]
"a1_320" = "4226158614"
[HKCU\Software\adm914]
"a1_323" = "3448092346"
[HKCU\Software\adm914]
"a1_322" = "3451291225"
[HKCU\Software\adm914]
"a1_329" = "1460532117"
[HKCU\Software\adm914]
"a1_328" = "2633680627"
[HKCU\Software\adm914]
"a2_242" = "1734930040"
[HKCU\Software\Aas]
"a3_116" = "814879197"
[HKCU\Software\Aas]
"a3_117" = "821922428"
[HKCU\Software\Aas]
"a3_114" = "834001179"
[HKCU\Software\Aas]
"a3_115" = "807894458"
[HKCU\Software\Aas]
"a3_112" = "785940569"
[HKCU\Software\Aas]
"a3_113" = "826942712"
[HKCU\Software\Aas]
"a3_110" = "771902343"
[HKCU\Software\Aas]
"a3_111" = "778955814"
[HKCU\Software\Aas]
"a1_49" = "111303492"
[HKCU\Software\Aas]
"a1_48" = "2544725102"
[HKCU\Software\Aas]
"a3_118" = "862924447"
[HKCU\Software\Aas]
"a3_119" = "869974846"
[HKCU\Software\adm914\695404737]
"50183847" = "7329B17EFD1799058CC507B8062C360BD9EAA93FEC92CD8196CE019C2B644F8B5AC11E54BC8D921572BC5C39CB0308531810224E18BC57A14754D33BC6678182373E7B47500C9E1C82FC29BF389B2B6F410B7B9F141B58DC2BA76EF625D3FD2F450761A6DFFF889DE058FDD1002052BDDBCDC8FCA7DFBA8BD347C7A4809EC681"
[HKCU\Software\adm914]
"a4_126" = "903309246"
[HKCU\Software\adm914]
"a4_127" = "910478367"
[HKCU\Software\adm914]
"a4_124" = "888971004"
[HKCU\Software\adm914]
"a4_125" = "896140125"
[HKCU\Software\adm914]
"a4_122" = "874632762"
[HKCU\Software\adm914]
"a4_123" = "881801883"
[HKCU\Software\adm914]
"a4_120" = "860294520"
[HKCU\Software\adm914]
"a4_121" = "867463641"
[HKCU\Software\adm914]
"a4_128" = "917647488"
[HKCU\Software\adm914]
"a4_129" = "924816609"
[HKCU\Software\Aas]
"a4_11" = "78860331"
[HKCU\Software\Aas]
"a4_10" = "71691210"
[HKCU\Software\Aas]
"a4_13" = "93198573"
[HKCU\Software\Aas]
"a4_12" = "86029452"
[HKCU\Software\Aas]
"a4_15" = "107536815"
[HKCU\Software\Aas]
"a4_14" = "100367694"
[HKCU\Software\Aas]
"a4_17" = "121875057"
[HKCU\Software\Aas]
"a4_16" = "114705936"
[HKCU\Software\Aas]
"a4_19" = "136213299"
[HKCU\Software\Aas]
"a4_18" = "129044178"
[HKCU\Software\adm914]
"a2_139" = "996513270"
[HKCU\Software\adm914]
"a2_138" = "989346896"
[HKCU\Software\adm914]
"a2_137" = "982164416"
[HKCU\Software\adm914]
"a2_136" = "974996864"
[HKCU\Software\adm914]
"a2_135" = "967833302"
[HKCU\Software\adm914]
"a2_134" = "960663611"
[HKCU\Software\adm914]
"a2_133" = "953497873"
[HKCU\Software\adm914]
"a2_132" = "946328028"
[HKCU\Software\adm914]
"a2_131" = "939148507"
[HKCU\Software\adm914]
"a2_130" = "931980608"
[HKCU\Software\adm914]
"a2_230" = "1648901324"
[HKCU\Software\adm914]
"a3_208" = "1508042897"
[HKCU\Software\adm914]
"a3_209" = "1481479536"
[HKCU\Software\adm914]
"a2_231" = "1656063195"
[HKCU\Software\adm914]
"a3_204" = "1445501709"
[HKCU\Software\adm914]
"a3_205" = "1452935148"
[HKCU\Software\adm914]
"a3_206" = "1493540943"
[HKCU\Software\adm914]
"a3_207" = "1500990510"
[HKCU\Software\adm914]
"a3_200" = "1416957321"
[HKCU\Software\adm914]
"a3_201" = "1424012904"
[HKCU\Software\adm914]
"a3_202" = "1465012939"
[HKCU\Software\adm914]
"a3_203" = "1472069290"
[HKCU\Software\adm914]
"a2_233" = "1670401941"
[HKCU\Software\adm914]
"a2_234" = "1677581726"
[HKCU\Software\adm914]
"a2_235" = "1684746288"
[HKCU\Software\adm914]
"a4_272" = "1950000912"
[HKCU\Software\adm914]
"a4_273" = "1957170033"
[HKCU\Software\adm914]
"a4_270" = "1935662670"
[HKCU\Software\adm914]
"a4_271" = "1942831791"
[HKCU\Software\adm914]
"a4_276" = "1978677396"
[HKCU\Software\adm914]
"a2_236" = "1691920496"
[HKCU\Software\adm914]
"a4_274" = "1964339154"
[HKCU\Software\adm914]
"a4_275" = "1971508275"
[HKCU\Software\adm914]
"a4_278" = "1993015638"
[HKCU\Software\adm914]
"a2_237" = "1699085890"
[HKCU\Software\adm914]
"a3_330" = "2348811083"
[HKCU\Software\adm914]
"a3_331" = "2356391722"
[HKCU\Software\adm914]
"a3_332" = "2363313037"
[HKCU\Software\adm914]
"a3_333" = "2403923052"
[HKCU\Software\adm914]
"a3_334" = "2411434191"
[HKCU\Software\adm914]
"a3_335" = "2384805038"
[HKCU\Software\adm914]
"a4_308" = "2208089268"
[HKCU\Software\adm914]
"a4_309" = "2215258389"
[HKCU\Software\adm914]
"a4_306" = "2193751026"
[HKCU\Software\adm914]
"a4_307" = "2200920147"
[HKCU\Software\adm914]
"a4_304" = "2179412784"
[HKCU\Software\adm914]
"a4_305" = "2186581905"
[HKCU\Software\adm914]
"a4_302" = "2165074542"
[HKCU\Software\adm914]
"a4_303" = "2172243663"
[HKCU\Software\adm914]
"a4_300" = "2150736300"
[HKCU\Software\adm914]
"a4_301" = "2157905421"
[HKCU\Software\adm914]
"a2_267" = "1914152086"
[HKCU\Software\adm914]
"a2_266" = "1906988098"
[HKCU\Software\adm914]
"a2_265" = "1899822087"
[HKCU\Software\adm914]
"a2_264" = "1892651599"
[HKCU\Software\adm914]
"a2_263" = "1885473017"
[HKCU\Software\adm914]
"a2_262" = "1878304772"
[HKCU\Software\adm914]
"a2_261" = "1871134882"
[HKCU\Software\adm914]
"a2_260" = "1863969668"
[HKCU\Software\adm914]
"a2_269" = "1928487143"
[HKCU\Software\adm914]
"a2_268" = "1921320872"
[HKCU\Software\adm914]
"a3_158" = "1115723167"
[HKCU\Software\adm914]
"a3_159" = "1123171966"
[HKCU\Software\adm914]
"a3_150" = "1092335255"
[HKCU\Software\adm914]
"a3_151" = "1099256694"
[HKCU\Software\adm914]
"a3_152" = "1106313177"
[HKCU\Software\adm914]
"a3_153" = "1080269752"
[HKCU\Software\adm914]
"a3_154" = "1087177755"
[HKCU\Software\adm914]
"a3_155" = "1127784698"
[HKCU\Software\adm914]
"a3_156" = "1135234397"
[HKCU\Software\adm914]
"a3_157" = "1108732220"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\adm914]
"a4_7" = "50183847"
[HKCU\Software\Aas]
"a4_108" = "774265068"
[HKCU\Software\Aas]
"a4_109" = "781434189"
[HKCU\Software\adm914]
"a4_6" = "43014726"
[HKCU\Software\Aas]
"a4_102" = "731250342"
[HKCU\Software\Aas]
"a4_103" = "738419463"
[HKCU\Software\Aas]
"a4_100" = "716912100"
[HKCU\Software\Aas]
"a4_101" = "724081221"
[HKCU\Software\Aas]
"a4_106" = "759926826"
[HKCU\Software\Aas]
"a4_107" = "767095947"
[HKCU\Software\Aas]
"a4_104" = "745588584"
[HKCU\Software\Aas]
"a4_105" = "752757705"
[HKCU\Software\adm914]
"a4_4" = "28676484"
[HKCU\Software\adm914]
"a2_115" = "824443997"
[HKCU\Software\adm914]
"a4_2" = "14338242"
[HKCU\Software\adm914]
"a4_1" = "7169121"
[HKCU\Software\adm914]
"a4_0" = "0"
[HKCU\Software\adm914]
"a1_246" = "1599801723"
[HKCU\Software\adm914]
"a1_247" = "2791605932"
[HKCU\Software\adm914]
"a1_244" = "1749265525"
[HKCU\Software\adm914]
"a1_245" = "4219613981"
[HKCU\Software\adm914]
"a1_242" = "326590121"
[HKCU\Software\adm914]
"a1_243" = "3307781967"
[HKCU\Software\adm914]
"a1_240" = "2484361038"
[HKCU\Software\adm914]
"a1_241" = "1818349970"
[HKCU\Software\adm914]
"a1_248" = "3123496614"
[HKCU\Software\adm914]
"a1_249" = "2955553327"
[HKCU\Software\adm914]
"a4_175" = "1254596175"
[HKCU\Software\Aas]
"a4_87" = "623713527"
[HKCU\Software\Aas]
"a4_84" = "602206164"
[HKCU\Software\adm914]
"a1_338" = "1090896973"
[HKCU\Software\Aas]
"a4_85" = "609375285"
[HKCU\Software\adm914]
"a1_98" = "4234808684"
[HKCU\Software\adm914]
"a1_99" = "3404479033"
[HKCU\Software\adm914]
"a1_94" = "1416239086"
[HKCU\Software\adm914]
"a1_95" = "2484280132"
[HKCU\Software\adm914]
"a1_96" = "2504028987"
[HKCU\Software\adm914]
"a1_97" = "3654627199"
[HKCU\Software\adm914]
"a1_90" = "1856110118"
[HKCU\Software\adm914]
"a1_91" = "720289477"
[HKCU\Software\adm914]
"a1_92" = "3941104652"
[HKCU\Software\adm914]
"a1_93" = "3161102918"
[HKCU\Software\adm914]
"a4_173" = "1240257933"
[HKCU\Software\Aas]
"a4_81" = "580698801"
[HKCU\Software\adm914]
"a2_211" = "1512681358"
[HKCU\Software\adm914]
"a3_223" = "1581848126"
[HKCU\Software\adm914\695404737]
"28676484" = "35"
[HKCU\Software\Aas]
"a1_58" = "2451557287"
[HKCU\Software\Aas]
"a1_59" = "4143869700"
[HKCU\Software\Aas]
"a1_56" = "29606934"
[HKCU\Software\Aas]
"a1_57" = "808725188"
[HKCU\Software\Aas]
"a1_54" = "1230601921"
[HKCU\Software\Aas]
"a1_55" = "2453986149"
[HKCU\Software\Aas]
"a1_52" = "2080816108"
[HKCU\Software\Aas]
"a1_53" = "3844715075"
[HKCU\Software\Aas]
"a1_50" = "2999411359"
[HKCU\Software\Aas]
"a1_51" = "4124553996"
[HKCU\Software\adm914]
"a3_96" = "671531553"
[HKCU\Software\adm914]
"a3_97" = "678456960"
[HKCU\Software\adm914]
"a3_94" = "690601439"
[HKCU\Software\adm914]
"a3_95" = "698046910"
[HKCU\Software\adm914]
"a3_92" = "643003549"
[HKCU\Software\adm914]
"a3_93" = "649990524"
[HKCU\Software\adm914]
"a3_90" = "662056027"
[HKCU\Software\adm914]
"a3_91" = "669108282"
[HKCU\Software\adm914]
"a3_98" = "685968227"
[HKCU\Software\adm914]
"a3_99" = "726579138"
[HKCU\Software\Aas]
"a3_109" = "798021476"
[HKCU\Software\Aas]
"a3_108" = "790966981"
[HKCU\Software\Aas]
"a3_101" = "707522668"
[HKCU\Software\Aas]
"a3_100" = "733503437"
[HKCU\Software\Aas]
"a3_103" = "754977070"
[HKCU\Software\Aas]
"a3_102" = "714511503"
[HKCU\Software\Aas]
"a3_105" = "769475040"
[HKCU\Software\Aas]
"a3_104" = "762555713"
[HKCU\Software\Aas]
"a3_107" = "750493346"
[HKCU\Software\Aas]
"a3_106" = "742980099"
[HKCU\Software\adm914]
"a2_128" = "917646656"
[HKCU\Software\adm914]
"a2_129" = "924811965"
[HKCU\Software\adm914]
"a2_124" = "888965678"
[HKCU\Software\adm914]
"a2_125" = "896145269"
[HKCU\Software\adm914]
"a2_126" = "903315384"
[HKCU\Software\adm914]
"a2_127" = "910480913"
[HKCU\Software\adm914]
"a2_120" = "860296554"
[HKCU\Software\adm914]
"a2_121" = "867462120"
[HKCU\Software\adm914]
"a2_122" = "874628913"
[HKCU\Software\adm914]
"a2_123" = "881795187"
[HKCU\Software\adm914]
"a3_231" = "1672934854"
[HKCU\Software\adm914]
"a3_230" = "1665878375"
[HKCU\Software\adm914]
"a3_233" = "1653815816"
[HKCU\Software\adm914]
"a3_232" = "1646367145"
[HKCU\Software\adm914]
"a3_235" = "1701331786"
[HKCU\Software\adm914]
"a3_234" = "1660856043"
[HKCU\Software\adm914]
"a3_237" = "1682344844"
[HKCU\Software\adm914]
"a3_236" = "1708912429"
[HKCU\Software\adm914]
"a3_239" = "1730400462"
[HKCU\Software\adm914]
"a4_210" = "1505515410"
[HKCU\Software\adm914]
"a4_211" = "1512684531"
[HKCU\Software\adm914]
"a4_207" = "1484008047"
[HKCU\Software\adm914]
"a4_206" = "1476838926"
[HKCU\Software\adm914]
"a4_205" = "1469669805"
[HKCU\Software\adm914]
"a4_204" = "1462500684"
[HKCU\Software\adm914]
"a4_203" = "1455331563"
[HKCU\Software\adm914]
"a4_202" = "1448162442"
[HKCU\Software\adm914]
"a4_201" = "1440993321"
[HKCU\Software\adm914]
"a4_200" = "1433824200"
[HKCU\Software\adm914]
"a4_209" = "1498346289"
[HKCU\Software\adm914]
"a4_208" = "1491177168"
[HKCU\Software\adm914]
"a3_305" = "2203578832"
[HKCU\Software\adm914]
"a3_304" = "2162447729"
[HKCU\Software\adm914]
"a3_307" = "2183923218"
[HKCU\Software\adm914]
"a3_306" = "2210569651"
[HKCU\Software\adm914]
"a3_301" = "2174509132"
[HKCU\Software\adm914]
"a3_300" = "2167588845"
[HKCU\Software\adm914]
"a3_303" = "2155522190"
[HKCU\Software\adm914]
"a3_302" = "2148469807"
[HKCU\Software\adm914]
"a4_218" = "1562868378"
[HKCU\Software\adm914]
"a3_309" = "2231979860"
[HKCU\Software\adm914]
"a3_308" = "2191500021"
[HKCU\Software\adm914]
"a4_219" = "1570037499"
[HKCU\Software\adm914]
"a2_274" = "1964340771"
[HKCU\Software\adm914]
"a2_275" = "1971506914"
[HKCU\Software\adm914]
"a2_276" = "1978671548"
[HKCU\Software\adm914]
"a2_277" = "1985842911"
[HKCU\Software\adm914]
"a2_270" = "1935658786"
[HKCU\Software\adm914]
"a2_271" = "1942836586"
[HKCU\Software\adm914]
"a2_272" = "1950003950"
[HKCU\Software\adm914]
"a2_273" = "1957175128"
[HKCU\Software\adm914]
"a2_278" = "1993020414"
[HKCU\Software\adm914]
"a2_279" = "2000188572"
[HKCU\Software\adm914]
"a3_250" = "1809277179"
[HKCU\Software\adm914]
"a3_169" = "1228153416"
[HKCU\Software\adm914]
"a3_168" = "1187690985"
[HKCU\Software\adm914]
"a3_165" = "1199756484"
[HKCU\Software\adm914]
"a3_164" = "1192700005"
[HKCU\Software\adm914]
"a3_167" = "1180638470"
[HKCU\Software\adm914]
"a3_166" = "1206677671"
[HKCU\Software\adm914]
"a3_161" = "1171212096"
[HKCU\Software\adm914]
"a3_160" = "1163778785"
[HKCU\Software\adm914]
"a3_163" = "1151700866"
[HKCU\Software\adm914]
"a3_162" = "1144709923"
[HKCU\Software\Aas]
"a1_41" = "3135876567"
[HKCU\Software\Aas]
"a1_40" = "4279178621"
[HKCU\Software\Aas]
"a1_43" = "1471861889"
[HKCU\Software\Aas]
"a1_42" = "4071168545"
[HKCU\Software\Aas]
"a1_45" = "1043434068"
[HKCU\Software\Aas]
"a1_44" = "2409623832"
[HKCU\Software\Aas]
"a1_47" = "756112097"
[HKCU\Software\Aas]
"a1_46" = "683917008"
[HKCU\Software\Aas]
"a4_119" = "853125399"
[HKCU\Software\Aas]
"a4_118" = "845956278"
[HKCU\Software\Aas]
"a4_115" = "824448915"
[HKCU\Software\Aas]
"a4_114" = "817279794"
[HKCU\Software\Aas]
"a4_117" = "838787157"
[HKCU\Software\Aas]
"a4_116" = "831618036"
[HKCU\Software\Aas]
"a4_111" = "795772431"
[HKCU\Software\Aas]
"a4_110" = "788603310"
[HKCU\Software\Aas]
"a4_113" = "810110673"
[HKCU\Software\Aas]
"a4_112" = "802941552"
[HKCU\Software\adm914]
"a4_284" = "2036030364"
[HKCU\Software\adm914]
"a1_189" = "945208641"
[HKCU\Software\adm914]
"a1_188" = "1413222388"
[HKCU\Software\adm914]
"a2_363" = "2602388293"
[HKCU\Software\adm914]
"a1_181" = "2749519830"
[HKCU\Software\adm914]
"a1_180" = "1516723528"
[HKCU\Software\adm914]
"a1_183" = "3352771849"
[HKCU\Software\adm914]
"a1_182" = "4015010445"
[HKCU\Software\adm914]
"a1_185" = "2895395652"
[HKCU\Software\adm914]
"a1_184" = "79196930"
[HKCU\Software\adm914]
"a1_187" = "3123323820"
[HKCU\Software\adm914]
"a1_186" = "1664689162"
[HKCU\Software\adm914]
"a1_83" = "377333054"
[HKCU\Software\adm914]
"a1_82" = "1625840196"
[HKCU\Software\adm914]
"a1_81" = "2448829423"
[HKCU\Software\adm914]
"a1_80" = "935954181"
[HKCU\Software\adm914]
"a1_87" = "1218686378"
[HKCU\Software\adm914]
"a1_86" = "123825220"
[HKCU\Software\adm914]
"a1_85" = "3239556598"
[HKCU\Software\adm914]
"a1_84" = "3261945242"
[HKCU\Software\adm914]
"a1_347" = "1393311936"
[HKCU\Software\adm914]
"a1_346" = "933764932"
[HKCU\Software\adm914]
"a1_89" = "1012791786"
[HKCU\Software\adm914]
"a1_88" = "3592706161"
[HKCU\Software\adm914]
"a1_343" = "3810743214"
[HKCU\Software\adm914]
"a1_342" = "786371525"
[HKCU\Software\adm914]
"a1_341" = "1727392135"
[HKCU\Software\adm914]
"a1_340" = "3291488905"
[HKCU\Software\adm914]
"a2_365" = "2616723612"
[HKCU\Software\adm914]
"a2_217" = "1555695378"
[HKCU\Software\adm914]
"a2_249" = "1785118119"
[HKCU\Software\adm914]
"a2_248" = "1777936191"
[HKCU\Software\adm914]
"a1_299" = "426982199"
[HKCU\Software\adm914]
"a1_298" = "2023232084"
[HKCU\Software\adm914]
"a1_295" = "737081205"
[HKCU\Software\adm914]
"a1_294" = "2508400437"
[HKCU\Software\adm914]
"a1_297" = "2431381557"
[HKCU\Software\adm914]
"a1_296" = "4092084581"
[HKCU\Software\adm914]
"a1_291" = "2159963390"
[HKCU\Software\adm914]
"a1_290" = "1745536173"
[HKCU\Software\adm914]
"a1_293" = "4245745086"
[HKCU\Software\adm914]
"a1_292" = "3391844633"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a1_29" = "2081206081"
[HKCU\Software\Aas]
"a1_28" = "692068557"
[HKCU\Software\Aas]
"a1_23" = "1393522403"
[HKCU\Software\Aas]
"a1_22" = "767601794"
[HKCU\Software\Aas]
"a1_21" = "3088289700"
[HKCU\Software\Aas]
"a1_20" = "1050578346"
[HKCU\Software\Aas]
"a1_27" = "3455136104"
[HKCU\Software\Aas]
"a1_26" = "1522734467"
[HKCU\Software\Aas]
"a1_25" = "1333846048"
[HKCU\Software\Aas]
"a1_24" = "2020335726"
[HKCU\Software\adm914]
"a3_85" = "626078324"
[HKCU\Software\adm914]
"a3_84" = "585599381"
[HKCU\Software\adm914]
"a3_87" = "607025846"
[HKCU\Software\adm914]
"a3_86" = "633134807"
[HKCU\Software\adm914]
"a3_81" = "597665008"
[HKCU\Software\adm914]
"a3_80" = "590100497"
[HKCU\Software\adm914]
"a3_83" = "578088242"
[HKCU\Software\adm914]
"a3_82" = "571031891"
[HKCU\Software\adm914]
"a3_89" = "654607352"
[HKCU\Software\adm914]
"a3_88" = "614065945"
[HKCU\Software\Aas]
"a2_31" = "222248444"
[HKCU\Software\Aas]
"a2_30" = "215079225"
[HKCU\Software\Aas]
"a2_33" = "236580588"
[HKCU\Software\Aas]
"a2_32" = "229415593"
[HKCU\Software\Aas]
"a2_35" = "250913468"
[HKCU\Software\Aas]
"a2_34" = "243745065"
[HKCU\Software\Aas]
"a2_37" = "265264706"
[HKCU\Software\Aas]
"a2_36" = "258082163"
[HKCU\Software\Aas]
"a2_39" = "279604744"
[HKCU\Software\Aas]
"a2_38" = "272418805"
[HKCU\Software\adm914]
"a1_303" = "3702958993"
[HKCU\Software\Aas]
"a4_79" = "566360559"
[HKCU\Software\Aas]
"a4_78" = "559191438"
[HKCU\Software\adm914]
"a1_302" = "1088951352"
[HKCU\Software\Aas]
"a4_73" = "523345833"
[HKCU\Software\Aas]
"a4_72" = "516176712"
[HKCU\Software\Aas]
"a4_71" = "509007591"
[HKCU\Software\Aas]
"a4_70" = "501838470"
[HKCU\Software\Aas]
"a4_77" = "552022317"
[HKCU\Software\Aas]
"a4_76" = "544853196"
[HKCU\Software\Aas]
"a4_75" = "537684075"
[HKCU\Software\Aas]
"a4_74" = "530514954"
[HKCU\Software\adm914]
"a2_111" = "795778589"
[HKCU\Software\adm914]
"a2_110" = "788607526"
[HKCU\Software\adm914]
"a2_113" = "810114601"
[HKCU\Software\adm914]
"a2_112" = "802946900"
[HKCU\Software\adm914]
"a4_3" = "21507363"
[HKCU\Software\adm914]
"a2_114" = "817276151"
[HKCU\Software\adm914]
"a2_117" = "838794269"
[HKCU\Software\adm914]
"a2_116" = "831611214"
[HKCU\Software\adm914]
"a2_119" = "853127391"
[HKCU\Software\adm914]
"a2_118" = "845962619"
[HKCU\Software\adm914]
"a4_9" = "64522089"
[HKCU\Software\adm914]
"a4_8" = "57352968"
[HKCU\Software\adm914]
"a1_305" = "2558885445"
[HKCU\Software\adm914]
"a2_360" = "2580888747"
[HKCU\Software\adm914]
"a1_304" = "2857129101"
[HKCU\Software\adm914]
"a3_226" = "1636957155"
[HKCU\Software\adm914]
"a3_227" = "1610835010"
[HKCU\Software\adm914]
"a3_224" = "1588900513"
[HKCU\Software\adm914]
"a3_225" = "1629904640"
[HKCU\Software\adm914]
"a3_222" = "1608411743"
[HKCU\Software\adm914]
"a4_199" = "1426655079"
[HKCU\Software\adm914]
"a3_220" = "1593910557"
[HKCU\Software\adm914]
"a3_221" = "1600963068"
[HKCU\Software\Aas\695404737]
"7169121" = "145"
[HKCU\Software\adm914]
"a3_228" = "1617821733"
[HKCU\Software\adm914]
"a3_229" = "1624878212"
[HKCU\Software\adm914]
"a4_214" = "1534191894"
[HKCU\Software\adm914]
"a4_215" = "1541361015"
[HKCU\Software\adm914]
"a4_216" = "1548530136"
[HKCU\Software\adm914]
"a4_217" = "1555699257"
[HKCU\Software\adm914]
"a2_9" = "64524657"
[HKCU\Software\adm914]
"a2_8" = "57358257"
[HKCU\Software\adm914]
"a4_212" = "1519853652"
[HKCU\Software\adm914]
"a4_213" = "1527022773"
[HKCU\Software\adm914]
"a2_5" = "35843092"
[HKCU\Software\adm914]
"a2_4" = "28675436"
[HKCU\Software\adm914]
"a2_7" = "50178272"
[HKCU\Software\adm914]
"a2_6" = "43011046"
[HKCU\Software\adm914]
"a2_1" = "7168686"
[HKCU\Software\adm914]
"a2_0" = "1743"
[HKCU\Software\adm914]
"a2_3" = "21511777"
[HKCU\Software\adm914]
"a2_2" = "14340484"
[HKCU\Software\adm914]
"a3_318" = "2262947391"
[HKCU\Software\adm914]
"a3_319" = "2303947422"
[HKCU\Software\adm914]
"a3_312" = "2219913337"
[HKCU\Software\adm914]
"a3_313" = "2226969816"
[HKCU\Software\adm914]
"a3_310" = "2239032119"
[HKCU\Software\adm914]
"a3_311" = "2246547350"
[HKCU\Software\adm914]
"a3_316" = "2248442365"
[HKCU\Software\adm914]
"a3_317" = "2255891036"
[HKCU\Software\adm914]
"a3_314" = "2267969723"
[HKCU\Software\adm914]
"a3_315" = "2275009818"
[HKCU\Software\adm914]
"a3_172" = "1216092013"
[HKCU\Software\adm914]
"a3_173" = "1223668684"
[HKCU\Software\adm914]
"a3_170" = "1235734059"
[HKCU\Software\adm914]
"a3_171" = "1209100938"
[HKCU\Software\adm914]
"a3_176" = "1245078769"
[HKCU\Software\adm914]
"a3_177" = "1252065616"
[HKCU\Software\adm914]
"a3_174" = "1264148399"
[HKCU\Software\adm914]
"a3_175" = "1271199758"
[HKCU\Software\adm914]
"a2_241" = "1727754663"
[HKCU\Software\adm914]
"a2_240" = "1720585179"
[HKCU\Software\adm914]
"a3_178" = "1292676403"
[HKCU\Software\adm914]
"a3_179" = "1300122002"
[HKCU\Software\adm914]
"a2_245" = "1756432715"
[HKCU\Software\adm914]
"a2_244" = "1749237620"
[HKCU\Software\adm914]
"a2_247" = "1770770330"
[HKCU\Software\adm914]
"a2_246" = "1763601659"
[HKCU\Software\Aas]
"a2_17" = "121878036"
[HKCU\Software\Aas]
"a2_16" = "114708582"
[HKCU\Software\Aas]
"a2_15" = "107543232"
[HKCU\Software\Aas]
"a2_14" = "100362012"
[HKCU\Software\Aas]
"a2_13" = "93206883"
[HKCU\Software\Aas]
"a2_12" = "86027549"
[HKCU\Software\Aas]
"a2_11" = "78860252"
[HKCU\Software\Aas]
"a2_10" = "71693673"
[HKCU\Software\Aas]
"a2_19" = "136209430"
[HKCU\Software\Aas]
"a2_18" = "129046589"
[HKCU\Software\Aas]
"a1_114" = "4142330733"
[HKCU\Software\Aas]
"a1_115" = "1894606031"
[HKCU\Software\Aas]
"a1_116" = "626655673"
[HKCU\Software\Aas]
"a1_117" = "988171753"
[HKCU\Software\Aas]
"a1_110" = "1279945363"
[HKCU\Software\Aas]
"a1_111" = "3240937175"
[HKCU\Software\Aas]
"a1_112" = "1878724137"
[HKCU\Software\Aas]
"a1_113" = "3431131162"
[HKCU\Software\Aas]
"a1_118" = "55546378"
[HKCU\Software\Aas]
"a1_119" = "2729215545"
[HKCU\Software\adm914]
"a1_198" = "2854621040"
[HKCU\Software\adm914]
"a1_199" = "963191513"
[HKCU\Software\adm914]
"a1_196" = "1573477366"
[HKCU\Software\adm914]
"a1_197" = "1001114838"
[HKCU\Software\adm914]
"a1_194" = "3602187070"
[HKCU\Software\adm914]
"a1_195" = "3688046891"
[HKCU\Software\adm914]
"a1_192" = "2380425869"
[HKCU\Software\adm914]
"a1_193" = "1683601952"
[HKCU\Software\adm914]
"a1_190" = "1138529712"
[HKCU\Software\adm914]
"a1_191" = "2060290789"
[HKCU\Software\adm914]
"a1_358" = "3998000841"
[HKCU\Software\adm914]
"a1_359" = "1923847098"
[HKCU\Software\adm914]
"a1_354" = "2718269565"
[HKCU\Software\adm914]
"a1_355" = "1500464094"
[HKCU\Software\adm914]
"a1_356" = "3983006554"
[HKCU\Software\adm914]
"a1_357" = "1451092364"
[HKCU\Software\adm914]
"a1_350" = "1870158802"
[HKCU\Software\adm914]
"a1_351" = "1144639119"
[HKCU\Software\adm914]
"a1_352" = "3303266605"
[HKCU\Software\adm914]
"a1_353" = "40691176"
[HKCU\Software\adm914]
"a1_282" = "211693751"
[HKCU\Software\adm914]
"a1_283" = "1039399297"
[HKCU\Software\adm914]
"a1_280" = "1384688470"
[HKCU\Software\adm914]
"a1_281" = "1024194757"
[HKCU\Software\adm914]
"a1_286" = "33465094"
[HKCU\Software\adm914]
"a1_287" = "1740559735"
[HKCU\Software\adm914]
"a1_284" = "2358067232"
[HKCU\Software\adm914]
"a1_285" = "2101462187"
[HKCU\Software\adm914]
"a1_288" = "1212706677"
[HKCU\Software\adm914]
"a1_289" = "3589026620"
[HKCU\Software\Aas]
"a1_38" = "3950349360"
[HKCU\Software\Aas]
"a1_39" = "3712091800"
[HKCU\Software\Aas]
"a1_30" = "2726533860"
[HKCU\Software\Aas]
"a1_31" = "3097054589"
[HKCU\Software\Aas]
"a1_32" = "4166483356"
[HKCU\Software\Aas]
"a1_33" = "3225505503"
[HKCU\Software\Aas]
"a1_34" = "2116925849"
[HKCU\Software\Aas]
"a1_35" = "1699808796"
[HKCU\Software\Aas]
"a1_36" = "376427999"
[HKCU\Software\Aas]
"a1_37" = "3345409366"
[HKCU\Software\Aas]
"a2_108" = "774273211"
[HKCU\Software\Aas]
"a2_109" = "781427187"
[HKCU\Software\Aas]
"a2_100" = "716908704"
[HKCU\Software\Aas]
"a2_101" = "724078558"
[HKCU\Software\Aas]
"a2_102" = "731244617"
[HKCU\Software\Aas]
"a2_103" = "738426246"
[HKCU\Software\Aas]
"a2_104" = "745594442"
[HKCU\Software\Aas]
"a2_105" = "752760480"
[HKCU\Software\Aas]
"a2_106" = "759925927"
[HKCU\Software\Aas]
"a2_107" = "767091684"
[HKCU\Software\Aas]
"a2_28" = "200727421"
[HKCU\Software\Aas]
"a2_29" = "207912618"
[HKCU\Software\Aas]
"a2_26" = "186394818"
[HKCU\Software\Aas]
"a2_27" = "193574378"
[HKCU\Software\Aas]
"a2_24" = "172061634"
[HKCU\Software\Aas]
"a2_25" = "179231562"
[HKCU\Software\Aas]
"a2_22" = "157728729"
[HKCU\Software\Aas]
"a2_23" = "164896728"
[HKCU\Software\Aas]
"a2_20" = "143379083"
[HKCU\Software\Aas]
"a2_21" = "150544185"
[HKCU\Software\Aas]
"a4_68" = "487500228"
[HKCU\Software\Aas]
"a4_69" = "494669349"
[HKCU\Software\Aas]
"a4_60" = "430147260"
[HKCU\Software\Aas]
"a4_61" = "437316381"
[HKCU\Software\Aas]
"a4_62" = "444485502"
[HKCU\Software\Aas]
"a4_63" = "451654623"
[HKCU\Software\Aas]
"a4_64" = "458823744"
[HKCU\Software\Aas]
"a4_65" = "465992865"
[HKCU\Software\Aas]
"a4_66" = "473161986"
[HKCU\Software\Aas]
"a4_67" = "480331107"
[HKCU\Software\adm914]
"a4_197" = "1412316837"
[HKCU\Software\adm914]
"a4_196" = "1405147716"
[HKCU\Software\adm914]
"a4_195" = "1397978595"
[HKCU\Software\adm914]
"a4_194" = "1390809474"
[HKCU\Software\adm914]
"a4_193" = "1383640353"
[HKCU\Software\adm914]
"a4_192" = "1376471232"
[HKCU\Software\adm914]
"a4_191" = "1369302111"
[HKCU\Software\adm914]
"a4_190" = "1362132990"
[HKCU\Software\adm914]
"a2_108" = "774261223"
[HKCU\Software\adm914]
"a2_109" = "781429583"
[HKCU\Software\Aas]
"a2_7" = "50176954"
[HKCU\Software\Aas]
"a2_6" = "43009444"
[HKCU\Software\Aas]
"a2_5" = "35841042"
[HKCU\Software\Aas]
"a2_4" = "28673537"
[HKCU\Software\Aas]
"a2_3" = "21498089"
[HKCU\Software\Aas]
"a2_2" = "14346572"
[HKCU\Software\Aas]
"a2_1" = "7173091"
[HKCU\Software\Aas]
"a2_0" = "9832"
[HKCU\Software\Aas]
"a2_9" = "64528830"
[HKCU\Software\Aas]
"a2_8" = "57360172"
[HKCU\Software\Aas]
"a4_5" = "35845605"
[HKCU\Software\Aas]
"a4_4" = "28676484"
[HKCU\Software\Aas]
"a4_7" = "50183847"
[HKCU\Software\Aas]
"a4_6" = "43014726"
[HKCU\Software\Aas]
"a4_1" = "7169121"
[HKCU\Software\Aas]
"a4_0" = "0"
[HKCU\Software\Aas]
"a4_3" = "21507363"
[HKCU\Software\Aas]
"a4_2" = "14338242"
[HKCU\Software\Aas]
"a4_9" = "64522089"
[HKCU\Software\Aas]
"a4_8" = "57352968"
[HKCU\Software\adm914]
"a3_369" = "2628700560"
[HKCU\Software\adm914]
"a3_368" = "2621648177"
[HKCU\Software\adm914]
"a3_367" = "2647753038"
[HKCU\Software\adm914]
"a3_366" = "2640766191"
[HKCU\Software\adm914]
"a3_365" = "2600171532"
[HKCU\Software\adm914]
"a3_364" = "2592726957"
[HKCU\Software\adm914]
"a3_363" = "2585670602"
[HKCU\Software\adm914]
"a3_362" = "2611779435"
[HKCU\Software\adm914]
"a3_361" = "2604788360"
[HKCU\Software\adm914]
"a3_360" = "2564181545"
[HKCU\Software\adm914]
"a3_107" = "750490314"
[HKCU\Software\Aas]
"a1_85" = "3925022304"
[HKCU\Software\adm914]
"a3_105" = "769478024"
[HKCU\Software\adm914]
"a3_104" = "762552617"
[HKCU\Software\adm914]
"a3_103" = "754976070"
[HKCU\Software\adm914]
"a3_102" = "714512615"
[HKCU\Software\adm914]
"a3_101" = "707525636"
[HKCU\Software\Aas]
"a1_84" = "272775309"
[HKCU\Software\adm914]
"a2_256" = "1835299369"
[HKCU\Software\adm914]
"a2_257" = "1842468513"
[HKCU\Software\adm914]
"a2_254" = "1820951494"
[HKCU\Software\adm914]
"a2_255" = "1828121687"
[HKCU\Software\adm914]
"a2_252" = "1806626676"
[HKCU\Software\Aas]
"a1_87" = "3855615690"
[HKCU\Software\adm914]
"a3_109" = "798022412"
[HKCU\Software\adm914]
"a3_108" = "790970029"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 72 0C D1 E2 15 FA C6 7B DB 81 FA 15 51 D8 0B"
[HKCU\Software\adm914]
"a4_228" = "1634559588"
[HKCU\Software\Aas]
"a1_86" = "1452634312"
[HKCU\Software\adm914]
"a4_221" = "1584375741"
[HKCU\Software\Aas]
"a1_81" = "2418611688"
[HKCU\Software\adm914]
"a4_223" = "1598713983"
[HKCU\Software\adm914]
"a4_222" = "1591544862"
[HKCU\Software\adm914]
"a4_225" = "1613052225"
[HKCU\Software\adm914]
"a4_224" = "1605883104"
[HKCU\Software\adm914]
"a4_227" = "1627390467"
[HKCU\Software\Aas]
"a1_80" = "3532132381"
[HKCU\Software\Aas]
"a1_83" = "291880385"
[HKCU\Software\adm914]
"a2_107" = "767093411"
[HKCU\Software\Aas]
"a1_82" = "104579502"
[HKCU\Software\adm914]
"a4_277" = "1985846517"
[HKCU\Software\adm914]
"a2_104" = "745594769"
[HKCU\Software\adm914]
"a4_372" = "2666913012"
[HKCU\Software\Aas\695404737]
"43014726" = "0B00687474703A2F2F6A6577656C6C65727962617A6161722E6E65742F6C6F676F2E67696600687474703A2F2F63617361656261722E636F6D2E62722F6C6F676F2E67696600687474703A2F2F63616E6F7373616468756C652E696E2F6C6F676F2E67696600687474703A2F2F63616E7365736961736B6E65666573692E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F686F773267657468617A616E61742E686F2E66756E7069632E64652F6C6F676F2E67696600687474703A2F2F7777772E65766973686F702E64652F6C6F676F2E67696600687474703A2F2F6368696875616875617570696E67686F6D652E636F6D2F6C6F676F2E67696600687474703A2F2F64656861737061732E636F6D2F6C6F676F2E67696600687474703A2F2F64657664696A6974616C2E636F6D2F6C6F676F2E67696600687474703A2F2F736F6272656E61747572616C62722E6E65742F6C6F676F2E67696600687474703A2F2F6469726569746F7075626C69636F2E636F6D2E62722F6C6F676F2E676966"
[HKCU\Software\adm914]
"a4_279" = "2000184759"
[HKCU\Software\adm914]
"a4_374" = "2681251254"
[HKCU\Software\Aas]
"a3_130" = "915379051"
[HKCU\Software\adm914]
"a3_336" = "2391857425"
[HKCU\Software\Aas]
"a3_131" = "922302346"
[HKCU\Software\adm914]
"a3_337" = "2432845296"
[HKCU\Software\Aas]
"a3_132" = "962897965"
[HKCU\Software\Aas]
"a1_107" = "516131805"
[HKCU\Software\Aas]
"a1_106" = "262120564"
[HKCU\Software\Aas]
"a1_105" = "3215812354"
[HKCU\Software\Aas]
"a1_104" = "2383000628"
[HKCU\Software\Aas]
"a1_103" = "2423355730"
[HKCU\Software\Aas]
"a1_102" = "1883199335"
[HKCU\Software\Aas]
"a1_101" = "2040266006"
[HKCU\Software\Aas]
"a1_100" = "3607084284"
[HKCU\Software\Aas]
"a1_109" = "2801603352"
[HKCU\Software\Aas]
"a1_108" = "2565570386"
[HKCU\Software\adm914]
"a1_163" = "966804654"
[HKCU\Software\adm914]
"a1_162" = "3321320267"
[HKCU\Software\adm914]
"a1_161" = "2331962963"
[HKCU\Software\adm914]
"a1_160" = "1762984053"
[HKCU\Software\adm914]
"a1_167" = "3864368019"
[HKCU\Software\adm914]
"a1_166" = "176056251"
[HKCU\Software\adm914]
"a1_165" = "615351609"
[HKCU\Software\adm914]
"a1_164" = "2403705695"
[HKCU\Software\adm914]
"a1_169" = "897746008"
[HKCU\Software\adm914]
"a1_168" = "749536876"
[HKCU\Software\adm914]
"a1_361" = "1623409593"
[HKCU\Software\adm914]
"a1_360" = "890147540"
[HKCU\Software\adm914]
"a1_363" = "1397392968"
[HKCU\Software\adm914]
"a1_362" = "791951508"
[HKCU\Software\adm914]
"a1_365" = "3312262809"
[HKCU\Software\adm914]
"a1_364" = "13189590"
[HKCU\Software\adm914]
"a1_367" = "4286678865"
[HKCU\Software\adm914]
"a1_366" = "3964976403"
[HKCU\Software\adm914]
"a1_369" = "3654170534"
[HKCU\Software\adm914]
"a1_368" = "4111584259"
[HKCU\Software\adm914\695404737]
"7169121" = "247"
[HKCU\Software\adm914]
"a2_88" = "630888632"
[HKCU\Software\adm914]
"a2_89" = "638043297"
[HKCU\Software\adm914]
"a2_86" = "616539736"
[HKCU\Software\adm914]
"a2_87" = "623709791"
[HKCU\Software\adm914]
"a2_84" = "602206888"
[HKCU\Software\adm914]
"a2_85" = "609372171"
[HKCU\Software\adm914]
"a2_82" = "587871058"
[HKCU\Software\adm914]
"a2_83" = "595041933"
[HKCU\Software\adm914]
"a2_80" = "573523991"
[HKCU\Software\adm914]
"a2_81" = "580704205"
[HKCU\Software\Aas]
"a2_119" = "853127912"
[HKCU\Software\Aas]
"a2_118" = "845961369"
[HKCU\Software\Aas]
"a2_113" = "810111668"
[HKCU\Software\Aas]
"a2_112" = "802943979"
[HKCU\Software\Aas]
"a2_111" = "795778724"
[HKCU\Software\Aas]
"a2_110" = "788611070"
[HKCU\Software\Aas]
"a2_117" = "838792606"
[HKCU\Software\Aas]
"a2_116" = "831612746"
[HKCU\Software\Aas]
"a2_115" = "824446933"
[HKCU\Software\Aas]
"a2_114" = "817276726"
[HKCU\Software\adm914]
"a1_335" = "2554481235"
[HKCU\Software\Aas]
"a2_59" = "422983812"
[HKCU\Software\Aas]
"a2_58" = "415804053"
[HKCU\Software\Aas]
"a2_53" = "379965865"
[HKCU\Software\Aas]
"a2_52" = "372798767"
[HKCU\Software\Aas]
"a2_51" = "365618012"
[HKCU\Software\Aas]
"a2_50" = "358449786"
[HKCU\Software\Aas]
"a2_57" = "408648142"
[HKCU\Software\Aas]
"a2_56" = "401468783"
[HKCU\Software\Aas]
"a2_55" = "394309773"
[HKCU\Software\Aas]
"a2_54" = "387134182"
[HKCU\Software\Aas]
"a4_55" = "394301655"
[HKCU\Software\Aas]
"a4_54" = "387132534"
[HKCU\Software\Aas]
"a4_57" = "408639897"
[HKCU\Software\Aas]
"a4_56" = "401470776"
[HKCU\Software\Aas]
"a4_51" = "365625171"
[HKCU\Software\adm914]
"a4_181" = "1297610901"
[HKCU\Software\Aas]
"a4_53" = "379963413"
[HKCU\Software\Aas]
"a4_52" = "372794292"
[HKCU\Software\Aas]
"a4_59" = "422978139"
[HKCU\Software\Aas]
"a4_58" = "415809018"
[HKCU\Software\adm914]
"a2_232" = "1663233809"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\adm914]
"a3_374" = "2664678391"
[HKCU\Software\adm914]
"a3_375" = "2705157206"
[HKCU\Software\adm914]
"a3_370" = "2669179507"
[HKCU\Software\adm914]
"a3_371" = "2676694738"
[HKCU\Software\adm914]
"a3_372" = "2683746997"
[HKCU\Software\adm914]
"a3_373" = "2657101588"
[HKCU\Software\adm914]
"a3_114" = "834000243"
[HKCU\Software\adm914]
"a3_115" = "807891410"
[HKCU\Software\adm914]
"a3_116" = "814882229"
[HKCU\Software\adm914]
"a3_117" = "821921300"
[HKCU\Software\adm914]
"a3_110" = "771901423"
[HKCU\Software\adm914]
"a3_111" = "778952782"
[HKCU\Software\adm914]
"a3_112" = "785943601"
[HKCU\Software\adm914]
"a3_113" = "826943632"
[HKCU\Software\adm914]
"a3_118" = "862921463"
[HKCU\Software\adm914]
"a3_119" = "869977942"
[HKCU\Software\adm914]
"a4_238" = "1706250798"
[HKCU\Software\adm914]
"a4_239" = "1713419919"
[HKCU\Software\adm914]
"a4_236" = "1691912556"
[HKCU\Software\adm914]
"a4_237" = "1699081677"
[HKCU\Software\adm914]
"a4_234" = "1677574314"
[HKCU\Software\adm914]
"a4_235" = "1684743435"
[HKCU\Software\adm914]
"a4_232" = "1663236072"
[HKCU\Software\adm914]
"a4_233" = "1670405193"
[HKCU\Software\adm914]
"a4_230" = "1648897830"
[HKCU\Software\adm914]
"a4_231" = "1656066951"
[HKCU\Software\Aas]
"a1_132" = "384144711"
[HKCU\Software\Aas]
"a1_130" = "690441866"
[HKCU\Software\Aas]
"a1_131" = "56680544"
[HKCU\Software\adm914]
"a4_88" = "630882648"
[HKCU\Software\adm914]
"a4_89" = "638051769"
[HKCU\Software\adm914]
"a4_80" = "573529680"
[HKCU\Software\adm914]
"a4_81" = "580698801"
[HKCU\Software\adm914]
"a4_82" = "587867922"
[HKCU\Software\adm914]
"a4_83" = "595037043"
[HKCU\Software\adm914]
"a4_84" = "602206164"
[HKCU\Software\adm914]
"a4_85" = "609375285"
[HKCU\Software\adm914]
"a4_86" = "616544406"
[HKCU\Software\adm914]
"a4_87" = "623713527"
[HKCU\Software\adm914]
"a1_170" = "2238620606"
[HKCU\Software\adm914]
"a1_171" = "1447519901"
[HKCU\Software\adm914]
"a1_172" = "1611864581"
[HKCU\Software\adm914]
"a1_173" = "2379136987"
[HKCU\Software\adm914]
"a1_174" = "4256917077"
[HKCU\Software\adm914]
"a1_175" = "1466278913"
[HKCU\Software\adm914]
"a1_176" = "3950792717"
[HKCU\Software\adm914]
"a1_177" = "20918364"
[HKCU\Software\adm914]
"a1_178" = "650829222"
[HKCU\Software\adm914]
"a1_179" = "1393574301"
[HKCU\Software\adm914]
"a1_376" = "2492070604"
[HKCU\Software\adm914]
"a1_374" = "4095118314"
[HKCU\Software\adm914]
"a1_375" = "2261616965"
[HKCU\Software\adm914]
"a1_372" = "3182957444"
[HKCU\Software\adm914]
"a1_373" = "3658752926"
[HKCU\Software\adm914]
"a1_370" = "3677953032"
[HKCU\Software\adm914]
"a1_371" = "2762866927"
[HKCU\Software\Aas]
"a4_37" = "265257477"
[HKCU\Software\adm914]
"a2_99" = "709739701"
[HKCU\Software\adm914]
"a2_98" = "702575721"
[HKCU\Software\Aas]
"a4_36" = "258088356"
[HKCU\Software\adm914]
"a2_95" = "681061311"
[HKCU\Software\adm914]
"a2_94" = "673890964"
[HKCU\Software\adm914]
"a2_97" = "695408991"
[HKCU\Software\adm914]
"a2_96" = "688241727"
[HKCU\Software\adm914]
"a2_91" = "652392760"
[HKCU\Software\adm914]
"a2_90" = "645226082"
[HKCU\Software\adm914]
"a2_93" = "666724073"
[HKCU\Software\adm914]
"a2_92" = "659555708"
[HKCU\Software\Aas]
"a4_34" = "243750114"
[HKCU\Software\Aas]
"a4_33" = "236580993"
[HKCU\Software\Aas]
"a4_32" = "229411872"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_31" = "222242751"
[HKCU\Software\Aas]
"a4_30" = "215073630"
[HKCU\Software\adm914]
"a3_52" = "389744117"
[HKCU\Software\adm914]
"a3_53" = "396799572"
[HKCU\Software\adm914]
"a3_50" = "341769395"
[HKCU\Software\adm914]
"a3_51" = "348756242"
[HKCU\Software\adm914]
"a3_56" = "384734073"
[HKCU\Software\adm914]
"a3_57" = "425213912"
[HKCU\Software\adm914]
"a3_54" = "370166327"
[HKCU\Software\adm914]
"a3_55" = "377747094"
[HKCU\Software\adm914]
"a3_58" = "432790459"
[HKCU\Software\adm914]
"a3_59" = "406144026"
[HKCU\Software\Aas]
"a2_128" = "917645562"
[HKCU\Software\Aas]
"a2_129" = "924811966"
[HKCU\Software\Aas]
"a2_126" = "903315315"
[HKCU\Software\Aas]
"a2_127" = "910482024"
[HKCU\Software\Aas]
"a2_124" = "888963725"
[HKCU\Software\Aas]
"a2_125" = "896147150"
[HKCU\Software\Aas]
"a2_122" = "874630597"
[HKCU\Software\Aas]
"a2_123" = "881799036"
[HKCU\Software\Aas]
"a2_120" = "860297105"
[HKCU\Software\Aas]
"a2_121" = "867460638"
[HKCU\Software\Aas]
"a1_12" = "1174665665"
[HKCU\Software\Aas]
"a1_13" = "4076776892"
[HKCU\Software\Aas]
"a1_10" = "1071546649"
[HKCU\Software\Aas]
"a1_11" = "2318739959"
[HKCU\Software\Aas]
"a1_16" = "1472144990"
[HKCU\Software\Aas]
"a1_17" = "3772702960"
[HKCU\Software\Aas]
"a1_14" = "4170948361"
[HKCU\Software\Aas]
"a1_15" = "247433699"
[HKCU\Software\Aas]
"a1_18" = "1449162629"
[HKCU\Software\Aas]
"a1_19" = "3052690794"
[HKCU\Software\Aas]
"a2_48" = "344116756"
[HKCU\Software\Aas]
"a2_49" = "351283759"
[HKCU\Software\Aas]
"a2_40" = "286767228"
[HKCU\Software\Aas]
"a2_41" = "293931777"
[HKCU\Software\Aas]
"a2_42" = "301093791"
[HKCU\Software\Aas]
"a2_43" = "308281026"
[HKCU\Software\Aas]
"a2_44" = "315449125"
[HKCU\Software\Aas]
"a2_45" = "322602330"
[HKCU\Software\Aas]
"a2_46" = "329787477"
[HKCU\Software\Aas]
"a2_47" = "336949694"
[HKCU\Software\Aas]
"a4_42" = "301103082"
[HKCU\Software\Aas]
"a4_43" = "308272203"
[HKCU\Software\Aas]
"a4_40" = "286764840"
[HKCU\Software\Aas]
"a4_41" = "293933961"
[HKCU\Software\Aas]
"a4_46" = "329779566"
[HKCU\Software\Aas]
"a4_47" = "336948687"
[HKCU\Software\Aas]
"a4_44" = "315441324"
[HKCU\Software\Aas]
"a4_45" = "322610445"
[HKCU\Software\Aas]
"a4_48" = "344117808"
[HKCU\Software\Aas]
"a4_49" = "351286929"
[HKCU\Software\Aas]
"a3_18" = "112354555"
[HKCU\Software\Aas]
"a3_19" = "152901914"
[HKCU\Software\Aas]
"a3_14" = "83367783"
[HKCU\Software\Aas]
"a3_15" = "124488582"
[HKCU\Software\Aas]
"a3_16" = "131411001"
[HKCU\Software\Aas]
"a3_17" = "104906840"
[HKCU\Software\Aas]
"a3_10" = "88506851"
[HKCU\Software\Aas]
"a3_11" = "95435266"
[HKCU\Software\Aas]
"a3_12" = "69459621"
[HKCU\Software\Aas]
"a3_13" = "76378820"
[HKCU\Software\adm914]
"a3_297" = "2146046664"
[HKCU\Software\adm914]
"a3_296" = "2139059817"
[HKCU\Software\adm914]
"a3_295" = "2131611014"
[HKCU\Software\adm914]
"a3_294" = "2091000103"
[HKCU\Software\adm914]
"a3_293" = "2083554628"
[HKCU\Software\adm914]
"a3_292" = "2110068965"
[HKCU\Software\adm914]
"a3_291" = "2103081986"
[HKCU\Software\adm914]
"a3_290" = "2062078883"
[HKCU\Software\adm914]
"a3_299" = "2126994186"
[HKCU\Software\adm914]
"a3_298" = "2119548587"
[HKCU\Software\adm914]
"a3_341" = "2427835252"
[HKCU\Software\adm914]
"a3_340" = "2420782741"
[HKCU\Software\adm914]
"a3_343" = "2475826102"
[HKCU\Software\adm914]
"a3_342" = "2468839383"
[HKCU\Software\adm914]
"a3_345" = "2456756472"
[HKCU\Software\adm914]
"a3_344" = "2482865177"
[HKCU\Software\adm914]
"a3_347" = "2504288570"
[HKCU\Software\adm914]
"a3_346" = "2463812955"
[HKCU\Software\adm914]
"a3_349" = "2485304956"
[HKCU\Software\adm914]
"a3_348" = "2511803805"
[HKCU\Software\adm914]
"a3_265" = "1883213352"
[HKCU\Software\adm914]
"a1_127" = "3174105194"
[HKCU\Software\adm914]
"a3_129" = "907866784"
[HKCU\Software\adm914]
"a3_128" = "934368961"
[HKCU\Software\adm914]
"a3_121" = "850859928"
[HKCU\Software\adm914]
"a3_120" = "843344697"
[HKCU\Software\adm914]
"a3_123" = "898391258"
[HKCU\Software\adm914]
"a3_122" = "891465851"
[HKCU\Software\adm914]
"a3_125" = "879322396"
[HKCU\Software\adm914]
"a3_124" = "905967805"
[HKCU\Software\adm914]
"a3_127" = "927443550"
[HKCU\Software\adm914]
"a3_126" = "886309375"
[HKCU\Software\Aas]
"a1_129" = "1432010424"
[HKCU\Software\Aas]
"a1_128" = "3127333326"
[HKCU\Software\Aas]
"a1_125" = "970875667"
[HKCU\Software\Aas]
"a1_124" = "4115117989"
[HKCU\Software\Aas]
"a1_127" = "65565130"
[HKCU\Software\Aas]
"a1_126" = "3464254432"
[HKCU\Software\Aas]
"a1_121" = "3106539700"
[HKCU\Software\Aas]
"a1_120" = "1615142597"
[HKCU\Software\Aas]
"a1_123" = "2505493287"
[HKCU\Software\Aas]
"a1_122" = "2493032295"
[HKCU\Software\adm914]
"a2_339" = "2430334219"
[HKCU\Software\adm914]
"a2_338" = "2423167815"
[HKCU\Software\adm914]
"a4_99" = "709742979"
[HKCU\Software\adm914]
"a4_98" = "702573858"
[HKCU\Software\adm914]
"a4_97" = "695404737"
[HKCU\Software\adm914]
"a4_96" = "688235616"
[HKCU\Software\adm914]
"a4_95" = "681066495"
[HKCU\Software\adm914]
"a4_94" = "673897374"
[HKCU\Software\adm914]
"a4_93" = "666728253"
[HKCU\Software\adm914]
"a4_92" = "659559132"
[HKCU\Software\adm914]
"a4_91" = "652390011"
[HKCU\Software\adm914]
"a4_90" = "645220890"
[HKCU\Software\adm914]
"a1_145" = "3645288382"
[HKCU\Software\adm914]
"a1_144" = "2534413805"
[HKCU\Software\adm914]
"a1_147" = "1951668958"
[HKCU\Software\adm914]
"a1_146" = "2981584161"
[HKCU\Software\adm914]
"a1_141" = "1684382998"
[HKCU\Software\adm914]
"a1_140" = "2480394453"
[HKCU\Software\adm914]
"a1_143" = "3275705441"
[HKCU\Software\adm914]
"a1_142" = "726793849"
[HKCU\Software\adm914]
"a1_149" = "1925051335"
[HKCU\Software\adm914]
"a1_148" = "2243725224"
[HKCU\Software\adm914]
"a2_331" = "2372980967"
[HKCU\Software\adm914]
"a2_330" = "2365802436"
[HKCU\Software\adm914]
"a2_333" = "2387314261"
[HKCU\Software\adm914]
"a2_332" = "2380151848"
[HKCU\Software\adm914]
"a2_335" = "2401648865"
[HKCU\Software\adm914]
"a2_334" = "2394483196"
[HKCU\Software\adm914]
"a2_337" = "2415998834"
[HKCU\Software\adm914]
"a2_336" = "2408817918"
[HKCU\Software\adm914]
"a1_301" = "4237116504"
[HKCU\Software\adm914]
"a1_300" = "4276499423"
[HKCU\Software\adm914]
"a1_307" = "1017085073"
[HKCU\Software\adm914]
"a1_306" = "1306362696"
[HKCU\Software\adm914]
"a3_41" = "277247432"
[HKCU\Software\adm914]
"a3_40" = "269797737"
[HKCU\Software\adm914]
"a3_43" = "324844042"
[HKCU\Software\adm914]
"a3_42" = "284234155"
[HKCU\Software\adm914]
"a3_45" = "305775436"
[HKCU\Software\adm914]
"a3_44" = "332277485"
[HKCU\Software\adm914]
"a3_47" = "353766286"
[HKCU\Software\adm914]
"a3_46" = "313225007"
[HKCU\Software\adm914]
"a3_49" = "368267472"
[HKCU\Software\adm914]
"a3_48" = "360821873"
[HKCU\Software\Aas]
"a2_75" = "537686322"
[HKCU\Software\Aas]
"a2_74" = "530521781"
[HKCU\Software\Aas]
"a2_77" = "552021526"
[HKCU\Software\Aas]
"a2_76" = "544856747"
[HKCU\Software\Aas]
"a2_71" = "509004939"
[HKCU\Software\Aas]
"a2_70" = "501834977"
[HKCU\Software\Aas]
"a2_73" = "523353208"
[HKCU\Software\Aas]
"a2_72" = "516170361"
[HKCU\Software\Aas]
"a2_79" = "566353720"
[HKCU\Software\Aas]
"a2_78" = "559189800"
[HKCU\Software\adm914]
"a3_195" = "1380979618"
[HKCU\Software\adm914]
"a3_271" = "1926112494"
[HKCU\Software\adm914]
"a2_48" = "344114656"
[HKCU\Software\adm914]
"a2_49" = "351284652"
[HKCU\Software\adm914]
"a2_42" = "301099138"
[HKCU\Software\adm914]
"a2_43" = "308267784"
[HKCU\Software\adm914]
"a2_40" = "286769120"
[HKCU\Software\adm914]
"a2_41" = "293930025"
[HKCU\Software\adm914]
"a2_46" = "329784791"
[HKCU\Software\adm914]
"a2_47" = "336952331"
[HKCU\Software\adm914]
"a2_44" = "315445554"
[HKCU\Software\adm914]
"a2_45" = "322614021"
[HKCU\Software\adm914]
"a1_339" = "1987469261"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\adm914]
"a1_332" = "3955351922"
[HKCU\Software\adm914]
"a1_333" = "2417009907"
[HKCU\Software\adm914]
"a1_330" = "1398682454"
[HKCU\Software\adm914]
"a1_331" = "4002165766"
[HKCU\Software\adm914]
"a1_336" = "439451965"
[HKCU\Software\adm914]
"a1_337" = "3872239598"
[HKCU\Software\Aas]
"a3_29" = "224867540"
[HKCU\Software\Aas]
"a3_28" = "183865525"
[HKCU\Software\adm914]
"a1_334" = "3329301475"
[HKCU\Software\Aas]
"a3_21" = "167399900"
[HKCU\Software\Aas]
"a3_20" = "159956413"
[HKCU\Software\Aas]
"a3_23" = "148336286"
[HKCU\Software\Aas]
"a3_22" = "140888703"
[HKCU\Software\Aas]
"a3_25" = "195929936"
[HKCU\Software\Aas]
"a3_24" = "188875569"
[HKCU\Software\Aas]
"a3_27" = "176880658"
[HKCU\Software\Aas]
"a3_26" = "169827315"
[HKCU\Software\adm914]
"a3_339" = "2446887474"
[HKCU\Software\adm914]
"a3_284" = "2019048925"
[HKCU\Software\adm914]
"a3_285" = "2026625468"
[HKCU\Software\adm914]
"a3_286" = "2067087903"
[HKCU\Software\adm914]
"a3_287" = "2074144510"
[HKCU\Software\adm914]
"a3_280" = "1990634585"
[HKCU\Software\adm914]
"a3_281" = "2031110200"
[HKCU\Software\adm914]
"a3_282" = "2038690971"
[HKCU\Software\adm914]
"a3_283" = "2045677946"
[HKCU\Software\adm914]
"a3_288" = "2048101217"
[HKCU\Software\adm914]
"a3_289" = "2055026624"
[HKCU\Software\adm914]
"a3_356" = "2568810661"
[HKCU\Software\adm914]
"a3_357" = "2576325892"
[HKCU\Software\adm914]
"a3_354" = "2521278563"
[HKCU\Software\adm914]
"a3_355" = "2528203970"
[HKCU\Software\adm914]
"a3_352" = "2540266273"
[HKCU\Software\adm914]
"a3_353" = "2547257216"
[HKCU\Software\adm914]
"a3_350" = "2492226271"
[HKCU\Software\adm914]
"a3_351" = "2499790526"
[HKCU\Software\adm914]
"a3_358" = "2583247335"
[HKCU\Software\adm914]
"a3_359" = "2556731974"
[HKCU\Software\adm914]
"a2_285" = "2043192915"
[HKCU\Software\adm914]
"a2_284" = "2036025645"
[HKCU\Software\adm914]
"a2_287" = "2057540039"
[HKCU\Software\adm914]
"a2_286" = "2050374657"
[HKCU\Software\adm914]
"a2_281" = "2014519636"
[HKCU\Software\adm914]
"a2_280" = "2007357620"
[HKCU\Software\adm914]
"a2_283" = "2028856134"
[HKCU\Software\adm914]
"a2_282" = "2021687343"
[HKCU\Software\adm914]
"a2_289" = "2071871817"
[HKCU\Software\adm914]
"a2_288" = "2064710373"
[HKCU\Software\adm914]
"a2_359" = "2573720879"
[HKCU\Software\adm914]
"a2_358" = "2566540758"
[HKCU\Software\adm914]
"a2_353" = "2530703881"
[HKCU\Software\adm914]
"a2_352" = "2523537048"
[HKCU\Software\adm914]
"a2_351" = "2516368103"
[HKCU\Software\adm914]
"a2_350" = "2509186333"
[HKCU\Software\adm914]
"a2_357" = "2559372926"
[HKCU\Software\adm914]
"a2_356" = "2552201376"
[HKCU\Software\adm914]
"a2_355" = "2545034019"
[HKCU\Software\adm914]
"a2_354" = "2537870973"
[HKCU\Software\adm914]
"a2_106" = "759924122"
[HKCU\Software\adm914]
"a3_138" = "1006336523"
[HKCU\Software\adm914]
"a3_139" = "979822314"
[HKCU\Software\adm914]
"a3_136" = "991835593"
[HKCU\Software\adm914]
"a3_137" = "998887848"
[HKCU\Software\adm914]
"a3_134" = "943844487"
[HKCU\Software\adm914]
"a3_135" = "950831462"
[HKCU\Software\adm914]
"a3_132" = "962896965"
[HKCU\Software\adm914]
"a3_133" = "970342436"
[HKCU\Software\adm914]
"a3_130" = "915382019"
[HKCU\Software\adm914]
"a3_131" = "922303458"
[HKCU\Software\adm914]
"a2_105" = "752759399"
[HKCU\Software\adm914]
"a2_102" = "731245355"
[HKCU\Software\adm914]
"a2_103" = "738426159"
[HKCU\Software\adm914]
"a2_100" = "716909504"
[HKCU\Software\adm914]
"a2_101" = "724075213"
[HKCU\Software\adm914]
"a4_62" = "444485502"
[HKCU\Software\adm914]
"a4_63" = "451654623"
[HKCU\Software\adm914]
"a4_60" = "430147260"
[HKCU\Software\adm914]
"a4_61" = "437316381"
[HKCU\Software\adm914]
"a4_66" = "473161986"
[HKCU\Software\adm914]
"a4_67" = "480331107"
[HKCU\Software\adm914]
"a4_64" = "458823744"
[HKCU\Software\adm914]
"a4_65" = "465992865"
[HKCU\Software\adm914]
"a4_68" = "487500228"
[HKCU\Software\adm914]
"a4_69" = "494669349"
[HKCU\Software\adm914]
"a1_158" = "3429317294"
[HKCU\Software\adm914]
"a1_159" = "262552674"
[HKCU\Software\adm914]
"a1_152" = "1468321015"
[HKCU\Software\adm914]
"a1_153" = "3289807497"
[HKCU\Software\adm914]
"a1_150" = "550246822"
[HKCU\Software\adm914]
"a1_151" = "4272000866"
[HKCU\Software\adm914]
"a1_156" = "3204113880"
[HKCU\Software\adm914]
"a1_157" = "813479202"
[HKCU\Software\adm914]
"a1_154" = "1886340580"
[HKCU\Software\adm914]
"a1_155" = "681561320"
[HKCU\Software\adm914]
"a1_32" = "2358265154"
[HKCU\Software\adm914]
"a1_33" = "1105670463"
[HKCU\Software\adm914]
"a1_30" = "1056644102"
[HKCU\Software\adm914]
"a1_31" = "297416461"
[HKCU\Software\adm914]
"a1_36" = "2477746923"
[HKCU\Software\adm914]
"a1_37" = "180481150"
[HKCU\Software\adm914]
"a1_34" = "2671267259"
[HKCU\Software\adm914]
"a1_35" = "2863077402"
[HKCU\Software\adm914]
"a1_38" = "3401221928"
[HKCU\Software\adm914]
"a1_39" = "448516541"
[HKCU\Software\adm914]
"a3_74" = "513565259"
[HKCU\Software\adm914]
"a3_75" = "554634794"
[HKCU\Software\adm914]
"a3_76" = "561687181"
[HKCU\Software\adm914]
"a3_77" = "568612716"
[HKCU\Software\adm914]
"a3_70" = "485102791"
[HKCU\Software\adm914]
"a3_71" = "525709478"
[HKCU\Software\adm914]
"a3_72" = "533159177"
[HKCU\Software\adm914]
"a3_73" = "506657256"
[HKCU\Software\adm914]
"a3_78" = "542634959"
[HKCU\Software\adm914]
"a3_79" = "549625774"
[HKCU\Software\Aas]
"a2_62" = "444486125"
[HKCU\Software\Aas]
"a2_63" = "451651644"
[HKCU\Software\Aas]
"a2_60" = "430153204"
[HKCU\Software\Aas]
"a2_61" = "437320174"
[HKCU\Software\Aas]
"a2_66" = "473168565"
[HKCU\Software\Aas]
"a2_67" = "480334400"
[HKCU\Software\Aas]
"a2_64" = "458819180"
[HKCU\Software\Aas]
"a2_65" = "465986063"
[HKCU\Software\Aas]
"a2_68" = "487502283"
[HKCU\Software\Aas]
"a2_69" = "494669941"
[HKCU\Software\adm914]
"a2_59" = "422984483"
[HKCU\Software\adm914]
"a2_58" = "415803538"
[HKCU\Software\adm914]
"a2_51" = "365619350"
[HKCU\Software\adm914]
"a2_50" = "358465336"
[HKCU\Software\adm914]
"a2_53" = "379967613"
[HKCU\Software\adm914]
"a2_52" = "372798985"
[HKCU\Software\adm914]
"a2_55" = "394310941"
[HKCU\Software\adm914]
"a2_54" = "387137454"
[HKCU\Software\adm914]
"a2_57" = "408633569"
[HKCU\Software\adm914]
"a2_56" = "401466109"
[HKCU\Software\Aas]
"a3_36" = "241268621"
[HKCU\Software\Aas]
"a3_37" = "248309804"
[HKCU\Software\Aas]
"a3_34" = "260325067"
[HKCU\Software\Aas]
"a3_35" = "267899754"
[HKCU\Software\Aas]
"a3_32" = "212854281"
[HKCU\Software\Aas]
"a3_33" = "253401768"
[HKCU\Software\Aas]
"a3_30" = "231909751"
[HKCU\Software\Aas]
"a3_31" = "205278614"
[HKCU\Software\Aas]
"a3_38" = "289377359"
[HKCU\Software\Aas]
"a3_39" = "296296686"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\adm914]
"a4_153" = "1096875513"
[HKCU\Software\adm914]
"a4_152" = "1089706392"
[HKCU\Software\adm914]
"a4_151" = "1082537271"
[HKCU\Software\adm914]
"a4_150" = "1075368150"
[HKCU\Software\adm914]
"a4_157" = "1125551997"
[HKCU\Software\adm914]
"a4_156" = "1118382876"
[HKCU\Software\adm914]
"a4_155" = "1111213755"
[HKCU\Software\adm914]
"a4_154" = "1104044634"
[HKCU\Software\adm914]
"a4_159" = "1139890239"
[HKCU\Software\adm914]
"a4_158" = "1132721118"
[HKCU\Software\adm914\695404737]
"14338242" = "0"
[HKCU\Software\adm914]
"a3_240" = "1737325745"
[HKCU\Software\adm914]
"a3_241" = "1744312592"
[HKCU\Software\adm914]
"a3_242" = "1718322675"
[HKCU\Software\adm914]
"a3_243" = "1725247058"
[HKCU\Software\adm914]
"a4_373" = "2674082133"
[HKCU\Software\adm914]
"a3_244" = "1765853749"
[HKCU\Software\adm914]
"a4_371" = "2659743891"
[HKCU\Software\adm914]
"a4_370" = "2652574770"
[HKCU\Software\adm914]
"a4_375" = "2688420375"
[HKCU\Software\adm914]
"a3_245" = "1773303444"
[HKCU\Software\adm914]
"a3_246" = "1746735991"
[HKCU\Software\adm914]
"a3_247" = "1753792470"
[HKCU\Software\adm914]
"a2_348" = "2494850390"
[HKCU\Software\adm914]
"a2_349" = "2502018695"
[HKCU\Software\adm914]
"a2_340" = "2437499400"
[HKCU\Software\adm914]
"a2_341" = "2444666735"
[HKCU\Software\adm914]
"a2_342" = "2451835390"
[HKCU\Software\adm914]
"a2_343" = "2459003898"
[HKCU\Software\adm914]
"a2_344" = "2466182356"
[HKCU\Software\adm914]
"a2_345" = "2473350233"
[HKCU\Software\adm914]
"a2_346" = "2480520434"
[HKCU\Software\adm914]
"a2_347" = "2487687484"
[HKCU\Software\adm914]
"a2_298" = "2136392322"
[HKCU\Software\adm914]
"a2_299" = "2143561147"
[HKCU\Software\adm914]
"a2_292" = "2093379064"
[HKCU\Software\adm914]
"a2_293" = "2100557637"
[HKCU\Software\adm914]
"a2_290" = "2079040745"
[HKCU\Software\adm914]
"a2_291" = "2086208081"
[HKCU\Software\adm914]
"a2_296" = "2122056199"
[HKCU\Software\adm914]
"a2_297" = "2129223728"
[HKCU\Software\adm914]
"a2_294" = "2107724990"
[HKCU\Software\adm914]
"a2_295" = "2114892377"
[HKCU\Software\adm914]
"a4_226" = "1620221346"
[HKCU\Software\adm914]
"a4_71" = "509007591"
[HKCU\Software\adm914]
"a4_70" = "501838470"
[HKCU\Software\adm914]
"a4_73" = "523345833"
[HKCU\Software\adm914]
"a4_72" = "516176712"
[HKCU\Software\adm914]
"a4_75" = "537684075"
[HKCU\Software\adm914]
"a4_74" = "530514954"
[HKCU\Software\adm914]
"a4_77" = "552022317"
[HKCU\Software\adm914]
"a4_76" = "544853196"
[HKCU\Software\adm914]
"a4_79" = "566360559"
[HKCU\Software\adm914]
"a4_78" = "559191438"
[HKCU\Software\adm914]
"a1_129" = "1363229339"
[HKCU\Software\adm914]
"a1_128" = "3569686334"
[HKCU\Software\Aas\695404737]
"50183847" = "8D482144D6AB9E65AB5D732E35BA327F2DCEC983D41A37D56DAFF40919CA9630CDF6902C1C5EAEE675386957562866F4069CED404BFAB7C8B60A4167F6A7847BEF830A6F30C03ADD6EA841B65CA653F5F5B7C53F251A450424A27E7AC478835F982AE213A3634E32F62DF34219E6C9D7744EEF2F97FD353F0C698D9D20F10EC0"
[HKCU\Software\adm914]
"a1_126" = "2516362451"
[HKCU\Software\adm914]
"a1_125" = "207109344"
[HKCU\Software\adm914]
"a1_124" = "1044358562"
[HKCU\Software\adm914]
"a1_123" = "3336436262"
[HKCU\Software\adm914]
"a1_122" = "1099123300"
[HKCU\Software\adm914]
"a1_121" = "929154436"
[HKCU\Software\adm914]
"a1_120" = "3449063968"
[HKCU\Software\adm914]
"a1_233" = "2120623396"
[HKCU\Software\adm914]
"a1_232" = "2442429620"
[HKCU\Software\adm914]
"a1_231" = "2066778684"
[HKCU\Software\adm914]
"a1_230" = "2481674857"
[HKCU\Software\adm914]
"a1_237" = "769112704"
[HKCU\Software\adm914]
"a1_236" = "1234903553"
[HKCU\Software\adm914]
"a1_235" = "2881438981"
[HKCU\Software\adm914]
"a1_234" = "326109402"
[HKCU\Software\adm914]
"a1_239" = "2750214484"
[HKCU\Software\adm914]
"a1_238" = "2295441239"
[HKCU\Software\adm914]
"a1_21" = "724125091"
[HKCU\Software\adm914]
"a1_20" = "3668784221"
[HKCU\Software\adm914]
"a1_23" = "2352108523"
[HKCU\Software\adm914]
"a1_22" = "247144938"
[HKCU\Software\adm914]
"a1_25" = "201460524"
[HKCU\Software\adm914]
"a1_24" = "493865126"
[HKCU\Software\adm914]
"a1_27" = "1858394245"
[HKCU\Software\adm914]
"a1_26" = "796654978"
[HKCU\Software\adm914]
"a1_29" = "586135848"
[HKCU\Software\adm914]
"a1_28" = "4090607394"
[HKCU\Software\adm914]
"a3_69" = "478111844"
[HKCU\Software\adm914]
"a3_68" = "470667141"
[HKCU\Software\adm914]
"a2_258" = "1849637039"
[HKCU\Software\adm914]
"a3_63" = "468243870"
[HKCU\Software\adm914]
"a3_62" = "461187391"
[HKCU\Software\adm914]
"a3_61" = "454266204"
[HKCU\Software\adm914]
"a3_60" = "413196541"
[HKCU\Software\adm914]
"a3_67" = "497165090"
[HKCU\Software\adm914]
"a3_66" = "489719619"
[HKCU\Software\adm914]
"a3_65" = "449125088"
[HKCU\Software\adm914]
"a3_64" = "442138113"
[HKCU\Software\adm914]
"a2_253" = "1813784225"
[HKCU\Software\adm914]
"a2_250" = "1792285901"
[HKCU\Software\adm914]
"a2_251" = "1799453755"
[HKCU\Software\adm914\695404737]
"35845605" = "315"
[HKCU\Software\adm914]
"a4_229" = "1641728709"
[HKCU\Software\Aas]
"a2_99" = "709740984"
[HKCU\Software\Aas]
"a2_98" = "702575865"
[HKCU\Software\Aas]
"a2_97" = "695407343"
[HKCU\Software\Aas]
"a2_96" = "688226730"
[HKCU\Software\Aas]
"a2_95" = "681060488"
[HKCU\Software\Aas]
"a2_94" = "673892335"
[HKCU\Software\Aas]
"a2_93" = "666725570"
[HKCU\Software\Aas]
"a2_92" = "659557986"
[HKCU\Software\Aas]
"a2_91" = "652381936"
[HKCU\Software\Aas]
"a2_90" = "645225620"
[HKCU\Software\adm914]
"a2_157" = "1125553891"
[HKCU\Software\adm914]
"a2_68" = "487504040"
[HKCU\Software\adm914]
"a2_69" = "494671782"
[HKCU\Software\adm914]
"a2_64" = "458820154"
[HKCU\Software\adm914]
"a2_65" = "465988943"
[HKCU\Software\adm914]
"a2_66" = "473168672"
[HKCU\Software\adm914]
"a2_67" = "480334863"
[HKCU\Software\adm914]
"a2_60" = "430151254"
[HKCU\Software\adm914]
"a2_61" = "437318761"
[HKCU\Software\adm914]
"a2_62" = "444487712"
[HKCU\Software\adm914]
"a2_63" = "451650193"
[HKCU\Software\adm914]
"a4_220" = "1577206620"
[HKCU\Software\Aas]
"a3_43" = "324843106"
[HKCU\Software\Aas]
"a3_42" = "284237251"
[HKCU\Software\Aas]
"a3_41" = "277248416"
[HKCU\Software\Aas]
"a3_40" = "269796609"
[HKCU\Software\Aas]
"a3_47" = "353765350"
[HKCU\Software\Aas]
"a3_46" = "313221959"
[HKCU\Software\Aas]
"a3_45" = "305778468"
[HKCU\Software\Aas]
"a3_44" = "332278405"
[HKCU\Software\Aas]
"a3_49" = "368270520"
[HKCU\Software\Aas]
"a3_48" = "360822809"
[HKCU\Software\Aas]
"a4_99" = "709742979"
[HKCU\Software\Aas]
"a4_98" = "702573858"
[HKCU\Software\Aas]
"a4_91" = "652390011"
[HKCU\Software\Aas]
"a4_90" = "645220890"
[HKCU\Software\Aas]
"a4_93" = "666728253"
[HKCU\Software\Aas]
"a4_92" = "659559132"
[HKCU\Software\Aas]
"a4_95" = "681066495"
[HKCU\Software\Aas]
"a4_94" = "673897374"
[HKCU\Software\Aas]
"a4_97" = "695404737"
[HKCU\Software\Aas]
"a4_96" = "688235616"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\adm914]
"a4_140" = "1003676940"
[HKCU\Software\adm914]
"a4_141" = "1010846061"
[HKCU\Software\adm914]
"a4_142" = "1018015182"
[HKCU\Software\adm914]
"a4_143" = "1025184303"
[HKCU\Software\adm914]
"a4_144" = "1032353424"
[HKCU\Software\adm914]
"a4_145" = "1039522545"
[HKCU\Software\adm914]
"a4_146" = "1046691666"
[HKCU\Software\adm914]
"a4_147" = "1053860787"
[HKCU\Software\adm914]
"a4_148" = "1061029908"
[HKCU\Software\adm914]
"a4_149" = "1068199029"
[HKCU\Software\adm914]
"a2_199" = "1426661152"
[HKCU\Software\adm914]
"a2_198" = "1419492382"
[HKCU\Software\adm914]
"a2_191" = "1369306793"
[HKCU\Software\adm914]
"a2_190" = "1362126619"
[HKCU\Software\adm914]
"a2_193" = "1383641683"
[HKCU\Software\adm914]
"a2_192" = "1376476342"
[HKCU\Software\adm914]
"a2_195" = "1397968937"
[HKCU\Software\adm914]
"a2_194" = "1390808448"
[HKCU\Software\adm914]
"a2_197" = "1412310629"
[HKCU\Software\adm914]
"a2_196" = "1405141531"
[HKCU\Software\adm914]
"a4_368" = "2638236528"
[HKCU\Software\adm914]
"a4_369" = "2645405649"
[HKCU\Software\adm914]
"a4_360" = "2580883560"
[HKCU\Software\adm914]
"a4_361" = "2588052681"
[HKCU\Software\adm914]
"a4_362" = "2595221802"
[HKCU\Software\adm914]
"a4_363" = "2602390923"
[HKCU\Software\adm914]
"a4_364" = "2609560044"
[HKCU\Software\adm914]
"a4_365" = "2616729165"
[HKCU\Software\adm914]
"a4_366" = "2623898286"
[HKCU\Software\adm914]
"a4_367" = "2631067407"
[HKCU\Software\adm914]
"a2_223" = "1598710152"
[HKCU\Software\adm914]
"a2_222" = "1591547878"
[HKCU\Software\adm914]
"a2_221" = "1584380479"
[HKCU\Software\adm914]
"a2_220" = "1577211620"
[HKCU\Software\adm914]
"a2_375" = "2688425158"
[HKCU\Software\adm914]
"a2_227" = "1627395477"
[HKCU\Software\adm914]
"a2_376" = "2695593107"
[HKCU\Software\adm914]
"a2_371" = "2659741417"
[HKCU\Software\adm914]
"a3_275" = "1954656882"
[HKCU\Software\adm914]
"a2_373" = "2674086423"
[HKCU\Software\adm914]
"a2_226" = "1620215286"
[HKCU\Software\adm914]
"a2_225" = "1613049496"
[HKCU\Software\Aas\695404737]
"35845605" = "390"
[HKCU\Software\adm914]
"a2_224" = "1605881128"
[HKCU\Software\adm914]
"a3_274" = "1947601299"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\adm914]
"a3_277" = "2002713268"
[HKCU\Software\adm914]
"a3_276" = "1962106581"
[HKCU\Software\adm914]
"a4_44" = "315441324"
[HKCU\Software\adm914]
"a4_45" = "322610445"
[HKCU\Software\adm914]
"a4_46" = "329779566"
[HKCU\Software\adm914]
"a4_47" = "336948687"
[HKCU\Software\adm914]
"a4_40" = "286764840"
[HKCU\Software\adm914]
"a4_41" = "293933961"
[HKCU\Software\adm914]
"a4_42" = "301103082"
[HKCU\Software\adm914]
"a4_43" = "308272203"
[HKCU\Software\adm914]
"a4_48" = "344117808"
[HKCU\Software\adm914]
"a4_49" = "351286929"
[HKCU\Software\adm914]
"a1_2" = "3348585627"
[HKCU\Software\adm914]
"a1_3" = "16369780"
[HKCU\Software\adm914]
"a1_0" = "316296286"
[HKCU\Software\adm914]
"a1_1" = "3634571327"
[HKCU\Software\adm914]
"a1_6" = "1867218184"
[HKCU\Software\adm914]
"a1_7" = "1040413911"
[HKCU\Software\adm914]
"a1_4" = "3274530548"
[HKCU\Software\adm914]
"a1_5" = "3408654500"
[HKCU\Software\adm914]
"a1_8" = "1202476373"
[HKCU\Software\adm914]
"a1_9" = "526911189"
[HKCU\Software\adm914]
"a3_4" = "11990981"
[HKCU\Software\adm914]
"a3_5" = "52532132"
[HKCU\Software\adm914]
"a3_6" = "59980807"
[HKCU\Software\adm914]
"a3_7" = "67033318"
[HKCU\Software\adm914]
"a3_0" = "17000001"
[HKCU\Software\adm914]
"a3_1" = "23986720"
[HKCU\Software\adm914]
"a3_2" = "31043203"
[HKCU\Software\adm914]
"a3_3" = "4934498"
[HKCU\Software\adm914]
"a1_134" = "202097528"
[HKCU\Software\adm914]
"a1_135" = "1059660697"
[HKCU\Software\adm914]
"a1_136" = "3520048340"
[HKCU\Software\adm914]
"a1_137" = "172859312"
[HKCU\Software\adm914]
"a1_130" = "3962194684"
[HKCU\Software\adm914]
"a1_131" = "3614184221"
[HKCU\Software\adm914]
"a1_132" = "1149537502"
[HKCU\Software\adm914]
"a1_133" = "1909136556"
[HKCU\Software\adm914]
"a3_270" = "1918679055"
[HKCU\Software\adm914]
"a1_220" = "2634686505"
[HKCU\Software\adm914]
"a1_221" = "1235126500"
[HKCU\Software\adm914]
"a1_222" = "3307499586"
[HKCU\Software\adm914]
"a1_223" = "3369548577"
[HKCU\Software\adm914]
"a1_224" = "150564533"
[HKCU\Software\adm914]
"a1_225" = "3299376178"
[HKCU\Software\adm914]
"a1_226" = "712989413"
[HKCU\Software\adm914]
"a1_227" = "3546205299"
[HKCU\Software\adm914]
"a1_228" = "115138071"
[HKCU\Software\adm914]
"a1_229" = "3999383422"
[HKCU\Software\adm914]
"a1_14" = "3480573719"
[HKCU\Software\adm914]
"a1_15" = "2222496226"
[HKCU\Software\adm914]
"a1_16" = "3116007854"
[HKCU\Software\adm914]
"a1_17" = "1086842789"
[HKCU\Software\adm914]
"a1_10" = "3287597971"
[HKCU\Software\adm914]
"a1_11" = "3200708678"
[HKCU\Software\adm914]
"a1_12" = "275850998"
[HKCU\Software\adm914]
"a1_13" = "2744150430"
[HKCU\Software\adm914]
"a1_18" = "2267350554"
[HKCU\Software\adm914]
"a1_19" = "3657197192"
[HKCU\Software\adm914]
"a3_18" = "112355475"
[HKCU\Software\adm914]
"a3_19" = "152900978"
[HKCU\Software\adm914]
"a3_16" = "131407953"
[HKCU\Software\adm914]
"a3_17" = "104909872"
[HKCU\Software\adm914]
"a3_14" = "83368719"
[HKCU\Software\adm914]
"a3_15" = "124487662"
[HKCU\Software\adm914]
"a3_12" = "69456589"
[HKCU\Software\adm914]
"a3_13" = "76381868"
[HKCU\Software\adm914]
"a3_10" = "88509835"
[HKCU\Software\adm914]
"a3_11" = "95434346"
[HKCU\Software\Aas]
"a2_88" = "630890778"
[HKCU\Software\Aas]
"a2_89" = "638015649"
[HKCU\Software\Aas]
"a2_84" = "602208489"
[HKCU\Software\Aas]
"a2_85" = "609373386"
[HKCU\Software\Aas]
"a2_86" = "616536473"
[HKCU\Software\Aas]
"a2_87" = "623708852"
[HKCU\Software\Aas]
"a2_80" = "573524375"
[HKCU\Software\Aas]
"a2_81" = "580705222"
[HKCU\Software\Aas]
"a2_82" = "587874202"
[HKCU\Software\Aas]
"a2_83" = "595041850"
[HKCU\Software\adm914]
"a2_73" = "523338869"
[HKCU\Software\adm914]
"a2_72" = "516172888"
[HKCU\Software\adm914]
"a2_71" = "509004945"
[HKCU\Software\adm914]
"a2_70" = "501835016"
[HKCU\Software\adm914]
"a2_77" = "552021599"
[HKCU\Software\adm914]
"a2_76" = "544857725"
[HKCU\Software\adm914]
"a2_75" = "537686426"
[HKCU\Software\adm914]
"a2_74" = "530520772"
[HKCU\Software\adm914]
"a2_79" = "566356701"
[HKCU\Software\adm914]
"a2_78" = "559189254"
[HKCU\Software\Aas]
"a3_50" = "341766363"
[HKCU\Software\Aas]
"a3_51" = "348755322"
[HKCU\Software\Aas]
"a3_52" = "389745053"
[HKCU\Software\Aas]
"a3_53" = "396796476"
[HKCU\Software\Aas]
"a3_54" = "370165343"
[HKCU\Software\Aas]
"a3_55" = "377748222"
[HKCU\Software\Aas]
"a3_56" = "384737041"
[HKCU\Software\Aas]
"a3_57" = "425210800"
[HKCU\Software\Aas]
"a3_58" = "432789459"
[HKCU\Software\Aas]
"a3_59" = "406145138"
[HKCU\Software\adm914]
"a3_238" = "1689269359"
[HKCU\Software\adm914]
"a3_106" = "742979179"
[HKCU\Software\adm914]
"a4_171" = "1225919691"
[HKCU\Software\Aas]
"a4_86" = "616544406"
[HKCU\Software\adm914]
"a4_174" = "1247427054"
[HKCU\Software\adm914]
"a4_177" = "1268934417"
[HKCU\Software\adm914]
"a4_176" = "1261765296"
[HKCU\Software\Aas]
"a4_82" = "587867922"
[HKCU\Software\Aas]
"a4_83" = "595037043"
[HKCU\Software\Aas]
"a4_80" = "573529680"
[HKCU\Software\adm914]
"a4_172" = "1233088812"
[HKCU\Software\adm914]
"a4_179" = "1283272659"
[HKCU\Software\adm914]
"a4_178" = "1276103538"
[HKCU\Software\Aas]
"a4_88" = "630882648"
[HKCU\Software\Aas]
"a4_89" = "638051769"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\adm914]
"a4_170" = "1218750570"
[HKCU\Software\adm914]
"a2_188" = "1347792652"
[HKCU\Software\adm914]
"a2_189" = "1354958751"
[HKCU\Software\adm914]
"a2_186" = "1333458306"
[HKCU\Software\adm914]
"a2_187" = "1340622499"
[HKCU\Software\adm914]
"a2_184" = "1319124160"
[HKCU\Software\adm914]
"a2_185" = "1326292936"
[HKCU\Software\adm914]
"a2_182" = "1304774615"
[HKCU\Software\adm914]
"a2_183" = "1311952044"
[HKCU\Software\adm914]
"a2_180" = "1290443748"
[HKCU\Software\adm914]
"a2_181" = "1297607070"
[HKCU\Software\adm914]
"a2_37" = "265263169"
[HKCU\Software\adm914]
"a4_359" = "2573714439"
[HKCU\Software\adm914]
"a4_358" = "2566545318"
[HKCU\Software\adm914]
"a2_36" = "258083753"
[HKCU\Software\adm914]
"a4_355" = "2545037955"
[HKCU\Software\adm914]
"a4_354" = "2537868834"
[HKCU\Software\adm914]
"a4_357" = "2559376197"
[HKCU\Software\adm914]
"a4_356" = "2552207076"
[HKCU\Software\adm914]
"a4_351" = "2516361471"
[HKCU\Software\adm914]
"a2_35" = "250915970"
[HKCU\Software\adm914]
"a4_353" = "2530699713"
[HKCU\Software\adm914]
"a4_352" = "2523530592"
[HKCU\Software\adm914]
"a3_253" = "1830770076"
[HKCU\Software\adm914]
"a3_252" = "1789765949"
[HKCU\Software\adm914]
"a3_251" = "1782713690"
[HKCU\Software\adm914]
"a2_34" = "243748044"
[HKCU\Software\adm914]
"a3_257" = "1825743648"
[HKCU\Software\adm914]
"a3_256" = "1818691393"
[HKCU\Software\adm914]
"a3_255" = "1844812510"
[HKCU\Software\adm914]
"a3_254" = "1837825663"
[HKCU\Software\adm914]
"a2_33" = "236577550"
[HKCU\Software\adm914]
"a3_259" = "1873799266"
[HKCU\Software\adm914]
"a3_258" = "1866223491"
[HKCU\Software\Aas]
"a1_97" = "1008675328"
[HKCU\Software\adm914]
"a2_31" = "222245039"
[HKCU\Software\adm914]
"a4_289" = "2071875969"
[HKCU\Software\adm914]
"a4_288" = "2064706848"
[HKCU\Software\adm914]
"a4_287" = "2057537727"
[HKCU\Software\adm914]
"a4_286" = "2050368606"
[HKCU\Software\adm914]
"a4_285" = "2043199485"
[HKCU\Software\adm914]
"a2_30" = "215079138"
[HKCU\Software\adm914]
"a4_283" = "2028861243"
[HKCU\Software\adm914]
"a4_282" = "2021692122"
[HKCU\Software\adm914]
"a4_281" = "2014523001"
[HKCU\Software\adm914]
"a4_280" = "2007353880"
[HKCU\Software\adm914]
"a2_362" = "2595220334"
[HKCU\Software\Aas]
"a2_131" = "939149988"
[HKCU\Software\adm914]
"a4_5" = "35845605"
[HKCU\Software\adm914]
"a2_361" = "2588053635"
[HKCU\Software\adm914]
"a2_366" = "2623904676"
[HKCU\Software\adm914]
"a2_367" = "2631070803"
[HKCU\Software\adm914]
"a2_364" = "2609557115"
[HKCU\Software\Aas]
"a2_130" = "931977420"
[HKCU\Software\adm914]
"a2_368" = "2638238446"
[HKCU\Software\adm914]
"a2_369" = "2645408025"
[HKCU\Software\Aas]
"a2_132" = "946328972"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\adm914]
"a3_100" = "733500325"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\adm914]
"a4_59" = "422978139"
[HKCU\Software\adm914]
"a4_58" = "415809018"
[HKCU\Software\adm914]
"a4_53" = "379963413"
[HKCU\Software\adm914]
"a4_52" = "372794292"
[HKCU\Software\adm914]
"a4_51" = "365625171"
[HKCU\Software\adm914]
"a4_50" = "358456050"
[HKCU\Software\adm914]
"a4_57" = "408639897"
[HKCU\Software\adm914]
"a4_56" = "401470776"
[HKCU\Software\adm914]
"a4_55" = "394301655"
[HKCU\Software\adm914]
"a4_54" = "387132534"
[HKCU\Software\Aas]
"a3_123" = "898388146"
[HKCU\Software\Aas]
"a3_122" = "891468819"
[HKCU\Software\Aas]
"a3_121" = "850861040"
[HKCU\Software\Aas]
"a3_120" = "843343697"
[HKCU\Software\Aas]
"a3_127" = "927442486"
[HKCU\Software\Aas]
"a3_126" = "886312343"
[HKCU\Software\Aas]
"a3_125" = "879323508"
[HKCU\Software\Aas]
"a3_124" = "905966805"
[HKCU\Software\adm914]
"a1_101" = "3785023991"
[HKCU\Software\adm914]
"a1_100" = "88592944"
[HKCU\Software\adm914]
"a1_103" = "1946363603"
[HKCU\Software\adm914]
"a1_102" = "397400826"
[HKCU\Software\adm914]
"a1_105" = "932009851"
[HKCU\Software\adm914]
"a1_104" = "181921329"
[HKCU\Software\adm914]
"a1_107" = "910990040"
[HKCU\Software\adm914]
"a1_106" = "4149406833"
[HKCU\Software\adm914]
"a1_109" = "4002948867"
[HKCU\Software\adm914]
"a1_108" = "1972058266"
[HKCU\Software\adm914]
"a1_215" = "4166259982"
[HKCU\Software\adm914]
"a1_214" = "2959089090"
[HKCU\Software\adm914]
"a1_217" = "2446813046"
[HKCU\Software\adm914]
"a1_216" = "3284467845"
[HKCU\Software\adm914]
"a1_211" = "4210471869"
[HKCU\Software\adm914]
"a1_210" = "81345723"
[HKCU\Software\adm914]
"a1_213" = "2382904302"
[HKCU\Software\adm914]
"a1_212" = "588583546"
[HKCU\Software\adm914]
"a1_219" = "1783867015"
[HKCU\Software\adm914]
"a1_218" = "2602965972"
[HKCU\Software\adm914]
"a1_209" = "2753790052"
[HKCU\Software\Aas]
"a3_6" = "59977839"
[HKCU\Software\Aas]
"a3_7" = "67032206"
[HKCU\Software\Aas]
"a3_4" = "11991981"
[HKCU\Software\Aas]
"a3_5" = "52535244"
[HKCU\Software\Aas]
"a3_2" = "31040235"
[HKCU\Software\Aas]
"a3_3" = "4933386"
[HKCU\Software\adm914]
"a2_243" = "1742102235"
[HKCU\Software\Aas]
"a3_0" = "17001001"
[HKCU\Software\adm914]
"a2_374" = "2681255668"
[HKCU\Software\Aas]
"a3_1" = "23989832"
[HKCU\Software\adm914]
"a2_370" = "2652570229"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\adm914]
"a2_372" = "2666907708"
[HKCU\Software\Aas]
"a3_69" = "478110732"
[HKCU\Software\Aas]
"a3_68" = "470664173"
[HKCU\Software\Aas]
"a3_65" = "449123976"
[HKCU\Software\Aas]
"a3_64" = "442135145"
[HKCU\Software\Aas]
"a3_67" = "497168202"
[HKCU\Software\Aas]
"a3_66" = "489720619"
[HKCU\Software\Aas]
"a3_61" = "454263092"
[HKCU\Software\Aas]
"a3_60" = "413199509"
[HKCU\Software\Aas]
"a3_63" = "468244982"
[HKCU\Software\Aas]
"a3_62" = "461186391"
[HKCU\Software\adm914\695404737]
"43014726" = "0800687474703A2F2F636174616E682E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F636869656E6773616E672E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F63686163617261626F6E616E7A612E636F6D2E62722F696D6167656E732F6C6F676F2E67696600687474703A2F2F6368616E647261706172612E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6561676C657475726B2E636F6D2F6C6F676F2E67696600687474703A2F2F646F67756167616373616E6179692E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E646F616E686E6768696570766965742E636F6D2E766E2F696D616765732F6C6F676F2E67696600687474703A2F2F64726E682E69722F696D672F69636F6E732F6C6F676F2E676966"
[HKCU\Software\adm914]
"a4_168" = "1204412328"
[HKCU\Software\adm914]
"a4_169" = "1211581449"
[HKCU\Software\adm914]
"a4_162" = "1161397602"
[HKCU\Software\adm914]
"a4_163" = "1168566723"
[HKCU\Software\adm914]
"a4_160" = "1147059360"
[HKCU\Software\adm914]
"a4_161" = "1154228481"
[HKCU\Software\adm914]
"a4_166" = "1190074086"
[HKCU\Software\adm914]
"a4_167" = "1197243207"
[HKCU\Software\adm914]
"a4_164" = "1175735844"
[HKCU\Software\adm914]
"a4_165" = "1182904965"
[HKCU\Software\adm914]
"a2_173" = "1240255829"
[HKCU\Software\adm914]
"a2_172" = "1233085066"
[HKCU\Software\adm914]
"a2_171" = "1225923078"
[HKCU\Software\adm914]
"a2_170" = "1218754562"
[HKCU\Software\adm914]
"a2_177" = "1268937886"
[HKCU\Software\adm914]
"a2_176" = "1261772376"
[HKCU\Software\adm914]
"a2_175" = "1254591719"
[HKCU\Software\adm914]
"a2_174" = "1247420864"
[HKCU\Software\adm914]
"a2_179" = "1283276043"
[HKCU\Software\adm914]
"a2_178" = "1276111647"
[HKCU\Software\adm914]
"a4_342" = "2451839382"
[HKCU\Software\adm914]
"a4_343" = "2459008503"
[HKCU\Software\adm914]
"a4_340" = "2437501140"
[HKCU\Software\adm914]
"a4_341" = "2444670261"
[HKCU\Software\adm914]
"a4_346" = "2480515866"
[HKCU\Software\adm914]
"a4_347" = "2487684987"
[HKCU\Software\adm914]
"a4_344" = "2466177624"
[HKCU\Software\adm914]
"a4_345" = "2473346745"
[HKCU\Software\adm914]
"a4_348" = "2494854108"
[HKCU\Software\adm914]
"a4_349" = "2502023229"
[HKCU\Software\Aas]
"a3_87" = "607024862"
[HKCU\Software\Aas]
"a3_86" = "633131711"
[HKCU\Software\Aas]
"a3_85" = "626081308"
[HKCU\Software\Aas]
"a3_84" = "585598461"
[HKCU\Software\Aas]
"a3_83" = "578085210"
[HKCU\Software\Aas]
"a3_82" = "571034939"
[HKCU\Software\Aas]
"a3_81" = "597665944"
[HKCU\Software\Aas]
"a3_80" = "590099577"
[HKCU\Software\adm914]
"a3_248" = "1761237945"
[HKCU\Software\adm914]
"a3_249" = "1801831448"
[HKCU\Software\Aas]
"a3_89" = "654610320"
[HKCU\Software\Aas]
"a3_88" = "614067057"
[HKCU\Software\adm914]
"a4_298" = "2136398058"
[HKCU\Software\adm914]
"a4_299" = "2143567179"
[HKCU\Software\adm914]
"a4_294" = "2107721574"
[HKCU\Software\adm914]
"a4_295" = "2114890695"
[HKCU\Software\adm914]
"a4_296" = "2122059816"
[HKCU\Software\adm914]
"a4_297" = "2129228937"
[HKCU\Software\adm914]
"a4_290" = "2079045090"
[HKCU\Software\adm914]
"a4_291" = "2086214211"
[HKCU\Software\adm914]
"a4_292" = "2093383332"
[HKCU\Software\adm914]
"a4_293" = "2100552453"
[HKCU\Software\adm914]
"a2_317" = "2272614773"
[HKCU\Software\adm914]
"a2_316" = "2265448222"
[HKCU\Software\adm914]
"a2_315" = "2258277779"
[HKCU\Software\adm914]
"a2_314" = "2251100514"
[HKCU\Software\adm914]
"a2_313" = "2243931155"
[HKCU\Software\adm914]
"a2_312" = "2236761860"
[HKCU\Software\adm914]
"a2_311" = "2229595363"
[HKCU\Software\adm914]
"a2_310" = "2222430070"
[HKCU\Software\adm914]
"a2_319" = "2286946791"
[HKCU\Software\adm914]
"a2_318" = "2279778703"
[HKCU\Software\adm914]
"a2_229" = "1641733821"
[HKCU\Software\adm914]
"a2_228" = "1634565935"
[HKCU\Software\adm914]
"a4_28" = "200735388"
[HKCU\Software\adm914]
"a4_29" = "207904509"
[HKCU\Software\adm914]
"a4_26" = "186397146"
[HKCU\Software\adm914]
"a4_27" = "193566267"
[HKCU\Software\adm914]
"a4_24" = "172058904"
[HKCU\Software\adm914]
"a4_25" = "179228025"
[HKCU\Software\adm914]
"a4_22" = "157720662"
[HKCU\Software\adm914]
"a4_23" = "164889783"
[HKCU\Software\adm914]
"a4_20" = "143382420"
[HKCU\Software\adm914]
"a4_21" = "150551541"
[HKCU\Software\adm914]
"a4_182" = "1304780022"
[HKCU\Software\adm914]
"a3_329" = "2375378664"
[HKCU\Software\adm914]
"a4_183" = "1311949143"
[HKCU\Software\adm914]
"a3_328" = "2368469513"
[HKCU\Software\adm914]
"a1_116" = "159039649"
[HKCU\Software\adm914]
"a1_117" = "1934464514"
[HKCU\Software\adm914]
"a1_114" = "1519992940"
[HKCU\Software\adm914]
"a1_115" = "3371496394"
[HKCU\Software\adm914]
"a1_112" = "1784381990"
[HKCU\Software\adm914]
"a1_113" = "3733321404"
[HKCU\Software\adm914]
"a1_110" = "4288617319"
[HKCU\Software\adm914]
"a1_111" = "4099666907"
[HKCU\Software\adm914]
"a1_118" = "1436715634"
[HKCU\Software\adm914]
"a1_119" = "646730558"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a1_0" = "3299283285"
[HKCU\Software\Aas]
"a1_1" = "3386940473"
[HKCU\Software\Aas]
"a1_2" = "3712339979"
[HKCU\Software\Aas]
"a1_3" = "2620474486"
[HKCU\Software\Aas]
"a1_4" = "83174613"
[HKCU\Software\Aas]
"a1_5" = "616562248"
[HKCU\Software\Aas]
"a1_6" = "454656014"
[HKCU\Software\Aas]
"a1_7" = "2401786110"
[HKCU\Software\Aas]
"a1_8" = "310532945"
[HKCU\Software\Aas]
"a1_9" = "2948510009"
[HKCU\Software\adm914]
"a1_208" = "2506712221"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Aas]
"a3_8" = "40388897"
[HKCU\Software\Aas]
"a3_9" = "47967552"
[HKCU\Software\adm914]
"a1_202" = "4285074132"
[HKCU\Software\adm914]
"a1_203" = "2118543422"
[HKCU\Software\adm914]
"a1_200" = "950353061"
[HKCU\Software\adm914]
"a1_201" = "305143927"
[HKCU\Software\adm914]
"a1_206" = "2407344757"
[HKCU\Software\adm914]
"a1_207" = "795506210"
[HKCU\Software\adm914]
"a1_204" = "565106930"
[HKCU\Software\adm914]
"a1_205" = "4160484247"
[HKCU\Software\adm914]
"a1_78" = "2414112985"
[HKCU\Software\adm914]
"a1_79" = "2077633716"
[HKCU\Software\adm914]
"a1_76" = "563290551"
[HKCU\Software\adm914]
"a1_77" = "3497485029"
[HKCU\Software\adm914]
"a1_74" = "3321854686"
[HKCU\Software\adm914]
"a1_75" = "3807761568"
[HKCU\Software\adm914]
"a1_72" = "1172368884"
[HKCU\Software\adm914]
"a1_73" = "1356707169"
[HKCU\Software\adm914]
"a1_70" = "719109944"
[HKCU\Software\adm914]
"a1_71" = "758794937"
[HKCU\Software\adm914]
"a3_30" = "231908639"
[HKCU\Software\adm914]
"a3_31" = "205275646"
[HKCU\Software\adm914]
"a3_32" = "212855393"
[HKCU\Software\adm914]
"a3_33" = "253400768"
[HKCU\Software\adm914]
"a3_34" = "260321955"
[HKCU\Software\adm914]
"a3_35" = "267902722"
[HKCU\Software\adm914]
"a3_36" = "241269733"
[HKCU\Software\adm914]
"a3_37" = "248308804"
[HKCU\Software\adm914]
"a3_38" = "289374247"
[HKCU\Software\adm914]
"a3_39" = "296299654"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"0df23b236896bd103bda905d61633c33.exe" = "c:\0df23b236896bd103bda905d61633c33.exe:*:Enabled:ipsec"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
The Virus deletes the following registry key(s):
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LanmanServer]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\ip6fw.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmio.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Messenger]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Browser]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Boot file system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\EventLog]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmboot.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AFD]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBT]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Base]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\DnsCache]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\File system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\HelpSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Netlogon]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Ndisuio]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmserver]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LmHosts]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\CryptSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmserver]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Dhcp]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBIOS]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetMan]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Base]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AppMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NDIS]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\File system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmload.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmadmin]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]
The Virus deletes the following value(s) in system registry:
[HKLM\System\CurrentControlSet\Control\SafeBoot]
"AlternateShell"
The process 0df23b236896bd103bda905d61633c33.exe:1748 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 8C FB 1D FA A1 40 65 6F 0F AD FF 90 05 D9 1A"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ctkmko" = "%Documents and Settings%\%current user%\Application Data\Ctkmko.exe"
The process Ctkmko.exe:744 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Aas\695404737]
"35845605" = "390"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Aas\695404737]
"50183847" = "8D482144D6AB9E65AB5D732E35BA327F2DCEC983D41A37D56DAFF40919CA9630CDF6902C1C5EAEE675386957562866F4069CED404BFAB7C8B60A4167F6A7847BEF830A6F30C03ADD6EA841B65CA653F5F5B7C53F251A450424A27E7AC478835F982AE213A3634E32F62DF34219E6C9D7744EEF2F97FD353F0C698D9D20F10EC0"
[HKCU\Software\Aas\695404737]
"43014726" = "0B00687474703A2F2F6A6577656C6C65727962617A6161722E6E65742F6C6F676F2E67696600687474703A2F2F63617361656261722E636F6D2E62722F6C6F676F2E67696600687474703A2F2F63616E6F7373616468756C652E696E2F6C6F676F2E67696600687474703A2F2F63616E7365736961736B6E65666573692E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F686F773267657468617A616E61742E686F2E66756E7069632E64652F6C6F676F2E67696600687474703A2F2F7777772E65766973686F702E64652F6C6F676F2E67696600687474703A2F2F6368696875616875617570696E67686F6D652E636F6D2F6C6F676F2E67696600687474703A2F2F64656861737061732E636F6D2F6C6F676F2E67696600687474703A2F2F64657664696A6974616C2E636F6D2F6C6F676F2E67696600687474703A2F2F736F6272656E61747572616C62722E6E65742F6C6F676F2E67696600687474703A2F2F6469726569746F7075626C69636F2E636F6D2E62722F6C6F676F2E676966"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\Aas\695404737]
"7169121" = "145"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 4B 6B 41 43 E2 C1 7F 4F 0B 77 0C 9F 04 A5 B0"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"Ctkmko.exe" = "%Documents and Settings%\%current user%\Application Data\Ctkmko.exe:*:Enabled:ipsec"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
The process Ctkmko.exe:1576 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 98 9F 15 2E B1 EE E2 C2 C8 DF 38 EB 8E 2E BA"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process Ctkmko.exe:940 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 23 15 33 5D C6 59 E0 16 DF F9 B3 F4 78 9B 7D"
Network activity (URLs)
No activity has been detected.
Rootkit activity
The Virus installs the following user-mode hooks in WININET.dll:
HttpSendRequestW
InternetWriteFile
HttpSendRequestA
The Virus installs the following user-mode hooks in ADVAPI32.dll:
RegCreateKeyExA
RegCreateKeyExW
The Virus installs the following user-mode hooks in WS2_32.dll:
send
getaddrinfo
The Virus installs the following user-mode hooks in kernel32.dll:
MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA
The Virus installs the following user-mode hooks in ntdll.dll:
LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.
A worm can spread its copies through the MSN Messanger.
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
TELNET.EXE:2724
TELNET.EXE:840
TELNET.EXE:2328
TELNET.EXE:2436
TELNET.EXE:2632
TELNET.EXE:3140
TELNET.EXE:2380
TELNET.EXE:3144
TELNET.EXE:3652
TELNET.EXE:3076
TELNET.EXE:3268
TELNET.EXE:2072
TELNET.EXE:3292
NOTEPAD.EXE:3596
NOTEPAD.EXE:2292
NOTEPAD.EXE:664
NOTEPAD.EXE:2968
NOTEPAD.EXE:3416
NOTEPAD.EXE:3008
NOTEPAD.EXE:2804
NOTEPAD.EXE:2524
NOTEPAD.EXE:3236
NOTEPAD.EXE:3380
NOTEPAD.EXE:1772
NOTEPAD.EXE:3512
NOTEPAD.EXE:2888
NOTEPAD.EXE:3792
NOTEPAD.EXE:2152
NOTEPAD.EXE:1292
NOTEPAD.EXE:1464
NOTEPAD.EXE:2112
NOTEPAD.EXE:2364
NOTEPAD.EXE:2668
NOTEPAD.EXE:2604
NOTEPAD.EXE:2872
NOTEPAD.EXE:2456
NOTEPAD.EXE:3764
NOTEPAD.EXE:2916
NOTEPAD.EXE:2628
NOTEPAD.EXE:2608
NOTEPAD.EXE:3624
NOTEPAD.EXE:2764
NOTEPAD.EXE:2696
NOTEPAD.EXE:3368
NOTEPAD.EXE:3176
NOTEPAD.EXE:2212
NOTEPAD.EXE:3204
NOTEPAD.EXE:3540
NOTEPAD.EXE:3472
NOTEPAD.EXE:3564
NOTEPAD.EXE:2272
NOTEPAD.EXE:3500
NOTEPAD.EXE:3444
NOTEPAD.EXE:2408
NOTEPAD.EXE:2256
NOTEPAD.EXE:3252
0df23b236896bd103bda905d61633c33.exe:640
0df23b236896bd103bda905d61633c33.exe:404
0df23b236896bd103bda905d61633c33.exe:1748
Ctkmko.exe:744
Ctkmko.exe:1576
Ctkmko.exe:940 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%Documents and Settings%\%current user%\Local Settings\Temp\J7ygghyk6L1AItgfM1t.tmp (3 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Application Data\Ctkmko.exe (2105 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ctkmko" = "%Documents and Settings%\%current user%\Application Data\Ctkmko.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
