not-a-virus:AdWare.Win32.Skyli.a (Kaspersky), Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Trojan.NSIS.StartPage.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Worm, Virus, Adware, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 663ca0bfaeafbd3c87ec94bcb346a372
SHA1: 07ca01c4a76ec3948ee13dc30beaabe415b80d08
SHA256: b2c760aef7de0454a5470754b26b43f5388f45d2fe961ee01d926ece4e3d30c6
SSDeep: 12288:CIBZw8DiEN86nYg7gOxLwKbtBOqjtz6RP5worKGTMAiILx PTmgyMMDzdS81u:fRDil6nTxpmIdKwqpTuILxITmvMMDztk
Size: 767528 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1752
Explorer.EXE:1140
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1752 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fxgrbp.exe (741 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\autorun.inf (334 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (432 bytes)
C:\fvjr.exe (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\modern-header.bmp (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getList[1].txt (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3.tmp (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080335_Rar\%original file name%.exe (5441 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\smhello.bmp (6026 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\fxgrbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sputnik2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx1.tmp (0 bytes)
Registry activity
The process %original file name%.exe:1752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494845501"
"a2_349" = "2502017040"
"a2_346" = "2480520393"
"a2_347" = "2487686276"
"a2_344" = "2466182511"
"a2_345" = "2473354099"
"a2_342" = "2451847173"
"a2_343" = "2459000386"
"a2_340" = "2437500911"
"a2_341" = "2444667994"
"a2_180" = "1290438335"
"a2_181" = "1297606162"
"a2_182" = "1304774559"
"a2_183" = "1311953828"
"a2_184" = "1319121751"
"a2_185" = "1326292304"
"a2_186" = "1333458067"
"a2_187" = "1340624753"
"a2_188" = "1347791510"
"a2_189" = "1354959910"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a2_749" = "1074706422"
"a2_742" = "1024518662"
"a2_743" = "1031697768"
"a2_740" = "1010184875"
"a2_741" = "1017352720"
"a2_746" = "1053204871"
"a2_747" = "1060372446"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a2_745" = "1046021414"
"a1_503" = "2165065153"
"a1_502" = "2481897352"
"a1_501" = "3185261962"
"a1_500" = "766729923"
"a1_507" = "3300764781"
"a1_506" = "2295195142"
"a1_505" = "2299638535"
"a1_504" = "603901007"
"a1_509" = "1694050947"
"a1_508" = "355798866"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "204786731"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "2797714058"
"a1_434" = "3779271516"
"a1_433" = "4230538568"
"a1_432" = "3614838749"
"a1_431" = "452645398"
"a1_430" = "4119515315"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a3_449" = "3202245640"
"a1_636" = "1113302594"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "2229809511"
"a1_728" = "3587430169"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "2632439657"
"a2_748" = "1067538161"
"a1_593" = "3570146559"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_987" = "3743813702"
"a1_986" = "2884417319"
"a1_985" = "3144191334"
"a1_984" = "3589506459"
"a1_983" = "86484782"
"a1_982" = "4104650538"
"a1_981" = "2800178697"
"a1_980" = "916086797"
"a1_989" = "2217349356"
"a1_988" = "1056815477"
"a3_869" = "1918293868"
"a2_744" = "1038852143"
"a1_855" = "3654339488"
"a3_655" = "383827462"
"a1_857" = "279480581"
"a1_856" = "2149152228"
"a1_851" = "63960637"
"a1_850" = "2348147021"
"a1_853" = "1950583128"
"a3_654" = "376767975"
"a1_859" = "3870933034"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "2002424391"
"a1_184" = "2429184746"
"a1_183" = "1470071816"
"a1_182" = "291493816"
"a1_181" = "1488333601"
"a1_180" = "3577127757"
"a1_963" = "242400439"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "3788008712"
"a1_801" = "1382982650"
"a4_824" = "1612388408"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "3895070826"
"a4_866" = "1913491490"
"a1_933" = "2459092543"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "3928547479"
"a4_863" = "1891984127"
"a1_936" = "3536698311"
"a4_862" = "1884815006"
"a1_937" = "1040424036"
"a2_405" = "2903496735"
"a2_404" = "2896328642"
"a2_407" = "2917826676"
"a2_406" = "2910655137"
"a2_401" = "2874811132"
"a2_400" = "2867646367"
"a2_403" = "2889159492"
"a2_402" = "2881992261"
"a1_935" = "2195048714"
"a2_409" = "2932165070"
"a2_408" = "2924996453"
"a2_975" = "2694933816"
"a2_974" = "2687759215"
"a2_977" = "2709272179"
"a2_976" = "2702093371"
"a2_971" = "2666243644"
"a2_970" = "2659074405"
"a2_973" = "2680595460"
"a4_896" = "2128565120"
"a2_979" = "2723595892"
"a2_978" = "2716430234"
"a1_222" = "3126899822"
"a1_223" = "2090818354"
"a1_220" = "1630122976"
"a1_221" = "3681360897"
"a1_226" = "2021774319"
"a1_227" = "2466060664"
"a1_224" = "1884308174"
"a1_225" = "794842412"
"a1_228" = "781602109"
"a1_229" = "1130393965"
"a2_998" = "2859813638"
"a2_993" = "2823965086"
"a2_992" = "2816796768"
"a2_991" = "2809628090"
"a2_990" = "2802454105"
"a2_997" = "2852649054"
"a2_996" = "2845482511"
"a2_995" = "2838311608"
"a2_994" = "2831147253"
"a2_579" = "4150923785"
"a2_578" = "4143756451"
"a2_571" = "4093571764"
"a2_570" = "4086392538"
"a2_573" = "4107908118"
"a2_572" = "4100745355"
"a2_575" = "4122242592"
"a2_574" = "4115073943"
"a2_577" = "4136576123"
"a2_576" = "4129408457"
"a2_351" = "2516353878"
"a2_350" = "2509186503"
"a2_353" = "2530692536"
"a2_352" = "2523535591"
"a2_355" = "2545029816"
"a2_354" = "2537871820"
"a2_357" = "2559372986"
"a2_356" = "2552205091"
"a2_359" = "2573723100"
"a2_358" = "2566538747"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642771"
"a2_192" = "1376473434"
"a2_191" = "1369294706"
"a2_190" = "1362126176"
"a2_197" = "1412310864"
"a2_196" = "1405142261"
"a2_195" = "1397975768"
"a2_194" = "1390808380"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426672404"
"a2_198" = "1419490361"
"a3_625" = "168917752"
"a2_759" = "1146389240"
"a3_626" = "175906587"
"a2_755" = "1117721557"
"a2_754" = "1110555359"
"a2_757" = "1132055801"
"a3_627" = "183481274"
"a2_751" = "1089036504"
"a2_750" = "1081872158"
"a2_753" = "1103387639"
"a2_752" = "1096205356"
"a1_536" = "3305335893"
"a1_537" = "1818209056"
"a1_534" = "3707378435"
"a1_535" = "2981434484"
"a1_89" = "3496135904"
"a1_88" = "1836489444"
"a1_530" = "1549495436"
"a1_531" = "372233455"
"a1_85" = "3396834136"
"a1_84" = "1640409731"
"a1_87" = "3119310240"
"a1_86" = "3395734219"
"a1_81" = "3425098511"
"a1_80" = "4212346987"
"a1_83" = "2065232446"
"a1_82" = "2542836922"
"a3_914" = "2274560123"
"a2_898" = "2142897710"
"a1_896" = "3092216793"
"a1_890" = "1822594391"
"a2_899" = "2150080174"
"a1_67" = "1932535056"
"a1_66" = "3012086619"
"a1_65" = "2663644399"
"a3_133" = "970345548"
"a1_63" = "3627718501"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "3088036578"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "3459830939"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "722069331"
"a1_68" = "3169793436"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "2265876676"
"a1_409" = "2089887662"
"a1_402" = "993576964"
"a1_403" = "2009097184"
"a1_400" = "2491002310"
"a1_401" = "3000328523"
"a1_406" = "3308405131"
"a1_407" = "893579106"
"a1_404" = "1939576128"
"a1_405" = "3635237163"
"a2_823" = "1605218096"
"a2_822" = "1598052217"
"a2_821" = "1590883401"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633902020"
"a1_628" = "2710289068"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "1754399693"
"a2_826" = "1626734014"
"a2_825" = "1619550678"
"a1_718" = "963381682"
"a1_719" = "961504310"
"a1_716" = "979666970"
"a1_717" = "1940607217"
"a1_714" = "1286552826"
"a1_715" = "2683032242"
"a1_712" = "714926735"
"a1_713" = "4139394680"
"a1_710" = "3837083999"
"a1_711" = "4213378354"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "2644655627"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a2_941" = "2451170672"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "287841569"
"a1_889" = "3006556288"
"a1_886" = "938824303"
"a1_887" = "232609610"
"a1_884" = "1392780636"
"a1_885" = "778905575"
"a1_882" = "1196200813"
"a1_883" = "321029118"
"a1_880" = "1773560367"
"a1_881" = "2922715527"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251295069"
"a3_444" = "3166269973"
"a3_445" = "3206813364"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Aas]
"a1_831" = "3234545298"
"a2_592" = "4244125650"
"a1_930" = "2112296484"
"a1_948" = "2924267656"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "3486679514"
"a1_723" = "1153661389"
"a1_722" = "3229061052"
"a1_721" = "2040299151"
"a1_720" = "2260247987"
"a1_768" = "1984476874"
"a1_727" = "138143166"
"a1_726" = "1418881954"
"a2_643" = "314771001"
"a2_790" = "1368643697"
"a1_725" = "3730993899"
"a2_642" = "307602193"
"a1_724" = "3694946462"
"a2_641" = "300436389"
"a2_640" = "293267434"
"a2_647" = "343450238"
"a2_646" = "336288353"
"a1_158" = "2517736072"
"a1_159" = "1604685982"
"a2_645" = "329119582"
"a1_150" = "3195314052"
"a1_151" = "97736930"
"a1_152" = "742270663"
"a1_153" = "2475626181"
"a1_154" = "3787968486"
"a1_155" = "3169566976"
"a1_156" = "243600674"
"a1_157" = "3757190946"
"a1_235" = "1011739609"
"a1_234" = "953156061"
"a1_237" = "827370112"
"a1_236" = "2257018930"
"a1_231" = "1890114105"
"a1_230" = "2485475482"
"a1_233" = "522638615"
"a1_232" = "3757269178"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Aas]
"a1_239" = "4053386450"
"a1_238" = "1344932479"
"a2_210" = "1505510136"
"a2_211" = "1512677388"
"a2_212" = "1519845619"
"a2_213" = "1527026523"
"a2_214" = "1534196369"
"a2_215" = "1541363624"
"a2_216" = "1548522971"
"a2_217" = "1555697571"
"a2_218" = "1562863805"
"a2_219" = "1570031383"
"a1_966" = "3866866779"
"a2_508" = "3641904707"
"a2_384" = "2752941628"
"a2_504" = "3613230910"
"a2_505" = "3620410381"
"a2_506" = "3627577485"
"a2_507" = "3634746338"
"a2_500" = "3584561610"
"a2_501" = "3591726545"
"a2_502" = "3598896097"
"a2_503" = "3606064464"
"a2_791" = "1375810302"
"a2_698" = "709078445"
"a2_699" = "716255908"
"a2_694" = "680410899"
"a2_695" = "687577704"
"a2_696" = "694743101"
"a2_697" = "701918340"
"a2_690" = "651727780"
"a2_691" = "658887290"
"a2_692" = "666061912"
"a2_693" = "673229914"
"a2_324" = "2322798374"
"a2_325" = "2329964917"
"a2_326" = "2337130013"
"a2_327" = "2344300464"
"a2_320" = "2294112955"
"a2_321" = "2301281690"
"a2_322" = "2308463469"
"a2_323" = "2315632216"
"a1_521" = "312096575"
"a1_520" = "3850985120"
"a1_523" = "3529744917"
"a1_522" = "3499257777"
"a2_328" = "2351466946"
"a2_329" = "2358647478"
"a1_527" = "2469575901"
"a1_526" = "871784730"
"a2_799" = "1433168734"
"a1_998" = "1344795228"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Aas]
"a2_798" = "1425996917"
"a4_962" = "2601727106"
"a1_98" = "1342755919"
"a1_99" = "725284157"
"a1_92" = "1662324111"
"a1_93" = "4192076896"
"a1_90" = "1399329111"
"a1_91" = "2254167846"
"a1_96" = "3153560233"
"a1_97" = "1506245276"
"a1_94" = "2501174720"
"a1_95" = "3673256864"
"a1_74" = "1544225488"
"a1_75" = "3121707570"
"a1_76" = "3491498657"
"a1_77" = "885548658"
"a1_70" = "682485471"
"a1_71" = "2885246609"
"a1_72" = "2327105300"
"a1_73" = "859775479"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "3051279194"
"a1_79" = "2111352450"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "518928023"
"a1_418" = "1121958157"
"a3_953" = "2520368944"
"a1_415" = "1560051562"
"a1_414" = "111361153"
"a1_417" = "2440288572"
"a1_416" = "3374014109"
"a1_411" = "963537892"
"a1_410" = "744321796"
"a1_413" = "1988932392"
"a1_412" = "4070293922"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "2655127841"
"a1_700" = "4227838594"
"a1_703" = "3799565446"
"a1_702" = "501496483"
"a1_705" = "2426794879"
"a1_704" = "1860497822"
"a1_707" = "2209589208"
"a1_706" = "442748251"
"a1_709" = "3172455543"
"a1_708" = "1101113370"
"a2_360" = "2580886553"
"a4_838" = "1712756102"
"a2_361" = "2588059836"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595221380"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609555075"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616724474"
"a2_366" = "2623903922"
"a2_367" = "2631069834"
"a1_743" = "202318280"
"a2_168" = "1204420335"
"a2_169" = "1211587987"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147052630"
"a4_973" = "2680587437"
"a2_161" = "1154220588"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "3889913253"
"a3_776" = "1251683361"
"a1_893" = "1458400015"
"a1_892" = "1415247530"
"a1_895" = "3610684197"
"a1_894" = "468214634"
"a1_897" = "500737370"
"a3_777" = "1292288064"
"a1_899" = "2207437023"
"a1_898" = "2425412869"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261942784"
"a1_617" = "3929196176"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "1738651993"
"a2_459" = "3290621830"
"a3_678" = "548713167"
"a1_614" = "2636231419"
"a1_820" = "775999471"
"a1_821" = "1479706507"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Aas]
"a1_822" = "307522351"
"a1_149" = "4008969258"
"a1_148" = "1324386782"
"a1_143" = "656556898"
"a1_142" = "2982336411"
"a1_141" = "2017514551"
"a1_140" = "3346942933"
"a1_147" = "959502846"
"a1_146" = "2502103819"
"a1_145" = "4100362408"
"a1_144" = "1903430854"
"a1_826" = "2729667042"
"a1_827" = "1928450"
"a2_203" = "1455328716"
"a2_202" = "1448160327"
"a2_201" = "1440991022"
"a2_200" = "1433827137"
"a2_207" = "1484001189"
"a2_206" = "1476844606"
"a2_205" = "1469675144"
"a2_204" = "1462495859"
"a2_209" = "1498343634"
"a2_208" = "1491179275"
"a2_519" = "3720779668"
"a2_518" = "3713599149"
"a2_517" = "3706430063"
"a2_516" = "3699265157"
"a2_515" = "3692098182"
"a2_514" = "3684931397"
"a2_513" = "3677765018"
"a2_512" = "3670594996"
"a2_511" = "3663415300"
"a2_510" = "3656245804"
"a2_689" = "644559741"
"a2_688" = "637394850"
"a2_687" = "630225641"
"a2_686" = "623044164"
"a2_685" = "615877695"
"a2_684" = "608709172"
"a2_683" = "601544708"
"a2_682" = "594374781"
"a2_681" = "587207374"
"a2_680" = "580027490"
"a2_337" = "2415999806"
"a2_336" = "2408819403"
"a2_335" = "2401649774"
"a2_334" = "2394483013"
"a2_333" = "2387314503"
"a2_332" = "2380151293"
"a2_331" = "2372981319"
"a2_330" = "2365816447"
"a1_554" = "3028069297"
"a1_555" = "314107904"
"a1_556" = "1124411893"
"a1_557" = "2470387547"
"a3_242" = "1718323611"
"a1_551" = "2944771487"
"a2_339" = "2430335508"
"a2_338" = "2423166391"
"a4_673" = "529851137"
"a1_918" = "3580645012"
"a1_919" = "884846731"
"a3_243" = "1725243962"
"a1_852" = "3094556813"
"a1_914" = "2737494522"
"a1_398" = "1260615292"
"a1_399" = "3769037540"
"a4_679" = "572865863"
"a1_392" = "54330582"
"a1_393" = "3415639475"
"a1_390" = "1857196945"
"a1_391" = "1958947186"
"a1_396" = "2173122650"
"a1_397" = "1652904612"
"a1_394" = "1233738973"
"a1_395" = "2198449685"
"a1_858" = "4180595832"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "3904407247"
"a1_48" = "1870462057"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "249186248"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "2198810649"
"a1_775" = "2814532204"
"a1_776" = "704343644"
"a1_777" = "3941858084"
"a1_191" = "2895971880"
"a1_771" = "2485419898"
"a1_772" = "190827729"
"a1_773" = "3486543530"
"a1_953" = "913765795"
"a3_927" = "2367492374"
"a1_778" = "1135318423"
"a1_779" = "3760954726"
"a3_926" = "2326953207"
"a2_17" = "121877030"
"a2_16" = "114712449"
"a2_15" = "107528519"
"a2_14" = "100363200"
"a2_13" = "93206533"
"a2_12" = "86028203"
"a2_11" = "78859909"
"a2_10" = "71683584"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "2898280222"
"a2_19" = "136211387"
"a2_18" = "129051878"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "2751460595"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "3006106657"
"a1_596" = "638936717"
"a4_987" = "2780955131"
"a1_597" = "3467977469"
"a1_608" = "874531129"
"a1_609" = "643072181"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Aas]
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "1981557449"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "4104605362"
"a3_484" = "3486690637"
"a1_952" = "478637830"
"a2_925" = "2336466991"
"a1_954" = "551904038"
"a1_955" = "2805074829"
"a1_956" = "379365472"
"a3_485" = "3460055532"
"a1_958" = "4023988128"
"a2_922" = "2314969421"
"a1_750" = "1556694098"
"a1_751" = "2160111411"
"a1_756" = "1165630505"
"a1_757" = "918594440"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "3994479051"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "4110817630"
"a4_903" = "2178748967"
"a1_188" = "628829282"
"a4_900" = "2157241604"
"a1_187" = "2145805957"
"a4_901" = "2164410725"
"a1_186" = "477691335"
"a2_929" = "2365152031"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "1707738709"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "785345411"
"a1_558" = "1188597297"
"a1_559" = "1582639474"
"a1_606" = "2012599495"
"a3_925" = "2319505492"
"a1_178" = "3108086308"
"a1_179" = "1268597130"
"a1_176" = "3005837548"
"a1_177" = "624305475"
"a1_174" = "1682642624"
"a1_175" = "1554044694"
"a1_172" = "703910259"
"a1_173" = "1745716416"
"a1_170" = "2481395763"
"a1_171" = "2445968786"
"a1_550" = "1630202546"
"a2_236" = "1691914243"
"a2_237" = "1699086202"
"a2_234" = "1677583125"
"a2_235" = "1684736876"
"a2_232" = "1663230191"
"a2_233" = "1670398199"
"a2_230" = "1648898968"
"a2_231" = "1656074326"
"a1_553" = "2999997493"
"a2_238" = "1706260452"
"a2_239" = "1713411602"
"a2_522" = "3742284493"
"a2_523" = "3749446956"
"a2_520" = "3727935295"
"a2_521" = "3735116803"
"a2_526" = "3770950095"
"a2_527" = "3778132726"
"a2_524" = "3756614104"
"a2_525" = "3763782530"
"a2_838" = "1712752841"
"a2_839" = "1719922560"
"a2_528" = "3785299535"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a3_688" = "620670617"
"a1_626" = "2465304683"
"a1_541" = "152405925"
"a1_627" = "1288028207"
"a1_624" = "563267903"
"a1_549" = "300835768"
"a1_548" = "1465300987"
"a1_547" = "1614916122"
"a1_546" = "310955959"
"a1_545" = "729209815"
"a1_544" = "2492283005"
"a1_543" = "2323898351"
"a1_542" = "3841179796"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a1_540" = "1956167457"
"a2_658" = "422321181"
"a2_659" = "429488152"
"a2_308" = "2208096735"
"a2_309" = "2215260846"
"a2_302" = "2165077515"
"a2_303" = "2172244837"
"a2_300" = "2150743687"
"a2_301" = "2157911176"
"a2_306" = "2193745357"
"a2_307" = "2200927694"
"a2_304" = "2179410820"
"a2_305" = "2186579737"
"a2_786" = "1339961279"
"a2_787" = "1347125725"
"a2_784" = "1325627200"
"a2_785" = "1332795310"
"a2_782" = "1311290019"
"a2_783" = "1318460035"
"a2_780" = "1296944539"
"a2_781" = "1304107962"
"a2_788" = "1354291641"
"a2_789" = "1361463619"
"a1_389" = "904234294"
"a1_388" = "2923516249"
"a1_385" = "127382188"
"a1_384" = "899566142"
"a1_387" = "2833738234"
"a1_386" = "3429248668"
"a1_381" = "2387358868"
"a1_380" = "1095207464"
"a1_383" = "3703338149"
"a1_382" = "309582951"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Aas]
"a1_58" = "1184945047"
"a1_59" = "2140748292"
"a1_56" = "2418884967"
"a1_57" = "1929704652"
"a1_54" = "612321224"
"a1_55" = "3638222986"
"a1_52" = "4113048825"
"a1_53" = "4068965700"
"a1_50" = "2001200303"
"a1_51" = "3309462497"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "1931370714"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a2_916" = "2271939457"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "2283177481"
"a1_764" = "1390793922"
"a1_762" = "4066949100"
"a1_761" = "3526896903"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257614754"
"a4_858" = "1856138522"
"a1_586" = "487283284"
"a1_789" = "1827227086"
"a3_720" = "849951481"
"a4_393" = "2817464553"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "3674209839"
"a1_619" = "1789074231"
"a1_618" = "2083278180"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "3150223666"
"a4_522" = "3742281162"
"a2_62" = "444486458"
"a4_523" = "3749450283"
"a2_63" = "451652174"
"a4_524" = "3756619404"
"a1_971" = "120287573"
"a2_60" = "430150099"
"a4_525" = "3763788525"
"a1_943" = "2896134435"
"a1_942" = "3266656960"
"a1_941" = "1261470783"
"a2_61" = "437317889"
"a1_947" = "3323108205"
"a4_526" = "3770957646"
"a1_945" = "3422101887"
"a1_944" = "2238246592"
"a2_66" = "473168203"
"a1_949" = "3724718026"
"a4_527" = "3778126767"
"a2_67" = "480336821"
"a2_64" = "458818814"
"a2_65" = "465987966"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "3086164466"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "4106690443"
"a1_41" = "477991477"
"a1_40" = "4208450539"
"a1_43" = "3567881478"
"a3_819" = "1559971962"
"a1_42" = "3553909683"
"a3_813" = "1516544548"
"a1_45" = "746734938"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "3423077080"
"a1_47" = "1782858390"
"a1_46" = "2638845136"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a4_998" = "2859815462"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a4_995" = "2838308099"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a4_996" = "2845477220"
"a3_756" = "1108280413"
"a4_991" = "2809631615"
"a1_783" = "1281616379"
"a3_757" = "1115339004"
"a1_959" = "1261330434"
"a2_907" = "2207418215"
"a4_990" = "2802462494"
"a1_161" = "1988760764"
"a1_160" = "823521778"
"a1_163" = "1208467866"
"a1_162" = "2362460441"
"a1_165" = "1327380939"
"a1_164" = "2731191625"
"a1_167" = "630479665"
"a1_166" = "358440285"
"a1_169" = "1771889272"
"a1_168" = "2966471522"
"a4_992" = "2816800736"
"a4_994" = "2831138978"
"a3_727" = "933979486"
"a2_535" = "3835482352"
"a2_534" = "3828302356"
"a2_537" = "3849819946"
"a2_536" = "3842653455"
"a2_531" = "3806800837"
"a2_530" = "3799643101"
"a2_533" = "3821135085"
"a2_532" = "3813980515"
"a2_829" = "1648236636"
"a2_828" = "1641068524"
"a2_539" = "3864150432"
"a2_538" = "3856984640"
"a4_447" = "3204597087"
"a4_997" = "2852646341"
"a1_572" = "815311355"
"a1_573" = "3000884059"
"a1_570" = "3553407114"
"a1_571" = "1793098357"
"a1_576" = "244049940"
"a1_577" = "1235503598"
"a1_574" = "1121645356"
"a1_575" = "2482177922"
"a1_578" = "2527396931"
"a1_579" = "3728123662"
"a2_649" = "357787463"
"a2_648" = "350620141"
"a2_319" = "2286947961"
"a2_318" = "2279779343"
"a2_315" = "2258278680"
"a2_314" = "2251111723"
"a2_317" = "2272613036"
"a2_316" = "2265434091"
"a2_311" = "2229594993"
"a2_310" = "2222430347"
"a2_313" = "2243931986"
"a2_312" = "2236773999"
"a2_229" = "1641736680"
"a2_228" = "1634562107"
"a2_221" = "1584379999"
"a2_220" = "1577212484"
"a2_223" = "1598712129"
"a2_222" = "1591546782"
"a2_225" = "1613046809"
"a2_224" = "1605860447"
"a2_227" = "1627397017"
"a2_226" = "1620228200"
"a1_370" = "1880750975"
"a1_371" = "2762474462"
"a1_372" = "1289058630"
"a1_373" = "131281672"
"a1_374" = "3922136795"
"a1_375" = "3022250574"
"a1_376" = "2537522219"
"a1_377" = "4257146743"
"a1_378" = "4170735461"
"a1_379" = "1006965741"
"a2_793" = "1390137494"
"a2_792" = "1382978069"
"a2_795" = "1404481137"
"a2_794" = "1397312215"
"a2_797" = "1418828290"
"a2_796" = "1411648042"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "2502824100"
"a1_28" = "3821843665"
"a1_590" = "2046423539"
"a1_23" = "3124198113"
"a1_22" = "817868340"
"a1_21" = "475817526"
"a1_20" = "1007473093"
"a1_27" = "32494164"
"a1_26" = "1252347532"
"a1_25" = "28384197"
"a1_24" = "2610012465"
"a1_284" = "246617809"
"a1_285" = "3844211262"
"a1_286" = "3949528074"
"a1_287" = "2590587106"
"a1_280" = "2042034998"
"a1_281" = "1222318644"
"a1_282" = "2691220375"
"a1_283" = "1539388256"
"a3_31" = "205278614"
"a1_288" = "2794469788"
"a1_289" = "1040196572"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746427"
"a1_591" = "1835691837"
"a3_32" = "212854281"
"a2_972" = "2673424347"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "3625689971"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "1131194719"
"a1_599" = "543599800"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222234252"
"a2_30" = "215078961"
"a2_33" = "236578508"
"a2_32" = "229414093"
"a2_35" = "250912820"
"a2_34" = "243748187"
"a2_37" = "265262219"
"a2_36" = "258083735"
"a2_39" = "279600384"
"a2_38" = "272429261"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186760079"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193940675"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "3246662351"
"a1_625" = "2568027818"
"a1_622" = "3548545245"
"a1_623" = "3476627802"
"a1_620" = "1573508158"
"a1_621" = "1464799217"
"a3_643" = "331380106"
[HKCU\Software\Aas\695404737]
"7169121" = "144"
[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "4175977383"
"a2_588" = "4215444971"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222611347"
"a1_976" = "3042606958"
"a1_977" = "757080423"
"a1_974" = "187875153"
"a1_975" = "2852901169"
"a1_972" = "3876862839"
"a1_973" = "718521312"
"a1_970" = "1468300499"
"a3_827" = "1616916338"
"a1_770" = "3002766996"
"a1_978" = "3438149831"
"a1_979" = "2746357325"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Aas]
"a4_199" = "1426655079"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Aas]
"a3_504" = "3596547281"
"a2_363" = "2602387950"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157248022"
"a1_746" = "2782677466"
"a4_827" = "1633895771"
"a2_901" = "2164416189"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171581334"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185916127"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193080710"
"a2_906" = "2200249683"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "3985629823"
"a1_115" = "3087229673"
"a1_116" = "628099497"
"a1_117" = "175723530"
"a1_110" = "1707571165"
"a1_111" = "3942495298"
"a1_112" = "960087849"
"a1_113" = "2604402316"
"a1_824" = "4089991818"
"a1_118" = "3789663203"
"a1_119" = "1942281035"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570229037"
"a2_499" = "3577354022"
"a2_492" = "3527209781"
"a2_493" = "3534384618"
"a2_490" = "3512874939"
"a2_491" = "3520041825"
"a2_496" = "3555880381"
"a2_497" = "3563059594"
"a2_494" = "3541544617"
"a2_495" = "3548711934"
"a2_816" = "1555033689"
"a2_817" = "1562212806"
"a2_814" = "1540699762"
"a2_815" = "1547864144"
"a2_812" = "1526363195"
"a3_740" = "1026900557"
"a2_810" = "1512014539"
"a2_811" = "1519182938"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569367853"
"a2_819" = "1576549208"
"a1_565" = "3326709291"
"a1_564" = "586911973"
"a1_567" = "789997721"
"a1_566" = "3393014955"
"a1_561" = "3997228335"
"a1_560" = "2379417704"
"a1_563" = "2150611742"
"a1_562" = "2094686778"
"a1_569" = "3182621900"
"a1_568" = "158219873"
"a1_525" = "3318906660"
"a2_678" = "565692374"
"a2_679" = "572857962"
"a2_676" = "551356797"
"a2_677" = "558524326"
"a2_674" = "537023199"
"a2_675" = "544181137"
"a2_672" = "522674498"
"a2_673" = "529856202"
"a2_670" = "508335250"
"a2_671" = "515522549"
"a3_982" = "2728158783"
"a2_258" = "1849638550"
"a2_259" = "1856803748"
"a2_254" = "1820950705"
"a2_255" = "1828120983"
"a2_256" = "1835300888"
"a2_257" = "1842466972"
"a2_250" = "1792287350"
"a2_251" = "1799453595"
"a2_252" = "1806626543"
"a2_253" = "1813778642"
"a1_363" = "1826650322"
"a1_362" = "3108420471"
"a1_361" = "3160989186"
"a1_360" = "3283370533"
"a1_367" = "3379169858"
"a1_366" = "682216720"
"a1_365" = "2408075794"
"a1_364" = "968413271"
"a1_369" = "600363117"
"a1_368" = "1801184972"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2256507962"
"a1_39" = "3758949514"
"a1_30" = "1475679714"
"a1_31" = "2625650406"
"a1_32" = "1883771000"
"a1_33" = "4034904019"
"a1_34" = "2333766838"
"a1_35" = "3158404634"
"a1_36" = "3398782185"
"a1_37" = "4160430521"
"a1_297" = "2067389142"
"a1_296" = "3634942035"
"a1_295" = "1338300552"
"a1_294" = "3849059368"
"a1_293" = "2904922216"
"a1_292" = "294126578"
"a1_291" = "1165315100"
"a1_290" = "412159671"
"a1_299" = "2534479378"
"a1_298" = "2070277267"
"a3_769" = "1234824520"
"a1_600" = "3152661507"
"a2_668" = "494010165"
"a1_601" = "312462292"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "167995212"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774304099"
"a2_109" = "781429563"
"a4_878" = "1999520942"
"a1_603" = "2772245935"
"a2_100" = "716908643"
"a2_101" = "724090767"
"a2_102" = "731243032"
"a2_103" = "738426321"
"a2_104" = "745594295"
"a2_105" = "752762496"
"a2_106" = "759925031"
"a2_107" = "767088620"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "2984785283"
"a1_589" = "799187555"
"a1_588" = "3257943922"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "3821888672"
"a1_748" = "3554882362"
"a2_28" = "200731867"
"a2_29" = "207896842"
"a2_26" = "186396285"
"a2_27" = "193574449"
"a2_24" = "172064370"
"a2_25" = "179229266"
"a2_22" = "157712823"
"a2_23" = "164898288"
"a2_20" = "143378610"
"a2_21" = "150546194"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139223814"
"a2_7" = "50177612"
"a2_6" = "43009130"
"a2_5" = "35842095"
"a2_4" = "28674283"
"a2_3" = "21499542"
"a2_2" = "14341287"
"a2_1" = "7175664"
"a2_0" = "9832"
"a1_639" = "2938856306"
"a1_638" = "3668350571"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64529059"
"a2_8" = "57358571"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124889641"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "3904613709"
"a1_533" = "1131717284"
"a4_845" = "1762939949"
"a2_853" = "1820289931"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 5F B3 C7 ED B3 D7 1C 95 04 3A 42 7D F5 F8 91"
[HKCU\Software\Aas]
"a1_968" = "1940588177"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "3742229737"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "2998587523"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "570763622"
"a2_911" = "2236096735"
"a1_957" = "3649767883"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"
[HKCU\Software\Aas\695404737]
"43014726" = "0C00687474703A2F2F7777772E6C656479617A696C696D2E636F6D2F6C6F676F2E67696600687474703A2F2F6B73616E64726166617368696F6E2E636F6D2F6C6F676F2E67696600687474703A2F2F7777772E6C6166796572692E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B756C7070617375722E636F6D2F6C6F676F2E67696600687474703A2F2F746F616C6C616465706170656C2E636F6D2E61722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E65636F6C652D7361696E742D73696D6F6E2E6E65742F696E6465785F746F702F6C6F676F2E67696600687474703A2F2F6C617A617265612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6B6F6F6E6164616E6365322E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B75706C752E62656C2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E6C69646572616E636173706F6C6974696361732E636F6D2E62722F6C6F676F2E67696600687474703A2F2F7777772E6C6567616C62696C676973617961722E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F6C696665636F6D32342E636F2E63632F696D616765732F6C6F676F2E676966"
[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014704782"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "2228941812"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"
"a3_130" = "915379051"
"a1_923" = "3858630382"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013860779"
"a1_107" = "577636562"
"a1_106" = "408349559"
"a1_105" = "497813392"
"a1_104" = "385062111"
"a1_103" = "1030908504"
"a1_102" = "344299656"
"a1_101" = "652637201"
"a1_100" = "2332540586"
"a3_134" = "943841519"
"a1_109" = "3413151764"
"a1_62" = "3261053225"
"a1_61" = "1763022916"
"a3_137" = "998890944"
"a2_883" = "2035363220"
"a3_686" = "606179783"
"a2_489" = "3505694598"
"a2_488" = "3498539087"
"a3_687" = "613616230"
"a2_485" = "3477028852"
"a2_484" = "3469858977"
"a2_487" = "3491357535"
"a2_486" = "3484192257"
"a2_481" = "3448341521"
"a2_480" = "3441174692"
"a2_483" = "3462692028"
"a2_482" = "3455509126"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028194444"
"a3_976" = "2685262841"
"a2_809" = "1504848004"
"a2_808" = "1497681420"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447496890"
"a2_800" = "1440332475"
"a2_803" = "1461830121"
"a3_681" = "570649632"
"a2_805" = "1476166870"
"a2_804" = "1469013500"
"a2_807" = "1490515279"
"a2_806" = "1483349087"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049709138"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443823981"
"a2_660" = "436655903"
"a2_663" = "458157880"
"a3_146" = "1063277947"
"a2_665" = "472490222"
"a2_664" = "465323712"
"a2_667" = "486839632"
"a2_666" = "479673666"
"a2_669" = "501173322"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021027726"
"a3_143" = "1008236550"
"a2_249" = "1785117094"
"a2_248" = "1777935879"
"a2_247" = "1770768000"
"a2_246" = "1763598428"
"a2_245" = "1756432882"
"a2_244" = "1749258069"
"a2_243" = "1742098472"
"a2_242" = "1734934187"
"a2_241" = "1727753592"
"a2_240" = "1720584567"
"a1_356" = "111977656"
"a1_357" = "1791789066"
"a1_354" = "3564549487"
"a1_355" = "2410872020"
"a1_352" = "3410868541"
"a1_353" = "4041076624"
"a1_350" = "652452032"
"a1_351" = "330989504"
"a2_855" = "1834623878"
"a3_639" = "269411382"
"a1_358" = "1534386425"
"a1_359" = "3666769498"
"a3_638" = "295912343"
"a2_887" = "2064044724"
"a2_886" = "2056879195"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583716740"
"a2_119" = "853127784"
"a2_118" = "845962713"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810111283"
"a2_112" = "802944533"
"a2_111" = "795778902"
"a2_110" = "788609977"
"a2_117" = "838792671"
"a2_116" = "831610430"
"a2_115" = "824445232"
"a2_114" = "817278271"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533534088"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422983858"
"a2_58" = "415801509"
"a2_53" = "379971924"
"a2_52" = "372785301"
"a2_51" = "365619950"
"a2_50" = "358464275"
"a2_57" = "408635284"
"a2_56" = "401469127"
"a2_55" = "394298813"
"a2_54" = "387133857"
"a4_842" = "1741432586"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "1093087317"
"a1_645" = "1567660600"
"a1_646" = "1131742360"
"a1_647" = "3831750526"
"a1_640" = "2662632252"
"a1_641" = "2745685192"
"a1_642" = "2792153848"
"a1_643" = "778153981"
"a1_648" = "617425461"
"a1_649" = "3471301011"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\Aas]
"a2_953" = "2537207526"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "1214683106"
"a1_829" = "3836287655"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "1366552965"
"a1_916" = "45834410"
"a1_917" = "3594325705"
"a1_910" = "1271179105"
"a1_911" = "3405377425"
"a1_912" = "2575486671"
"a1_913" = "4245858990"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "3219476119"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "2116737012"
"a1_139" = "296770544"
"a3_907" = "2190592386"
"a1_132" = "402043737"
"a1_133" = "3243930029"
"a1_130" = "1691845399"
"a1_131" = "1352307411"
"a1_136" = "728734675"
"a1_137" = "1604020131"
"a1_134" = "1921171096"
"a1_135" = "2149190256"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369489357"
"a2_471" = "3376659656"
"a2_472" = "3383823455"
"a2_473" = "3390988758"
"a2_474" = "3398159852"
"a2_475" = "3405327042"
"a2_476" = "3412507019"
"a2_477" = "3419674038"
"a2_478" = "3426842231"
"a2_479" = "3434006789"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "2828656819"
"a2_878" = "1999529129"
"a2_879" = "2006695045"
"a2_874" = "1970842381"
"a2_875" = "1978011031"
"a2_876" = "1985178843"
"a2_877" = "1992357994"
"a2_870" = "1942173329"
"a2_871" = "1949342470"
"a2_872" = "1956508127"
"a2_873" = "1963677166"
"a1_349" = "3096374626"
"a1_348" = "2202360965"
"a2_586" = "4201111250"
"a2_587" = "4208277157"
"a2_580" = "4158091834"
"a2_581" = "4165258304"
"a2_582" = "4172420305"
"a2_583" = "4179606686"
"a1_341" = "2658432846"
"a1_340" = "3055888793"
"a1_343" = "1458066094"
"a1_342" = "13385679"
"a1_345" = "3781032167"
"a1_344" = "3057534208"
"a1_347" = "2242140199"
"a1_346" = "2911447375"
"a2_614" = "106879422"
"a2_615" = "114040784"
"a2_616" = "121214191"
"a2_617" = "128381642"
"a2_610" = "78187941"
"a2_611" = "85364179"
"a2_612" = "92529199"
"a2_613" = "99698072"
"a2_618" = "135547349"
"a2_619" = "142716220"
"a2_272" = "1950005694"
"a2_273" = "1957172972"
"a2_270" = "1935635479"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a2_276" = "1978672446"
"a2_277" = "1985840457"
"a2_274" = "1964339777"
"a2_275" = "1971516564"
"a2_908" = "2214596747"
"a2_909" = "2221764966"
"a2_278" = "1993021089"
"a2_279" = "2000189679"
"a1_842" = "2134182995"
"a2_298" = "2136407328"
"a2_299" = "2143561457"
"a1_841" = "4270778465"
"a2_290" = "2079040329"
"a2_291" = "2086208328"
"a2_292" = "2093376859"
"a2_293" = "2100557218"
"a2_294" = "2107726658"
"a2_295" = "2114892164"
"a2_296" = "2122068335"
"a2_297" = "2129225218"
"a2_728" = "924150668"
"a2_729" = "931316194"
"a2_720" = "866798439"
"a2_721" = "873961443"
"a2_722" = "881135556"
"a2_723" = "888299353"
"a2_724" = "895482553"
"a2_725" = "902650576"
"a2_726" = "909819457"
"a2_727" = "916984541"
"a1_594" = "2962546765"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917644599"
"a2_129" = "924814083"
"a2_126" = "903311841"
"a2_127" = "910486624"
"a2_124" = "888963197"
"a2_125" = "896147610"
"a2_122" = "874627581"
"a2_123" = "881795508"
"a2_120" = "860296215"
"a2_121" = "867462158"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612386156"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "351444949"
"a1_13" = "177990713"
"a1_10" = "1338952632"
"a1_11" = "2258274199"
"a1_16" = "247327660"
"a1_17" = "2386287148"
"a1_14" = "2653007090"
"a1_15" = "452903419"
"a1_18" = "965297169"
"a1_19" = "1852180334"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563574"
"a2_48" = "344115986"
"a2_49" = "351284806"
"a1_846" = "279463127"
"a2_40" = "286756645"
"a2_41" = "293931691"
"a2_42" = "301100364"
"a2_43" = "308267916"
"a2_44" = "315450323"
"a2_45" = "322613316"
"a2_46" = "329782196"
"a2_47" = "336952300"
"a2_897" = "2135730762"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "4161455030"
"a1_656" = "349926958"
"a1_655" = "732503787"
"a1_632" = "1892339131"
"a1_653" = "231301029"
"a1_652" = "2791665749"
"a1_651" = "1625433590"
"a1_650" = "217956100"
"a3_796" = "1428649909"
"a1_659" = "1710273033"
"a1_658" = "3463082496"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233088371"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Aas]
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "601488308"
"a1_838" = "3476781803"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "913910514"
"a1_906" = "919629848"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "310857552"
"a1_902" = "799439992"
"a1_901" = "769431769"
"a1_900" = "3559222621"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "353316391"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "2788998215"
"a2_644" = "321952371"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "2813082322"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "701632196"
"a1_879" = "2164885590"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "2669140396"
"a1_128" = "558719437"
"a1_125" = "1845966337"
"a1_124" = "3424960165"
"a1_127" = "2031739206"
"a1_126" = "1107576551"
"a1_121" = "3822762599"
"a1_120" = "3751648941"
"a1_123" = "2784080621"
"a1_122" = "229157999"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "3505732450"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "2171432715"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "718167142"
"a4_793" = "1390145657"
"a1_836" = "962062749"
"a1_835" = "2552647482"
"a1_754" = "1520461836"
"a4_993" = "2823969857"
"a1_834" = "2510648927"
"a1_634" = "3121564040"
"a2_463" = "3319306185"
"a2_462" = "3312139582"
"a2_461" = "3304971151"
"a2_460" = "3297803047"
"a2_467" = "3347972645"
"a2_466" = "3340807093"
"a2_465" = "3333639350"
"a2_464" = "3326473907"
"a2_469" = "3362320510"
"a2_468" = "3355153517"
"a1_934" = "451788477"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934991713"
"a2_868" = "1927827431"
"a2_867" = "1920658932"
"a2_866" = "1913489664"
"a2_865" = "1906325125"
"a2_864" = "1899160753"
"a2_863" = "1891989770"
"a1_791" = "2012304874"
"a2_861" = "1877640609"
"a2_860" = "1870502251"
"a2_597" = "4279960027"
"a2_596" = "4272794618"
"a2_595" = "4265627892"
"a2_594" = "4258459658"
"a1_338" = "3759481927"
"a1_339" = "3541223978"
"a2_591" = "4236942036"
"a2_590" = "4229775493"
"a1_334" = "1569885403"
"a1_335" = "141900449"
"a1_336" = "1339527812"
"a1_337" = "418009576"
"a1_330" = "2547796549"
"a1_331" = "3153623094"
"a1_332" = "1789842558"
"a1_333" = "2199069299"
"a2_607" = "56695958"
"a2_606" = "49512500"
"a3_30" = "231909751"
"a2_604" = "35180235"
"a1_64" = "3503099673"
"a2_602" = "20845005"
"a2_601" = "13676559"
"a2_600" = "6511851"
"a4_875" = "1978013579"
"a2_609" = "71029942"
"a2_608" = "63862927"
"a2_265" = "1899822414"
"a2_264" = "1892654516"
"a2_267" = "1914153396"
"a2_266" = "1906989313"
"a2_261" = "1871138538"
"a2_260" = "1863970362"
"a2_263" = "1885471856"
"a2_262" = "1878304401"
"a2_919" = "2293464595"
"a1_908" = "2416016213"
"a2_269" = "1928485334"
"a2_268" = "1921322158"
"a1_905" = "3407188823"
"a2_884" = "2042530251"
"a1_482" = "3625245468"
"a1_483" = "1235620940"
"a2_289" = "2071874343"
"a2_288" = "2064707617"
"a1_486" = "3446860107"
"a1_487" = "3477905105"
"a1_484" = "1126752189"
"a1_485" = "361058200"
"a2_283" = "2028855629"
"a2_282" = "2021690281"
"a2_281" = "2014524891"
"a2_280" = "2007358959"
"a2_287" = "2057543560"
"a2_286" = "2050374312"
"a2_285" = "2043194638"
"a2_284" = "2036024752"
"a2_739" = "1003019636"
"a2_738" = "995836335"
"a3_522" = "3725445091"
"a2_733" = "960002029"
"a2_732" = "952835822"
"a2_731" = "945666964"
"a2_730" = "938484781"
"a2_737" = "988668820"
"a2_736" = "981500810"
"a2_735" = "974332978"
"a2_734" = "967168890"
"a4_446" = "3197427966"
"a1_637" = "1802939650"
"a3_912" = "2226582457"
"a1_240" = "538183721"
"a1_241" = "535438081"
"a1_242" = "781726208"
"a1_243" = "2705537871"
"a1_244" = "481031119"
"a1_245" = "2172803"
"a1_246" = "1879759225"
"a1_247" = "172601048"
"a1_248" = "3283820449"
"a1_249" = "1266214033"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939149980"
"a2_130" = "931980520"
"a2_133" = "953495870"
"a2_132" = "946330251"
"a2_135" = "967831666"
"a2_134" = "960667402"
"a2_137" = "982167194"
"a2_136" = "974999055"
"a2_139" = "996513844"
"a2_138" = "989331994"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566355292"
"a2_78" = "559186818"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "1883492804"
"a1_583" = "3377140260"
"a1_794" = "2864123540"
"a1_795" = "3271755626"
"a1_792" = "1686148315"
"a1_793" = "1854951675"
"a1_790" = "631661371"
"a1_582" = "3585678303"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "938148838"
"a1_798" = "501484325"
"a1_799" = "1906035459"
"a1_580" = "3618772088"
"a3_198" = "1436076335"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737932258"
"a1_585" = "4034763204"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "1165441081"
"a1_469" = "1051674633"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "2009297685"
"a1_461" = "1530280689"
"a1_462" = "152853466"
"a1_463" = "1416143670"
"a1_464" = "4112989186"
"a1_465" = "1818440120"
"a1_466" = "823068364"
"a1_467" = "3973332650"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "3938578910"
"a1_669" = "1515976911"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a3_996" = "2828657485"
"a2_830" = "1655400479"
"a3_994" = "2847713931"
"a3_995" = "2821607210"
"a3_992" = "2800197065"
"a3_499" = "3560555322"
"a3_990" = "2785625399"
"a2_831" = "1662569987"
"a3_498" = "3587059355"
"a2_832" = "1669736327"
"a3_998" = "2876651535"
"a3_497" = "3579611768"
"a2_833" = "1676904058"
"a3_496" = "3539014105"
"a2_834" = "1684086688"
"a3_495" = "3532029350"
"a2_835" = "1691240702"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698419993"
"a3_493" = "3551077604"
"a2_837" = "1705579252"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a1_837" = "500591486"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a2_529" = "3792466774"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "1804398109"
"a1_807" = "2659194506"
"a1_804" = "3607955963"
"a1_805" = "2457214663"
"a1_802" = "1721991990"
"a1_803" = "1834152730"
"a1_800" = "2430683746"
"a1_808" = "706274686"
"a1_809" = "4248500210"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "2903316899"
"a1_939" = "1891085943"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407970123"
"a1_875" = "1912355282"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "2604749666"
"a4_989" = "2795293373"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "2218574968"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269122405"
"a2_457" = "3276286556"
"a2_454" = "3254785425"
"a3_380" = "2741212629"
"a2_452" = "3240437705"
"a2_453" = "3247607295"
"a2_450" = "3226103189"
"a2_451" = "3233271040"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283464256"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "3781557078"
"a2_852" = "1813120027"
"a1_730" = "3909180628"
"a2_850" = "1798789113"
"a2_851" = "1805946100"
"a2_856" = "1841806983"
"a2_857" = "1848974769"
"a2_854" = "1827455435"
"a1_731" = "1089262758"
"a3_632" = "252486993"
"a2_858" = "1856141441"
"a2_859" = "1863305573"
"a1_732" = "2058170117"
"a2_714" = "823783222"
"a1_733" = "795468260"
"a1_329" = "1867465444"
"a1_328" = "2171255569"
"a1_327" = "682138203"
"a1_326" = "1317095244"
"a1_325" = "752397293"
"a1_324" = "1880501626"
"a1_323" = "1468032024"
"a1_322" = "2559861443"
"a1_321" = "3349710332"
"a1_320" = "2774807294"
"a2_650" = "364956045"
"a1_436" = "2905783946"
"a1_736" = "2653548215"
"a3_631" = "211878206"
"a1_737" = "1274839283"
"a2_652" = "379290310"
"a3_923" = "2339079058"
"a2_926" = "2343646313"
"a2_927" = "2350802360"
"a2_924" = "2329308118"
"a2_653" = "386471818"
"a4_887" = "2064043031"
"a2_923" = "2322137004"
"a2_920" = "2300616521"
"a2_921" = "2307785696"
"a2_654" = "393639816"
"a2_928" = "2357969148"
"a2_655" = "400804672"
"a3_630" = "204893343"
"a2_657" = "415152442"
"a3_922" = "2298015603"
"a1_495" = "1894527937"
"a1_494" = "1511840625"
"a1_497" = "4023412254"
"a1_496" = "2918264492"
"a1_491" = "44608594"
"a1_490" = "2759489525"
"a1_493" = "445862275"
"a1_492" = "3358286806"
"a1_499" = "3620570304"
"a1_498" = "2732886751"
"a3_637" = "288468852"
"a2_708" = "780766207"
"a2_709" = "787948066"
"a2_706" = "766429962"
"a2_707" = "773598521"
"a2_704" = "752095657"
"a2_705" = "759265018"
"a2_702" = "737762505"
"a2_703" = "744931299"
"a2_700" = "723411475"
"a2_701" = "730581905"
"a4_885" = "2049704789"
"a2_638" = "278935358"
"a2_639" = "286102720"
"a3_808" = "1481095169"
"a2_632" = "235925391"
"a2_633" = "243085244"
"a2_630" = "221582129"
"a2_631" = "228752927"
"a2_636" = "264600875"
"a2_637" = "271769412"
"a2_634" = "250249496"
"a2_635" = "257415505"
"a1_253" = "2375792787"
"a1_252" = "1502408884"
"a1_251" = "3285472341"
"a1_250" = "3013743492"
"a1_257" = "217911763"
"a1_256" = "2815230286"
"a1_255" = "2026018761"
"a1_254" = "4053266033"
"a3_920" = "2284050097"
"a1_259" = "3800077727"
"a1_258" = "3481566895"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032349713"
"a2_145" = "1039531835"
"a2_146" = "1046684325"
"a2_147" = "1053867593"
"a2_140" = "1003681931"
"a2_141" = "1010851385"
"a2_142" = "1018018465"
"a2_143" = "1025181711"
"a1_781" = "1028015291"
"a1_780" = "3065490526"
"a2_68" = "487504911"
"a2_69" = "494672134"
"a2_148" = "1061033406"
"a2_149" = "1068200123"
"a1_787" = "2437283685"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a2_987" = "2780961637"
"a1_904" = "2297022421"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "3062314790"
"a1_478" = "1245731888"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "1592546157"
"a1_472" = "979749148"
"a1_471" = "648587526"
"a1_470" = "3731513311"
"a1_477" = "911455719"
"a1_476" = "1811710981"
"a1_475" = "424168870"
"a1_474" = "3115775826"
"a4_533" = "3821141493"
"a1_679" = "872549912"
"a1_678" = "462459835"
"a4_532" = "3813972372"
"a1_675" = "1446665364"
"a1_674" = "2984812859"
"a1_677" = "2451204059"
"a1_676" = "1700882547"
"a1_671" = "3347265156"
"a4_531" = "3806803251"
"a1_673" = "344739517"
"a1_672" = "1111653398"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a3_989" = "2812256404"
"a1_868" = "2127982794"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_985" = "2783204112"
"a3_984" = "2776284913"
"a3_987" = "2764139474"
"a3_986" = "2757228467"
"a2_151" = "1082532504"
"a2_150" = "1075366593"
"a1_869" = "4132386314"
"a2_271" = "1942838935"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "1219465693"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139885072"
"a4_758" = "1139226422"
"a2_158" = "1132718985"
"a1_925" = "945354039"
"a1_924" = "234603204"
"a1_927" = "1119639910"
"a1_926" = "2670484575"
"a1_921" = "3177466031"
"a1_920" = "865638122"
"a3_787" = "1363737626"
"a1_922" = "2018606103"
"a3_80" = "590099577"
"a1_929" = "250166348"
"a1_928" = "3235291389"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "140295180"
"a1_818" = "4141270951"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "3278128678"
"a1_810" = "2457434029"
"a1_813" = "3596122750"
"a1_812" = "2205060600"
"a1_815" = "3557483155"
"a1_814" = "3568845873"
"a1_817" = "2532031740"
"a1_816" = "327729774"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454657539"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"
"a1_994" = "4107418620"
[HKCU\Software\Aas\695404737]
"50183847" = "83AD022F944CCF21DDECD41871254667172BA39F3E949513F4CC29B07060AC534912E5BCB155880C2C4326E6FB83E6FA099D4219F6885291D527824C5507229614A07CE2AF035D97263FF7F26AD2ACC9D5D4395D4B8B3109DC5C0C87B31A1505E6E94E08EF20E71B91B96D3856F531DADFD78A894AD6A6C177136C5657B01661"
[HKCU\Software\Aas]
"a2_845" = "1762948293"
"a2_844" = "1755773091"
"a2_847" = "1777285413"
"a2_846" = "1770101103"
"a2_841" = "1734268413"
"a2_840" = "1727088495"
"a2_843" = "1748604751"
"a2_842" = "1741423625"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791621378"
"a2_848" = "1784455222"
"a1_312" = "2772333409"
"a1_313" = "4052736983"
"a1_310" = "3568413384"
"a1_311" = "3445865502"
"a1_316" = "2545390821"
"a1_317" = "3420732736"
"a1_314" = "3481050287"
"a1_315" = "4164172342"
"a3_620" = "166490309"
"a1_318" = "213867281"
"a1_319" = "828587142"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218936479"
"a2_448" = "3211771726"
"a3_621" = "140449124"
"a2_441" = "3161584588"
"a2_440" = "3154418475"
"a2_443" = "3175916572"
"a2_442" = "3168752832"
"a2_445" = "3190254071"
"a2_444" = "3183086934"
"a2_447" = "3204600594"
"a2_446" = "3197433271"
"a2_939" = "2436837787"
"a2_938" = "2429672448"
"a4_893" = "2107057757"
"a2_931" = "2379487138"
"a2_930" = "2372318233"
"a2_933" = "2393819653"
"a2_932" = "2386651507"
"a2_935" = "2408153699"
"a2_934" = "2400983745"
"a2_937" = "2422501607"
"a2_936" = "2415336307"
"a3_818" = "1552537563"
"a2_711" = "802286103"
"a2_710" = "795114526"
"a2_713" = "816613790"
"a2_712" = "809449370"
"a2_715" = "830949142"
"a1_510" = "2682234995"
"a2_717" = "845298667"
"a2_716" = "838118139"
"a2_719" = "859633624"
"a2_718" = "852464816"
"a1_587" = "2775677404"
"a3_623" = "187965990"
"a2_629" = "214416676"
"a2_628" = "207234221"
"a2_625" = "185732754"
"a2_624" = "178566391"
"a2_627" = "200068172"
"a2_626" = "192900329"
"a2_621" = "157048218"
"a2_620" = "149894843"
"a2_623" = "171403832"
"a2_622" = "164233085"
"a1_266" = "2504622070"
"a1_267" = "711171698"
"a1_264" = "2104802149"
"a1_265" = "1179617575"
"a1_262" = "3661753875"
"a1_263" = "1452687862"
"a1_260" = "2906916861"
"a1_261" = "3473349048"
"a1_268" = "581067217"
"a1_269" = "370434385"
"a2_157" = "1125553830"
"a2_156" = "1118387472"
"a2_155" = "1111222069"
"a2_154" = "1104050669"
"a2_153" = "1096870799"
"a2_152" = "1089701056"
"a2_99" = "709740198"
"a2_98" = "702575604"
"a2_97" = "695410606"
"a2_96" = "688228173"
"a2_95" = "681059604"
"a2_94" = "673893769"
"a2_93" = "666724918"
"a2_92" = "659557613"
"a2_91" = "652391812"
"a2_90" = "645225889"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "3712105965"
"a1_847" = "3921056950"
"a3_404" = "2913010493"
"a1_844" = "3012250246"
"a3_405" = "2886510428"
"a1_845" = "3203808624"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a2_862" = "1884807712"
"a4_983" = "2752278647"
"a1_961" = "620801435"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "2738642158"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "1639779440"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "2764074527"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a1_448" = "3149176222"
"a1_449" = "694106493"
"a1_446" = "1256623679"
"a3_408" = "2941554865"
"a1_444" = "847795299"
"a1_445" = "1644626635"
"a1_442" = "1199212228"
"a1_443" = "1609581189"
"a1_440" = "3644430838"
"a3_409" = "2949002448"
"a1_680" = "1752724337"
"a1_681" = "1984738747"
"a1_682" = "4058099156"
"a1_683" = "1697988886"
"a2_561" = "4021870762"
"a1_685" = "3744550364"
"a1_686" = "3690420688"
"a1_687" = "1892949785"
"a1_688" = "4048806889"
"a1_689" = "4209728941"
"a3_834" = "1700949547"
"a3_988" = "2804681845"
"a1_767" = "1019670482"
"a1_766" = "1874065999"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294296746"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "2463520417"
"a2_605" = "42345306"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "2770107789"
"a2_603" = "28010012"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "586036752"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "1193034032"
"a1_441" = "2474588999"
"a4_964" = "2616065348"
"a1_744" = "3079031329"
"a4_988" = "2788124252"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250432603"
"a1_747" = "498816598"
"a2_912" = "2243279549"
"a3_997" = "2869200876"
"a2_651" = "372135532"
"a2_910" = "2228932457"
"a3_794" = "1380597491"
[HKCU\Software\Aas\695404737]
"35845605" = "476"
[HKCU\Software\Aas]
"a2_917" = "2279118399"
"a4_883" = "2035366547"
"a2_509" = "3649079584"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "4261363102"
"a1_867" = "817084892"
"a1_860" = "380497518"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Aas]
"a1_862" = "1341421504"
"a4_859" = "1863307643"
"a4_182" = "1304780022"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "2190705296"
"a2_918" = "2286284786"
"a4_168" = "1204412328"
"a1_194" = "2585017051"
"a1_195" = "583073464"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287129599"
"a1_192" = "3898095229"
"a1_193" = "417987692"
"a1_969" = "915781748"
"a4_934" = "2400991718"
"a3_993" = "2840671848"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "231799195"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a3_505" = "3603458416"
"a1_305" = "2752577276"
"a1_304" = "128216159"
"a1_307" = "414324740"
"a1_306" = "1009807529"
"a1_301" = "45720263"
"a1_300" = "561575268"
"a1_303" = "1288220545"
"a1_302" = "3716566959"
"a3_792" = "1399711281"
"a1_309" = "3278117720"
"a1_308" = "3010456557"
"a2_540" = "3871318517"
"a2_541" = "3878502358"
"a2_542" = "3885668524"
"a1_481" = "1286787465"
"a2_544" = "3900010029"
"a2_545" = "3907168910"
"a2_546" = "3914347823"
"a2_547" = "3921505980"
"a2_548" = "3928670777"
"a2_549" = "3935853695"
"a2_894" = "2114230355"
"a2_895" = "2121387682"
"a2_892" = "2099893366"
"a2_893" = "2107064189"
"a2_890" = "2085505199"
"a2_891" = "2092713793"
"a2_438" = "3140067411"
"a2_439" = "3147251353"
"a2_434" = "3111391157"
"a2_435" = "3118564957"
"a2_436" = "3125733815"
"a2_437" = "3132900510"
"a2_430" = "3082731300"
"a2_431" = "3089885296"
"a2_432" = "3097067034"
"a2_433" = "3104235042"
"a4_986" = "2773786010"
"a2_948" = "2501353793"
"a2_949" = "2508522210"
"a4_908" = "2214594572"
"a2_944" = "2472688151"
"a2_945" = "2479861723"
"a2_946" = "2487022639"
"a2_947" = "2494187288"
"a2_940" = "2444014331"
"a1_488" = "2109787994"
"a2_942" = "2458339603"
"a2_943" = "2465519855"
"a1_279" = "2152639706"
"a1_278" = "811084651"
"a1_489" = "1873282324"
"a1_271" = "4036628477"
"a1_270" = "1133177952"
"a1_273" = "550024370"
"a1_272" = "3977892681"
"a1_275" = "1331465722"
"a1_274" = "3584407690"
"a1_277" = "366164284"
"a1_276" = "3368726989"
"a2_764" = "1182249724"
"a2_765" = "1189407922"
"a2_766" = "1196587571"
"a2_767" = "1203743164"
"a2_760" = "1153557152"
"a2_761" = "1160739047"
"a2_762" = "1167905511"
"a2_763" = "1175067380"
"a2_768" = "1210924913"
"a2_769" = "1218092710"
"a2_382" = "2738609137"
"a2_383" = "2745775320"
"a2_380" = "2724260160"
"a2_381" = "2731441370"
"a2_386" = "2767277285"
"a2_387" = "2774442031"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Aas]
"a2_385" = "2760110017"
"a2_388" = "2781624363"
"a2_389" = "2788796264"
"a1_613" = "593639187"
"a1_612" = "248466172"
"a1_611" = "1678703165"
"a2_368" = "2638238381"
"a2_369" = "2645408347"
"a1_610" = "2379406998"
"a2_88" = "630888821"
"a2_89" = "638057889"
"a2_84" = "602207826"
"a2_85" = "609374147"
"a2_86" = "616538443"
"a2_87" = "623708490"
"a2_80" = "573523831"
"a2_81" = "580705878"
"a2_82" = "587873963"
"a2_83" = "595041319"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161406031"
"a2_163" = "1168572042"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190070733"
"a2_167" = "1197234972"
"a2_164" = "1175738279"
"a2_165" = "1182902762"
"a3_690" = "668723035"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "1296564227"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "1925136589"
"a1_450" = "424849657"
"a1_453" = "2503234813"
"a1_452" = "3824226074"
"a1_455" = "2091855160"
"a1_454" = "1017996997"
"a1_457" = "333532052"
"a1_456" = "2402970778"
"a1_459" = "61999541"
"a1_458" = "1424807903"
"a1_693" = "1478070988"
"a1_692" = "3725715050"
"a1_691" = "3699664266"
"a1_690" = "1030550567"
"a1_697" = "3912477248"
"a1_696" = "2074373350"
"a1_695" = "3763789836"
"a1_694" = "2564814660"
"a1_699" = "2759063463"
"a1_698" = "3560631730"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "752180692"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "1206737469"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "396907274"
"a4_387" = "2774449827"
"a1_940" = "678487665"
"a1_752" = "2747704501"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537687982"
"a2_74" = "530518810"
"a1_763" = "3539726757"
"a2_77" = "552020084"
"a2_76" = "544855534"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Aas]
"a2_71" = "509004814"
"a2_70" = "501830599"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523339926"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "734505881"
"a1_876" = "2344605264"
"a4_759" = "1146395543"
"a2_72" = "516169970"
"a1_873" = "2258657470"
"a1_872" = "471304742"
"a1_871" = "2021537823"
"a1_870" = "1180128251"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "577155875"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_985" = "2766616889"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "1591692729"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "3384696190"
"a1_437" = "3259140694"
"a3_960" = "2604335593"
"a2_553" = "3964521122"
"a2_552" = "3957352864"
"a2_551" = "3950188203"
"a2_550" = "3943018941"
"a2_557" = "3993205025"
"a2_556" = "3986037079"
"a2_555" = "3978869403"
"a2_554" = "3971686669"
"a2_889" = "2078380025"
"a2_888" = "2071210511"
"a2_559" = "4007529452"
"a2_558" = "4000371276"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075549991"
"a2_428" = "3068383003"
"a2_427" = "3061206085"
"a2_426" = "3054050837"
"a2_425" = "3046879331"
"a2_424" = "3039715622"
"a2_423" = "3032546320"
"a2_422" = "3025366673"
"a2_421" = "3018207838"
"a2_420" = "3011032863"
"a1_758" = "2407306656"
"a2_565" = "4050554890"
"a4_984" = "2759447768"
"a2_959" = "2580222612"
"a2_958" = "2573054993"
"a2_957" = "2565876166"
"a2_956" = "2558707289"
"a2_955" = "2551535072"
"a2_954" = "2544373397"
"a1_785" = "319321636"
"a2_952" = "2530038605"
"a2_951" = "2522870672"
"a2_950" = "2515691116"
"a1_208" = "1192291998"
"a1_209" = "3236478844"
"a1_204" = "2888732177"
"a1_205" = "1699258851"
"a1_206" = "62420819"
"a1_207" = "2661892820"
"a1_200" = "3342661522"
"a1_201" = "1270912868"
"a1_202" = "2221056322"
"a1_203" = "3812893992"
"a2_777" = "1275444486"
"a2_776" = "1268273327"
"a2_775" = "1261093349"
"a2_774" = "1253925501"
"a2_773" = "1246758223"
"a2_772" = "1239592413"
"a2_771" = "1232423772"
"a2_770" = "1225260141"
"a2_779" = "1289776706"
"a2_778" = "1282616765"
"a2_395" = "2831794644"
"a2_394" = "2824627282"
"a2_397" = "2846142866"
"a2_396" = "2838976823"
"a2_391" = "2803124040"
"a2_390" = "2795959571"
"a2_393" = "2817458386"
"a2_392" = "2810287961"
"a2_399" = "2860477269"
"a2_398" = "2853313253"
"a2_568" = "4072058055"
"a2_569" = "4079223068"
"a2_379" = "2717090333"
"a2_378" = "2709922384"
"a2_373" = "2674089849"
"a2_372" = "2666907407"
"a2_371" = "2659739032"
"a2_370" = "2652570149"
"a2_377" = "2702756566"
"a2_376" = "2695591989"
"a2_375" = "2688422559"
"a2_374" = "2681254745"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283273772"
"a2_178" = "1276107814"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254589673"
"a2_174" = "1247420620"
"a2_177" = "1268926154"
"a2_176" = "1261770807"
"a2_171" = "1225920900"
"a2_170" = "1218753518"
"a2_173" = "1240266106"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKCU\Software\Aas]
"a1_511" = "844975058"
"a1_512" = "1545908317"
"a1_513" = "3215156191"
"a1_514" = "1526195479"
"a1_515" = "3061451167"
"a1_516" = "2519092433"
"a1_517" = "806252383"
"a1_518" = "512749050"
"a1_519" = "1239497458"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "3127125678"
"a3_514" = "3667976427"
"a2_543" = "3892838345"
"a1_424" = "2123788819"
"a1_425" = "2531231312"
"a1_426" = "112733747"
"a1_427" = "3305755541"
"a1_420" = "3973385197"
"a1_421" = "1028619607"
"a1_422" = "1943867573"
"a1_423" = "191475482"
"a3_199" = "1409969486"
"a1_428" = "4165642875"
"a1_429" = "886986435"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623241362"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "3122921966"
"a1_739" = "705709503"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "2482843454"
"a2_915" = "2264780918"
"a1_865" = "1137858683"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_861" = "2509050699"
"a1_863" = "3122312870"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"
"a4_871" = "1949337095"
"a1_995" = "3841013688"
"a1_996" = "366059850"
"a1_997" = "3884418451"
"a1_990" = "331816357"
"a1_991" = "2028466993"
"a1_992" = "340109609"
"a1_993" = "2547715830"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "3781847591"
"a1_849" = "1386273420"
"a1_439" = "2392670350"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450998779"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "2086702687"
"a1_199" = "408438328"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "662917661"
"a4_145" = "1039522545"
"a1_190" = "2258699691"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752275724"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "3772091423"
"a1_663" = "3289658214"
"a3_965" = "2639793036"
"a1_660" = "2781686339"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"
"a1_667" = "1347527906"
"a1_664" = "3782624198"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a1_665" = "2028718262"
"a1_0" = "3299283285"
"a1_1" = "1129195820"
"a1_2" = "3880223299"
"a1_3" = "3391505519"
"a1_4" = "3183246288"
"a1_5" = "775286361"
"a1_6" = "3987227912"
"a1_7" = "504402686"
"a1_8" = "749458246"
"a1_9" = "1552809276"
"a2_566" = "4057714305"
"a2_567" = "4064888027"
"a2_564" = "4043387891"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Aas]
"a2_562" = "4029040043"
"a2_563" = "4036223616"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953679436"
"a2_413" = "2960845794"
"a2_410" = "2939344029"
"a2_411" = "2946510980"
"a2_416" = "2982348743"
"a2_417" = "2989530482"
"a2_414" = "2968014635"
"a2_415" = "2975179012"
"a2_418" = "2996695353"
"a2_419" = "3003866189"
"a2_962" = "2601719477"
"a2_963" = "2608891084"
"a2_960" = "2587391921"
"a2_961" = "2594557326"
"a2_966" = "2630410079"
"a2_967" = "2637577632"
"a2_964" = "2616060483"
"a4_950" = "2515697654"
"a1_631" = "1724424524"
"a2_968" = "2644743955"
"a2_969" = "2651909696"
"a4_564" = "4043384244"
"a1_219" = "2451942823"
"a1_218" = "756273655"
"a1_217" = "3639526533"
"a1_216" = "55975821"
"a1_215" = "3227525056"
"a1_214" = "1941460044"
"a1_213" = "2102471136"
"a1_212" = "1099555944"
"a1_211" = "3378263740"
"a1_210" = "740237789"
"a2_988" = "2788130467"
"a2_989" = "2795301724"
"a4_567" = "4064891607"
"a1_630" = "4006323183"
"a2_980" = "2730776809"
"a4_560" = "4014707760"
"a2_982" = "2745112013"
"a4_956" = "2558712380"
"a2_984" = "2759444850"
"a2_985" = "2766610472"
"a2_986" = "2773780007"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a3_991" = "2792683862"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "3157895302"
"a4_442" = "3168751482"
"a4_441" = "3161582361"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 5acc3d2f4585216f86110466433881df | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080335_Rar\%original file name%.exe |
| c17103ae9072a06da581dec998343fc1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\System.dll |
| e541458cfe66ef95ffbea40eaaa07289 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\inetc.dll |
| c10e04dd4ad4277d5adc951bb331c777 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\nsDialogs.dll |
| dc5ee8a893cac7d6ae141cd91fef59b7 | c:\fvjr.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fxgrbp.exe (741 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\autorun.inf (334 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (432 bytes)
C:\fvjr.exe (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\modern-header.bmp (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getList[1].txt (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3.tmp (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080335_Rar\%original file name%.exe (5441 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\smhello.bmp (6026 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 23628 | 24064 | 4.48399 | ffbbaa7c1ae817c5ec9d4d4ca24064d7 |
| .rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
| .data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
| .ndata | 192512 | 69632 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 262144 | 106496 | 104448 | 5.27644 | 872420d8696f0e33764f126c93f5fccd |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://api.skymonk.net/bundle/getList?admin=1 | 78.140.170.86 |
| hxxp://update.skymonk.net/bundles/sputnik2.exe | 88.85.88.189 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /bundle/getList?admin=1 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: api.skymonk.net
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Sep 2014 11:27:49 GMT
Server: Apache/2.2.22 (Ubuntu)
Content-Length: 86
Connection: close
Content-Type: text/plain;charset=utf8
OK..141,ua,sputnik2.exe,1,HKLM,MailRuSputnik..51,ua,webalta.exe,1,HKCU,Webalta Toolbar..
GET /bundles/sputnik2.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: update.skymonk.net
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 25 Sep 2014 11:27:51 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>....
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1752:
.text
.text
.rdata
.rdata
.data
.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\nsDialogs.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\nsDialogs.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\nsDialogs.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\nsDialogs.dll
ion Data\Skymonk2\config.ini
ion Data\Skymonk2\config.ini
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp
&%cX-
&%cX-
D&%F>*
D&%F>*
21Ü"a
21Ü"a
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sputnik2.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sputnik2.exe
sputnik2.exe
sputnik2.exe
ata\Skymonk2\config.ini
ata\Skymonk2\config.ini
faeafbd3c87ec94bcb346a372.exe
faeafbd3c87ec94bcb346a372.exe
-66780169
-66780169
822739891
822739891
k2.exe
k2.exe
tnik2.exe
tnik2.exe
Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuSputnik
Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuSputnik
c:\%original file name%.exe
c:\%original file name%.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
%original file name%.exe
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
738853948
738853948
1048888
1048888
Nullsoft Install System v2.46
Nullsoft Install System v2.46
SHELL32.DLL
SHELL32.DLL
KERNEL32.DLL
KERNEL32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00080335_Rar\%original file name%.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00080335_Rar\%original file name%.exe
hXXp://VVV.ledyazilim.com/logo.gif
hXXp://VVV.ledyazilim.com/logo.gif
hXXp://ksandrafashion.com/logo.gif
hXXp://ksandrafashion.com/logo.gif
hXXp://VVV.lafyeri.com/images/logo.gif
hXXp://VVV.lafyeri.com/images/logo.gif
hXXp://kulppasur.com/logo.gif
hXXp://kulppasur.com/logo.gif
hXXp://toalladepapel.com.ar/images/logo.gif
hXXp://toalladepapel.com.ar/images/logo.gif
hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif
hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif
hXXp://lazarea.ro/images/logo.gif
hXXp://lazarea.ro/images/logo.gif
hXXp://koonadance2.com/images/logo.gif
hXXp://koonadance2.com/images/logo.gif
hXXp://kuplu.bel.tr/images/logo.gif
hXXp://kuplu.bel.tr/images/logo.gif
hXXp://VVV.liderancaspoliticas.com.br/logo.gif
hXXp://VVV.liderancaspoliticas.com.br/logo.gif
hXXp://VVV.legalbilgisayar.com/img/logo.gif
hXXp://VVV.legalbilgisayar.com/img/logo.gif
hXXp://lifecom24.co.cc/images/logo.gif
hXXp://lifecom24.co.cc/images/logo.gif
bilya.com/logo.gif
bilya.com/logo.gif
hXXp://VVV.jandegelinlik.com/logo.gif
hXXp://VVV.jandegelinlik.com/logo.gif
.info/J
.info/J
home.gifI888
home.gifI888
h.rata
h.rata
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
MSVCRT.dll
MSVCRT.dll
WS2_32.dll
WS2_32.dll
%original file name%.exe_1752_rwx_003F0000_00002000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
.text
.text
Explorer.EXE_1140_rwx_00FF0000_00002000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
.text
.text
%original file name%.exe_1752_rwx_00449000_00011000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00080335_Rar\%original file name%.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00080335_Rar\%original file name%.exe
%original file name%.exe
%original file name%.exe
.rsrc
.rsrc
.text
.text
c:\%original file name%.exe
c:\%original file name%.exe
hXXp://VVV.ledyazilim.com/logo.gif
hXXp://VVV.ledyazilim.com/logo.gif
hXXp://ksandrafashion.com/logo.gif
hXXp://ksandrafashion.com/logo.gif
hXXp://VVV.lafyeri.com/images/logo.gif
hXXp://VVV.lafyeri.com/images/logo.gif
hXXp://kulppasur.com/logo.gif
hXXp://kulppasur.com/logo.gif
hXXp://toalladepapel.com.ar/images/logo.gif
hXXp://toalladepapel.com.ar/images/logo.gif
hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif
hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif
hXXp://lazarea.ro/images/logo.gif
hXXp://lazarea.ro/images/logo.gif
hXXp://koonadance2.com/images/logo.gif
hXXp://koonadance2.com/images/logo.gif
hXXp://kuplu.bel.tr/images/logo.gif
hXXp://kuplu.bel.tr/images/logo.gif
hXXp://VVV.liderancaspoliticas.com.br/logo.gif
hXXp://VVV.liderancaspoliticas.com.br/logo.gif
hXXp://VVV.legalbilgisayar.com/img/logo.gif
hXXp://VVV.legalbilgisayar.com/img/logo.gif
hXXp://lifecom24.co.cc/images/logo.gif
hXXp://lifecom24.co.cc/images/logo.gif
bilya.com/logo.gif
bilya.com/logo.gif
hXXp://VVV.jandegelinlik.com/logo.gif
hXXp://VVV.jandegelinlik.com/logo.gif
.info/J
.info/J
home.gifI888
home.gifI888
KERNEL32.dll
KERNEL32.dll
h.rata
h.rata
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
ADVAPI32.dll
ADVAPI32.dll
MSVCRT.dll
MSVCRT.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
WS2_32.dll
WS2_32.dll
RegCloseKey
RegCloseKey
SHFileOperationA
SHFileOperationA
%original file name%.exe_1752_rwx_00A40000_0108E000:
c:\windows
c:\windows
hXXp://VVV.ledyazilim.com/logo.gif
hXXp://VVV.ledyazilim.com/logo.gif
hXXp://ksandrafashion.com/logo.gif
hXXp://ksandrafashion.com/logo.gif
hXXp://VVV.lafyeri.com/images/logo.gif
hXXp://VVV.lafyeri.com/images/logo.gif
hXXp://kulppasur.com/logo.gif
hXXp://kulppasur.com/logo.gif
hXXp://toalladepapel.com.ar/images/logo.gif
hXXp://toalladepapel.com.ar/images/logo.gif
hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif
hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif
hXXp://lazarea.ro/images/logo.gif
hXXp://lazarea.ro/images/logo.gif
hXXp://koonadance2.com/images/logo.gif
hXXp://koonadance2.com/images/logo.gif
hXXp://kuplu.bel.tr/images/logo.gif
hXXp://kuplu.bel.tr/images/logo.gif
hXXp://VVV.liderancaspoliticas.com.br/logo.gif
hXXp://VVV.liderancaspoliticas.com.br/logo.gif
hXXp://VVV.legalbilgisayar.com/img/logo.gif
hXXp://VVV.legalbilgisayar.com/img/logo.gif
hXXp://lifecom24.co.cc/images/logo.gif
hXXp://lifecom24.co.cc/images/logo.gif
%System%\drivers\kmnrg.sys
%System%\drivers\kmnrg.sys
5245467712
5245467712
.rsrc
.rsrc
.text
.text
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
hXXp://89.119.67.154/testo5/
hXXp://89.119.67.154/testo5/
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet987.info/home.gif
hXXp://kukutrustnet987.info/home.gif
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
h.rdata
h.rdata
H.data
H.data
.reloc
.reloc
ntoskrnl.exe
ntoskrnl.exe
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://kukutrustnet777888.info/
hXXp://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
GdiPlus.dll
hXXp://
hXXp://
ipfltdrv.sys
ipfltdrv.sys
VVV.microsoft.com
VVV.microsoft.com
?%x=%d
?%x=%d
&%x=%d
&%x=%d
SYSTEM.INI
SYSTEM.INI
USER32.DLL
USER32.DLL
.%c%s
.%c%s
\\.\amsint32
\\.\amsint32
NTDLL.DLL
NTDLL.DLL
autorun.inf
autorun.inf
ADVAPI32.DLL
ADVAPI32.DLL
win%s.exe
win%s.exe
%s.exe
%s.exe
WININET.DLL
WININET.DLL
InternetOpenUrlA
InternetOpenUrlA
avast! Web Scanner
avast! Web Scanner
Avira AntiVir Premium WebGuard
Avira AntiVir Premium WebGuard
cmdGuard
cmdGuard
cmdAgent
cmdAgent
Eset HTTP Server
Eset HTTP Server
ProtoPort Firewall service
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
SpIDer FS Monitor for Windows NT
Symantec Password Validation
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootDesktopFirewallDataService
WebrootFirewall
WebrootFirewall
%d%d.tmp
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Explorer.exe
Explorer.exe
A2CMD.
A2CMD.
ASHWEBSV.
ASHWEBSV.
AVGCC.AVGCHSVX.
AVGCC.AVGCHSVX.
DRWEB
DRWEB
DWEBLLIO
DWEBLLIO
DWEBIO
DWEBIO
FSGUIEXE.
FSGUIEXE.
MCVSSHLD.
MCVSSHLD.
NPFMSG.
NPFMSG.
SYMSPORT.
SYMSPORT.
WEBSCANX.
WEBSCANX.
.adata
.adata
M_%d_
M_%d_
%c%d_%d
%c%d_%d
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryA
GetWindowsDirectoryA
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SHFileOperationA
SHFileOperationA
&3&3&3&389
&3&3&3&389
.rdata
.rdata
.data
.data
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
ADVAPI32.dll
ADVAPI32.dll
MSVCRT.dll
MSVCRT.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll
%original file name%.exe_1752_rwx_020D0000_00001000:
|%original file name%.exeM_1752_
|%original file name%.exeM_1752_
%original file name%.exe_1752_rwx_10004000_00001000:
callback%d
callback%d
Explorer.EXE_1140_rwx_01E00000_00001000:
|explorer.exeM_1140_
|explorer.exeM_1140_