Win32.Sality.3_598a3fc9d8

by malwarelabrobot on June 10th, 2015 in Malware Descriptions.

Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Trojan.Win32.Swrort.3.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 598a3fc9d8277dc98197e6243e65ea29
SHA1: e85d0ebd50dcceb3748069adb251c2209d92940c
SHA256: 60e87c66ead138ac5d358e037318a905baef8b4267e44f7a8e6757fd43d49dab
SSDeep: 12288:wA0i50GtFITrf/OyFFLd5pc75zB1OTppaNzbxlf:wAfyGMrf/hFqOpqXf
Size: 491144 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: LLC "Bundle"
Created at: 2010-12-17 11:14:12
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

WMIC.exe:216
WMIC.exe:1240
WMIC.exe:556
WMIC.exe:1352
%original file name%.exe:172
7za.exe:1112
wmic.exe:1040

The Trojan injects its code into the following process(es):

setupcl.exe:1052
Explorer.EXE:532

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process WMIC.exe:216 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)

The process WMIC.exe:1240 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)

The process WMIC.exe:556 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)

The process WMIC.exe:1352 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)

The process setupcl.exe:1052 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)

The process %original file name%.exe:172 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsExec.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns7.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns4.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\[RANDOM_STRING].7z (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns8.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC605_Rar\%original file name%.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (14882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns5.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns6.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\7za.exe (19592 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\[RANDOM_STRING].7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\7za.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\setupcl.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx1.tmp (0 bytes)

The process 7za.exe:1112 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\setupcl.exe (198 bytes)

The process wmic.exe:1040 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)

Registry activity

The process WMIC.exe:216 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 9F 50 16 83 66 0F 1E FA B6 31 3A C7 E7 81 7F"

The process WMIC.exe:1240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 97 BC F7 BD C9 EB 9C 01 5D 1D 36 47 A1 CC D9"

The process WMIC.exe:556 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 98 52 33 C5 D7 A7 14 5E 0E 3A 04 06 1B 8B 70"

The process WMIC.exe:1352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA A0 2C 67 9D A3 87 0E 03 F1 D1 74 52 D8 40 3B"

The process setupcl.exe:1052 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD F1 C0 74 85 80 C6 5C 43 0D 82 A1 1B F5 37 C8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:172 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494845507"
"a2_349" = "2502017358"
"a2_346" = "2480518750"
"a2_347" = "2487692655"
"a2_344" = "2466184739"
"a2_345" = "2473349436"
"a2_342" = "2451834688"
"a2_343" = "2459003680"
"a2_340" = "2437500418"
"a2_341" = "2444668586"
"a2_180" = "1290439268"
"a2_181" = "1297603234"
"a2_182" = "1304772825"
"a2_183" = "1311955056"
"a2_184" = "1319121909"
"a2_185" = "1326290846"
"a2_186" = "1333458999"
"a2_187" = "1340622673"
"a2_188" = "1347789444"
"a2_189" = "1354971212"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074706908"
"a2_742" = "1024519364"
"a2_743" = "1031686457"
"a2_740" = "1010188176"
"a2_741" = "1017354510"
"a2_746" = "1053204954"
"a2_747" = "1060356466"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_745" = "1046022429"
"a1_503" = "3663558441"
"a1_502" = "2425458316"
"a1_501" = "480477829"
"a1_500" = "4211463753"
"a1_507" = "3535661217"
"a1_506" = "3266293392"
"a1_505" = "2447250155"
"a1_504" = "1246816129"
"a1_509" = "1348967445"
"a1_508" = "2204076778"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "2583627599"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "200089197"
"a1_434" = "390668231"
"a1_433" = "647561391"
"a1_432" = "3982629861"
"a1_431" = "1942567987"
"a1_430" = "876109093"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a1_636" = "2283082548"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "529335905"
"a1_728" = "3060187782"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "558871467"
"a2_748" = "1067537724"
"a1_593" = "2893038596"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_983" = "3789665314"
"a1_982" = "3541733231"
"a1_981" = "304211460"
"a1_980" = "1939061563"
"a3_869" = "1918293868"
"a2_744" = "1038855831"
"a1_855" = "3268391467"
"a3_655" = "383827462"
"a1_857" = "2875090071"
"a1_856" = "2029755997"
"a1_851" = "172307497"
"a1_850" = "623487033"
"a1_853" = "3785569163"
"a3_654" = "376767975"
"a1_859" = "4292645190"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "3936948165"
"a1_184" = "3168263561"
"a1_183" = "1547126155"
"a1_182" = "4144523768"
"a1_181" = "2814639656"
"a1_180" = "2143601764"
"a1_963" = "2244539285"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "154122648"
"a4_824" = "1612388408"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "3411794279"
"a4_866" = "1913491490"
"a1_933" = "1993936568"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "486769083"
"a4_863" = "1891984127"
"a1_936" = "436360476"
"a4_862" = "1884815006"
"a1_937" = "1783306591"
"a2_405" = "2903495587"
"a2_404" = "2896328135"
"a2_407" = "2917840804"
"a2_406" = "2910655227"
"a2_401" = "2874810854"
"a2_400" = "2867644695"
"a2_403" = "2889162025"
"a2_402" = "2881994242"
"a1_935" = "3407667985"
"a2_409" = "2932163770"
"a2_408" = "2924996567"
"a2_975" = "2694928456"
"a2_974" = "2687748921"
"a2_977" = "2709262326"
"a2_976" = "2702087143"
"a2_971" = "2666240107"
"a2_970" = "2659077663"
"a2_973" = "2680592647"
"a4_896" = "2128565120"
"a2_979" = "2723596063"
"a2_978" = "2716429619"
"a1_222" = "4151708893"
"a1_223" = "3390284214"
"a1_220" = "2594061927"
"a1_221" = "749920267"
"a1_226" = "2460490256"
"a1_227" = "3957428504"
"a1_224" = "4168984253"
"a1_225" = "2625875851"
"a1_228" = "764381869"
"a1_229" = "673430763"
"a2_579" = "4150927097"
"a2_578" = "4143757877"
"a2_571" = "4093574467"
"a2_570" = "4086391486"
"a2_573" = "4107908288"
"a2_572" = "4100739907"
"a2_575" = "4122234901"
"a2_574" = "4115073675"
"a2_577" = "4136577966"
"a2_576" = "4129421901"
"a2_351" = "2516368440"
"a2_350" = "2509186677"
"a2_353" = "2530691850"
"a2_352" = "2523535591"
"a2_355" = "2545034628"
"a2_354" = "2537869713"
"a2_357" = "2559370898"
"a2_356" = "2552204354"
"a2_359" = "2573721726"
"a2_358" = "2566538323"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642957"
"a2_192" = "1376476031"
"a2_191" = "1369306040"
"a2_190" = "1362125433"
"a2_197" = "1412310847"
"a2_196" = "1405142979"
"a2_195" = "1397976315"
"a2_194" = "1390808104"
"a3_624" = "195544665"
"a2_199" = "1426661066"
"a2_198" = "1419490696"
"a3_625" = "168917752"
"a2_759" = "1146390032"
"a3_626" = "175906587"
"a2_755" = "1117722564"
"a2_754" = "1110555492"
"a2_757" = "1132053562"
"a3_627" = "183481274"
"a2_751" = "1089038334"
"a2_750" = "1081868770"
"a2_753" = "1103388778"
"a2_752" = "1096204366"
"a1_536" = "407099007"
"a1_537" = "698875428"
"a1_534" = "532694760"
"a1_535" = "994795713"
"a1_89" = "3269461217"
"a1_88" = "234048547"
"a1_530" = "3679708558"
"a1_531" = "3479388263"
"a1_85" = "800674702"
"a1_84" = "233378408"
"a1_87" = "1890841985"
"a1_86" = "1938259410"
"a1_81" = "2257319917"
"a1_80" = "2683372164"
"a1_83" = "39759054"
"a1_82" = "1094047071"
"a3_914" = "2274560123"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\setupcl.exe,"

[HKCU\Software\Aas]
"a2_898" = "2142897843"
"a1_896" = "1408506942"
"a1_890" = "288379874"
"a2_899" = "2150079107"
"a1_67" = "417746556"
"a1_66" = "185724860"
"a1_65" = "2142442268"
"a3_133" = "970345548"
"a1_63" = "4148159916"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "4258292633"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "2475941964"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "3032651103"
"a1_68" = "1797637241"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "868245730"
"a1_409" = "1756861844"
"a1_402" = "1931417580"
"a1_403" = "1661607949"
"a1_400" = "3132869718"
"a1_401" = "4178706892"
"a1_406" = "1571436397"
"a1_407" = "3658021401"
"a1_404" = "2535714124"
"a1_405" = "2402528847"
"a2_823" = "1605216092"
"a2_822" = "1598052491"
"a2_821" = "1590885537"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633902589"
"a1_628" = "2439376701"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "33956857"
"a2_826" = "1626732633"
"a2_825" = "1619550868"
"a1_718" = "160621600"
"a1_719" = "394180309"
"a1_716" = "1376678681"
"a1_717" = "1696776336"
"a1_714" = "2475868884"
"a1_715" = "2092221365"
"a1_712" = "774446310"
"a1_713" = "4166174065"
"a1_710" = "3622556763"
"a1_711" = "1099556425"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "416515813"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
"a3_449" = "3202245640"
"a2_941" = "2451171220"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "185610438"
"a1_889" = "1551639771"
"a1_886" = "3769182730"
"a1_887" = "903394270"
"a1_884" = "3454019002"
"a1_885" = "2422603314"
"a1_882" = "3634495334"
"a1_883" = "2990231879"
"a1_880" = "1389435850"
"a1_881" = "694918498"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251292502"
"a3_444" = "3166269973"
"a3_445" = "3206813364"
"a1_831" = "1208673636"
"a2_592" = "4244126154"
"a1_930" = "1776004287"
"a1_948" = "1178941834"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "1197461468"
"a1_723" = "1081155657"
"a1_722" = "3712708643"
"a1_721" = "2390774500"
"a1_720" = "1852376587"
"a1_768" = "1204566318"
"a1_727" = "3170671029"
"a1_726" = "2230686088"
"a2_643" = "314772072"
"a2_790" = "1368643473"
"a1_725" = "3035852231"
"a2_642" = "307602717"
"a1_724" = "1759544442"
"a2_641" = "300437371"
"a2_640" = "293261880"
"a2_647" = "343452423"
"a2_646" = "336287450"
"a1_158" = "930122736"
"a1_159" = "835732582"
"a2_645" = "329119111"
"a1_150" = "3262117224"
"a1_151" = "266232442"
"a1_152" = "1298328517"
"a1_153" = "1038892732"
"a1_154" = "1583126630"
"a1_155" = "3712127190"
"a1_156" = "2424191527"
"a1_157" = "3411407543"
"a1_235" = "3738730866"
"a1_234" = "2899465860"
"a1_237" = "3555237623"
"a1_236" = "4103173131"
"a1_231" = "3914708537"
"a1_230" = "4135900081"
"a1_233" = "1350138158"
"a1_232" = "1444192571"
"a1_239" = "1782566872"
"a1_238" = "876063749"
"a2_210" = "1505513460"
"a2_211" = "1512681064"
"a2_212" = "1519845459"
"a2_213" = "1527029658"
"a2_214" = "1534194685"
"a2_215" = "1541362504"
"a2_216" = "1548521941"
"a2_217" = "1555696078"
"a2_218" = "1562860224"
"a2_219" = "1570045398"
"a1_966" = "590312887"
"a2_508" = "3641911652"
"a2_509" = "3649079615"
"a2_504" = "3613229463"
"a2_505" = "3620411334"
"a2_506" = "3627580960"
"a2_507" = "3634745509"
"a2_500" = "3584562117"
"a2_501" = "3591721490"
"a2_502" = "3598893281"
"a2_503" = "3606060893"
"a2_791" = "1375812318"
"a2_698" = "709077613"
"a2_699" = "716246879"
"a2_694" = "680397105"
"a2_695" = "687577144"
"a2_696" = "694745683"
"a2_697" = "701911815"
"a2_690" = "651728237"
"a2_691" = "658891944"
"a2_692" = "666071831"
"a2_693" = "673227186"
"a2_324" = "2322804423"
"a2_325" = "2329964630"
"a2_326" = "2337142348"
"a2_327" = "2344293360"
"a2_320" = "2294112711"
"a2_321" = "2301280267"
"a2_322" = "2308463111"
"a2_323" = "2315617614"
"a1_521" = "1880144085"
"a1_520" = "925608118"
"a1_523" = "4018947447"
"a1_522" = "1681526165"
"a2_328" = "2351465972"
"a2_329" = "2358647572"
"a1_527" = "3690764593"
"a1_526" = "3640316924"
"a2_799" = "1433162533"
"a2_798" = "1425983178"
"a4_962" = "2601727106"
"a1_98" = "2110398341"
"a1_99" = "2512325330"
"a1_92" = "2763713045"
"a1_93" = "158587905"
"a1_90" = "71224774"
"a1_91" = "764023239"
"a1_96" = "3902849102"
"a1_97" = "1421276157"
"a1_94" = "454731043"
"a1_95" = "1091587895"
"a1_74" = "4256955702"
"a1_75" = "2050558752"
"a1_76" = "836545915"
"a1_77" = "3934897534"
"a1_70" = "1234053309"
"a1_71" = "1058471060"
"a1_72" = "623534978"
"a1_73" = "3067930620"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "1915998133"
"a1_79" = "3770257586"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "3327396472"
"a1_418" = "2358090073"
"a3_953" = "2520368944"
"a1_415" = "3460883589"
"a1_414" = "4177611879"
"a1_417" = "4206072251"
"a1_416" = "3390203252"
"a1_411" = "2255391879"
"a1_410" = "891580251"
"a1_413" = "1100888771"
"a1_412" = "1051173742"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "2416799777"
"a1_700" = "3025360741"
"a1_703" = "3833779202"
"a1_702" = "1761552170"
"a1_705" = "1901657146"
"a1_704" = "934125209"
"a1_707" = "3642822039"
"a1_706" = "3595110106"
"a1_709" = "679049448"
"a1_708" = "684617001"
"a2_360" = "2580886671"
"a4_838" = "1712756102"
"a2_361" = "2588055017"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595213831"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609551423"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616721563"
"a2_366" = "2623904405"
"a2_367" = "2631073754"
"a1_743" = "4160084530"
"a2_168" = "1204404728"
"a2_169" = "1211587634"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147054847"
"a4_973" = "2680587437"
"a2_161" = "1154235302"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "1955378879"
"a3_776" = "1251683361"
"a1_893" = "1614474022"
"a1_892" = "1363794490"
"a1_895" = "4252289901"
"a1_894" = "3359240931"
"a1_897" = "1859365604"
"a3_777" = "1292288064"
"a1_899" = "1385957880"
"a1_898" = "622402814"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261952509"
"a1_617" = "186134136"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "3704073179"
"a2_459" = "3290585152"
"a3_678" = "548713167"
"a1_614" = "2166257417"
"a1_820" = "3857604809"
"a1_821" = "1555209818"
"a1_822" = "3939635660"

"a1_149" = "616996518"
"a1_148" = "2266063121"
"a1_143" = "2011165683"
"a1_142" = "2054136342"
"a1_141" = "3124431416"
"a1_140" = "270290480"
"a1_147" = "1207569660"
"a1_146" = "3323141459"
"a1_145" = "4273910439"
"a1_144" = "407435701"
"a1_826" = "4085861266"
"a1_827" = "2600681229"
"a2_203" = "1455325852"
"a2_202" = "1448160938"
"a2_201" = "1440992158"
"a2_200" = "1433826024"
"a2_207" = "1483999539"
"a2_206" = "1476843561"
"a2_205" = "1469661822"
"a2_204" = "1462494106"
"a2_209" = "1498341502"
"a2_208" = "1491179427"
"a2_519" = "3720782730"
"a2_518" = "3713600186"
"a2_517" = "3706433136"
"a2_516" = "3699264791"
"a2_515" = "3692097724"
"a2_514" = "3684933426"
"a2_513" = "3677750706"
"a2_512" = "3670596018"
"a2_511" = "3663428857"
"a2_510" = "3656249129"
"a2_689" = "644548934"
"a2_688" = "637391369"
"a2_687" = "630225104"
"a2_686" = "623045711"
"a2_685" = "615878356"
"a2_684" = "608709399"
"a2_683" = "601544164"
"a2_682" = "594366368"
"a2_681" = "587208858"
"a2_680" = "580042555"
"a2_337" = "2416000522"
"a2_336" = "2408817160"
"a2_335" = "2401648693"
"a2_334" = "2394477987"
"a2_333" = "2387314581"
"a2_332" = "2380149527"
"a2_331" = "2372983842"
"a2_330" = "2365801237"
"a1_554" = "2841234622"
"a1_555" = "1546041618"
"a1_556" = "2798265362"
"a1_557" = "600882776"
"a3_242" = "1718323611"
"a1_551" = "3592425242"
"a2_339" = "2430334616"
"a2_338" = "2423165151"
"a4_673" = "529851137"
"a1_918" = "1378702252"
"a1_919" = "729587593"
"a3_243" = "1725243962"
"a1_852" = "3931368891"
"a1_914" = "2621126298"
"a1_398" = "760935337"
"a1_399" = "470329690"
"a4_679" = "572865863"
"a1_392" = "2645648705"
"a1_393" = "2155546267"
"a1_390" = "4075633167"
"a1_391" = "584805049"
"a1_396" = "1023482550"
"a1_397" = "4258910768"
"a1_394" = "1930191765"
"a1_395" = "2335219239"
"a1_858" = "3908389028"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "1321480950"
"a1_48" = "3796027805"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "1483562399"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "3983841634"
"a1_775" = "3670186746"
"a1_776" = "2498569086"
"a1_777" = "263839787"
"a1_191" = "66374513"
"a1_771" = "1863649879"
"a1_772" = "1435333434"
"a1_773" = "959659159"
"a1_953" = "1389328663"
"a3_927" = "2367492374"
"a1_778" = "105743984"
"a1_779" = "1734846842"
"a3_926" = "2326953207"
"a2_17" = "121868219"
"a2_16" = "114711137"
"a2_15" = "107542280"
"a2_14" = "100360876"
"a2_13" = "93206970"
"a2_12" = "86024832"
"a2_11" = "78869598"
"a2_10" = "71682075"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "3576361743"
"a2_19" = "136212452"
"a2_18" = "129045031"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "917275152"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "2425401805"
"a1_596" = "2912214044"
"a1_597" = "1555135365"
"a1_608" = "1152744870"
"a1_609" = "988941695"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "813087169"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "4019629887"
"a3_484" = "3486690637"
"a1_952" = "2469651897"
"a2_925" = "2336467632"
"a1_954" = "614539055"
"a1_955" = "2786713737"
"a1_956" = "3843140979"
"a3_485" = "3460055532"
"a1_958" = "2605879619"
"a2_922" = "2314970842"
"a1_750" = "2066116219"
"a1_751" = "1072716758"
"a1_756" = "381843658"
"a1_757" = "1848022248"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "1401532329"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "1403674199"
"a4_903" = "2178748967"
"a1_188" = "132986538"
"a4_900" = "2157241604"
"a1_187" = "859250564"
"a4_901" = "2164410725"
"a1_186" = "2859841829"
"a2_929" = "2365155116"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "809562685"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "737744006"
"a1_558" = "204755220"
"a1_559" = "3841613202"
"a1_606" = "1528982483"
"a3_925" = "2319505492"
"a1_178" = "2113986827"
"a1_179" = "4051783277"
"a1_176" = "2805054053"
"a1_177" = "4111113052"
"a1_174" = "495760048"
"a1_175" = "1434083864"
"a1_172" = "3745004260"
"a1_173" = "3997237204"
"a1_170" = "3851615929"
"a1_171" = "2836801659"
"a1_550" = "221503304"
"a2_236" = "1691914489"
"a2_237" = "1699084923"
"a2_234" = "1677582462"
"a2_235" = "1684749686"
"a2_232" = "1663229999"
"a2_233" = "1670400971"
"a2_230" = "1648900845"
"a2_231" = "1656065316"
"a1_553" = "1504162907"
"a2_238" = "1706249247"
"a2_239" = "1713411490"
"a2_522" = "3742273297"
"a2_523" = "3749449327"
"a2_520" = "3727946479"
"a2_521" = "3735113776"
"a2_526" = "3770950372"
"a2_527" = "3778133140"
"a2_524" = "3756614423"
"a2_525" = "3763782081"
"a2_838" = "1712754228"
"a2_839" = "1719918717"
"a2_528" = "3785298314"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a3_688" = "620670617"
"a1_626" = "2588485882"
"a1_627" = "2268413678"
"a1_624" = "1840308686"
"a1_549" = "686870620"
"a1_548" = "1019311861"
"a1_547" = "3820727953"
"a1_546" = "1911365024"
"a1_545" = "3355399382"
"a1_544" = "4182006915"
"a1_543" = "68316876"
"a1_542" = "1872055046"
"a1_541" = "357625744"
"a1_540" = "137690273"
"a2_658" = "422322015"
"a2_659" = "429488523"
"a2_308" = "2208094853"
"a2_309" = "2215261378"
"a2_302" = "2165077486"
"a2_303" = "2172244660"
"a2_300" = "2150742211"
"a2_301" = "2157911859"
"a2_306" = "2193742757"
"a2_307" = "2200925960"
"a2_304" = "2179410592"
"a2_305" = "2186578369"
"a2_786" = "1339959368"
"a2_787" = "1347128708"
"a2_784" = "1325628471"
"a2_785" = "1332796301"
"a2_782" = "1311291009"
"a2_783" = "1318457695"
"a2_780" = "1296943627"
"a2_781" = "1304109387"
"a2_788" = "1354294539"
"a2_789" = "1361462950"
"a1_389" = "2184267995"
"a1_388" = "3498855807"
"a1_385" = "4144062811"
"a1_384" = "1365077824"
"a1_387" = "742150104"
"a1_386" = "4086922782"
"a1_381" = "4263542586"
"a1_380" = "3458895492"
"a1_383" = "2958687343"
"a1_382" = "1602088704"
"a1_58" = "3804915518"
"a1_59" = "2989418027"
"a1_56" = "3443732329"
"a1_57" = "4047470295"
"a1_54" = "585137665"
"a1_55" = "836610041"
"a1_52" = "2949548994"
"a1_53" = "3105533499"
"a1_50" = "3872894502"
"a1_51" = "3283006759"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "693412657"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "364240303"
"a1_764" = "2722084300"
"a1_763" = "1820087117"
"a1_762" = "270192840"
"a1_761" = "1474541431"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257601473"
"a4_858" = "1856138522"
"a1_586" = "760737246"
"a1_789" = "2386379328"
"a3_720" = "849951481"
"a4_393" = "2817464553"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "4136773418"
"a1_619" = "1956472130"
"a1_618" = "4063825890"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "1819213863"
"a4_522" = "3742281162"
"a2_62" = "444486789"
"a4_523" = "3749450283"
"a2_63" = "451646997"
"a4_524" = "3756619404"
"a1_971" = "3452109253"
"a2_60" = "430150120"
"a4_525" = "3763788525"
"a1_943" = "2974457333"
"a1_942" = "842363548"
"a1_941" = "1883899443"
"a2_61" = "437309143"
"a1_947" = "1474627611"
"a4_526" = "3770957646"
"a1_945" = "4175405667"
"a1_944" = "1363451103"
"a2_66" = "473169340"
"a1_949" = "232801786"
"a4_527" = "3778126767"
"a2_67" = "480336880"
"a2_64" = "458818005"
"a2_65" = "465986167"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "323869475"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "3335277742"
"a1_41" = "3779483391"
"a1_40" = "4079743638"
"a1_43" = "2304316733"
"a3_819" = "1559971962"
"a1_42" = "2865358065"
"a3_813" = "1516544548"
"a1_45" = "2146064819"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "1616997343"
"a1_47" = "1388669466"
"a1_46" = "1625483072"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a1_783" = "2807175134"
"a3_757" = "1115339004"
"a1_959" = "3279802737"
"a2_907" = "2207431276"
"a1_161" = "2980834392"
"a1_160" = "922274546"
"a1_163" = "1801329905"
"a1_162" = "2284908970"
"a1_165" = "1541113563"
"a1_164" = "2106735262"
"a1_167" = "3865208630"
"a1_166" = "1513734591"
"a1_169" = "3698293443"
"a1_168" = "1781694745"
"a3_727" = "933979486"
"a2_535" = "3835482140"
"a2_534" = "3828318204"
"a2_537" = "3849819538"
"a2_536" = "3842640346"
"a2_531" = "3806800214"
"a2_530" = "3799632832"
"a2_533" = "3821133938"
"a2_532" = "3813966520"
"a2_829" = "1648237431"
"a2_828" = "1641056539"
"a2_539" = "3864150506"
"a2_538" = "3856984101"
"a4_447" = "3204597087"
"a1_572" = "2487434977"
"a1_573" = "19735774"
"a1_570" = "2601817164"
"a1_571" = "3152491751"
"a1_576" = "367318597"
"a1_577" = "477535224"
"a1_574" = "464707008"
"a1_575" = "3789298955"
"a1_578" = "3354685643"
"a1_579" = "1126770705"
"a2_649" = "357786686"
"a2_648" = "350621012"
"a2_319" = "2286948351"
"a2_318" = "2279780008"
"a2_315" = "2258279046"
"a2_314" = "2251096937"
"a2_317" = "2272614880"
"a2_316" = "2265444584"
"a2_311" = "2229593844"
"a2_310" = "2222429521"
"a2_313" = "2243929286"
"a2_312" = "2236763893"
"a2_229" = "1641731683"
"a2_228" = "1634564877"
"a2_221" = "1584366736"
"a2_220" = "1577211296"
"a2_223" = "1598713432"
"a2_222" = "1591546999"
"a2_225" = "1613045916"
"a2_224" = "1605878551"
"a2_227" = "1627397959"
"a2_226" = "1620214363"
"a1_370" = "2894787559"
"a1_371" = "3396299306"
"a1_372" = "4121029190"
"a1_373" = "329010450"
"a1_374" = "3619134603"
"a1_375" = "1442635109"
"a1_376" = "3180896454"
"a1_377" = "1792219049"
"a1_378" = "1920973451"
"a1_379" = "94666434"
"a2_793" = "1390143841"
"a2_792" = "1382983707"
"a2_795" = "1404478296"
"a2_794" = "1397312121"
"a2_797" = "1418827562"
"a2_796" = "1411648345"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "2995683725"
"a1_28" = "3249721174"
"a1_590" = "2388761136"
"a1_23" = "1349771146"
"a1_22" = "631769962"
"a1_21" = "3391660968"
"a1_20" = "1663796184"
"a1_27" = "512471903"
"a1_26" = "902994775"
"a1_25" = "4228385064"
"a1_24" = "2590400465"
"a1_284" = "2655804174"
"a1_285" = "1657488436"
"a1_286" = "4153320904"
"a1_287" = "506657304"
"a1_280" = "1481716906"
"a1_281" = "2480754754"
"a1_282" = "903817386"
"a1_283" = "2487461974"
"a3_31" = "205278614"
"a1_288" = "171820788"
"a1_289" = "1581897411"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178757110"
"a1_591" = "1263039057"
"a3_32" = "212854281"
"a2_972" = "2673425579"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "2015067949"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "2596397864"
"a1_599" = "2107665318"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222246128"
"a2_30" = "215079529"
"a2_33" = "236572790"
"a2_32" = "229414310"
"a2_35" = "250911528"
"a2_34" = "243758313"
"a2_37" = "265263037"
"a2_36" = "258081003"
"a2_39" = "279600416"
"a2_38" = "272431578"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186759850"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193943148"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "2490415711"
"a1_625" = "1243559023"
"a1_622" = "2032516372"
"a1_623" = "3439259990"
"a1_620" = "1568404663"
"a1_621" = "737456096"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "230"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "1154238229"
"a2_588" = "4215446027"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222608514"
"a1_976" = "3483067045"
"a1_977" = "3533893964"
"a1_974" = "1629621"
"a1_975" = "1722657106"
"a1_972" = "1547056126"
"a1_973" = "3225173186"
"a1_970" = "935468084"
"a3_827" = "1616916338"
"a1_770" = "1895514563"
"a1_978" = "3359782080"
"a1_979" = "3154048938"
"a4_199" = "1426655079"
"a3_505" = "3603458416"
"a3_504" = "3596547281"
"a2_363" = "2602398896"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157233019"
"a1_746" = "2991767188"
"a4_827" = "1633895771"
"a2_901" = "2164413501"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171580921"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185914462"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193083774"
"a2_906" = "2200248488"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "4095372815"
"a1_115" = "4239310889"
"a1_116" = "1261348928"
"a1_117" = "200267829"
"a1_110" = "29031059"
"a1_111" = "2905182898"
"a1_112" = "2986523951"
"a1_113" = "328154642"
"a1_824" = "1118519813"
"a1_118" = "2523612354"
"a1_119" = "2779335496"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570225827"
"a2_499" = "3577393896"
"a2_492" = "3527209974"
"a2_493" = "3534378158"
"a2_490" = "3512875974"
"a2_491" = "3520043596"
"a2_496" = "3555874871"
"a2_497" = "3563060871"
"a2_494" = "3541543656"
"a2_495" = "3548711533"
"a2_816" = "1555027681"
"a2_817" = "1562198195"
"a2_814" = "1540698133"
"a2_815" = "1547864135"
"a2_812" = "1526343685"
"a3_740" = "1026900557"
"a2_810" = "1512014908"
"a2_811" = "1519183728"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569368921"
"a2_819" = "1576548798"
"a1_565" = "499569839"
"a1_564" = "306065841"
"a1_567" = "3964524"
"a1_566" = "1736820831"
"a1_561" = "1056408798"
"a1_560" = "4274053485"
"a1_563" = "3954875547"
"a1_562" = "2045259439"
"a1_569" = "3251453694"
"a1_568" = "2532087830"
"a1_525" = "2725639502"
"a2_678" = "565691078"
"a2_679" = "572857855"
"a2_676" = "551357393"
"a2_677" = "558522863"
"a2_674" = "537025988"
"a2_675" = "544190732"
"a2_672" = "522675239"
"a2_673" = "529857608"
"a2_670" = "508341251"
"a2_671" = "515507802"
"a3_982" = "2728158783"
"a2_258" = "1849635709"
"a2_259" = "1856804793"
"a2_254" = "1820965881"
"a2_255" = "1828121322"
"a2_256" = "1835302669"
"a2_257" = "1842469840"
"a2_250" = "1792286165"
"a2_251" = "1799451539"
"a2_252" = "1806625885"
"a2_253" = "1813785042"
"a1_363" = "3536973030"
"a1_362" = "2851233251"
"a1_361" = "3684030067"
"a1_360" = "3836667350"
"a1_367" = "1704625205"
"a1_366" = "2575903250"
"a1_365" = "597938419"
"a1_364" = "1228762719"
"a1_369" = "1487691452"
"a1_368" = "489857542"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2507649291"
"a1_39" = "561264253"
"a1_30" = "717794314"
"a1_31" = "1874545921"
"a1_32" = "93294741"
"a1_33" = "1424583135"
"a1_34" = "2647207860"
"a1_35" = "2897359949"
"a1_36" = "3352597102"
"a1_37" = "1601635219"
"a1_297" = "1696728006"
"a1_296" = "1147090733"
"a1_295" = "1379144978"
"a1_294" = "1300152382"
"a1_293" = "3839089598"
"a1_292" = "369504538"
"a1_291" = "26368499"
"a1_290" = "3888269750"
"a1_299" = "2410082549"
"a1_298" = "3842539600"
"a3_769" = "1234824520"
"a1_600" = "2306066442"
"a2_668" = "494008124"
"a1_601" = "1249208338"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "1754938589"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774262712"
"a2_109" = "781426314"
"a4_878" = "1999520942"
"a1_603" = "3115969845"
"a2_100" = "716907011"
"a2_101" = "724074585"
"a2_102" = "731243719"
"a2_103" = "738423831"
"a2_104" = "745594642"
"a2_105" = "752749096"
"a2_106" = "759923162"
"a2_107" = "767088550"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "302200225"
"a1_589" = "3085902564"
"a1_588" = "2234597266"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "2824830468"
"a1_748" = "2745362541"
"a2_28" = "200728107"
"a2_29" = "207912400"
"a2_26" = "186388637"
"a2_27" = "193563684"
"a2_24" = "172062536"
"a2_25" = "179231470"
"a2_22" = "157726875"
"a2_23" = "164896764"
"a2_20" = "143379707"
"a2_21" = "150542710"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139222509"
"a2_7" = "50177519"
"a2_6" = "43009253"
"a2_5" = "35842497"
"a2_4" = "28673507"
"a2_3" = "21499244"
"a2_2" = "14342116"
"a2_1" = "7174603"
"a2_0" = "8391"
"a1_639" = "1801336386"
"a1_638" = "3512793207"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64528926"
"a2_8" = "57344343"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124880179"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"
"a3_875" = "1961196962"
"a1_532" = "3514387287"
"a1_533" = "33107531"
"a4_845" = "1762939949"
"a2_853" = "1820284338"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 1D 71 95 1D A3 B2 DB 81 AD 12 F5 3D 9B 40 B1"

[HKCU\Software\Aas]
"a1_968" = "902878578"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "591365145"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "1590216580"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "771001193"
"a1_957" = "1746824154"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0800687474703A2F2F7777772E61727469706C6578692E636F6D2F696D616765732F696D6167652E67696600687474703A2F2F766974696E6864757963756F6E672E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E637570726573732E6368756C612E61632E74682F696D616765732F696D6167652E67696600687474703A2F2F626974656C696E6469612E636F6D2F696D616765732F626F74746F6D2E67696600687474703A2F2F6C7371756172657461726C61632E636F6D2F696D616765732F696D6167652E67696600687474703A2F2F7777772E636F72706E6F782D746563686E6F6C6F6769652E66722F626F74746F6D2E67696600687474703A2F2F7777772E77746F2E6E65742E6D792F696D616765732F626F74746F6D2E67696600687474703A2F2F3230332E3134362E34332E33352F6C6F676F2E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014705127"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "3535870316"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "2083496171"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013862663"
"a1_107" = "3616150758"
"a1_106" = "99499751"
"a1_105" = "1285765820"
"a1_104" = "371394679"
"a1_103" = "1857813282"
"a1_102" = "271915517"
"a1_101" = "967265256"
"a1_100" = "4285675871"
"a3_134" = "943841519"
"a1_109" = "298700407"
"a1_62" = "538128433"
"a1_61" = "1277515847"
"a3_137" = "998890944"
"a2_883" = "2035358142"
"a3_686" = "606179783"
"a2_489" = "3505694039"
"a2_488" = "3498526437"
"a3_687" = "613616230"
"a2_485" = "3477026510"
"a2_484" = "3469859250"
"a2_487" = "3491360281"
"a2_486" = "3484190812"
"a2_481" = "3448343906"
"a2_480" = "3441168426"
"a2_483" = "3462692783"
"a2_482" = "3455508889"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028192049"
"a3_976" = "2685262841"
"a2_809" = "1504846819"
"a2_808" = "1497678091"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447495262"
"a2_800" = "1440332201"
"a2_803" = "1461830640"
"a3_681" = "570649632"
"a2_805" = "1476181797"
"a2_804" = "1469011867"
"a2_807" = "1490516695"
"a2_806" = "1483347888"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049712535"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443822243"
"a2_660" = "436654639"
"a2_663" = "458154304"
"a3_146" = "1063277947"
"a2_665" = "472489030"
"a2_664" = "465322306"
"a2_667" = "486839004"
"a2_666" = "479671170"
"a2_669" = "501172234"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021026939"
"a3_143" = "1008236550"
"a2_249" = "1785117126"
"a2_248" = "1777935073"
"a2_247" = "1770781600"
"a2_246" = "1763600665"
"a2_245" = "1756433791"
"a2_244" = "1749224927"
"a2_243" = "1742100012"
"a2_242" = "1734934040"
"a2_241" = "1727751742"
"a2_240" = "1720584527"
"a1_356" = "707292715"
"a1_357" = "2800695035"
"a1_354" = "2948064926"
"a1_355" = "2204990781"
"a1_352" = "3379833471"
"a1_353" = "3594918798"
"a1_350" = "2057245872"
"a1_351" = "396194614"
"a2_855" = "1834622170"
"a3_639" = "269411382"
"a1_358" = "3266075582"
"a1_359" = "3015483473"
"a3_638" = "295912343"
"a2_887" = "2064046060"
"a2_886" = "2056879465"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583718019"
"a2_119" = "853128713"
"a2_118" = "845962339"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810111326"
"a2_112" = "802944421"
"a2_111" = "795778583"
"a2_110" = "788610117"
"a2_117" = "838793147"
"a2_116" = "831611246"
"a2_115" = "824456170"
"a2_114" = "817277839"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533531006"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422984641"
"a2_58" = "415802594"
"a2_53" = "379966442"
"a2_52" = "372800443"
"a2_51" = "365619769"
"a2_50" = "358449967"
"a2_57" = "408633899"
"a2_56" = "401461490"
"a2_55" = "394299016"
"a2_54" = "387124645"
"a4_842" = "1741432586"
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "1432832698"
"a1_645" = "2995662555"
"a1_646" = "2444024188"
"a1_647" = "2005767765"
"a1_640" = "4157455837"
"a1_641" = "1997243688"
"a1_642" = "3398311474"
"a1_643" = "1082756090"
"a1_648" = "707853822"
"a1_649" = "660911703"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas]
"a2_953" = "2537195990"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "1538472943"
"a1_829" = "1174421923"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "3331649890"
"a1_916" = "871146317"
"a1_917" = "646348745"
"a1_910" = "861009776"
"a1_911" = "457440145"
"a1_912" = "3557970222"
"a1_913" = "366650187"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "2678179000"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "262490919"
"a1_139" = "2005364479"
"a3_907" = "2190592386"
"a1_132" = "3119341238"
"a1_133" = "1899504990"
"a1_130" = "3726951056"
"a1_131" = "922073848"
"a1_136" = "142817366"
"a1_137" = "66311845"
"a1_134" = "175430677"
"a1_135" = "2569912183"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369490029"
"a2_471" = "3376659280"
"a2_472" = "3383821791"
"a2_473" = "3390989078"
"a2_474" = "3398157229"
"a2_475" = "3405323478"
"a2_476" = "3412508607"
"a2_477" = "3419679596"
"a2_478" = "3426841544"
"a2_479" = "3434007812"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "1195797168"
"a2_878" = "1999529167"
"a2_879" = "2006682146"
"a2_874" = "1970841223"
"a2_875" = "1978010124"
"a2_876" = "1985175685"
"a2_877" = "1992359521"
"a2_870" = "1942175041"
"a2_871" = "1949340586"
"a2_872" = "1956498223"
"a2_873" = "1963677035"
"a1_349" = "3314820737"
"a1_348" = "3646048113"
"a2_586" = "4201107889"
"a2_587" = "4208277441"
"a2_580" = "4158081351"
"a2_581" = "4165258678"
"a2_582" = "4172426906"
"a2_583" = "4179605972"
"a1_341" = "3018758911"
"a1_340" = "4172583274"
"a1_343" = "3763680837"
"a1_342" = "1088685203"
"a1_345" = "346626307"
"a1_344" = "931380277"
"a1_347" = "1956396477"
"a1_346" = "1326283475"
"a2_614" = "106880624"
"a2_615" = "114046812"
"a2_616" = "121219615"
"a2_617" = "128383722"
"a2_610" = "78197909"
"a2_611" = "85364428"
"a2_612" = "92529111"
"a2_613" = "99697902"
"a2_618" = "135547281"
"a2_619" = "142712924"
"a2_272" = "1950007111"
"a2_273" = "1957183452"
"a2_270" = "1935656977"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978671139"
"a2_277" = "1985854626"
"a2_274" = "1964340976"
"a2_275" = "1971516672"
"a2_908" = "2214599940"
"a2_909" = "2221767158"
"a2_278" = "1993021301"
"a2_279" = "2000188158"
"a1_842" = "1920966245"
"a2_298" = "2136407085"
"a2_299" = "2143559982"
"a1_841" = "2108093463"
"a2_290" = "2079035873"
"a2_291" = "2086208531"
"a2_292" = "2093378510"
"a2_293" = "2100558876"
"a2_294" = "2107723975"
"a2_295" = "2114893689"
"a2_296" = "2122069046"
"a2_297" = "2129226134"
"a2_728" = "924149393"
"a2_729" = "931315975"
"a2_720" = "866799110"
"a2_721" = "873967134"
"a2_722" = "881147021"
"a2_723" = "888299534"
"a2_724" = "895483236"
"a2_725" = "902650814"
"a2_726" = "909817027"
"a2_727" = "916985987"
"a1_594" = "1646803675"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917645291"
"a2_129" = "924814841"
"a2_126" = "903315097"
"a2_127" = "910481380"
"a2_124" = "888979314"
"a2_125" = "896145706"
"a2_122" = "874628469"
"a2_123" = "881796299"
"a2_120" = "860295223"
"a2_121" = "867460944"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612397247"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "3190591548"
"a1_13" = "1918066523"
"a1_10" = "1029061298"
"a1_11" = "2471529202"
"a1_16" = "1580755156"
"a1_17" = "2222051364"
"a1_14" = "952701210"
"a1_15" = "1074442085"
"a1_18" = "1167385095"
"a1_19" = "183697774"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563457"
"a2_48" = "344115241"
"a2_49" = "351281574"
"a1_846" = "929235781"
"a2_40" = "286767713"
"a2_41" = "293941412"
"a2_42" = "301096990"
"a2_43" = "308279681"
"a2_44" = "315448147"
"a2_45" = "322616157"
"a2_46" = "329784937"
"a2_47" = "336950367"
"a2_897" = "2135730790"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "3489615416"
"a1_656" = "3802011618"
"a1_655" = "2698055323"
"a1_632" = "3795481864"
"a1_653" = "1507158189"
"a1_652" = "3873407154"
"a1_651" = "1020694293"
"a1_650" = "2791068032"
"a3_796" = "1428649909"
"a1_659" = "371871425"
"a1_658" = "1587148605"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233085660"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"
"a4_793" = "1390145657"
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "2658391742"
"a1_838" = "1588847817"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "246705173"
"a1_906" = "3310165560"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "356514385"
"a1_902" = "3669686140"
"a1_901" = "3598698425"
"a1_900" = "968899776"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "82367682"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "3739260580"
"a2_644" = "321950698"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "2240941467"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "3637326283"
"a1_879" = "3439412668"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "740901583"
"a1_128" = "1274891471"
"a1_125" = "410790978"
"a1_124" = "819962434"
"a1_127" = "1755321674"
"a1_126" = "360334783"
"a1_121" = "391232799"
"a1_120" = "2916128514"
"a1_123" = "351763538"
"a1_122" = "1949219683"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "2791490676"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "854854254"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "2740984837"
"a1_837" = "2412731659"
"a1_836" = "1384256669"
"a1_835" = "540950335"
"a1_754" = "1687298663"
"a1_834" = "4261505657"
"a1_634" = "3485651332"
"a2_463" = "3319305657"
"a2_462" = "3312136473"
"a2_461" = "3304972668"
"a2_460" = "3297790897"
"a2_467" = "3347972468"
"a2_466" = "3340808001"
"a2_465" = "3333639322"
"a2_464" = "3326473557"
"a2_469" = "3362323299"
"a2_468" = "3355153455"
"a1_934" = "2487541403"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934993545"
"a2_868" = "1927824007"
"a2_867" = "1920652472"
"a2_866" = "1913489224"
"a2_865" = "1906324244"
"a2_864" = "1899159111"
"a2_863" = "1891987937"
"a1_791" = "383365635"
"a2_861" = "1877640068"
"a2_860" = "1870475065"
"a2_597" = "4279963346"
"a2_596" = "4272794145"
"a2_595" = "4265628298"
"a2_594" = "4258461506"
"a1_338" = "321434075"
"a1_339" = "3852519885"
"a2_591" = "4236943516"
"a2_590" = "4229779197"
"a1_334" = "3691980090"
"a1_335" = "2701210041"
"a1_336" = "1064941536"
"a1_337" = "4071883120"
"a1_330" = "2155332535"
"a1_331" = "844664240"
"a1_332" = "1970597244"
"a1_333" = "15930299"
"a2_607" = "56694544"
"a2_606" = "49514239"
"a3_30" = "231909751"
"a2_604" = "35180417"
"a1_64" = "1106168820"
"a2_602" = "20846083"
"a2_601" = "13679613"
"a2_600" = "6509887"
"a4_875" = "1978013579"
"a2_609" = "71030598"
"a2_608" = "63850053"
"a2_265" = "1899819530"
"a2_264" = "1892656842"
"a2_267" = "1914147268"
"a2_266" = "1906988368"
"a2_261" = "1871137615"
"a2_260" = "1863970686"
"a2_263" = "1885472733"
"a2_262" = "1878303078"
"a2_919" = "2293452722"
"a1_908" = "34048457"
"a2_269" = "1928487382"
"a2_268" = "1921331270"
"a1_905" = "1652330290"
"a2_884" = "2042543411"
"a1_482" = "870975096"
"a1_483" = "1159658673"
"a2_289" = "2071874454"
"a2_288" = "2064709443"
"a1_486" = "1741347224"
"a1_487" = "1586008298"
"a1_484" = "3839779537"
"a1_485" = "195981086"
"a2_283" = "2028855670"
"a2_282" = "2021690980"
"a2_281" = "2014523730"
"a2_280" = "2007361944"
"a2_287" = "2057545957"
"a2_286" = "2050372070"
"a2_285" = "2043194101"
"a2_284" = "2036023437"
"a2_739" = "1003018429"
"a2_738" = "995850856"
"a3_522" = "3725445091"
"a2_733" = "960000722"
"a2_732" = "952835540"
"a2_731" = "945665882"
"a2_730" = "938484923"
"a2_737" = "988631320"
"a2_736" = "981503747"
"a2_735" = "974333336"
"a2_734" = "967173771"
"a4_446" = "3197427966"
"a1_637" = "3304405985"
"a3_912" = "2226582457"
"a1_240" = "2218859418"
"a1_241" = "976156643"
"a1_242" = "1338858461"
"a1_243" = "4149101324"
"a1_244" = "3276739885"
"a1_245" = "3241517195"
"a1_246" = "935733537"
"a1_247" = "1051853348"
"a1_248" = "3293996741"
"a1_249" = "1255009904"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939149628"
"a2_130" = "931978133"
"a2_133" = "953497658"
"a2_132" = "946332243"
"a2_135" = "967833616"
"a2_134" = "960663689"
"a2_137" = "982159907"
"a2_136" = "975008365"
"a2_139" = "996515454"
"a2_138" = "989331888"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566355172"
"a2_78" = "559189863"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "372608929"
"a1_583" = "1086778042"
"a1_794" = "3605919195"
"a1_795" = "336106082"
"a1_792" = "567204421"
"a1_793" = "2042789942"
"a1_790" = "2373170713"
"a1_582" = "1267300408"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "4003924625"
"a1_798" = "3421096257"
"a1_799" = "2047646979"
"a1_580" = "2585672859"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737945175"
"a1_585" = "3296408049"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "3811486221"
"a1_469" = "154330335"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "568559499"
"a1_461" = "2843291159"
"a1_462" = "3645138763"
"a1_463" = "1581464352"
"a1_464" = "267067502"
"a1_465" = "2505148408"
"a1_466" = "2413252893"
"a1_467" = "1363353320"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "1063329954"
"a1_669" = "1861065398"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655394963"
"a3_499" = "3560555322"
"a2_831" = "1662568591"
"a3_498" = "3587059355"
"a2_832" = "1669736001"
"a3_497" = "3579611768"
"a2_833" = "1676904300"
"a3_496" = "3539014105"
"a2_834" = "1684086436"
"a3_495" = "3532029350"
"a2_835" = "1691251173"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698421495"
"a3_493" = "3551077604"
"a2_837" = "1705584586"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a2_529" = "3792466956"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "3780482647"
"a1_807" = "3685810665"
"a1_804" = "4164717676"
"a1_805" = "3479913168"
"a1_802" = "1160402000"
"a1_803" = "1314940145"
"a1_800" = "803671269"
"a1_801" = "199796943"
"a1_808" = "2685379590"
"a1_809" = "2223562919"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "1265561044"
"a1_939" = "3294261670"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407972379"
"a1_875" = "3894849161"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "712957854"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "1952897626"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"

"a2_456" = "3269121059"
"a2_457" = "3276287383"
"a2_454" = "3254787081"
"a3_380" = "2741212629"
"a2_452" = "3240438995"
"a2_453" = "3247604546"
"a2_450" = "3226103557"
"a2_451" = "3233267764"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283455273"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "2954066625"
"a2_852" = "1813122283"
"a1_730" = "4261251252"
"a2_850" = "1798793797"
"a2_851" = "1805956342"
"a2_856" = "1841806184"
"a2_857" = "1848978803"
"a2_854" = "1827455500"
"a1_731" = "3781449388"
"a3_632" = "252486993"
"a2_858" = "1856130763"
"a2_859" = "1863306362"
"a1_732" = "740469106"
"a1_733" = "1250148555"
"a1_329" = "2938689718"
"a1_328" = "670322561"
"a1_327" = "2213297400"
"a1_326" = "4219851447"
"a1_325" = "4009301372"
"a1_324" = "627821690"
"a1_323" = "146942225"
"a1_322" = "2103582392"
"a1_321" = "3051874111"
"a1_320" = "2643328514"
"a2_650" = "364953859"
"a1_436" = "660790145"
"a1_736" = "606514000"
"a3_631" = "211878206"
"a1_737" = "2687286814"
"a2_652" = "379301895"
"a3_923" = "2339079058"
"a2_926" = "2343646379"
"a2_927" = "2350799364"
"a2_924" = "2329302788"
"a2_653" = "386477646"
"a4_887" = "2064043031"
"a2_923" = "2322123166"
"a2_920" = "2300619235"
"a2_921" = "2307800997"
"a2_654" = "393629273"
"a2_928" = "2357970359"
"a2_655" = "400803924"
"a3_630" = "204893343"
"a2_657" = "415138156"
"a3_922" = "2298015603"
"a1_495" = "531519038"
"a1_494" = "3678262881"
"a1_497" = "1804737561"
"a1_496" = "3500888450"
"a1_491" = "2780825781"
"a1_490" = "3639920766"
"a1_493" = "41797649"
"a1_492" = "1753974495"
"a1_499" = "4244024366"
"a1_498" = "176130572"
"a3_637" = "288468852"
"a2_708" = "780763675"
"a2_709" = "787945695"
"a2_706" = "766429528"
"a2_707" = "773595818"
"a2_704" = "752098395"
"a2_705" = "759264068"
"a2_702" = "737762273"
"a2_703" = "744931269"
"a2_700" = "723414102"
"a2_701" = "730580001"
"a4_885" = "2049704789"
"a2_638" = "278934620"
"a2_639" = "286103076"
"a3_808" = "1481095169"
"a2_632" = "235920051"
"a2_633" = "243084874"
"a2_630" = "221584370"
"a2_631" = "228752667"
"a2_636" = "264598451"
"a2_637" = "271767638"
"a2_634" = "250252961"
"a2_635" = "257420188"
"a1_253" = "2696137897"
"a1_252" = "3874632122"
"a1_251" = "638129478"
"a1_250" = "1686353422"
"a1_257" = "1568415324"
"a1_256" = "2171682490"
"a1_255" = "1640157530"
"a1_254" = "3663930736"
"a3_920" = "2284050097"
"a1_259" = "1825457794"
"a1_258" = "523538680"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032348077"
"a2_145" = "1039517531"
"a2_146" = "1046686172"
"a2_147" = "1053866404"
"a2_140" = "1003683265"
"a2_141" = "1010848968"
"a2_142" = "1018007242"
"a2_143" = "1025182030"
"a1_781" = "563869523"
"a1_780" = "4033084926"
"a2_68" = "487503843"
"a2_69" = "494671843"
"a2_148" = "1061031983"
"a2_149" = "1068190143"
"a1_787" = "565470458"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a1_904" = "1926114101"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "833088962"
"a1_478" = "829912684"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "2522296580"
"a1_472" = "334465926"
"a1_471" = "1027820106"
"a1_470" = "2030932130"
"a1_477" = "846556806"
"a1_476" = "1058669682"
"a1_475" = "2427459909"
"a1_474" = "341014763"
"a4_533" = "3821141493"
"a1_679" = "256334172"
"a1_678" = "2333639643"
"a4_532" = "3813972372"
"a1_675" = "3144440447"
"a1_674" = "2209160287"
"a1_677" = "23594712"
"a1_676" = "3297548536"
"a1_671" = "1047021445"
"a4_531" = "3806803251"
"a1_673" = "973308250"
"a1_672" = "2685200382"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a1_868" = "3764924331"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a2_151" = "1082529194"
"a2_150" = "1075367383"
"a1_869" = "511931415"
"a2_271" = "1942838132"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "727631015"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139885185"
"a4_758" = "1139226422"
"a2_158" = "1132719968"
"a1_925" = "4268708547"
"a1_924" = "3973788993"
"a1_927" = "3393217357"
"a1_926" = "1984231851"
"a1_921" = "146241096"
"a1_920" = "4223143110"
"a3_787" = "1363737626"
"a1_922" = "1300852115"
"a3_80" = "590099577"
"a1_929" = "4119303624"
"a1_928" = "388215835"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "926161101"
"a1_818" = "1498615212"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "3015422485"
"a1_810" = "2998565326"
"a1_813" = "1579424196"
"a1_812" = "600029214"
"a1_815" = "1054531699"
"a1_814" = "3298967616"
"a1_817" = "248932268"
"a1_816" = "983407589"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454665689"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"

[HKCU\Software\Aas\695404737]
"50183847" = "13BEAC28144BD44711765592EAECE92514A9883DBF7CDB4574924F8E58D0EA613F8AF8C54C1B2D4E0F0128B5D1AF6EFCC3B9E14A2B2AFFFE139B310BBB9E62A4D35DFD7634D69B6E84CE65722E7C3C6EB60AAAD82AFE7AA36C36B88B0B8F7E3CEDCF360F0DEB0F6B657801EFE0F85033DE26603036E38BE9D24E91074DD44E69"

[HKCU\Software\Aas]
"a2_845" = "1762935077"
"a2_844" = "1755772502"
"a2_847" = "1777271504"
"a2_846" = "1770102851"
"a2_841" = "1734270674"
"a2_840" = "1727087048"
"a2_843" = "1748603633"
"a2_842" = "1741437441"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791622376"
"a2_848" = "1784453698"
"a1_312" = "2728197380"
"a1_313" = "297385982"
"a1_310" = "1253728072"
"a1_311" = "1200562206"
"a1_316" = "3219298794"
"a1_317" = "412466900"
"a1_314" = "3706150218"
"a1_315" = "1890645793"
"a3_620" = "166490309"
"a1_318" = "2322738721"
"a1_319" = "830425189"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218936598"
"a2_448" = "3211768039"
"a3_621" = "140449124"
"a2_441" = "3161583846"
"a2_440" = "3154418495"
"a2_443" = "3175919217"
"a2_442" = "3168753712"
"a2_445" = "3190253905"
"a2_444" = "3183083942"
"a2_447" = "3204602148"
"a2_446" = "3197435177"
"a2_939" = "2436838090"
"a2_938" = "2429670143"
"a4_893" = "2107057757"
"a2_931" = "2379485188"
"a2_930" = "2372318675"
"a2_933" = "2393821158"
"a2_932" = "2386645751"
"a2_935" = "2408153316"
"a2_934" = "2400988335"
"a2_937" = "2422491010"
"a2_936" = "2415336881"
"a3_818" = "1552537563"
"a2_711" = "802282476"
"a2_710" = "795113601"
"a2_713" = "816625635"
"a2_712" = "809449387"
"a2_715" = "830948770"
"a2_714" = "823776989"
"a2_717" = "845298231"
"a2_716" = "838116847"
"a2_719" = "859622642"
"a2_718" = "852464816"
"a1_587" = "625451312"
"a3_623" = "187965990"
"a2_629" = "214416264"
"a2_628" = "207233046"
"a2_625" = "185732403"
"a2_624" = "178568019"
"a2_627" = "200065108"
"a2_626" = "192900114"
"a2_621" = "157048620"
"a2_620" = "149882804"
"a2_623" = "171398696"
"a2_622" = "164217129"
"a1_266" = "2425214355"
"a1_267" = "1468962418"
"a1_264" = "2785040060"
"a1_265" = "4195918902"
"a1_262" = "2596719131"
"a1_263" = "1518984292"
"a1_260" = "2639954591"
"a1_261" = "91118586"
"a1_268" = "2652034610"
"a1_269" = "2816674480"
"a2_157" = "1125554538"
"a2_156" = "1118384871"
"a2_155" = "1111221942"
"a2_154" = "1104050701"
"a2_153" = "1096865843"
"a2_152" = "1089714639"
"a2_99" = "709741924"
"a2_98" = "702577109"
"a2_97" = "695410659"
"a2_96" = "688241215"
"a2_95" = "681057828"
"a2_94" = "673890665"
"a2_93" = "666726384"
"a2_92" = "659558235"
"a2_91" = "652392164"
"a2_90" = "645225869"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "8482267"
"a1_847" = "405953369"
"a3_404" = "2913010493"
"a1_844" = "3971806654"
"a3_405" = "2886510428"
"a1_845" = "239869341"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_862" = "1884807186"
"a4_983" = "2752278647"
"a1_961" = "3894295925"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "686600081"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "543731227"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "854609973"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "1305046417"
"a1_449" = "4102234383"
"a1_446" = "3795633472"
"a3_408" = "2941554865"
"a1_444" = "2129543814"
"a1_445" = "3372526932"
"a1_442" = "4170851372"
"a1_443" = "78085792"
"a1_440" = "3612628081"
"a3_409" = "2949002448"
"a1_680" = "2240296186"
"a1_681" = "2323901887"
"a1_682" = "1415502644"
"a1_683" = "3507219858"
"a2_561" = "4021869661"
"a1_685" = "1808094966"
"a1_686" = "1313518174"
"a1_687" = "2515799137"
"a1_688" = "2970325981"
"a1_689" = "981825628"

"a3_834" = "1700949547"
"a1_767" = "856090149"
"a1_766" = "1284264694"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294297146"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "1763289781"
"a2_605" = "42346349"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "3593743097"
"a2_603" = "28011768"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "3255773461"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "802516449"
"a1_441" = "2067176022"
"a4_964" = "2616065348"
"a1_744" = "3700443220"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250433441"
"a1_747" = "2295108666"
"a2_912" = "2243268343"
"a2_911" = "2236097401"
"a2_651" = "372136550"
"a2_910" = "2228932606"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "331"

[HKCU\Software\Aas]
"a2_917" = "2279117771"
"a4_883" = "2035366547"
"a2_916" = "2271949761"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "1380270571"
"a1_867" = "3551318079"
"a1_860" = "1833707391"
"a1_861" = "1887023204"
"a1_862" = "618952640"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "143633147"
"a2_918" = "2286284363"
"a4_168" = "1204412328"
"a1_194" = "1997296861"
"a1_195" = "313703261"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287127755"
"a1_192" = "3747558038"
"a1_193" = "3771303288"
"a1_969" = "1510804819"
"a4_934" = "2400991718"
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "3758833560"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a1_305" = "762665775"
"a1_304" = "1616048786"
"a1_307" = "3460124063"
"a1_306" = "4118851916"
"a1_301" = "3079198155"
"a1_300" = "1042283030"
"a1_303" = "806093748"
"a1_302" = "1789742800"
"a3_792" = "1399711281"
"a1_309" = "1261236139"
"a1_308" = "3289922207"
"a2_540" = "3871321995"
"a2_541" = "3878501443"
"a2_542" = "3885668596"
"a1_481" = "1881128703"
"a2_544" = "3900004737"
"a2_545" = "3907168166"
"a2_546" = "3914348231"
"a2_547" = "3921503616"
"a2_548" = "3928672763"
"a2_549" = "3935852670"
"a2_894" = "2114231342"
"a2_895" = "2121396681"
"a2_892" = "2099895297"
"a2_893" = "2107062719"
"a2_890" = "2085547088"
"a2_891" = "2092712090"
"a2_438" = "3140067601"
"a2_439" = "3147251548"
"a2_434" = "3111391071"
"a2_435" = "3118565796"
"a2_436" = "3125733488"
"a2_437" = "3132908148"
"a2_430" = "3082730415"
"a2_431" = "3089883458"
"a2_432" = "3097066854"
"a2_433" = "3104231812"
"a2_948" = "2501356369"
"a2_949" = "2508522819"
"a4_908" = "2214594572"
"a2_944" = "2472687591"
"a2_945" = "2479854791"
"a2_946" = "2487024845"
"a2_947" = "2494187852"
"a2_940" = "2444003964"
"a1_488" = "117271954"
"a2_942" = "2458340105"
"a2_943" = "2465519829"
"a1_279" = "1418467945"
"a1_278" = "2861614343"
"a1_489" = "3022135062"
"a1_271" = "1003983645"
"a1_270" = "2098066711"
"a1_273" = "4045240876"
"a1_272" = "2222116166"
"a1_275" = "388500355"
"a1_274" = "1505296994"
"a1_277" = "2376627072"
"a1_276" = "4008468673"
"a2_764" = "1182249361"
"a2_765" = "1189408345"
"a2_766" = "1196574684"
"a2_767" = "1203741806"
"a2_760" = "1153556657"
"a2_761" = "1160758456"
"a2_762" = "1167906270"
"a2_763" = "1175074180"
"a2_768" = "1210924612"
"a2_769" = "1218094156"
"a2_382" = "2738612528"
"a2_383" = "2745775858"
"a2_380" = "2724258756"
"a2_381" = "2731438974"
"a2_386" = "2767277153"
"a2_387" = "2774443556"
"a2_384" = "2752940402"
"a2_385" = "2760108505"
"a2_388" = "2781624679"
"a2_389" = "2788795831"
"a1_613" = "129863052"
"a1_612" = "988316336"
"a1_611" = "3389096497"
"a2_368" = "2638239479"
"a2_369" = "2645405942"
"a1_610" = "2805309052"
"a2_88" = "630887879"
"a2_89" = "638043408"
"a2_84" = "602206423"
"a2_85" = "609370463"
"a2_86" = "616538380"
"a2_87" = "623708123"
"a2_80" = "573523613"
"a2_81" = "580703574"
"a2_82" = "587873928"
"a2_83" = "595040548"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161403247"
"a2_163" = "1168570268"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190070507"
"a2_167" = "1197235008"
"a2_164" = "1175737400"
"a2_165" = "1182902307"
"a3_690" = "668723035"
"a3_679" = "589715310"
"a1_666" = "619008533"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "1763647042"
"a1_450" = "3471443726"
"a1_453" = "826953324"
"a1_452" = "4204130810"
"a1_455" = "3614551769"
"a1_454" = "2084441270"
"a1_457" = "1682692832"
"a1_456" = "1143072401"
"a1_459" = "2171701943"
"a1_458" = "1456029410"
"a1_693" = "3152267464"
"a1_692" = "586787667"
"a1_691" = "27701097"
"a1_690" = "3006111787"
"a1_697" = "3940423335"
"a1_696" = "227076519"
"a1_695" = "440844346"
"a1_694" = "3884265903"
"a1_699" = "2860330565"
"a1_698" = "220587169"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "917099775"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "2446160094"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "3343181066"
"a4_387" = "2774449827"
"a1_940" = "2696849303"
"a1_752" = "263884221"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537687256"
"a2_74" = "530518825"
"a2_77" = "552014336"
"a2_76" = "544860422"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509002637"
"a2_70" = "501837201"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523338706"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "1914911366"
"a1_876" = "2141128122"
"a4_759" = "1146395543"
"a2_72" = "516172888"
"a1_873" = "2582392349"
"a1_872" = "4245272736"
"a1_871" = "2536622521"
"a1_870" = "2568243992"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "3639033509"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "2098663347"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "3302039882"
"a1_437" = "2987205336"
"a3_960" = "2604335593"
"a2_553" = "3964521198"
"a2_552" = "3957353647"
"a2_551" = "3950187492"
"a2_550" = "3943021929"
"a2_557" = "3993205430"
"a2_556" = "3986037071"
"a2_555" = "3978870075"
"a2_554" = "3971687764"
"a2_889" = "2078376661"
"a2_888" = "2071204163"
"a2_559" = "4007540661"
"a2_558" = "4000372231"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075551125"
"a2_428" = "3068392120"
"a2_427" = "3061215308"
"a2_426" = "3054047725"
"a2_425" = "3046880135"
"a2_424" = "3039716136"
"a2_423" = "3032530978"
"a2_422" = "3025366652"
"a2_421" = "3018207400"
"a2_420" = "3011032450"
"a1_758" = "731470984"
"a2_565" = "4050555776"
"a2_959" = "2580225742"
"a2_958" = "2573055356"
"a2_957" = "2565877179"
"a2_956" = "2558707491"
"a2_955" = "2551540619"
"a2_954" = "2544371277"
"a1_785" = "2635580088"
"a2_952" = "2530038790"
"a2_951" = "2522872779"
"a2_950" = "2515692107"
"a1_208" = "2323063660"
"a1_209" = "2063833691"
"a1_204" = "3613628945"
"a1_205" = "158943108"
"a1_206" = "2680945808"
"a1_207" = "3556273976"
"a1_200" = "1609279094"
"a1_201" = "711303796"
"a1_202" = "131072823"
"a1_203" = "3275701682"
"a2_777" = "1275443182"
"a2_776" = "1268275422"
"a2_775" = "1261108226"
"a2_774" = "1253923210"
"a2_773" = "1246760335"
"a2_772" = "1239592222"
"a2_771" = "1232422452"
"a2_770" = "1225257133"
"a2_779" = "1289774360"
"a2_778" = "1282609649"
"a2_395" = "2831796602"
"a2_394" = "2824624517"
"a2_397" = "2846144008"
"a2_396" = "2838977499"
"a2_391" = "2803124384"
"a2_390" = "2795958811"
"a2_393" = "2817495038"
"a2_392" = "2810293490"
"a2_399" = "2860475404"
"a2_398" = "2853310520"
"a2_568" = "4072057468"
"a2_569" = "4079237467"
"a2_379" = "2717091275"
"a2_378" = "2709918906"
"a2_373" = "2674088894"
"a2_372" = "2666914507"
"a2_371" = "2659738340"
"a2_370" = "2652571861"
"a2_377" = "2702757278"
"a2_376" = "2695590810"
"a2_375" = "2688423270"
"a2_374" = "2681241724"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283273204"
"a2_178" = "1276110579"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254603653"
"a2_174" = "1247418630"
"a2_177" = "1268939734"
"a2_176" = "1261770539"
"a2_171" = "1225921020"
"a2_170" = "1218752822"
"a2_173" = "1240256298"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
"a1_510" = "2199610395"
"a1_511" = "585354544"
"a1_512" = "2858986619"
"a1_513" = "376915146"
"a1_514" = "156262043"
"a1_515" = "2439211117"
"a1_516" = "2169892658"
"a1_517" = "2582531628"
"a1_518" = "1098285155"
"a1_519" = "1055915196"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "687947833"
"a3_514" = "3667976427"
"a2_543" = "3892836201"
"a1_424" = "2956309248"
"a1_425" = "2209479607"
"a1_426" = "3847300676"
"a1_427" = "1053085813"
"a1_420" = "467137561"
"a1_421" = "1773676111"
"a1_422" = "1409806906"
"a1_423" = "3269905554"
"a3_199" = "1409969486"
"a1_428" = "4215430630"
"a1_429" = "1696078408"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623241154"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "4147183323"
"a1_739" = "3463518385"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "4195073333"
"a2_915" = "2264784400"
"a1_865" = "2720069348"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_863" = "3176665148"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"
"a4_871" = "1949337095"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "2607342"
"a1_849" = "2076808982"
"a1_439" = "2949770754"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450988234"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "3702158632"
"a1_199" = "3695137204"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "1536307085"
"a4_145" = "1039522545"
"a1_190" = "391714215"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752265220"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "373929871"
"a1_663" = "751063533"
"a3_965" = "2639793036"
"a1_660" = "3653675172"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "1886423968"
"a1_664" = "323722485"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "3868481185"
"a1_0" = "1487051954"
"a1_1" = "3966450983"
"a1_2" = "1425751807"
"a1_3" = "2640995182"
"a1_4" = "3837506437"
"a1_5" = "2969274296"
"a1_6" = "679347448"
"a1_7" = "1532897644"
"a1_8" = "3796725317"
"a1_9" = "416712379"
"a2_566" = "4057724908"
"a2_567" = "4064887822"
"a2_564" = "4043389194"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029041181"
"a2_563" = "4036220067"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953680321"
"a2_413" = "2960844968"
"a2_410" = "2939345528"
"a2_411" = "2946514806"
"a2_416" = "2982346903"
"a2_417" = "2989530193"
"a2_414" = "2968012816"
"a2_415" = "2975181970"
"a2_418" = "2996697315"
"a2_419" = "3003864937"
"a2_962" = "2601731457"
"a2_963" = "2608904951"
"a2_960" = "2587393687"
"a2_961" = "2594555370"
"a2_966" = "2630411563"
"a2_967" = "2637575897"
"a2_964" = "2616060531"
"a4_950" = "2515697654"
"a1_631" = "2935231041"
"a2_968" = "2644749970"
"a2_969" = "2651909109"
"a4_564" = "4043384244"
"a1_219" = "2177559345"
"a1_218" = "1216503332"
"a1_217" = "1418550880"
"a1_216" = "1231650442"
"a1_215" = "2627175497"
"a1_214" = "3336260430"
"a1_213" = "1963589608"
"a1_212" = "291933306"
"a1_211" = "2515344975"
"a1_210" = "4214009518"
"a4_567" = "4064891607"
"a1_630" = "2805791458"
"a2_980" = "2730778207"
"a4_560" = "4014707760"
"a2_982" = "2745118561"
"a4_956" = "2558712380"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "3521988237"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The process 7za.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D A5 2A 87 5D A9 19 86 6D 8F E1 20 46 95 E8 26"

The process wmic.exe:1040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 1C 64 29 A2 34 71 9A 8C C1 F3 CC 40 DD 92 05"

Dropped PE files

MD5	File path
10bd2af1b07ec6bc9cd17ba512569e59	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\setupcl.exe
7e5424e9703323d28d5190a441c9a912	c:\yohq.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.1
File Description:
Comments:
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.39085	561fc4bce3e925383590fa86b62cec27
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	40960	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	204800	98304	95744	5.39094	8f13cec55e328b2cc58950f42603fb06

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://d3hnlp5dtgb93r.cloudfront.net/init/598a3fc9d8277dc98197e6243e65ea29/61c58decf4fd1844a31ed769232f5920?v=2.4&uid=61c58decf4fd1844a31ed769232f5920&muid=9E10BDD7664AB688D1D7F2AB0B148110&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&v2=1
hxxp://sub.warese.info/init/598a3fc9d8277dc98197e6243e65ea29/61c58decf4fd1844a31ed769232f5920?v=2.4&uid=61c58decf4fd1844a31ed769232f5920&muid=9E10BDD7664AB688D1D7F2AB0B148110&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&v2=1	54.230.99.36

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Win32.Sefnit

Traffic

GET /init/598a3fc9d8277dc98197e6243e65ea29/61c58decf4fd1844a31ed769232f5920?v=2.4&uid=61c58decf4fd1844a31ed769232f5920&muid=9E10BDD7664AB688D1D7F2AB0B148110&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&v2=1 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sub.warese.info

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Tue, 09 Jun 2015 02:16:27 GMT

Expires: Mon, 08 Jun 2015 23:29:47 GMT

Cache-Control: no-cache

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 9d20a7bb63aef532ab86d12af354967a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XcOX_5SlmVXGDIL1sAm2Bk9wltjtnTwMEAqyI7-B5qsHB5F36JCy1w==

14........................0..HTTP/1.1 200 OK..Content-Type: text/html;
 charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Se
rver: nginx..Date: Tue, 09 Jun 2015 02:16:27 GMT..Expires: Mon, 08 Jun
 2015 23:29:47 GMT..Cache-Control: no-cache..Content-Encoding: gzip..V
ary: Accept-Encoding..X-Cache: Miss from cloudfront..Via: 1.1 9d20a7bb
63aef532ab86d12af354967a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: XcO
X_5SlmVXGDIL1sAm2Bk9wltjtnTwMEAqyI7-B5qsHB5F36JCy1w==..14.............
...........0..

The Trojan connects to the servers at the folowing location(s):

setupcl.exe_1052:

.text

`.rdata

@.data

.rsrc

SSSSh

RegOpenKeyTransactedW

RegDeleteKeyTransactedW

FRegDeleteKeyExW

FtpCommandW

kernel32.dll

XXXXXXXXXXXX

RegCreateKeyTransactedW

operator

GetProcessWindowStation

C:\Develop\coin\coin-ca7a559\coin-ca7a559\bi\BetterInstaller\Release\BetterInstaller.pdb

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

CreatePipe

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

COMDLG32.dll

CryptSetKeyParam

CryptImportKey

CryptDestroyKey

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

USERENV.dll

GetCPInfo

.?AUIHTMLOMWindowServices@@

.?AV?$CAtlExeModuleT@VCInternetExplorerModule@@@ATL@@

Created by MIDL version 7.00.0555 at Thu Oct 30 12:07:16 2014

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

Advapi32.dll

OLEAUT32.DLL

Mscoree.dll

%u kB

%u bytes

Range: bytes=%d-%d

Range: bytes=%d-

%d:d:d

%s - %s

Wwininet.dll

%s.%d

@"%s" %s

@%s (%d)%s

*.TXT

%d.%d.%d %s %sbit

%DOCUMENTS%

ÞSKTOP%

/initurl

hXXp://bi.bisrv.com

<memory>%d</memory>

%s\Mozilla\Firefox\%s\prefs.js

%s\Mozilla\Firefox\profiles.ini

biDeleteRegistryKey

biGetExecutionArguments

biCreateRegistryKey

biExistRegistryKey

Better Installer(Mozilla)

%sv=%s&uid=%s&muid=%s&v1=%s&v2=%i

Preparing %s...

ekernel32.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

KERNEL32.DLL

mscoree.dll

WUSER32.DLL

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

hXXp://sub.warese.info/init/598a3fc9d8277dc98197e6243e65ea29/61c58decf4fd1844a31ed769232f5920?

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\setupcl.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

setupcl.exe_1052_rwx_00BC0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

setupcl.exe_1052_rwx_00BD0000_00001000:

|setupcl.exeM_1052_

Explorer.EXE_532_rwx_00FF0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

Explorer.EXE_532_rwx_01E00000_00001000:

|explorer.exeM_532_

Explorer.EXE_532_rwx_038F0000_0108E000:

c:\windows

hXXp://VVV.artiplexi.com/images/image.gif

hXXp://vitinhduycuong.com/images/logo.gif

hXXp://VVV.cupress.chula.ac.th/images/image.gif

hXXp://bitelindia.com/images/bottom.gif

hXXp://lsquaretarlac.com/images/image.gif

hXXp://VVV.corpnox-technologie.fr/bottom.gif

hXXp://VVV.wto.net.my/images/bottom.gif

hXXp://203.146.43.35/logo.gif

%System%\drivers\ophpe.sys

8366403910

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

KERNEL32.dll

USER32.dll

h.rdata

H.data

.reloc

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

.adata

M_%d_

%c%d_%d

?456789:;<=

!"#$%&'()* ,-./0123

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

.rdata

.data

Bkrnl.exe?

= =$=(=,=

322%2`.50728)

.klkjw:9fqwi

FamXf39.sys

.pBTa8

%s:*:

Bg.laXV

&?%x=

GUrlA'

Web%w|nc

HTTP)

2GUARDCMD.

.ENHCDM

PL/KPCKwWEB

MM.PFW.

.bssf

J:CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

WMIC.exe:216
WMIC.exe:1240
WMIC.exe:556
WMIC.exe:1352
%original file name%.exe:172
7za.exe:1112
wmic.exe:1040
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\TempWmicBatchFile.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsExec.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns7.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns4.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\[RANDOM_STRING].7z (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns8.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000CC605_Rar\%original file name%.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (14882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns5.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ns6.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\7za.exe (19592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\setupcl.exe (198 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Win32.Sality.3_598a3fc9d8

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Win32.Sality.3_598a3fc9d8

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet