Virus.Win32.Sality_489f6bd786
HEUR:Trojan.Win32.Generic (Kaspersky), Packed.Win32.Rebhip.a (v) (VIPRE), Trojan.Win32.Midgare!IK (Emsisoft), Backdoor.Win32.Bifrose.FD, Trojan.Win32.IEDummy.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, GenericAutorunWorm.YR, VirusSality.YR, BackdoorBifrose.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Worm, Virus, Packed, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 489f6bd786f63d1403167dab6c10bab8
SHA1: ac0d9f8854f66356bdc59b1bae164158a20bfdcb
SHA256: 04bcec532cc5d5baa27311086392ca441dcb73e0dea094d04c4194230fdf5e87
SSDeep: 6144:6NcFxLKInMtAhA6emVqaOq6bx4lSx6pIEYUx5I:6NQLrM2A/Eqhq6bPwGfUQ
Size: 266440 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualCv71EXE, UPolyXv05_v6
Company: no certificate found
Created at: 2004-08-04 09:01:37
Summary:
Virus. A program that recursively replicates a possibly evolved copy of itself.
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Virus creates the following process(es):
WINMINE.EXE:1560
WINMINE.EXE:1832
server.exe:744
server.exe:948
NOTEPAD.EXE:744
iexplore.exe:2020
489f6bd786f63d1403167dab6c10bab8.exe:632
The Virus injects its code into the following process(es):
iexplore.exe:1572
File activity
The process server.exe:744 makes changes in a file system.
The Virus deletes the following file(s):
C:\93e64 (0 bytes)
D:\9427b (0 bytes)
The process server.exe:948 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\system.ini (72 bytes)
The process iexplore.exe:1572 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Program Files%\Explorer\klog.dat (74 bytes)
The process 489f6bd786f63d1403167dab6c10bab8.exe:632 makes changes in a file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\server.exe (2712 bytes)
The Virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\server.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP (0 bytes)
Registry activity
The process WINMINE.EXE:1560 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA 57 35 D8 9B FB 84 03 88 FF 12 DA F9 0C D1 47"
The process WINMINE.EXE:1832 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 3E 2C 57 E3 83 D2 1E C2 97 94 99 0F 9A 60 1C"
The process server.exe:744 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E F3 21 5B F5 A9 95 B8 F0 46 08 04 3F E7 30 61"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP]
"server.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\server.exe:*:Enabled:ipsec"
The process server.exe:948 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKCU\Software\adm914]
"a2_267" = "1914154402"
[HKCU\Software\adm914]
"a2_266" = "1906989642"
[HKCU\Software\adm914]
"a2_265" = "1899808776"
[HKCU\Software\adm914]
"a2_264" = "1892653428"
[HKCU\Software\adm914]
"a2_263" = "1885473425"
[HKCU\Software\adm914]
"a1_241" = "1187121668"
[HKCU\Software\adm914]
"a2_261" = "1871134784"
[HKCU\Software\adm914]
"a2_260" = "1863969743"
[HKCU\Software\adm914]
"a2_269" = "1928490536"
[HKCU\Software\adm914]
"a2_268" = "1921325804"
[HKCU\Software\adm914]
"a3_158" = "1115723167"
[HKCU\Software\adm914]
"a3_159" = "1123171966"
[HKCU\Software\adm914]
"a2_226" = "1620215636"
[HKCU\Software\adm914]
"a3_150" = "1092335255"
[HKCU\Software\adm914]
"a3_151" = "1099256694"
[HKCU\Software\adm914]
"a3_152" = "1106313177"
[HKCU\Software\adm914]
"a3_153" = "1080269752"
[HKCU\Software\adm914]
"a3_154" = "1087177755"
[HKCU\Software\adm914]
"a3_155" = "1127784698"
[HKCU\Software\adm914]
"a3_156" = "1135234397"
[HKCU\Software\adm914]
"a3_157" = "1108732220"
[HKCU\Software\adm914]
"a2_15" = "107544459"
[HKCU\Software\adm914]
"a2_14" = "100361286"
[HKCU\Software\adm914]
"a2_17" = "121879562"
[HKCU\Software\adm914]
"a2_16" = "114711838"
[HKCU\Software\adm914]
"a2_11" = "78859443"
[HKCU\Software\adm914]
"a2_10" = "71693364"
[HKCU\Software\adm914]
"a2_13" = "93194021"
[HKCU\Software\adm914]
"a2_12" = "86021270"
[HKCU\Software\adm914]
"a2_292" = "2093379020"
[HKCU\Software\adm914]
"a3_288" = "2048101217"
[HKCU\Software\adm914]
"a2_290" = "2079039621"
[HKCU\Software\adm914]
"a3_203" = "1472069290"
[HKCU\Software\adm914]
"a2_19" = "136210335"
[HKCU\Software\adm914]
"a2_18" = "129046425"
[HKCU\Software\adm914]
"a2_294" = "2107727747"
[HKCU\Software\adm914]
"a3_289" = "2055026624"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\adm914]
"a1_219" = "2630677922"
[HKCU\Software\adm914]
"a3_92" = "643003549"
[HKCU\Software\adm914]
"a1_301" = "1684372315"
[HKCU\Software\adm914]
"a4_237" = "1699081677"
[HKCU\Software\adm914]
"a3_93" = "649990524"
[HKCU\Software\adm914]
"a2_111" = "795775508"
[HKCU\Software\adm914]
"a3_129" = "907866784"
[HKCU\Software\adm914]
"a2_110" = "788608619"
[HKCU\Software\adm914]
"a1_296" = "3476111765"
[HKCU\Software\adm914]
"a2_113" = "810112779"
[HKCU\Software\adm914]
"a4_71" = "509007591"
[HKCU\Software\adm914]
"a4_70" = "501838470"
[HKCU\Software\adm914]
"a4_73" = "523345833"
[HKCU\Software\adm914]
"a4_72" = "516176712"
[HKCU\Software\adm914]
"a4_75" = "537684075"
[HKCU\Software\adm914]
"a4_74" = "530514954"
[HKCU\Software\adm914]
"a4_77" = "552022317"
[HKCU\Software\adm914]
"a4_76" = "544853196"
[HKCU\Software\adm914]
"a4_79" = "566360559"
[HKCU\Software\adm914]
"a4_78" = "559191438"
[HKCU\Software\adm914]
"a2_114" = "817276122"
[HKCU\Software\adm914]
"a2_230" = "1648901543"
[HKCU\Software\adm914]
"a3_128" = "934368961"
[HKCU\Software\adm914]
"a2_117" = "838794019"
[HKCU\Software\adm914]
"a2_116" = "831614671"
[HKCU\Software\adm914]
"a4_184" = "1319118264"
[HKCU\Software\adm914]
"a4_185" = "1326287385"
[HKCU\Software\adm914]
"a4_186" = "1333456506"
[HKCU\Software\adm914]
"a4_187" = "1340625627"
[HKCU\Software\adm914]
"a4_180" = "1290441780"
[HKCU\Software\adm914]
"a3_98" = "685968227"
[HKCU\Software\adm914]
"a1_129" = "3660182191"
[HKCU\Software\adm914]
"a2_118" = "845961310"
[HKCU\Software\adm914]
"a1_127" = "736219469"
[HKCU\Software\adm914]
"a1_126" = "1215357291"
[HKCU\Software\adm914]
"a1_125" = "3809064460"
[HKCU\Software\adm914]
"a3_99" = "726579138"
[HKCU\Software\adm914]
"a1_123" = "1643794892"
[HKCU\Software\adm914]
"a1_122" = "309983843"
[HKCU\Software\adm914]
"a1_121" = "1066764547"
[HKCU\Software\adm914]
"a1_120" = "1744839733"
[HKCU\Software\adm914]
"a1_291" = "2448083965"
[HKCU\Software\adm914]
"a2_225" = "1613048417"
[HKCU\Software\adm914]
"a1_262" = "985748335"
[HKCU\Software\adm914]
"a4_119" = "853125399"
[HKCU\Software\adm914]
"a4_118" = "845956278"
[HKCU\Software\adm914]
"a4_117" = "838787157"
[HKCU\Software\adm914]
"a4_116" = "831618036"
[HKCU\Software\adm914]
"a4_115" = "824448915"
[HKCU\Software\adm914]
"a4_114" = "817279794"
[HKCU\Software\adm914]
"a4_113" = "810110673"
[HKCU\Software\adm914]
"a4_112" = "802941552"
[HKCU\Software\adm914]
"a4_111" = "795772431"
[HKCU\Software\adm914]
"a4_110" = "788603310"
[HKCU\Software\adm914]
"a2_160" = "1147051448"
[HKCU\Software\adm914]
"a2_161" = "1154234597"
[HKCU\Software\adm914]
"a2_162" = "1161403418"
[HKCU\Software\adm914]
"a2_163" = "1168572174"
[HKCU\Software\adm914]
"a2_164" = "1175737286"
[HKCU\Software\adm914]
"a2_165" = "1182902621"
[HKCU\Software\adm914]
"a2_166" = "1190069668"
[HKCU\Software\adm914]
"a2_167" = "1197239737"
[HKCU\Software\adm914]
"a2_168" = "1204419170"
[HKCU\Software\adm914]
"a2_169" = "1211584526"
[HKCU\Software\adm914]
"a1_216" = "3283214485"
[HKCU\Software\adm914]
"a1_238" = "4120590968"
[HKCU\Software\adm914]
"a2_298" = "2136394546"
[HKCU\Software\adm914]
"a2_299" = "2143562083"
[HKCU\Software\adm914]
"a1_98" = "1734606936"
[HKCU\Software\adm914]
"a1_99" = "2666425560"
[HKCU\Software\adm914]
"a1_94" = "1785824208"
[HKCU\Software\adm914]
"a1_95" = "1065702569"
[HKCU\Software\adm914]
"a1_96" = "3000318828"
[HKCU\Software\adm914]
"a1_97" = "2904209663"
[HKCU\Software\adm914]
"a1_90" = "147535942"
[HKCU\Software\adm914]
"a1_91" = "2027441964"
[HKCU\Software\adm914]
"a1_92" = "3943305758"
[HKCU\Software\adm914]
"a1_93" = "2004594030"
[HKCU\Software\adm914]
"a1_21" = "4064479153"
[HKCU\Software\adm914]
"a1_20" = "2640527822"
[HKCU\Software\adm914]
"a1_23" = "4123585774"
[HKCU\Software\adm914]
"a1_22" = "2117828245"
[HKCU\Software\adm914]
"a1_25" = "2389026095"
[HKCU\Software\adm914]
"a1_24" = "1475592486"
[HKCU\Software\adm914]
"a1_27" = "20392801"
[HKCU\Software\adm914]
"a1_26" = "1325351814"
[HKCU\Software\adm914]
"a1_29" = "1134962346"
[HKCU\Software\adm914]
"a1_28" = "4092731938"
[HKCU\Software\adm914]
"a3_279" = "1983579126"
[HKCU\Software\adm914]
"a3_278" = "2009622295"
[HKCU\Software\adm914]
"a1_252" = "3260103737"
[HKCU\Software\adm914]
"a4_196" = "1405147716"
[HKCU\Software\adm914]
"a2_293" = "2100557557"
[HKCU\Software\adm914]
"a2_234" = "1677580674"
[HKCU\Software\adm914]
"a1_138" = "1899021849"
[HKCU\Software\adm914]
"a1_265" = "1530223152"
[HKCU\Software\adm914]
"a1_139" = "3593930645"
[HKCU\Software\adm914]
"a2_304" = "2179410611"
[HKCU\Software\adm914]
"a2_305" = "2186579201"
[HKCU\Software\adm914]
"a3_69" = "478111844"
[HKCU\Software\adm914]
"a3_68" = "470667141"
[HKCU\Software\adm914]
"a2_300" = "2150740324"
[HKCU\Software\adm914]
"a2_258" = "1849637713"
[HKCU\Software\adm914]
"a2_302" = "2165079983"
[HKCU\Software\adm914]
"a2_303" = "2172247166"
[HKCU\Software\adm914]
"a3_63" = "468243870"
[HKCU\Software\adm914]
"a3_62" = "461187391"
[HKCU\Software\adm914]
"a3_61" = "454266204"
[HKCU\Software\adm914]
"a3_60" = "413196541"
[HKCU\Software\adm914]
"a3_67" = "497165090"
[HKCU\Software\adm914]
"a3_66" = "489719619"
[HKCU\Software\adm914]
"a3_65" = "449125088"
[HKCU\Software\adm914]
"a3_64" = "442138113"
[HKCU\Software\adm914]
"a3_114" = "834000243"
[HKCU\Software\adm914]
"a3_115" = "807891410"
[HKCU\Software\adm914]
"a3_116" = "814882229"
[HKCU\Software\adm914]
"a3_117" = "821921300"
[HKCU\Software\adm914]
"a3_110" = "771901423"
[HKCU\Software\adm914]
"a3_111" = "778952782"
[HKCU\Software\adm914]
"a3_112" = "785943601"
[HKCU\Software\adm914]
"a3_113" = "826943632"
[HKCU\Software\adm914]
"a4_243" = "1742096403"
[HKCU\Software\adm914]
"a4_242" = "1734927282"
[HKCU\Software\adm914]
"a4_241" = "1727758161"
[HKCU\Software\adm914]
"a4_240" = "1720589040"
[HKCU\Software\adm914]
"a3_118" = "862921463"
[HKCU\Software\adm914]
"a3_119" = "869977942"
[HKCU\Software\adm914]
"a4_245" = "1756434645"
[HKCU\Software\adm914]
"a4_244" = "1749265524"
[HKCU\Software\adm914]
"a3_226" = "1636957155"
[HKCU\Software\adm914]
"a1_213" = "1393531116"
[HKCU\Software\adm914]
"a4_238" = "1706250798"
[HKCU\Software\adm914]
"a3_227" = "1610835010"
[HKCU\Software\adm914]
"a4_236" = "1691912556"
[HKCU\Software\adm914]
"a1_130" = "2950077958"
[HKCU\Software\adm914]
"a4_234" = "1677574314"
[HKCU\Software\adm914]
"a2_190" = "1362124854"
[HKCU\Software\adm914]
"a4_232" = "1663236072"
[HKCU\Software\adm914]
"a3_224" = "1588900513"
[HKCU\Software\adm914]
"a4_230" = "1648897830"
[HKCU\Software\adm914]
"a1_131" = "692626932"
[HKCU\Software\adm914]
"a1_248" = "4263849413"
[HKCU\Software\adm914]
"a4_194" = "1390809474"
[HKCU\Software\adm914]
"a3_225" = "1629904640"
[HKCU\Software\adm914]
"a2_250" = "1792283106"
[HKCU\Software\adm914]
"a3_189" = "1371569628"
[HKCU\Software\adm914]
"a3_188" = "1364644221"
[HKCU\Software\adm914]
"a3_187" = "1324037274"
[HKCU\Software\adm914]
"a3_186" = "1316587579"
[HKCU\Software\adm914]
"a3_185" = "1309600856"
[HKCU\Software\adm914]
"a3_184" = "1336099833"
[HKCU\Software\adm914]
"a3_183" = "1328654102"
[HKCU\Software\adm914]
"a3_182" = "1288059575"
[HKCU\Software\adm914]
"a3_181" = "1280614100"
[HKCU\Software\adm914]
"a3_180" = "1307177589"
[HKCU\Software\adm914\695404737]
"35845605" = "391"
[HKCU\Software\adm914]
"a4_229" = "1641728709"
[HKCU\Software\adm914]
"a1_212" = "2910804761"
[HKCU\Software\adm914]
"a4_39" = "279595719"
[HKCU\Software\adm914]
"a4_38" = "272426598"
[HKCU\Software\adm914]
"a4_35" = "250919235"
[HKCU\Software\adm914]
"a4_34" = "243750114"
[HKCU\Software\adm914]
"a4_37" = "265257477"
[HKCU\Software\adm914]
"a4_36" = "258088356"
[HKCU\Software\adm914]
"a4_31" = "222242751"
[HKCU\Software\adm914]
"a4_30" = "215073630"
[HKCU\Software\adm914]
"a4_33" = "236580993"
[HKCU\Software\adm914]
"a4_32" = "229411872"
[HKCU\Software\adm914\695404737]
"28676484" = "35"
[HKCU\Software\adm914]
"a1_251" = "2982457422"
[HKCU\Software\adm914]
"a1_158" = "2637035917"
[HKCU\Software\adm914]
"a3_37" = "248308804"
[HKCU\Software\adm914]
"a3_96" = "671531553"
[HKCU\Software\adm914]
"a3_97" = "678456960"
[HKCU\Software\adm914]
"a3_94" = "690601439"
[HKCU\Software\adm914]
"a3_95" = "698046910"
[HKCU\Software\adm914]
"a2_68" = "487502613"
[HKCU\Software\adm914]
"a2_69" = "494671205"
[HKCU\Software\adm914]
"a3_90" = "662056027"
[HKCU\Software\adm914]
"a3_91" = "669108282"
[HKCU\Software\adm914]
"a2_64" = "458817866"
[HKCU\Software\adm914]
"a2_65" = "465988981"
[HKCU\Software\adm914]
"a2_66" = "473167039"
[HKCU\Software\adm914]
"a2_67" = "480336923"
[HKCU\Software\adm914]
"a2_60" = "430151796"
[HKCU\Software\adm914]
"a2_61" = "437320985"
[HKCU\Software\adm914]
"a2_62" = "444487508"
[HKCU\Software\adm914]
"a2_63" = "451650037"
[HKCU\Software\adm914]
"a2_286" = "2050374208"
[HKCU\Software\adm914]
"a3_228" = "1617821733"
[HKCU\Software\adm914]
"a2_281" = "2014523989"
[HKCU\Software\adm914]
"a2_280" = "2007355612"
[HKCU\Software\adm914]
"a1_310" = "374336043"
[HKCU\Software\adm914]
"a3_206" = "1493540943"
[HKCU\Software\adm914]
"a2_282" = "2021689891"
[HKCU\Software\adm914]
"a1_305" = "3456009180"
[HKCU\Software\adm914]
"a1_220" = "1127041413"
[HKCU\Software\adm914]
"a4_284" = "2036030364"
[HKCU\Software\adm914]
"a2_112" = "802946288"
[HKCU\Software\adm914]
"a2_88" = "630887936"
[HKCU\Software\adm914]
"a4_260" = "1863971460"
[HKCU\Software\adm914]
"a4_88" = "630882648"
[HKCU\Software\adm914]
"a4_89" = "638051769"
[HKCU\Software\adm914]
"a2_185" = "1326291749"
[HKCU\Software\adm914]
"a3_310" = "2239032119"
[HKCU\Software\adm914]
"a4_80" = "573529680"
[HKCU\Software\adm914]
"a4_81" = "580698801"
[HKCU\Software\adm914]
"a4_82" = "587867922"
[HKCU\Software\adm914]
"a4_83" = "595037043"
[HKCU\Software\adm914]
"a4_84" = "602206164"
[HKCU\Software\adm914]
"a4_85" = "609375285"
[HKCU\Software\adm914]
"a4_86" = "616544406"
[HKCU\Software\adm914]
"a4_87" = "623713527"
[HKCU\Software\adm914]
"a1_170" = "1439266872"
[HKCU\Software\adm914]
"a1_171" = "4276333721"
[HKCU\Software\adm914]
"a1_172" = "1588699000"
[HKCU\Software\adm914]
"a1_173" = "3259443928"
[HKCU\Software\adm914]
"a1_174" = "3773892947"
[HKCU\Software\adm914]
"a1_175" = "3120162560"
[HKCU\Software\adm914]
"a1_176" = "3315878670"
[HKCU\Software\adm914]
"a1_177" = "1808903992"
[HKCU\Software\adm914]
"a1_178" = "3308136878"
[HKCU\Software\adm914]
"a1_179" = "1274085370"
[HKCU\Software\adm914]
"a4_305" = "2186581905"
[HKCU\Software\adm914]
"a2_128" = "917644731"
[HKCU\Software\adm914]
"a2_129" = "924811942"
[HKCU\Software\adm914]
"a1_279" = "106578805"
[HKCU\Software\adm914]
"a1_278" = "2715707657"
[HKCU\Software\adm914]
"a2_124" = "888964356"
[HKCU\Software\adm914]
"a2_125" = "896145052"
[HKCU\Software\adm914]
"a2_126" = "903312433"
[HKCU\Software\adm914]
"a2_127" = "910481032"
[HKCU\Software\adm914]
"a2_120" = "860298383"
[HKCU\Software\adm914]
"a2_121" = "867460686"
[HKCU\Software\adm914]
"a2_122" = "874628472"
[HKCU\Software\adm914]
"a2_123" = "881798875"
[HKCU\Software\adm914]
"a4_140" = "1003676940"
[HKCU\Software\adm914]
"a4_141" = "1010846061"
[HKCU\Software\adm914]
"a4_142" = "1018015182"
[HKCU\Software\adm914]
"a4_143" = "1025184303"
[HKCU\Software\adm914]
"a4_144" = "1032353424"
[HKCU\Software\adm914]
"a4_145" = "1039522545"
[HKCU\Software\adm914]
"a4_146" = "1046691666"
[HKCU\Software\adm914]
"a4_147" = "1053860787"
[HKCU\Software\adm914]
"a4_148" = "1061029908"
[HKCU\Software\adm914]
"a4_149" = "1068199029"
[HKCU\Software\adm914]
"a4_235" = "1684743435"
[HKCU\Software\adm914]
"a3_231" = "1672934854"
[HKCU\Software\adm914]
"a3_230" = "1665878375"
[HKCU\Software\adm914]
"a3_233" = "1653815816"
[HKCU\Software\adm914]
"a3_232" = "1646367145"
[HKCU\Software\adm914]
"a1_69" = "2396833655"
[HKCU\Software\adm914]
"a1_68" = "601579916"
[HKCU\Software\adm914]
"a1_218" = "3797330867"
[HKCU\Software\adm914]
"a3_236" = "1708912429"
[HKCU\Software\adm914]
"a1_65" = "4083535854"
[HKCU\Software\adm914]
"a1_64" = "1801138457"
[HKCU\Software\adm914]
"a1_67" = "713121850"
[HKCU\Software\adm914]
"a1_66" = "3469586511"
[HKCU\Software\adm914]
"a1_61" = "2164782916"
[HKCU\Software\adm914]
"a1_60" = "1260354028"
[HKCU\Software\adm914]
"a1_63" = "1774745476"
[HKCU\Software\adm914]
"a1_62" = "4276924717"
[HKCU\Software\adm914]
"a3_27" = "176877690"
[HKCU\Software\adm914]
"a3_26" = "169826203"
[HKCU\Software\adm914]
"a3_25" = "195930936"
[HKCU\Software\adm914]
"a3_24" = "188878681"
[HKCU\Software\adm914]
"a3_23" = "148333302"
[HKCU\Software\adm914]
"a3_22" = "140887575"
[HKCU\Software\adm914]
"a3_21" = "167402932"
[HKCU\Software\adm914]
"a3_20" = "159953365"
[HKCU\Software\adm914]
"a2_95" = "681058360"
[HKCU\Software\adm914]
"a2_94" = "673891969"
[HKCU\Software\adm914]
"a2_97" = "695409847"
[HKCU\Software\adm914]
"a2_96" = "688238995"
[HKCU\Software\adm914]
"a2_91" = "652393785"
[HKCU\Software\adm914]
"a2_90" = "645230544"
[HKCU\Software\adm914]
"a3_29" = "224868540"
[HKCU\Software\adm914]
"a3_28" = "183868637"
[HKCU\Software\adm914]
"a4_207" = "1484008047"
[HKCU\Software\adm914]
"a4_206" = "1476838926"
[HKCU\Software\adm914]
"a4_205" = "1469669805"
[HKCU\Software\adm914]
"a4_204" = "1462500684"
[HKCU\Software\adm914]
"a4_203" = "1455331563"
[HKCU\Software\adm914]
"a4_202" = "1448162442"
[HKCU\Software\adm914]
"a4_201" = "1440993321"
[HKCU\Software\adm914]
"a4_200" = "1433824200"
[HKCU\Software\adm914]
"a2_251" = "1799454211"
[HKCU\Software\adm914]
"a1_224" = "3687107253"
[HKCU\Software\adm914]
"a1_240" = "2599143352"
[HKCU\Software\adm914]
"a1_194" = "1720045910"
[HKCU\Software\adm914]
"a4_209" = "1498346289"
[HKCU\Software\adm914]
"a4_208" = "1491177168"
[HKCU\Software\adm914]
"a3_305" = "2203578832"
[HKCU\Software\adm914]
"a3_304" = "2162447729"
[HKCU\Software\adm914]
"a3_307" = "2183923218"
[HKCU\Software\adm914]
"a3_85" = "626078324"
[HKCU\Software\adm914]
"a3_301" = "2174509132"
[HKCU\Software\adm914]
"a1_226" = "1533933542"
[HKCU\Software\adm914]
"a3_303" = "2155522190"
[HKCU\Software\adm914]
"a3_302" = "2148469807"
[HKCU\Software\adm914]
"a4_218" = "1562868378"
[HKCU\Software\adm914]
"a1_227" = "649368637"
[HKCU\Software\adm914]
"a2_98" = "702578682"
[HKCU\Software\adm914]
"a3_308" = "2191500021"
[HKCU\Software\adm914]
"a4_219" = "1570037499"
[HKCU\Software\adm914]
"a2_223" = "1598712121"
[HKCU\Software\adm914]
"a1_221" = "3899166436"
[HKCU\Software\adm914]
"a2_222" = "1591547924"
[HKCU\Software\adm914]
"a2_221" = "1584380553"
[HKCU\Software\adm914]
"a1_287" = "3249685711"
[HKCU\Software\adm914]
"a2_274" = "1964342516"
[HKCU\Software\adm914]
"a3_84" = "585599381"
[HKCU\Software\adm914]
"a1_269" = "960342564"
[HKCU\Software\adm914]
"a2_220" = "1577212974"
[HKCU\Software\adm914]
"a2_270" = "1935658787"
[HKCU\Software\adm914]
"a2_271" = "1942835911"
[HKCU\Software\adm914]
"a2_272" = "1950004179"
[HKCU\Software\adm914]
"a2_273" = "1957174797"
[HKCU\Software\adm914]
"a1_185" = "78412836"
[HKCU\Software\adm914]
"a2_278" = "1993019498"
[HKCU\Software\adm914]
"a3_275" = "1954656882"
[HKCU\Software\adm914]
"a1_184" = "1147942635"
[HKCU\Software\adm914]
"a3_169" = "1228153416"
[HKCU\Software\adm914]
"a3_168" = "1187690985"
[HKCU\Software\adm914]
"a3_165" = "1199756484"
[HKCU\Software\adm914]
"a3_164" = "1192700005"
[HKCU\Software\adm914]
"a3_167" = "1180638470"
[HKCU\Software\adm914]
"a3_166" = "1206677671"
[HKCU\Software\adm914]
"a3_161" = "1171212096"
[HKCU\Software\adm914]
"a3_160" = "1163778785"
[HKCU\Software\adm914]
"a3_163" = "1151700866"
[HKCU\Software\adm914]
"a3_162" = "1144709923"
[HKCU\Software\adm914]
"a3_297" = "2146046664"
[HKCU\Software\adm914]
"a1_289" = "2121285626"
[HKCU\Software\adm914]
"a3_296" = "2139059817"
[HKCU\Software\adm914\695404737]
"21507363" = "0"
[HKCU\Software\adm914]
"a3_295" = "2131611014"
[HKCU\Software\adm914]
"a3_52" = "389744117"
[HKCU\Software\adm914]
"a2_29" = "207897473"
[HKCU\Software\adm914]
"a3_50" = "341769395"
[HKCU\Software\adm914]
"a3_51" = "348756242"
[HKCU\Software\adm914]
"a3_56" = "384734073"
[HKCU\Software\adm914]
"a3_57" = "425213912"
[HKCU\Software\adm914]
"a3_54" = "370166327"
[HKCU\Software\adm914]
"a3_55" = "377747094"
[HKCU\Software\adm914]
"a2_20" = "143380057"
[HKCU\Software\adm914]
"a2_21" = "150542557"
[HKCU\Software\adm914]
"a2_22" = "157727848"
[HKCU\Software\adm914]
"a2_23" = "164893068"
[HKCU\Software\adm914]
"a2_24" = "172060920"
[HKCU\Software\adm914]
"a2_25" = "179229777"
[HKCU\Software\adm914]
"a2_26" = "186393888"
[HKCU\Software\adm914]
"a2_27" = "193541827"
[HKCU\Software\adm914]
"a2_212" = "1519861648"
[HKCU\Software\adm914]
"a3_291" = "2103081986"
[HKCU\Software\adm914]
"a2_213" = "1527029405"
[HKCU\Software\adm914]
"a3_277" = "2002713268"
[HKCU\Software\adm914]
"a3_290" = "2062078883"
[HKCU\Software\adm914]
"a2_210" = "1505512627"
[HKCU\Software\adm914]
"a1_263" = "990999027"
[HKCU\Software\adm914]
"a2_211" = "1512681275"
[HKCU\Software\adm914]
"a2_216" = "1548529126"
[HKCU\Software\adm914]
"a4_198" = "1419485958"
[HKCU\Software\adm914]
"a2_217" = "1555706867"
[HKCU\Software\adm914]
"a2_214" = "1534197250"
[HKCU\Software\adm914]
"a3_276" = "1962106581"
[HKCU\Software\adm914]
"a3_190" = "1345526207"
[HKCU\Software\adm914]
"a2_215" = "1541365521"
[HKCU\Software\adm914]
"a3_262" = "1861737735"
[HKCU\Software\adm914]
"a4_44" = "315441324"
[HKCU\Software\adm914]
"a4_45" = "322610445"
[HKCU\Software\adm914]
"a4_46" = "329779566"
[HKCU\Software\adm914]
"a4_47" = "336948687"
[HKCU\Software\adm914]
"a4_40" = "286764840"
[HKCU\Software\adm914]
"a4_41" = "293933961"
[HKCU\Software\adm914]
"a4_42" = "301103082"
[HKCU\Software\adm914]
"a4_43" = "308272203"
[HKCU\Software\adm914]
"a3_220" = "1593910557"
[HKCU\Software\adm914]
"a4_48" = "344117808"
[HKCU\Software\adm914]
"a4_49" = "351286929"
[HKCU\Software\adm914]
"a1_2" = "3411375763"
[HKCU\Software\adm914]
"a1_3" = "3884430696"
[HKCU\Software\adm914]
"a1_0" = "316296286"
[HKCU\Software\adm914]
"a1_1" = "3634571327"
[HKCU\Software\adm914]
"a1_6" = "1037226783"
[HKCU\Software\adm914]
"a1_7" = "957338865"
[HKCU\Software\adm914]
"a1_4" = "2441076445"
[HKCU\Software\adm914]
"a1_5" = "3355889852"
[HKCU\Software\adm914]
"a1_222" = "534578765"
[HKCU\Software\adm914]
"a1_8" = "1249591121"
[HKCU\Software\adm914]
"a1_9" = "2259107132"
[HKCU\Software\adm914]
"a3_4" = "11990981"
[HKCU\Software\adm914]
"a3_5" = "52532132"
[HKCU\Software\adm914]
"a3_6" = "59980807"
[HKCU\Software\adm914]
"a3_7" = "67033318"
[HKCU\Software\adm914]
"a3_0" = "17000001"
[HKCU\Software\adm914]
"a3_1" = "23986720"
[HKCU\Software\adm914]
"a3_2" = "31043203"
[HKCU\Software\adm914]
"a3_3" = "4934498"
[HKCU\Software\adm914]
"a1_134" = "781980676"
[HKCU\Software\adm914]
"a1_135" = "2830650458"
[HKCU\Software\adm914]
"a1_136" = "100877020"
[HKCU\Software\adm914]
"a1_137" = "1734303293"
[HKCU\Software\adm914]
"a3_8" = "40387913"
[HKCU\Software\adm914]
"a3_9" = "47964456"
[HKCU\Software\adm914]
"a1_132" = "32638559"
[HKCU\Software\adm914]
"a1_133" = "4045348659"
[HKCU\Software\adm914]
"a3_270" = "1918679055"
[HKCU\Software\adm914]
"a4_215" = "1541361015"
[HKCU\Software\adm914]
"a4_164" = "1175735844"
[HKCU\Software\adm914]
"a1_253" = "3284195204"
[HKCU\Software\adm914]
"a3_260" = "1847235781"
[HKCU\Software\adm914]
"a1_303" = "512263692"
[HKCU\Software\adm914]
"a1_302" = "919947894"
[HKCU\Software\adm914]
"a3_148" = "1044213333"
[HKCU\Software\adm914]
"a4_108" = "774265068"
[HKCU\Software\adm914]
"a4_109" = "781434189"
[HKCU\Software\adm914]
"a4_104" = "745588584"
[HKCU\Software\adm914]
"a4_105" = "752757705"
[HKCU\Software\adm914]
"a4_106" = "759926826"
[HKCU\Software\adm914]
"a4_107" = "767095947"
[HKCU\Software\adm914]
"a4_100" = "716912100"
[HKCU\Software\adm914]
"a4_101" = "724081221"
[HKCU\Software\adm914]
"a4_102" = "731250342"
[HKCU\Software\adm914]
"a4_103" = "738419463"
[HKCU\Software\adm914]
"a2_155" = "1111223461"
[HKCU\Software\adm914]
"a2_154" = "1104051044"
[HKCU\Software\adm914]
"a2_157" = "1125552575"
[HKCU\Software\adm914]
"a2_156" = "1118384740"
[HKCU\Software\adm914]
"a2_151" = "1082535461"
[HKCU\Software\adm914]
"a2_150" = "1075364975"
[HKCU\Software\adm914]
"a2_153" = "1096868054"
[HKCU\Software\adm914]
"a2_152" = "1089705475"
[HKCU\Software\adm914]
"a1_181" = "1840502081"
[HKCU\Software\adm914]
"a1_180" = "3751682199"
[HKCU\Software\adm914]
"a1_183" = "4237412398"
[HKCU\Software\adm914]
"a1_182" = "3100674978"
[HKCU\Software\adm914]
"a2_159" = "1139886711"
[HKCU\Software\adm914]
"a2_158" = "1132719606"
[HKCU\Software\adm914]
"a1_187" = "3202460558"
[HKCU\Software\adm914]
"a1_186" = "1215237286"
[HKCU\Software\adm914]
"a1_83" = "3377790502"
[HKCU\Software\adm914]
"a1_82" = "2482987609"
[HKCU\Software\adm914]
"a1_81" = "3889735911"
[HKCU\Software\adm914]
"a1_80" = "3293777457"
[HKCU\Software\adm914]
"a1_87" = "911698377"
[HKCU\Software\adm914]
"a1_86" = "3988726312"
[HKCU\Software\adm914]
"a1_85" = "784984676"
[HKCU\Software\adm914]
"a1_84" = "2005514138"
[HKCU\Software\adm914]
"a3_274" = "1947601299"
[HKCU\Software\adm914]
"a1_89" = "3798779360"
[HKCU\Software\adm914]
"a1_88" = "864457473"
[HKCU\Software\adm914]
"a1_275" = "3100349566"
[HKCU\Software\adm914]
"a3_299" = "2126994186"
[HKCU\Software\adm914]
"a3_298" = "2119548587"
[HKCU\Software\adm914]
"a1_14" = "1836397335"
[HKCU\Software\adm914]
"a1_15" = "3325352929"
[HKCU\Software\adm914]
"a1_16" = "76621406"
[HKCU\Software\adm914]
"a1_17" = "1177756200"
[HKCU\Software\adm914]
"a1_10" = "651780228"
[HKCU\Software\adm914]
"a1_11" = "1846970489"
[HKCU\Software\adm914]
"a1_12" = "2055200218"
[HKCU\Software\adm914]
"a1_13" = "1481788084"
[HKCU\Software\adm914]
"a1_273" = "3736244516"
[HKCU\Software\adm914]
"a1_18" = "299378315"
[HKCU\Software\adm914]
"a1_19" = "3446756709"
[HKCU\Software\adm914]
"a1_272" = "1083612973"
[HKCU\Software\adm914]
"a3_268" = "1938191309"
[HKCU\Software\adm914]
"a3_269" = "1945182124"
[HKCU\Software\adm914]
"a1_271" = "3710016019"
[HKCU\Software\adm914]
"a1_223" = "1957216823"
[HKCU\Software\adm914]
"a3_263" = "1902213606"
[HKCU\Software\adm914]
"a2_93" = "666723382"
[HKCU\Software\adm914]
"a3_144" = "1015746769"
[HKCU\Software\adm914]
"a3_266" = "1890134667"
[HKCU\Software\adm914]
"a3_267" = "1930745706"
[HKCU\Software\adm914]
"a3_264" = "1909252681"
[HKCU\Software\adm914]
"a3_265" = "1883213352"
[HKCU\Software\adm914]
"a4_210" = "1505515410"
[HKCU\Software\adm914]
"a1_292" = "1879917257"
[HKCU\Software\adm914]
"a3_18" = "112355475"
[HKCU\Software\adm914]
"a3_19" = "152900978"
[HKCU\Software\adm914]
"a3_16" = "131407953"
[HKCU\Software\adm914]
"a3_17" = "104909872"
[HKCU\Software\adm914]
"a3_14" = "83368719"
[HKCU\Software\adm914]
"a3_15" = "124487662"
[HKCU\Software\adm914]
"a3_12" = "69456589"
[HKCU\Software\adm914]
"a3_13" = "76381868"
[HKCU\Software\adm914]
"a3_10" = "88509835"
[HKCU\Software\adm914]
"a3_11" = "95434346"
[HKCU\Software\adm914]
"a4_258" = "1849633218"
[HKCU\Software\adm914]
"a4_259" = "1856802339"
[HKCU\Software\adm914]
"a2_232" = "1663232460"
[HKCU\Software\adm914]
"a1_242" = "3707150313"
[HKCU\Software\adm914]
"a2_92" = "659557364"
[HKCU\Software\adm914]
"a4_251" = "1799449371"
[HKCU\Software\adm914]
"a4_252" = "1806618492"
[HKCU\Software\adm914]
"a4_253" = "1813787613"
[HKCU\Software\adm914]
"a4_254" = "1820956734"
[HKCU\Software\adm914]
"a4_255" = "1828125855"
[HKCU\Software\adm914]
"a1_189" = "2929036996"
[HKCU\Software\adm914]
"a4_257" = "1842464097"
[HKCU\Software\adm914]
"a1_246" = "2006234477"
[HKCU\Software\adm914]
"a3_261" = "1854156964"
[HKCU\Software\adm914]
"a2_227" = "1627397489"
[HKCU\Software\adm914]
"a1_247" = "1465683156"
[HKCU\Software\adm914]
"a3_240" = "1737325745"
[HKCU\Software\adm914]
"a1_244" = "2923395606"
[HKCU\Software\adm914]
"a1_245" = "3784725532"
[HKCU\Software\adm914]
"a3_198" = "1436075335"
[HKCU\Software\adm914]
"a3_199" = "1409966374"
[HKCU\Software\adm914]
"a3_194" = "1407547331"
[HKCU\Software\adm914]
"a3_195" = "1380979618"
[HKCU\Software\adm914]
"a3_196" = "1388559365"
[HKCU\Software\adm914]
"a3_197" = "1429035236"
[HKCU\Software\adm914]
"a1_188" = "3766372861"
[HKCU\Software\adm914]
"a3_191" = "1352565278"
[HKCU\Software\adm914]
"a3_192" = "1393045121"
[HKCU\Software\adm914]
"a4_181" = "1297610901"
[HKCU\Software\adm914]
"a3_135" = "950831462"
[HKCU\Software\adm914]
"a2_209" = "1498341619"
[HKCU\Software\adm914]
"a4_182" = "1304780022"
[HKCU\Software\adm914]
"a2_205" = "1469674370"
[HKCU\Software\adm914]
"a2_204" = "1462494198"
[HKCU\Software\adm914]
"a2_207" = "1484013551"
[HKCU\Software\adm914]
"a1_128" = "3485818324"
[HKCU\Software\adm914]
"a2_201" = "1440992179"
[HKCU\Software\adm914]
"a2_200" = "1433825872"
[HKCU\Software\adm914]
"a2_203" = "1455329099"
[HKCU\Software\adm914]
"a2_202" = "1448157386"
[HKCU\Software\adm914]
"a2_241" = "1727751235"
[HKCU\Software\adm914]
"a4_310" = "2222427510"
[HKCU\Software\adm914]
"a1_290" = "160234902"
[HKCU\Software\adm914]
"a2_240" = "1720582932"
[HKCU\Software\adm914]
"a4_213" = "1527022773"
[HKCU\Software\adm914]
"a1_268" = "1789854431"
[HKCU\Software\adm914]
"a2_243" = "1742099772"
[HKCU\Software\adm914]
"a2_73" = "523338941"
[HKCU\Software\adm914]
"a2_72" = "516173746"
[HKCU\Software\adm914]
"a2_71" = "509002868"
[HKCU\Software\adm914]
"a2_70" = "501834712"
[HKCU\Software\adm914]
"a3_81" = "597665008"
[HKCU\Software\adm914]
"a3_80" = "590100497"
[HKCU\Software\adm914]
"a2_75" = "537689644"
[HKCU\Software\adm914]
"a2_74" = "530519858"
[HKCU\Software\adm914]
"a3_121" = "850859928"
[HKCU\Software\adm914]
"a3_120" = "843344697"
[HKCU\Software\adm914]
"a2_79" = "566355437"
[HKCU\Software\adm914]
"a2_78" = "559186231"
[HKCU\Software\adm914]
"a3_89" = "654607352"
[HKCU\Software\adm914]
"a3_88" = "614065945"
[HKCU\Software\adm914]
"a3_127" = "927443550"
[HKCU\Software\adm914]
"a3_126" = "886309375"
[HKCU\Software\adm914]
"a2_284" = "2036024036"
[HKCU\Software\adm914]
"a1_230" = "2913624191"
[HKCU\Software\adm914]
"a3_235" = "1701331786"
[HKCU\Software\adm914]
"a2_246" = "1763594492"
[HKCU\Software\adm914]
"a3_234" = "1660856043"
[HKCU\Software\adm914]
"a2_224" = "1605880857"
[HKCU\Software\adm914]
"a3_237" = "1682344844"
[HKCU\Software\adm914]
"a2_191" = "1369308501"
[HKCU\Software\adm914]
"a4_233" = "1670405193"
[HKCU\Software\adm914]
"a1_255" = "3812964312"
[HKCU\Software\adm914]
"a1_228" = "148631357"
[HKCU\Software\adm914]
"a3_239" = "1730400462"
[HKCU\Software\adm914]
"a4_292" = "2093383332"
[HKCU\Software\adm914]
"a3_238" = "1689269359"
[HKCU\Software\adm914]
"a2_279" = "2000187465"
[HKCU\Software\adm914]
"a3_142" = "1034865551"
[HKCU\Software\adm914]
"a2_199" = "1426660824"
[HKCU\Software\adm914]
"a4_239" = "1713419919"
[HKCU\Software\adm914]
"a1_229" = "1181662221"
[HKCU\Software\adm914]
"a2_296" = "2122056928"
[HKCU\Software\adm914]
"a4_99" = "709742979"
[HKCU\Software\adm914]
"a4_98" = "702573858"
[HKCU\Software\adm914]
"a4_97" = "695404737"
[HKCU\Software\adm914]
"a4_96" = "688235616"
[HKCU\Software\adm914]
"a4_95" = "681066495"
[HKCU\Software\adm914]
"a4_94" = "673897374"
[HKCU\Software\adm914]
"a4_93" = "666728253"
[HKCU\Software\adm914]
"a4_92" = "659559132"
[HKCU\Software\adm914]
"a4_91" = "652390011"
[HKCU\Software\adm914]
"a4_90" = "645220890"
[HKCU\Software\adm914]
"a1_145" = "1845524520"
[HKCU\Software\adm914]
"a1_144" = "3731359455"
[HKCU\Software\adm914]
"a1_147" = "3846567152"
[HKCU\Software\adm914]
"a1_146" = "2385950996"
[HKCU\Software\adm914]
"a1_141" = "1636773920"
[HKCU\Software\adm914]
"a1_140" = "2649460825"
[HKCU\Software\adm914]
"a1_143" = "3846858336"
[HKCU\Software\adm914]
"a1_142" = "1235419291"
[HKCU\Software\adm914]
"a1_149" = "1485221944"
[HKCU\Software\adm914]
"a1_148" = "3249883863"
[HKCU\Software\adm914]
"a4_7" = "50183847"
[HKCU\Software\adm914]
"a4_6" = "43014726"
[HKCU\Software\adm914]
"a4_5" = "35845605"
[HKCU\Software\adm914]
"a4_4" = "28676484"
[HKCU\Software\adm914]
"a4_3" = "21507363"
[HKCU\Software\adm914]
"a4_2" = "14338242"
[HKCU\Software\adm914]
"a4_1" = "7169121"
[HKCU\Software\adm914]
"a4_0" = "0"
[HKCU\Software\adm914]
"a2_119" = "853127990"
[HKCU\Software\adm914]
"a2_99" = "709740744"
[HKCU\Software\adm914]
"a1_266" = "343157657"
[HKCU\Software\adm914]
"a1_267" = "2420463218"
[HKCU\Software\adm914]
"a1_260" = "3929222857"
[HKCU\Software\adm914]
"a1_261" = "3506680743"
[HKCU\Software\adm914]
"a4_9" = "64522089"
[HKCU\Software\adm914]
"a4_8" = "57352968"
[HKCU\Software\adm914]
"a4_175" = "1254596175"
[HKCU\Software\adm914]
"a4_174" = "1247427054"
[HKCU\Software\adm914]
"a4_177" = "1268934417"
[HKCU\Software\adm914]
"a4_176" = "1261765296"
[HKCU\Software\adm914]
"a4_171" = "1225919691"
[HKCU\Software\adm914]
"a4_170" = "1218750570"
[HKCU\Software\adm914]
"a4_173" = "1240257933"
[HKCU\Software\adm914]
"a4_172" = "1233088812"
[HKCU\Software\adm914]
"a1_304" = "2939276281"
[HKCU\Software\adm914]
"a4_179" = "1283272659"
[HKCU\Software\adm914]
"a4_178" = "1276103538"
[HKCU\Software\adm914]
"a1_50" = "4043436452"
[HKCU\Software\adm914]
"a1_51" = "2421578250"
[HKCU\Software\adm914]
"a1_52" = "354553824"
[HKCU\Software\adm914]
"a1_53" = "1951343041"
[HKCU\Software\adm914]
"a1_54" = "3945488943"
[HKCU\Software\adm914]
"a1_55" = "902357906"
[HKCU\Software\adm914]
"a1_56" = "2974083945"
[HKCU\Software\adm914]
"a1_57" = "3513223041"
[HKCU\Software\adm914]
"a1_58" = "941442989"
[HKCU\Software\adm914]
"a1_59" = "3036503815"
[HKCU\Software\adm914]
"a2_193" = "1383644771"
[HKCU\Software\adm914]
"a2_195" = "1397973931"
[HKCU\Software\adm914]
"a3_229" = "1624878212"
[HKCU\Software\adm914]
"a1_254" = "3166627938"
[HKCU\Software\adm914]
"a2_192" = "1376475678"
[HKCU\Software\adm914]
"a3_47" = "353766286"
[HKCU\Software\adm914]
"a2_188" = "1347791596"
[HKCU\Software\adm914]
"a2_189" = "1354959093"
[HKCU\Software\adm914]
"a2_186" = "1333459194"
[HKCU\Software\adm914]
"a2_187" = "1340623523"
[HKCU\Software\adm914]
"a2_184" = "1319121119"
[HKCU\Software\adm914]
"a3_46" = "313225007"
[HKCU\Software\adm914]
"a2_182" = "1304776138"
[HKCU\Software\adm914]
"a2_183" = "1311955705"
[HKCU\Software\adm914]
"a2_180" = "1290439718"
[HKCU\Software\adm914]
"a2_181" = "1297607724"
[HKCU\Software\adm914]
"a4_214" = "1534191894"
[HKCU\Software\adm914]
"a2_37" = "265262573"
[HKCU\Software\adm914]
"a4_216" = "1548530136"
[HKCU\Software\adm914]
"a4_217" = "1555699257"
[HKCU\Software\adm914]
"a2_9" = "64527522"
[HKCU\Software\adm914]
"a2_8" = "57356500"
[HKCU\Software\adm914]
"a4_212" = "1519853652"
[HKCU\Software\adm914]
"a3_48" = "360821873"
[HKCU\Software\adm914]
"a2_5" = "35840348"
[HKCU\Software\adm914]
"a2_4" = "28673735"
[HKCU\Software\adm914]
"a2_7" = "50178311"
[HKCU\Software\adm914]
"a2_6" = "43011839"
[HKCU\Software\adm914]
"a2_1" = "7168686"
[HKCU\Software\adm914]
"a2_0" = "1743"
[HKCU\Software\adm914]
"a2_3" = "21511796"
[HKCU\Software\adm914]
"a2_2" = "14341495"
[HKCU\Software\adm914]
"a3_253" = "1830770076"
[HKCU\Software\adm914]
"a3_252" = "1789765949"
[HKCU\Software\adm914]
"a3_251" = "1782713690"
[HKCU\Software\adm914]
"a3_250" = "1809277179"
[HKCU\Software\adm914]
"a3_257" = "1825743648"
[HKCU\Software\adm914]
"a3_256" = "1818691393"
[HKCU\Software\adm914]
"a3_255" = "1844812510"
[HKCU\Software\adm914]
"a3_254" = "1837825663"
[HKCU\Software\adm914]
"a3_259" = "1873799266"
[HKCU\Software\adm914]
"a3_258" = "1866223491"
[HKCU\Software\adm914]
"a1_300" = "2609299925"
[HKCU\Software\adm914]
"a4_289" = "2071875969"
[HKCU\Software\adm914]
"a4_288" = "2064706848"
[HKCU\Software\adm914]
"a4_287" = "2057537727"
[HKCU\Software\adm914]
"a4_286" = "2050368606"
[HKCU\Software\adm914]
"a2_197" = "1412311909"
[HKCU\Software\adm914]
"a2_198" = "1419491706"
[HKCU\Software\adm914]
"a4_283" = "2028861243"
[HKCU\Software\adm914]
"a4_282" = "2021692122"
[HKCU\Software\adm914]
"a4_281" = "2014523001"
[HKCU\Software\adm914]
"a4_280" = "2007353880"
[HKCU\Software\adm914]
"a1_233" = "1872227343"
[HKCU\Software\adm914]
"a1_232" = "3558572733"
[HKCU\Software\adm914]
"a1_225" = "3010002182"
[HKCU\Software\adm914]
"a1_231" = "3083868114"
[HKCU\Software\adm914]
"a1_307" = "463441960"
[HKCU\Software\adm914]
"a3_222" = "1608411743"
[HKCU\Software\adm914]
"a3_172" = "1216092013"
[HKCU\Software\adm914]
"a3_173" = "1223668684"
[HKCU\Software\adm914]
"a3_170" = "1235734059"
[HKCU\Software\adm914]
"a3_171" = "1209100938"
[HKCU\Software\adm914]
"a3_176" = "1245078769"
[HKCU\Software\adm914]
"a3_177" = "1252065616"
[HKCU\Software\adm914]
"a3_174" = "1264148399"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\adm914]
"a2_196" = "1405141994"
[HKCU\Software\adm914]
"a1_237" = "215690159"
[HKCU\Software\adm914]
"a3_178" = "1292676403"
[HKCU\Software\adm914]
"a3_179" = "1300122002"
[HKCU\Software\adm914]
"a2_245" = "1756432245"
[HKCU\Software\adm914]
"a2_244" = "1749267308"
[HKCU\Software\adm914]
"a2_247" = "1770766725"
[HKCU\Software\adm914]
"a1_236" = "3190507176"
[HKCU\Software\adm914]
"a1_235" = "2689349342"
[HKCU\Software\adm914]
"a1_234" = "4133196393"
[HKCU\Software\adm914]
"a1_306" = "3967892099"
[HKCU\Software\adm914]
"a3_41" = "277247432"
[HKCU\Software\adm914]
"a3_40" = "269797737"
[HKCU\Software\adm914]
"a3_43" = "324844042"
[HKCU\Software\adm914]
"a3_42" = "284234155"
[HKCU\Software\adm914]
"a3_45" = "305775436"
[HKCU\Software\adm914]
"a3_44" = "332277485"
[HKCU\Software\adm914]
"a2_39" = "279600989"
[HKCU\Software\adm914]
"a2_38" = "272429510"
[HKCU\Software\adm914]
"a3_49" = "368267472"
[HKCU\Software\adm914]
"a2_36" = "258080912"
[HKCU\Software\adm914]
"a2_35" = "250916281"
[HKCU\Software\adm914]
"a2_34" = "243748310"
[HKCU\Software\adm914]
"a2_33" = "236579804"
[HKCU\Software\adm914]
"a2_32" = "229413975"
[HKCU\Software\adm914]
"a2_31" = "222245927"
[HKCU\Software\adm914]
"a2_30" = "215078264"
[HKCU\Software\adm914]
"a4_59" = "422978139"
[HKCU\Software\adm914]
"a4_58" = "415809018"
[HKCU\Software\adm914]
"a2_235" = "1684748899"
[HKCU\Software\adm914]
"a4_53" = "379963413"
[HKCU\Software\adm914]
"a4_52" = "372794292"
[HKCU\Software\adm914]
"a4_51" = "365625171"
[HKCU\Software\adm914]
"a4_50" = "358456050"
[HKCU\Software\adm914]
"a4_57" = "408639897"
[HKCU\Software\adm914]
"a4_56" = "401470776"
[HKCU\Software\adm914]
"a4_55" = "394301655"
[HKCU\Software\adm914]
"a4_54" = "387132534"
[HKCU\Software\adm914]
"a1_295" = "3197456381"
[HKCU\Software\adm914]
"a3_306" = "2210569651"
[HKCU\Software\adm914]
"a2_89" = "638043667"
[HKCU\Software\adm914]
"a3_53" = "396799572"
[HKCU\Software\adm914]
"a3_241" = "1744312592"
[HKCU\Software\adm914]
"a3_271" = "1926112494"
[HKCU\Software\adm914]
"a1_297" = "1732814019"
[HKCU\Software\adm914]
"a3_300" = "2167588845"
[HKCU\Software\adm914]
"a2_48" = "344113430"
[HKCU\Software\adm914]
"a2_49" = "351284481"
[HKCU\Software\adm914]
"a2_42" = "301100556"
[HKCU\Software\adm914]
"a2_43" = "308266555"
[HKCU\Software\adm914]
"a2_40" = "286769025"
[HKCU\Software\adm914]
"a2_41" = "293929185"
[HKCU\Software\adm914]
"a2_46" = "329781655"
[HKCU\Software\adm914]
"a2_47" = "336952418"
[HKCU\Software\adm914]
"a2_44" = "315445696"
[HKCU\Software\adm914]
"a2_45" = "322613526"
[HKCU\Software\adm914]
"a2_115" = "824443317"
[HKCU\Software\adm914]
"a1_293" = "1497785203"
[HKCU\Software\adm914]
"a3_242" = "1718322675"
[HKCU\Software\adm914]
"a2_289" = "2071874501"
[HKCU\Software\adm914]
"a3_193" = "1400621920"
[HKCU\Software\adm914]
"a3_309" = "2231979860"
[HKCU\Software\adm914]
"a1_309" = "1987655000"
[HKCU\Software\adm914]
"a1_101" = "3680815896"
[HKCU\Software\adm914]
"a1_100" = "4150679989"
[HKCU\Software\adm914]
"a1_103" = "3354732228"
[HKCU\Software\adm914]
"a1_102" = "2515810036"
[HKCU\Software\adm914]
"a1_105" = "1421220893"
[HKCU\Software\adm914]
"a1_104" = "1964923442"
[HKCU\Software\adm914]
"a1_107" = "202255058"
[HKCU\Software\adm914]
"a1_106" = "2872631795"
[HKCU\Software\adm914]
"a1_109" = "1108594575"
[HKCU\Software\adm914]
"a1_108" = "190542261"
[HKCU\Software\adm914]
"a2_208" = "1491178948"
[HKCU\Software\adm914]
"a3_223" = "1581848126"
[HKCU\Software\adm914]
"a1_298" = "2876645411"
[HKCU\Software\adm914]
"a4_131" = "939154851"
[HKCU\Software\adm914]
"a4_130" = "931985730"
[HKCU\Software\adm914]
"a4_133" = "953493093"
[HKCU\Software\adm914]
"a4_132" = "946323972"
[HKCU\Software\adm914]
"a4_135" = "967831335"
[HKCU\Software\adm914]
"a4_134" = "960662214"
[HKCU\Software\adm914]
"a4_137" = "982169577"
[HKCU\Software\adm914]
"a4_136" = "975000456"
[HKCU\Software\adm914]
"a4_139" = "996507819"
[HKCU\Software\adm914]
"a4_138" = "989338698"
[HKCU\Software\adm914]
"a3_202" = "1465012939"
[HKCU\Software\adm914]
"a1_215" = "3507561505"
[HKCU\Software\adm914]
"a1_214" = "1255175000"
[HKCU\Software\adm914]
"a1_217" = "1537377387"
[HKCU\Software\adm914]
"a2_206" = "1476842420"
[HKCU\Software\adm914]
"a1_211" = "2798943565"
[HKCU\Software\adm914]
"a1_210" = "3262727259"
[HKCU\Software\adm914]
"a1_198" = "2797232733"
[HKCU\Software\adm914]
"a1_199" = "1538820527"
[HKCU\Software\adm914]
"a1_196" = "2393783316"
[HKCU\Software\adm914]
"a1_197" = "1406480884"
[HKCU\Software\adm914]
"a1_154" = "894203924"
[HKCU\Software\adm914]
"a1_195" = "2756845493"
[HKCU\Software\adm914]
"a1_192" = "1773230996"
[HKCU\Software\adm914]
"a1_193" = "987291517"
[HKCU\Software\adm914]
"a1_190" = "2493062317"
[HKCU\Software\adm914]
"a1_191" = "916442374"
[HKCU\Software\adm914]
"a3_284" = "2019048925"
[HKCU\Software\adm914]
"a3_285" = "2026625468"
[HKCU\Software\adm914]
"a2_148" = "1061034728"
[HKCU\Software\adm914]
"a2_149" = "1068234701"
[HKCU\Software\adm914]
"a3_280" = "1990634585"
[HKCU\Software\adm914]
"a3_281" = "2031110200"
[HKCU\Software\adm914]
"a3_282" = "2038690971"
[HKCU\Software\adm914]
"a3_283" = "2045677946"
[HKCU\Software\adm914]
"a2_142" = "1018016998"
[HKCU\Software\adm914]
"a2_143" = "1025180903"
[HKCU\Software\adm914]
"a2_140" = "1003682766"
[HKCU\Software\adm914]
"a2_141" = "1010851277"
[HKCU\Software\adm914]
"a2_146" = "1046685701"
[HKCU\Software\adm914]
"a2_147" = "1053865365"
[HKCU\Software\adm914]
"a2_144" = "1032349456"
[HKCU\Software\adm914]
"a2_145" = "1039516602"
[HKCU\Software\adm914]
"a1_308" = "2658518536"
[HKCU\Software\adm914]
"a3_273" = "1974168880"
[HKCU\Software\adm914]
"a2_231" = "1656065145"
[HKCU\Software\adm914]
"a2_248" = "1777938391"
[HKCU\Software\adm914]
"a3_272" = "1966719313"
[HKCU\Software\adm914]
"a1_256" = "2736904524"
[HKCU\Software\adm914]
"a4_250" = "1792280250"
[HKCU\Software\adm914]
"a2_297" = "2129224250"
[HKCU\Software\adm914]
"a1_209" = "3136583807"
[HKCU\Software\adm914]
"a3_219" = "1553447098"
[HKCU\Software\adm914]
"a3_218" = "1545870555"
[HKCU\Software\adm914]
"a3_217" = "1572434040"
[HKCU\Software\adm914]
"a3_216" = "1565513625"
[HKCU\Software\adm914]
"a3_215" = "1524378422"
[HKCU\Software\adm914]
"a3_214" = "1517457239"
[HKCU\Software\adm914]
"a3_213" = "1510466292"
[HKCU\Software\adm914]
"a3_212" = "1536443925"
[HKCU\Software\adm914]
"a3_211" = "1529535922"
[HKCU\Software\adm914]
"a3_210" = "1488925139"
[HKCU\Software\adm914]
"a2_275" = "1971516922"
[HKCU\Software\adm914]
"a2_276" = "1978674773"
[HKCU\Software\adm914]
"a2_285" = "2043193195"
[HKCU\Software\adm914]
"a1_202" = "1429021656"
[HKCU\Software\adm914]
"a2_287" = "2057539918"
[HKCU\Software\adm914]
"a2_277" = "1985840807"
[HKCU\Software\adm914]
"a4_269" = "1928493549"
[HKCU\Software\adm914]
"a4_268" = "1921324428"
[HKCU\Software\adm914]
"a2_283" = "2028855679"
[HKCU\Software\adm914]
"a1_203" = "1032499378"
[HKCU\Software\adm914]
"a4_265" = "1899817065"
[HKCU\Software\adm914]
"a4_264" = "1892647944"
[HKCU\Software\adm914]
"a4_267" = "1914155307"
[HKCU\Software\adm914]
"a4_266" = "1906986186"
[HKCU\Software\adm914]
"a4_261" = "1871140581"
[HKCU\Software\adm914]
"a1_200" = "282275830"
[HKCU\Software\adm914]
"a4_263" = "1885478823"
[HKCU\Software\adm914]
"a4_262" = "1878309702"
[HKCU\Software\adm914]
"a1_201" = "563165307"
[HKCU\Software\adm914]
"a3_221" = "1600963068"
[HKCU\Software\adm914]
"a1_206" = "3278580589"
[HKCU\Software\adm914]
"a1_207" = "3043888427"
[HKCU\Software\adm914]
"a1_282" = "2643014927"
[HKCU\Software\adm914]
"a1_283" = "450465133"
[HKCU\Software\adm914]
"a1_280" = "3733295013"
[HKCU\Software\adm914]
"a1_281" = "2961704122"
[HKCU\Software\adm914]
"a1_286" = "3857715200"
[HKCU\Software\adm914]
"a1_204" = "3284834074"
[HKCU\Software\adm914]
"a1_284" = "3164104994"
[HKCU\Software\adm914]
"a1_285" = "778574388"
[HKCU\Software\adm914]
"a1_288" = "2422968988"
[HKCU\Software\adm914]
"a1_205" = "2863892980"
[HKCU\Software\adm914]
"a2_194" = "1390805594"
[HKCU\Software\adm914]
"a4_17" = "121875057"
[HKCU\Software\adm914]
"a4_16" = "114705936"
[HKCU\Software\adm914]
"a4_15" = "107536815"
[HKCU\Software\adm914]
"a4_14" = "100367694"
[HKCU\Software\adm914]
"a4_13" = "93198573"
[HKCU\Software\adm914]
"a4_12" = "86029452"
[HKCU\Software\adm914]
"a4_11" = "78860331"
[HKCU\Software\adm914]
"a4_10" = "71691210"
[HKCU\Software\adm914]
"a2_218" = "1562864550"
[HKCU\Software\adm914]
"a2_219" = "1570031871"
[HKCU\Software\adm914]
"a3_87" = "607025846"
[HKCU\Software\adm914]
"a4_19" = "136213299"
[HKCU\Software\adm914]
"a4_18" = "129044178"
[HKCU\Software\adm914]
"a3_149" = "1051200052"
[HKCU\Software\adm914]
"a3_86" = "633134807"
[HKCU\Software\adm914]
"a3_143" = "1008235630"
[HKCU\Software\adm914]
"a2_77" = "552020955"
[HKCU\Software\adm914]
"a3_141" = "1027813164"
[HKCU\Software\adm914]
"a3_140" = "986809165"
[HKCU\Software\adm914]
"a3_147" = "1070843378"
[HKCU\Software\adm914]
"a3_146" = "1063278867"
[HKCU\Software\adm914]
"a3_145" = "1022803120"
[HKCU\Software\adm914]
"a2_76" = "544857620"
[HKCU\Software\adm914]
"a1_155" = "1331520389"
[HKCU\Software\adm914]
"a4_197" = "1412316837"
[HKCU\Software\adm914]
"a2_295" = "2114894355"
[HKCU\Software\adm914]
"a3_83" = "578088242"
[HKCU\Software\adm914]
"a3_138" = "1006336523"
[HKCU\Software\adm914]
"a3_139" = "979822314"
[HKCU\Software\adm914]
"a3_136" = "991835593"
[HKCU\Software\adm914]
"a3_137" = "998887848"
[HKCU\Software\adm914]
"a3_134" = "943844487"
[HKCU\Software\adm914]
"a3_82" = "571031891"
[HKCU\Software\adm914]
"a3_132" = "962896965"
[HKCU\Software\adm914]
"a3_133" = "970342436"
[HKCU\Software\adm914]
"a3_130" = "915382019"
[HKCU\Software\adm914]
"a3_131" = "922303458"
[HKCU\Software\adm914]
"a3_205" = "1452935148"
[HKCU\Software\adm914]
"a1_299" = "190672771"
[HKCU\Software\adm914]
"a1_159" = "3847694445"
[HKCU\Software\adm914]
"a4_193" = "1383640353"
[HKCU\Software\adm914]
"a2_262" = "1878303679"
[HKCU\Software\adm914]
"a3_123" = "898391258"
[HKCU\Software\adm914]
"a4_192" = "1376471232"
[HKCU\Software\adm914]
"a3_122" = "891465851"
[HKCU\Software\adm914]
"a4_191" = "1369302111"
[HKCU\Software\adm914]
"a4_199" = "1426655079"
[HKCU\Software\adm914]
"a3_125" = "879322396"
[HKCU\Software\adm914]
"a4_190" = "1362132990"
[HKCU\Software\adm914]
"a2_259" = "1856805251"
[HKCU\Software\adm914]
"a1_264" = "2614616413"
[HKCU\Software\adm914]
"a3_124" = "905967805"
[HKCU\Software\adm914]
"a1_259" = "102380904"
[HKCU\Software\adm914]
"a2_307" = "2200925339"
[HKCU\Software\adm914]
"a1_258" = "1290331797"
[HKCU\Software\adm914]
"a2_288" = "2064697578"
[HKCU\Software\adm914]
"a2_301" = "2157911541"
[HKCU\Software\adm914]
"a4_256" = "1835294976"
[HKCU\Software\adm914\695404737]
"43014726" = "0B00687474703A2F2F7777772E626C6F6E64612D7374656C697374612E676F2E726F2F78732E6A706700687474703A2F2F63666D752E6E6C2F454B323030382F696D616765732F78732E6A706700687474703A2F2F63616C696E67616C636869732E636F6D2F662E6A706700687474703A2F2F68656C6C6F6D652E3530776562732E636F6D2F496D616765732F732E6A706700687474703A2F2F6578706F696E2E72752F6C6F676F2F662E6A706700687474703A2F2F36312E31392E3139372E3130362F7E6E61726F6E6773616B2F696D6167652F732E6A706700687474703A2F2F646F636D616E696E6469612E636F6D2F696D616765732F78732E6A706700687474703A2F2F6B6D706561726C2E636F6D2F732E6A706700687474703A2F2F6261646D696E746F6E626C6F672E736974652E67652F662E6A706700687474703A2F2F7777772E6B617061646F6B79617661646973692E636F6D2F78732E6A706700687474703A2F2F6F6E75727461736172696D2E6E65742F696D616765732F78732E6A7067"
[HKCU\Software\adm914]
"a4_62" = "444485502"
[HKCU\Software\adm914]
"a4_63" = "451654623"
[HKCU\Software\adm914]
"a4_60" = "430147260"
[HKCU\Software\adm914]
"a4_61" = "437316381"
[HKCU\Software\adm914]
"a4_66" = "473161986"
[HKCU\Software\adm914]
"a4_67" = "480331107"
[HKCU\Software\adm914]
"a4_64" = "458823744"
[HKCU\Software\adm914]
"a4_65" = "465992865"
[HKCU\Software\adm914]
"a3_208" = "1508042897"
[HKCU\Software\adm914]
"a4_68" = "487500228"
[HKCU\Software\adm914]
"a4_69" = "494669349"
[HKCU\Software\adm914]
"a4_211" = "1512684531"
[HKCU\Software\adm914]
"a2_291" = "2086209956"
[HKCU\Software\adm914]
"a2_308" = "2208092580"
[HKCU\Software\adm914]
"a2_309" = "2215261873"
[HKCU\Software\adm914]
"a2_106" = "759923761"
[HKCU\Software\adm914]
"a2_107" = "767093217"
[HKCU\Software\adm914]
"a2_104" = "745594054"
[HKCU\Software\adm914]
"a2_105" = "752761619"
[HKCU\Software\adm914]
"a2_102" = "731245563"
[HKCU\Software\adm914]
"a2_103" = "738421916"
[HKCU\Software\adm914]
"a2_100" = "716908092"
[HKCU\Software\adm914]
"a2_101" = "724075267"
[HKCU\Software\adm914]
"a1_152" = "101047387"
[HKCU\Software\adm914]
"a1_153" = "3532035759"
[HKCU\Software\adm914]
"a1_150" = "4073891481"
[HKCU\Software\adm914]
"a1_151" = "2771253347"
[HKCU\Software\adm914]
"a1_156" = "815446343"
[HKCU\Software\adm914]
"a1_157" = "2358020777"
[HKCU\Software\adm914]
"a2_108" = "774259710"
[HKCU\Software\adm914]
"a2_109" = "781428976"
[HKCU\Software\adm914]
"a3_207" = "1500990510"
[HKCU\Software\adm914]
"a1_277" = "42642331"
[HKCU\Software\adm914]
"a3_200" = "1416957321"
[HKCU\Software\adm914]
"a4_249" = "1785111129"
[HKCU\Software\adm914]
"a3_201" = "1424012904"
[HKCU\Software\adm914]
"a1_47" = "1208828054"
[HKCU\Software\adm914]
"a1_46" = "4134545463"
[HKCU\Software\adm914]
"a1_45" = "2230831947"
[HKCU\Software\adm914]
"a1_44" = "1981442293"
[HKCU\Software\adm914]
"a1_43" = "2706828937"
[HKCU\Software\adm914]
"a1_42" = "409295534"
[HKCU\Software\adm914]
"a1_41" = "2212575952"
[HKCU\Software\adm914]
"a1_40" = "1614468989"
[HKCU\Software\adm914]
"a4_162" = "1161397602"
[HKCU\Software\adm914]
"a4_163" = "1168566723"
[HKCU\Software\adm914]
"a4_160" = "1147059360"
[HKCU\Software\adm914]
"a4_161" = "1154228481"
[HKCU\Software\adm914]
"a4_166" = "1190074086"
[HKCU\Software\adm914]
"a4_167" = "1197243207"
[HKCU\Software\adm914]
"a1_49" = "2371699907"
[HKCU\Software\adm914]
"a1_48" = "3595384435"
[HKCU\Software\adm914]
"a2_173" = "1240254821"
[HKCU\Software\adm914]
"a2_172" = "1233092100"
[HKCU\Software\adm914]
"a2_171" = "1225926913"
[HKCU\Software\adm914]
"a2_170" = "1218750206"
[HKCU\Software\adm914]
"a2_177" = "1268925147"
[HKCU\Software\adm914]
"a2_176" = "1261771976"
[HKCU\Software\adm914]
"a2_175" = "1254590433"
[HKCU\Software\adm914]
"a2_174" = "1247423764"
[HKCU\Software\adm914]
"a2_179" = "1283275217"
[HKCU\Software\adm914]
"a2_178" = "1276108635"
[HKCU\Software\adm914]
"a2_233" = "1670412675"
[HKCU\Software\adm914]
"a2_242" = "1734931810"
[HKCU\Software\adm914]
"a1_32" = "3658218863"
[HKCU\Software\adm914]
"a2_28" = "200731485"
[HKCU\Software\adm914]
"a1_30" = "3032587024"
[HKCU\Software\adm914]
"a1_31" = "778719972"
[HKCU\Software\adm914]
"a1_36" = "2341371123"
[HKCU\Software\adm914]
"a1_37" = "3192912712"
[HKCU\Software\adm914]
"a1_34" = "4136156854"
[HKCU\Software\adm914]
"a1_35" = "175611162"
[HKCU\Software\adm914]
"a3_248" = "1761237945"
[HKCU\Software\adm914]
"a4_247" = "1770772887"
[HKCU\Software\adm914]
"a1_38" = "3663337897"
[HKCU\Software\adm914]
"a1_39" = "3401929606"
[HKCU\Software\adm914]
"a4_168" = "1204412328"
[HKCU\Software\adm914]
"a4_246" = "1763603766"
[HKCU\Software\adm914]
"a2_86" = "616538606"
[HKCU\Software\adm914]
"a4_169" = "1211581449"
[HKCU\Software\adm914]
"a4_298" = "2136398058"
[HKCU\Software\adm914]
"a4_299" = "2143567179"
[HKCU\Software\adm914]
"a2_87" = "623707143"
[HKCU\Software\adm914]
"a4_294" = "2107721574"
[HKCU\Software\adm914]
"a4_295" = "2114890695"
[HKCU\Software\adm914]
"a4_296" = "2122059816"
[HKCU\Software\adm914]
"a4_297" = "2129228937"
[HKCU\Software\adm914]
"a4_290" = "2079045090"
[HKCU\Software\adm914]
"a4_291" = "2086214211"
[HKCU\Software\adm914]
"a1_274" = "2111499022"
[HKCU\Software\adm914]
"a4_293" = "2100552453"
[HKCU\Software\adm914]
"a1_243" = "1804054727"
[HKCU\Software\adm914]
"a2_310" = "2222431222"
[HKCU\Software\adm914]
"a3_107" = "750490314"
[HKCU\Software\adm914]
"a3_106" = "742979179"
[HKCU\Software\adm914]
"a3_105" = "769478024"
[HKCU\Software\adm914]
"a3_104" = "762552617"
[HKCU\Software\adm914]
"a3_103" = "754976070"
[HKCU\Software\adm914]
"a3_102" = "714512615"
[HKCU\Software\adm914]
"a3_101" = "707525636"
[HKCU\Software\adm914]
"a3_100" = "733500325"
[HKCU\Software\adm914]
"a2_256" = "1835286636"
[HKCU\Software\adm914]
"a2_257" = "1842470401"
[HKCU\Software\adm914]
"a2_254" = "1820956178"
[HKCU\Software\adm914]
"a2_255" = "1828120837"
[HKCU\Software\adm914]
"a2_252" = "1806621145"
[HKCU\Software\adm914]
"a3_58" = "432790459"
[HKCU\Software\adm914]
"a3_109" = "798022412"
[HKCU\Software\adm914]
"a3_108" = "790970029"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 CC 85 04 DF 99 46 69 C8 E2 FB 12 00 43 EB 53"
[HKCU\Software\adm914]
"a4_228" = "1634559588"
[HKCU\Software\adm914]
"a3_59" = "406144026"
[HKCU\Software\adm914]
"a4_273" = "1957170033"
[HKCU\Software\adm914]
"a4_221" = "1584375741"
[HKCU\Software\adm914]
"a4_220" = "1577206620"
[HKCU\Software\adm914]
"a4_223" = "1598713983"
[HKCU\Software\adm914]
"a4_222" = "1591544862"
[HKCU\Software\adm914]
"a4_225" = "1613052225"
[HKCU\Software\adm914]
"a4_224" = "1605883104"
[HKCU\Software\adm914]
"a4_227" = "1627390467"
[HKCU\Software\adm914]
"a4_226" = "1620221346"
[HKCU\Software\adm914]
"a3_74" = "513565259"
[HKCU\Software\adm914]
"a3_75" = "554634794"
[HKCU\Software\adm914]
"a3_76" = "561687181"
[HKCU\Software\adm914]
"a3_77" = "568612716"
[HKCU\Software\adm914]
"a3_70" = "485102791"
[HKCU\Software\adm914]
"a3_71" = "525709478"
[HKCU\Software\adm914]
"a3_72" = "533159177"
[HKCU\Software\adm914]
"a3_73" = "506657256"
[HKCU\Software\adm914]
"a4_165" = "1182904965"
[HKCU\Software\adm914]
"a3_78" = "542634959"
[HKCU\Software\adm914]
"a3_79" = "549625774"
[HKCU\Software\adm914]
"a4_277" = "1985846517"
[HKCU\Software\adm914]
"a4_195" = "1397978595"
[HKCU\Software\adm914]
"a2_229" = "1641732102"
[HKCU\Software\adm914]
"a2_228" = "1634562807"
[HKCU\Software\adm914]
"a4_274" = "1964339154"
[HKCU\Software\adm914]
"a4_28" = "200735388"
[HKCU\Software\adm914]
"a4_29" = "207904509"
[HKCU\Software\adm914]
"a4_26" = "186397146"
[HKCU\Software\adm914]
"a4_27" = "193566267"
[HKCU\Software\adm914]
"a4_24" = "172058904"
[HKCU\Software\adm914]
"a4_25" = "179228025"
[HKCU\Software\adm914]
"a4_22" = "157720662"
[HKCU\Software\adm914]
"a4_23" = "164889783"
[HKCU\Software\adm914]
"a4_20" = "143382420"
[HKCU\Software\adm914]
"a4_21" = "150551541"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\adm914]
"a4_231" = "1656066951"
[HKCU\Software\adm914]
"a3_175" = "1271199758"
[HKCU\Software\adm914]
"a2_253" = "1813782933"
[HKCU\Software\adm914]
"a2_59" = "422981879"
[HKCU\Software\adm914]
"a2_58" = "415802608"
[HKCU\Software\adm914]
"a4_279" = "2000184759"
[HKCU\Software\adm914]
"a2_51" = "365620091"
[HKCU\Software\adm914]
"a2_50" = "358451736"
[HKCU\Software\adm914]
"a2_53" = "379966260"
[HKCU\Software\adm914]
"a2_52" = "372799119"
[HKCU\Software\adm914]
"a2_55" = "394300171"
[HKCU\Software\adm914]
"a2_54" = "387137030"
[HKCU\Software\adm914]
"a2_57" = "408634647"
[HKCU\Software\adm914]
"a2_56" = "401467533"
[HKCU\Software\adm914]
"a1_294" = "1744572376"
[HKCU\Software\adm914]
"a1_270" = "2750318324"
[HKCU\Software\adm914]
"a4_183" = "1311949143"
[HKCU\Software\adm914]
"a4_285" = "2043199485"
[HKCU\Software\adm914]
"a1_276" = "3861084230"
[HKCU\Software\adm914]
"a3_292" = "2110068965"
[HKCU\Software\adm914]
"a4_248" = "1777942008"
[HKCU\Software\adm914]
"a2_306" = "2193745106"
[HKCU\Software\adm914]
"a1_116" = "3419008935"
[HKCU\Software\adm914]
"a1_117" = "1140115468"
[HKCU\Software\adm914]
"a1_114" = "2746413671"
[HKCU\Software\adm914]
"a1_115" = "2117033309"
[HKCU\Software\adm914]
"a1_112" = "873201512"
[HKCU\Software\adm914]
"a1_113" = "1300602755"
[HKCU\Software\adm914]
"a1_110" = "1951664887"
[HKCU\Software\adm914]
"a1_111" = "317852993"
[HKCU\Software\adm914\695404737]
"50183847" = "4989E596D9D17963DA839A3A0ED54AE0A705BCC58FA240BDA3EAF7B79367FC3F64C2D7949B7789BAA88A3614ED685AA04708879D912FE0EFEFA538B83D536802E30F13F30814B0AD678AC3B25E8080CFE0D9EB91B18A831324E17B56CD5538CCE9E24819B2DDE6137C2AA374F9604E34D47FF9157273A96B60E92B257A12E52D"
[HKCU\Software\adm914]
"a1_118" = "2160146154"
[HKCU\Software\adm914]
"a1_119" = "454607425"
[HKCU\Software\adm914]
"a4_126" = "903309246"
[HKCU\Software\adm914]
"a4_127" = "910478367"
[HKCU\Software\adm914]
"a4_124" = "888971004"
[HKCU\Software\adm914]
"a4_125" = "896140125"
[HKCU\Software\adm914]
"a4_122" = "874632762"
[HKCU\Software\adm914]
"a4_123" = "881801883"
[HKCU\Software\adm914]
"a4_120" = "860294520"
[HKCU\Software\adm914]
"a4_121" = "867463641"
[HKCU\Software\adm914]
"a1_257" = "4114364105"
[HKCU\Software\adm914]
"a4_128" = "917647488"
[HKCU\Software\adm914]
"a4_129" = "924816609"
[HKCU\Software\adm914]
"a1_163" = "3213325723"
[HKCU\Software\adm914]
"a1_162" = "3927946558"
[HKCU\Software\adm914]
"a1_161" = "235623261"
[HKCU\Software\adm914]
"a1_160" = "1308797725"
[HKCU\Software\adm914]
"a1_167" = "1903849987"
[HKCU\Software\adm914]
"a1_166" = "2610723762"
[HKCU\Software\adm914]
"a1_165" = "3356254912"
[HKCU\Software\adm914]
"a1_164" = "3067507306"
[HKCU\Software\adm914]
"a4_302" = "2165074542"
[HKCU\Software\adm914]
"a1_169" = "1159012988"
[HKCU\Software\adm914]
"a1_168" = "963720668"
[HKCU\Software\adm914]
"a4_303" = "2172243663"
[HKCU\Software\adm914]
"a2_238" = "1706247792"
[HKCU\Software\adm914]
"a3_204" = "1445501709"
[HKCU\Software\adm914]
"a1_208" = "1800879262"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\adm914]
"a2_139" = "996514795"
[HKCU\Software\adm914]
"a2_138" = "989331912"
[HKCU\Software\adm914]
"a2_137" = "982164243"
[HKCU\Software\adm914]
"a2_136" = "974995870"
[HKCU\Software\adm914]
"a2_135" = "967822061"
[HKCU\Software\adm914]
"a2_134" = "960664020"
[HKCU\Software\adm914]
"a2_133" = "953495865"
[HKCU\Software\adm914]
"a2_132" = "946329025"
[HKCU\Software\adm914]
"a2_131" = "939151323"
[HKCU\Software\adm914]
"a2_130" = "931981438"
[HKCU\Software\adm914]
"a4_153" = "1096875513"
[HKCU\Software\adm914]
"a4_152" = "1089706392"
[HKCU\Software\adm914]
"a4_151" = "1082537271"
[HKCU\Software\adm914]
"a4_150" = "1075368150"
[HKCU\Software\adm914]
"a4_157" = "1125551997"
[HKCU\Software\adm914]
"a4_156" = "1118382876"
[HKCU\Software\adm914]
"a4_155" = "1111213755"
[HKCU\Software\adm914]
"a4_154" = "1104044634"
[HKCU\Software\adm914]
"a4_159" = "1139890239"
[HKCU\Software\adm914]
"a4_158" = "1132721118"
[HKCU\Software\adm914]
"a2_239" = "1713418117"
[HKCU\Software\adm914\695404737]
"14338242" = "0"
[HKCU\Software\adm914\695404737]
"7169121" = "214"
[HKCU\Software\adm914]
"a3_209" = "1481479536"
[HKCU\Software\adm914]
"a1_78" = "9352407"
[HKCU\Software\adm914]
"a1_79" = "123188305"
[HKCU\Software\adm914]
"a1_76" = "1768585629"
[HKCU\Software\adm914]
"a1_77" = "4157313872"
[HKCU\Software\adm914]
"a1_74" = "3798851923"
[HKCU\Software\adm914]
"a1_75" = "624113590"
[HKCU\Software\adm914]
"a1_72" = "1505135115"
[HKCU\Software\adm914]
"a1_73" = "1483914856"
[HKCU\Software\adm914]
"a1_70" = "1673551810"
[HKCU\Software\adm914]
"a1_71" = "1460711082"
[HKCU\Software\adm914]
"a3_30" = "231908639"
[HKCU\Software\adm914]
"a3_31" = "205275646"
[HKCU\Software\adm914]
"a3_32" = "212855393"
[HKCU\Software\adm914]
"a3_33" = "253400768"
[HKCU\Software\adm914]
"a3_34" = "260321955"
[HKCU\Software\adm914]
"a3_35" = "267902722"
[HKCU\Software\adm914]
"a3_36" = "241269733"
[HKCU\Software\adm914]
"a1_33" = "1692851008"
[HKCU\Software\adm914]
"a3_38" = "289374247"
[HKCU\Software\adm914]
"a3_39" = "296299654"
[HKCU\Software\adm914]
"a2_84" = "602207132"
[HKCU\Software\adm914]
"a2_85" = "609371541"
[HKCU\Software\adm914]
"a2_82" = "587873180"
[HKCU\Software\adm914]
"a2_83" = "595038431"
[HKCU\Software\adm914]
"a2_80" = "573524938"
[HKCU\Software\adm914]
"a2_81" = "580702985"
[HKCU\Software\adm914]
"a4_272" = "1950000912"
[HKCU\Software\adm914]
"a1_239" = "2438109398"
[HKCU\Software\adm914]
"a4_188" = "1347794748"
[HKCU\Software\adm914]
"a3_243" = "1725247058"
[HKCU\Software\adm914]
"a4_276" = "1978677396"
[HKCU\Software\adm914]
"a2_236" = "1691917323"
[HKCU\Software\adm914]
"a2_249" = "1785117549"
[HKCU\Software\adm914]
"a4_275" = "1971508275"
[HKCU\Software\adm914]
"a3_294" = "2091000103"
[HKCU\Software\adm914]
"a3_244" = "1765853749"
[HKCU\Software\adm914]
"a4_278" = "1993015638"
[HKCU\Software\adm914]
"a2_237" = "1699083837"
[HKCU\Software\adm914]
"a3_245" = "1773303444"
[HKCU\Software\adm914]
"a4_270" = "1935662670"
[HKCU\Software\adm914]
"a3_246" = "1746735991"
[HKCU\Software\adm914]
"a4_308" = "2208089268"
[HKCU\Software\adm914]
"a4_309" = "2215258389"
[HKCU\Software\adm914]
"a4_306" = "2193751026"
[HKCU\Software\adm914]
"a4_307" = "2200920147"
[HKCU\Software\adm914]
"a4_304" = "2179412784"
[HKCU\Software\adm914]
"a3_247" = "1753792470"
[HKCU\Software\adm914]
"a1_249" = "471454732"
[HKCU\Software\adm914]
"a3_286" = "2067087903"
[HKCU\Software\adm914]
"a4_300" = "2150736300"
[HKCU\Software\adm914]
"a4_301" = "2157905421"
[HKCU\Software\adm914]
"a4_189" = "1354963869"
[HKCU\Software\adm914]
"a3_287" = "2074144510"
[HKCU\Software\adm914]
"a1_124" = "625274803"
[HKCU\Software\adm914]
"a3_293" = "2083554628"
[HKCU\Software\adm914]
"a3_249" = "1801831448"
[HKCU\Software\adm914]
"a1_250" = "2915653867"
[HKCU\Software\adm914]
"a4_271" = "1942831791"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP]
"server.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\server.exe:*:Enabled:ipsec"
The process NOTEPAD.EXE:744 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 8B EB 01 8B F8 D2 B7 97 56 11 2B A0 E8 25 07"
The process iexplore.exe:1572 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 C1 51 88 D7 37 C0 32 09 41 04 6E E9 5D C4 0A"
[HKCU\Software\Explorer]
"klg" = "01"
The process iexplore.exe:2020 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 9B 01 3B BD BB F0 5F 27 B9 C5 7A 17 0B 91 43"
The process 489f6bd786f63d1403167dab6c10bab8.exe:632 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F CF 3C F8 B6 06 85 DA ED 7A 4F C4 F1 04 BB 59"
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
The Virus deletes the following value(s) in system registry:
The Virus disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"
Network activity (URLs)
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
WINMINE.EXE:1560
WINMINE.EXE:1832
server.exe:744
server.exe:948
NOTEPAD.EXE:744
iexplore.exe:2020
489f6bd786f63d1403167dab6c10bab8.exe:632 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%WinDir%\system.ini (72 bytes)
%Program Files%\Explorer\klog.dat (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\server.exe (2712 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
