Virus.Win32.Sality_a9818b331b

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Virus creates the following process(es):

wmic.exe:1204

The Virus injects its code into the following process(es):

f.exe:1976
%original file name%.exe:1072
Explorer.EXE:1912

Mutexes

The following mutexes were created/opened:

wmiprvse.exeM_2012_%original file name%.exeM_1072_imapi.exeM_1264_vmtoolsd.exeM_460_jqs.exeM_348_spoolsv.exeM_1440_svchost.exeM_1100_svchost.exeM_948_vmacthlp.exeM_920_winlogon.exeM_708_lsass.exeM_764_csrss.exeM_684_smss.exeM_612_services.exeM_752_uxJLpe1m

File activity

The process f.exe:1976 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\DynamicOfferScreen[1].htm (6591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process wmic.exe:1204 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (0 bytes)

The process %original file name%.exe:1072 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\f.exe (149252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (28018 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jyyrbr.exe (741 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (952 bytes)
C:\lyim.pif (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00158602_Rar\%original file name%.exe (7433 bytes)
C:\autorun.inf (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfE.tmp\Convert.dll (3005 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jyyrbr.exe (0 bytes)

Registry activity

The process f.exe:1976 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070320140704]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070320140704]
"CacheOptions" = "11"
"CacheLimit" = "8192"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070320140704]
"CachePrefix" = ":2014070320140704:"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 83 C2 80 59 EA DF 61 63 BF 9F E7 57 02 E4 2D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070320140704]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014070320140704\"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Virus deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040820140409]

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wmic.exe:1204 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 71 0F 61 AE 26 8F 92 6B 54 4E 5E A0 82 13 53"

The process %original file name%.exe:1072 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494852006"
"a2_349" = "2502021055"
"a2_346" = "2480519005"
"a2_347" = "2487686452"
"a2_344" = "2466169215"
"a2_345" = "2473354099"
"a2_342" = "2451834225"
"a2_343" = "2458999824"
"a2_340" = "2437499285"
"a2_341" = "2444665818"
"a2_180" = "1290440475"
"a2_181" = "1297603349"
"a2_182" = "1304773891"
"a2_183" = "1311957488"
"a2_184" = "1319121152"
"a2_185" = "1326295896"
"a2_186" = "1333458912"
"a2_187" = "1340624296"
"a2_188" = "1347786707"
"a2_189" = "1354971312"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074695820"
"a2_742" = "1024517705"
"a2_743" = "1031688132"
"a2_740" = "1010184518"
"a2_741" = "1017355183"
"a2_746" = "1053202935"
"a2_747" = "1060368846"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_745" = "1046020118"
"a1_503" = "4097195660"
"a1_502" = "2700044162"
"a1_501" = "4124138852"
"a1_500" = "2888986415"
"a1_507" = "2507914195"
"a1_506" = "2121948551"
"a1_505" = "2027301958"
"a1_504" = "3279034017"
"a1_509" = "1637368340"
"a1_508" = "4009461556"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "2643293484"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "4029919649"
"a1_434" = "3063305259"
"a1_433" = "3482761804"
"a1_432" = "3267600100"
"a1_431" = "1897757978"
"a1_430" = "3647459664"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a1_636" = "2773634740"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "3553332343"
"a1_728" = "1344957590"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "3734128275"
"a2_748" = "1067536531"
"a1_593" = "2483154089"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_987" = "1768861862"
"a1_986" = "4178503886"
"a1_985" = "3042119015"
"a1_984" = "1756744157"
"a1_983" = "1600393849"
"a1_982" = "2855188056"
"a1_981" = "1719431177"
"a1_980" = "3785197034"
"a1_989" = "361925096"
"a1_988" = "351671297"
"a3_869" = "1918293868"
"a2_744" = "1038854117"
"a1_855" = "2797368762"
"a3_655" = "383827462"
"a1_857" = "499009287"
"a1_856" = "1771319670"
"a1_851" = "2762965290"
"a1_850" = "1645642412"
"a1_853" = "1231635049"
"a3_654" = "376767975"
"a1_859" = "99327268"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "3203634851"
"a1_184" = "3459473389"
"a1_183" = "1851112939"
"a1_182" = "278163631"
"a1_181" = "369871709"
"a1_180" = "77892973"
"a1_963" = "3079820696"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "3179855236"
"a4_824" = "1612388408"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "18055255"
"a4_866" = "1913491490"
"a1_933" = "261064242"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "924276593"
"a4_863" = "1891984127"
"a1_936" = "1476737917"
"a4_862" = "1884815006"
"a1_937" = "1505177784"
"a2_405" = "2903497362"
"a2_404" = "2896326939"
"a2_407" = "2917830562"
"a2_406" = "2910661161"
"a2_401" = "2874809915"
"a2_400" = "2867642406"
"a2_403" = "2889161232"
"a2_402" = "2881993160"
"a1_935" = "1388569096"
"a2_409" = "2932163813"
"a2_408" = "2924996627"
"a2_975" = "2694929280"
"a2_974" = "2687762169"
"a2_977" = "2709272032"
"a2_976" = "2702093543"
"a2_971" = "2666243692"
"a2_970" = "2659074293"
"a2_973" = "2680594258"
"a4_896" = "2128565120"
"a2_979" = "2723595124"
"a2_978" = "2716424961"
"a1_222" = "1473560398"
"a1_223" = "3669294682"
"a1_220" = "990822665"
"a1_221" = "3517043936"
"a1_226" = "979502332"
"a1_227" = "1861313101"
"a1_224" = "3457008073"
"a1_225" = "3312283805"
"a1_228" = "1788915786"
"a1_229" = "3425818750"
"a2_991" = "2809629552"
"a2_990" = "2802464277"
"a2_579" = "4150926415"
"a2_578" = "4143758981"
"a2_571" = "4093574374"
"a2_570" = "4086393203"
"a2_573" = "4107908722"
"a2_572" = "4100743035"
"a2_575" = "4122241085"
"a2_574" = "4115074695"
"a2_577" = "4136577254"
"a2_576" = "4129407194"
"a2_351" = "2516354357"
"a2_350" = "2509185597"
"a2_353" = "2530702246"
"a2_352" = "2523537839"
"a2_355" = "2545034416"
"a2_354" = "2537843829"
"a2_357" = "2559370047"
"a2_356" = "2552203314"
"a2_359" = "2573723136"
"a2_358" = "2566538886"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642034"
"a2_192" = "1376475015"
"a2_191" = "1369308042"
"a2_190" = "1362125786"
"a2_197" = "1412310342"
"a2_196" = "1405142325"
"a2_195" = "1397968937"
"a2_194" = "1390807844"
"a3_624" = "195544665"
"a2_199" = "1426659920"
"a2_198" = "1419492442"
"a3_625" = "168917752"
"a2_759" = "1146391732"
"a3_626" = "175906587"
"a2_755" = "1117722392"
"a2_754" = "1110555618"
"a2_757" = "1132055786"
"a3_627" = "183481274"
"a2_751" = "1089040174"
"a2_750" = "1081870796"
"a2_753" = "1103386228"
"a2_752" = "1096206714"
"a1_536" = "1158708549"
"a1_537" = "3575236297"
"a1_534" = "3414389228"
"a1_535" = "4240626957"
"a1_89" = "4185631603"
"a1_88" = "2320939974"
"a1_530" = "685395084"
"a1_531" = "2562095214"
"a1_85" = "1914307181"
"a1_84" = "1833323842"
"a1_87" = "3215257677"
"a1_86" = "1739259867"
"a1_81" = "2318600134"
"a1_80" = "194496117"
"a1_83" = "3127690814"

"a3_914" = "2274560123"
"a2_898" = "2142910856"
"a1_896" = "1323378383"
"a1_890" = "1430875412"
"a2_899" = "2150079975"
"a1_67" = "2395737299"
"a1_66" = "885213533"
"a1_65" = "3180632002"
"a3_133" = "970345548"
"a1_63" = "2751556783"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "91724664"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "578619976"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "58163580"
"a1_68" = "464174529"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "1158756649"
"a1_409" = "950251916"
"a1_402" = "3662662662"
"a1_403" = "1844680941"
"a1_400" = "1873805758"
"a1_401" = "3621189812"
"a1_406" = "3491757443"
"a1_407" = "3331127977"
"a1_404" = "357859682"
"a1_405" = "2070463164"
"a2_823" = "1605211920"
"a2_822" = "1598051820"
"a2_821" = "1590885850"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633902404"
"a1_628" = "3443695802"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "568183336"
"a2_826" = "1626732669"
"a2_825" = "1619551940"
"a1_718" = "2074795074"
"a1_719" = "1370837297"
"a1_716" = "224106517"
"a1_717" = "9022600"
"a1_714" = "2867012931"
"a1_715" = "1926153045"
"a1_712" = "2640044406"
"a1_713" = "2812085403"
"a1_710" = "44879472"
"a1_711" = "654446642"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "180574876"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
"a3_449" = "3202245640"
"a2_941" = "2451173337"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "3533136181"
"a1_889" = "2318214293"
"a1_886" = "1258520533"
"a1_887" = "3821598345"
"a1_884" = "4260452271"
"a1_885" = "3331622939"
"a1_882" = "3056534158"
"a1_883" = "1041191877"
"a1_880" = "3742603298"
"a1_881" = "1276009096"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251294558"
"a3_444" = "3166269973"
"a3_445" = "3206813364"
"a1_831" = "1824105104"
"a2_592" = "4244126091"
"a1_930" = "3330247890"
"a1_948" = "65933792"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "4159602258"
"a1_723" = "1943426599"
"a1_722" = "3668240987"
"a1_721" = "2905143662"
"a1_720" = "229643787"
"a1_768" = "1411930453"
"a1_727" = "1517649194"
"a1_726" = "1018381152"
"a2_643" = "314771230"
"a2_790" = "1368643166"
"a1_725" = "2111562604"
"a2_642" = "307601453"
"a1_724" = "3087767554"
"a2_641" = "300433574"
"a2_640" = "293262816"
"a2_647" = "343451936"
"a2_646" = "336285765"
"a1_158" = "2147814755"
"a1_159" = "3249204213"
"a2_645" = "329119478"
"a1_150" = "37567491"
"a1_151" = "3840616586"
"a1_152" = "1364947020"
"a1_153" = "3864144855"
"a1_154" = "3052014348"
"a1_155" = "496085653"
"a1_156" = "1407738791"
"a1_157" = "3966897250"
"a1_235" = "892274911"
"a1_234" = "4081182195"
"a1_237" = "4107077051"
"a1_236" = "2938506672"
"a1_231" = "1766288693"
"a1_230" = "2874344575"
"a1_233" = "1217160347"
"a1_232" = "2992357875"
"a1_239" = "731159254"
"a1_238" = "2578900112"
"a2_210" = "1505509809"
"a2_211" = "1512677524"
"a2_212" = "1519859396"
"a2_213" = "1527025928"
"a2_214" = "1534183810"
"a2_215" = "1541369212"
"a2_216" = "1548529143"
"a2_217" = "1555697390"
"a2_218" = "1562861295"
"a2_219" = "1570045398"
"a1_966" = "1644536155"
"a2_508" = "3641911839"
"a2_509" = "3649080667"
"a2_504" = "3613231597"
"a2_505" = "3620410422"
"a2_506" = "3627579756"
"a2_507" = "3634746582"
"a2_500" = "3584563931"
"a2_501" = "3591728899"
"a2_502" = "3598896209"
"a2_503" = "3606061495"
"a2_791" = "1375812192"
"a2_698" = "709071348"
"a2_699" = "716256385"
"a2_694" = "680396428"
"a2_695" = "687577740"
"a2_696" = "694743668"
"a2_697" = "701912790"
"a2_690" = "651728165"
"a2_691" = "658894189"
"a2_692" = "666072345"
"a2_693" = "673226478"
"a2_324" = "2322800102"
"a2_325" = "2329966271"
"a2_326" = "2337142747"
"a2_327" = "2344298619"
"a2_320" = "2294113703"
"a2_321" = "2301280505"
"a2_322" = "2308461554"
"a2_323" = "2315631636"
"a1_521" = "1463436062"
"a1_520" = "2098309957"
"a1_523" = "3461045910"
"a1_522" = "3280395522"
"a2_328" = "2351467430"
"a2_329" = "2358647054"
"a1_527" = "1128613395"
"a1_526" = "1419859866"
"a2_799" = "1433168740"
"a2_798" = "1425997048"
"a4_962" = "2601727106"
"a1_98" = "2733329531"
"a1_99" = "4184060109"
"a1_92" = "1854630631"
"a1_93" = "2114541052"
"a1_90" = "3788298145"
"a1_91" = "4189263371"
"a1_96" = "587428274"
"a1_97" = "2310515372"
"a1_94" = "2366643398"
"a1_95" = "1598388297"
"a1_74" = "357049683"
"a1_75" = "3526815705"
"a1_76" = "619755418"
"a1_77" = "3547137529"
"a1_70" = "638003788"
"a1_71" = "3157237591"
"a1_72" = "2231819788"
"a1_73" = "1682003191"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "3112125143"
"a1_79" = "4101439379"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "3559148109"
"a1_418" = "738884632"
"a3_953" = "2520368944"
"a1_415" = "2987439979"
"a1_414" = "1607969477"
"a1_417" = "2626378044"
"a1_416" = "3047475484"
"a1_411" = "3095537925"
"a1_410" = "982061412"
"a1_413" = "152315684"
"a1_412" = "799722017"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "2385467457"
"a1_700" = "4161374279"
"a1_703" = "1245868259"
"a1_702" = "1078563648"
"a1_705" = "3519721726"
"a1_704" = "2871605581"
"a1_707" = "2239210426"
"a1_706" = "23313994"
"a1_709" = "4258228979"
"a1_708" = "1787286010"
"a2_360" = "2580876101"
"a4_838" = "1712756102"
"a2_361" = "2588055614"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595221433"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609554024"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616737082"
"a2_366" = "2623904275"
"a2_367" = "2631070069"
"a1_743" = "1637599705"
"a2_168" = "1204406001"
"a2_169" = "1211585382"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147053289"
"a4_973" = "2680587437"
"a2_161" = "1154236097"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "191112909"
"a3_776" = "1251683361"
"a1_893" = "1433563393"
"a1_892" = "2021624509"
"a1_895" = "1484956480"
"a1_894" = "2356141686"
"a1_897" = "2536696667"
"a3_777" = "1292288064"
"a1_899" = "928586237"
"a1_898" = "186991774"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261953928"
"a1_617" = "2790017653"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "412518210"
"a2_459" = "3290623428"
"a3_678" = "548713167"
"a1_614" = "152560127"
"a1_820" = "1434517879"
"a1_821" = "1151220444"
"a1_822" = "2741643465"

"a1_149" = "3265140256"
"a1_148" = "3851473477"
"a1_143" = "2281239321"
"a1_142" = "1919562128"
"a1_141" = "38811222"
"a1_140" = "2350482466"
"a1_147" = "3308881126"
"a1_146" = "2542683911"
"a1_145" = "1960607291"
"a1_144" = "1861548120"
"a1_826" = "1995320388"
"a1_827" = "4130449525"
"a2_203" = "1455327092"
"a2_202" = "1448153408"
"a2_201" = "1441002244"
"a2_200" = "1433826712"
"a2_207" = "1484010632"
"a2_206" = "1476846532"
"a2_205" = "1469675991"
"a2_204" = "1462494428"
"a2_209" = "1498344474"
"a2_208" = "1491179095"
"a2_519" = "3720788352"
"a2_518" = "3713600087"
"a2_517" = "3706426568"
"a2_516" = "3699273519"
"a2_515" = "3692099499"
"a2_514" = "3684933057"
"a2_513" = "3677764941"
"a2_512" = "3670595742"
"a2_511" = "3663413532"
"a2_510" = "3656243508"
"a2_689" = "644560303"
"a2_688" = "637393632"
"a2_687" = "630226039"
"a2_686" = "623040986"
"a2_685" = "615877482"
"a2_684" = "608707704"
"a2_683" = "601544276"
"a2_682" = "594375405"
"a2_681" = "587210462"
"a2_680" = "580042692"
"a2_337" = "2416000359"
"a2_336" = "2408816087"
"a2_335" = "2401649210"
"a2_334" = "2394483833"
"a2_333" = "2387323658"
"a2_332" = "2380148838"
"a2_331" = "2372981796"
"a2_330" = "2365816103"
"a1_554" = "693952703"
"a1_555" = "2803810335"
"a1_556" = "3100707251"
"a1_557" = "2455386208"
"a3_242" = "1718323611"
"a1_551" = "3605734814"
"a2_339" = "2430333484"
"a2_338" = "2423165856"
"a4_673" = "529851137"
"a1_918" = "41739107"
"a1_919" = "2053386889"
"a3_243" = "1725243962"
"a1_852" = "4175359555"
"a1_914" = "3751547151"
"a1_398" = "2140264126"
"a1_399" = "3810452113"
"a4_679" = "572865863"
"a1_392" = "574252726"
"a1_393" = "2255105876"
"a1_390" = "765925636"
"a1_391" = "4045529981"
"a1_396" = "405603261"
"a1_397" = "234978612"
"a1_394" = "1563739429"
"a1_395" = "4256505046"
"a1_858" = "3458219338"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "1073021996"
"a1_48" = "3691250785"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "3527666887"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "3965071899"
"a1_775" = "4219756332"
"a1_776" = "3332716373"
"a1_777" = "2391056748"
"a1_191" = "3111420674"
"a1_771" = "159210068"
"a1_772" = "3238394687"
"a1_773" = "2678013275"
"a1_953" = "838955842"
"a3_927" = "2367492374"
"a1_778" = "2110178225"
"a1_779" = "1495215344"
"a3_926" = "2326953207"
"a2_17" = "121866656"
"a2_16" = "114710924"
"a2_15" = "107543475"
"a2_14" = "100359183"
"a2_13" = "93193634"
"a2_12" = "86026977"
"a2_11" = "78858181"
"a2_10" = "71692794"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "3451444771"
"a2_19" = "136205176"
"a2_18" = "129046495"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "2101833719"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "3362552269"
"a1_596" = "3346329454"
"a4_987" = "2780955131"
"a1_597" = "4026132617"
"a1_608" = "2744115155"
"a1_609" = "1089453212"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "2888058974"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "3859897634"
"a3_484" = "3486690637"
"a1_952" = "1035038653"
"a2_925" = "2336466264"
"a1_954" = "876400418"
"a1_955" = "3365348747"
"a1_956" = "2028869959"
"a3_485" = "3460055532"
"a1_958" = "2484590503"
"a2_922" = "2314965117"
"a1_750" = "2242892688"
"a1_751" = "2365398578"
"a1_756" = "4090669514"
"a1_757" = "1079374181"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "3522691116"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "3704638240"
"a4_903" = "2178748967"
"a1_188" = "157271392"
"a4_900" = "2157241604"
"a1_187" = "1688579752"
"a4_901" = "2164410725"
"a1_186" = "2088523567"
"a2_929" = "2365151890"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "3864395070"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "1246952374"
"a1_558" = "1830968661"
"a1_559" = "3026212725"
"a1_606" = "3693434656"
"a3_925" = "2319505492"
"a1_178" = "3098836552"
"a1_179" = "2039381412"
"a1_176" = "1701588382"
"a1_177" = "912759853"
"a1_174" = "1713000627"
"a1_175" = "3277328773"
"a1_172" = "4216249488"
"a1_173" = "2809927951"
"a1_170" = "313326301"
"a1_171" = "609993333"
"a1_550" = "2219581503"
"a2_236" = "1691916096"
"a2_237" = "1699084842"
"a2_234" = "1677580865"
"a2_235" = "1684749208"
"a2_232" = "1663232578"
"a2_233" = "1670399375"
"a2_230" = "1648900211"
"a2_231" = "1656074326"
"a1_553" = "3010656976"
"a2_238" = "1706258862"
"a2_239" = "1713418135"
"a2_522" = "3742272529"
"a2_523" = "3749447215"
"a2_520" = "3727949751"
"a2_521" = "3735115736"
"a2_526" = "3770951713"
"a2_527" = "3778131653"
"a2_524" = "3756615759"
"a2_525" = "3763797710"
"a2_838" = "1712750828"
"a2_839" = "1719922423"
"a2_528" = "3785299721"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a3_688" = "620670617"
"a1_626" = "3921694860"
"a1_627" = "3361647401"
"a1_624" = "4195714089"
"a1_549" = "523168185"
"a1_548" = "2729916114"
"a1_547" = "1961911288"
"a1_546" = "536269491"
"a1_545" = "2074921431"
"a1_544" = "2251120910"
"a1_543" = "1445905003"
"a1_542" = "2610416878"
"a1_541" = "244816528"
"a1_540" = "453393750"
"a2_658" = "422321777"
"a2_659" = "429489856"
"a2_308" = "2208097647"
"a2_309" = "2215260937"
"a2_302" = "2165079161"
"a2_303" = "2172247016"
"a2_300" = "2150743118"
"a2_301" = "2157911659"
"a2_306" = "2193744338"
"a2_307" = "2200926091"
"a2_304" = "2179410127"
"a2_305" = "2186589248"
"a2_786" = "1339959920"
"a2_787" = "1347127836"
"a2_784" = "1325627077"
"a2_785" = "1332793590"
"a2_782" = "1311292270"
"a2_783" = "1318459653"
"a2_780" = "1296941815"
"a2_781" = "1304110560"
"a2_788" = "1354295244"
"a2_789" = "1361476766"
"a1_389" = "1472974392"
"a1_388" = "3603385727"
"a1_385" = "3496439356"
"a1_384" = "3005673277"
"a1_387" = "3775855480"
"a1_386" = "746984444"
"a1_381" = "3083616569"
"a1_380" = "777839501"
"a1_383" = "766652742"
"a1_382" = "3038843402"
"a1_58" = "2126545729"
"a1_59" = "322232801"
"a1_56" = "4045458669"
"a1_57" = "467226152"
"a1_54" = "459377092"
"a1_55" = "3012850825"
"a1_52" = "262209003"
"a1_53" = "2969538088"
"a1_50" = "1323260553"
"a1_51" = "3298254654"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "3250231770"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "2458133780"
"a1_764" = "885906370"
"a1_763" = "1115928745"
"a1_762" = "769827588"
"a1_761" = "104701020"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257615281"
"a4_858" = "1856138522"
"a1_586" = "3244371580"
"a1_789" = "1922970832"
"a3_720" = "849951481"
"a4_393" = "2817464553"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "3320355810"
"a1_619" = "1721398842"
"a1_618" = "1758334096"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "179062011"
"a4_522" = "3742281162"
"a2_62" = "444493225"
"a4_523" = "3749450283"
"a2_63" = "451645682"
"a4_524" = "3756619404"
"a1_971" = "3072079310"
"a2_60" = "430152507"
"a4_525" = "3763788525"
"a1_943" = "1403624181"
"a1_942" = "961535431"
"a1_941" = "3006385617"
"a2_61" = "437320730"
"a1_947" = "1949192799"
"a4_526" = "3770957646"
"a1_945" = "1863217741"
"a1_944" = "3602533119"
"a2_66" = "473153856"
"a1_949" = "1974763464"
"a4_527" = "3778126767"
"a2_67" = "480334672"
"a2_64" = "458818386"
"a2_65" = "465985990"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "51109430"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "1493483711"
"a1_41" = "2056053739"
"a1_40" = "2855282933"
"a1_43" = "1413321345"
"a3_819" = "1559971962"
"a1_42" = "3735661783"
"a3_813" = "1516544548"
"a1_45" = "4196920128"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "2154872338"
"a1_47" = "1198667764"
"a1_46" = "4269563677"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a1_539" = "1695834610"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a4_991" = "2809631615"
"a1_783" = "3695966225"
"a3_757" = "1115339004"
"a1_959" = "2174151368"
"a2_907" = "2207432431"
"a4_990" = "2802462494"
"a1_161" = "2718278776"
"a1_160" = "1830436078"
"a1_163" = "1799106222"
"a1_162" = "765074237"
"a1_165" = "3570332624"
"a1_164" = "1251830682"
"a1_167" = "3776072083"
"a1_166" = "1969905202"
"a1_169" = "1205254843"
"a1_168" = "3309105905"
"a3_727" = "933979486"
"a2_535" = "3835484391"
"a2_534" = "3828317190"
"a2_537" = "3849820490"
"a2_536" = "3842650408"
"a2_531" = "3806820296"
"a2_530" = "3799631863"
"a2_533" = "3821136031"
"a2_532" = "3813980857"
"a2_829" = "1648241673"
"a2_828" = "1641069607"
"a2_539" = "3864150262"
"a2_538" = "3856983327"
"a4_447" = "3204597087"
"a1_572" = "1522167013"
"a1_573" = "1326389064"
"a1_570" = "1782462390"
"a1_571" = "1998642319"
"a1_576" = "2362116224"
"a1_577" = "2342666256"
"a1_574" = "2048813843"
"a1_575" = "3158981729"
"a1_578" = "180166730"
"a1_579" = "3988686559"
"a2_649" = "357786938"
"a2_648" = "350630130"
"a2_319" = "2286957828"
"a2_318" = "2279778894"
"a2_315" = "2258277496"
"a2_314" = "2251096215"
"a2_317" = "2272613889"
"a2_316" = "2265433233"
"a2_311" = "2229594359"
"a2_310" = "2222435810"
"a2_313" = "2243928566"
"a2_312" = "2236760232"
"a2_229" = "1641731221"
"a2_228" = "1634565531"
"a2_221" = "1584366449"
"a2_220" = "1577213922"
"a2_223" = "1598707125"
"a2_222" = "1591547288"
"a2_225" = "1613044188"
"a2_224" = "1605880511"
"a2_227" = "1627398100"
"a2_226" = "1620229461"
"a1_370" = "1070794377"
"a1_371" = "3733394890"
"a1_372" = "3157408842"
"a1_373" = "1654393575"
"a1_374" = "2364816340"
"a1_375" = "2998000570"
"a1_376" = "788133955"
"a1_377" = "317274223"
"a1_378" = "1300402159"
"a1_379" = "989156077"
"a2_793" = "1390143590"
"a2_792" = "1382978120"
"a2_795" = "1404477821"
"a2_794" = "1397311893"
"a2_797" = "1418828409"
"a2_796" = "1411645880"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "1263864226"
"a1_28" = "3372130338"
"a1_590" = "2921344979"
"a1_23" = "3614421389"
"a1_22" = "1448247895"
"a1_21" = "3710924622"
"a1_20" = "4290877117"
"a1_27" = "3572075655"
"a1_26" = "1230475680"
"a1_25" = "1144893619"
"a1_24" = "2838406108"
"a1_284" = "3722070061"
"a1_285" = "203306147"
"a1_286" = "3583419028"
"a1_287" = "192859913"
"a1_280" = "1333560405"
"a1_281" = "196311076"
"a1_282" = "3670417364"
"a1_283" = "1175450097"
"a3_31" = "205278614"
"a1_288" = "2290596617"
"a1_289" = "242083024"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178747360"
"a1_591" = "2663886226"
"a3_32" = "212854281"
"a2_972" = "2673424976"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "473193051"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "1247700205"
"a1_599" = "3959072673"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222248083"
"a2_30" = "215081605"
"a2_33" = "236578662"
"a2_32" = "229421041"
"a2_35" = "250913702"
"a2_34" = "243747815"
"a2_37" = "265265620"
"a2_36" = "258082375"
"a2_39" = "279598231"
"a2_38" = "272418123"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186758757"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193942952"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "4289156172"
"a1_625" = "1440100999"
"a1_622" = "3521199297"
"a1_623" = "1417578875"
"a1_620" = "1005754194"
"a1_621" = "980972276"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "220"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "513749086"
"a2_588" = "4215444655"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222610878"
"a1_976" = "2978362124"
"a1_977" = "2411526268"
"a1_974" = "320399749"
"a1_975" = "2324066609"
"a1_972" = "3546555381"
"a1_973" = "2892781567"
"a1_970" = "3215539932"
"a3_827" = "1616916338"
"a1_770" = "2599950603"
"a1_978" = "3180642274"
"a1_979" = "3555908840"
"a4_199" = "1426655079"
"a3_505" = "3603458416"
"a3_504" = "3596547281"
"a2_363" = "2602388651"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157246882"
"a1_746" = "3429075181"
"a4_827" = "1633895771"
"a2_901" = "2164412520"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171582018"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185916095"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193084320"
"a2_906" = "2200249686"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "4150576712"
"a1_115" = "870380420"
"a1_116" = "2763295706"
"a1_117" = "363215909"
"a1_110" = "1174233339"
"a1_111" = "3509363633"
"a1_112" = "2079988813"
"a1_113" = "3393950741"
"a1_824" = "3862957697"
"a1_118" = "1075897335"
"a1_119" = "273008737"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570228189"
"a2_499" = "3577384153"
"a2_492" = "3527211343"
"a2_493" = "3534377070"
"a2_490" = "3512873761"
"a2_491" = "3520043937"
"a2_496" = "3555875531"
"a2_497" = "3563060614"
"a2_494" = "3541542833"
"a2_495" = "3548711721"
"a2_816" = "1555030750"
"a2_817" = "1562198027"
"a2_814" = "1540699881"
"a2_815" = "1547874504"
"a2_812" = "1526364211"
"a3_740" = "1026900557"
"a2_810" = "1512015624"
"a2_811" = "1519181610"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569366053"
"a2_819" = "1576550172"
"a1_565" = "4134921080"
"a1_564" = "3784601098"
"a1_567" = "1644503179"
"a1_566" = "3741175239"
"a1_561" = "973295019"
"a1_560" = "2475839518"
"a1_563" = "3505096602"
"a1_562" = "203721281"
"a1_569" = "3577574605"
"a1_568" = "539086408"
"a1_525" = "2658437823"
"a2_678" = "565691652"
"a2_679" = "572859210"
"a2_676" = "551357525"
"a2_677" = "558519646"
"a2_674" = "537025357"
"a2_675" = "544191006"
"a2_672" = "522677099"
"a2_673" = "529857501"
"a2_670" = "508341455"
"a2_671" = "515507433"
"a3_982" = "2728158783"
"a2_258" = "1849635161"
"a2_259" = "1856804730"
"a2_254" = "1820952161"
"a2_255" = "1828121504"
"a2_256" = "1835287754"
"a2_257" = "1842467726"
"a2_250" = "1792286225"
"a2_251" = "1799452522"
"a2_252" = "1806619049"
"a2_253" = "1813784212"
"a1_363" = "506114903"
"a1_362" = "318819994"
"a1_361" = "1834500252"
"a1_360" = "685621563"
"a1_367" = "3520671662"
"a1_366" = "3697860974"
"a1_365" = "5871618"
"a1_364" = "1547528127"
"a1_369" = "3024179565"
"a1_368" = "2401140410"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2370284763"
"a1_39" = "1603077497"
"a1_30" = "2228437397"
"a1_31" = "669888713"
"a1_32" = "921061092"
"a1_33" = "253173806"
"a1_34" = "1219028120"
"a1_35" = "3603534487"
"a1_36" = "2796331029"
"a1_37" = "2596242110"
"a1_297" = "4088760911"
"a1_296" = "3851184147"
"a1_295" = "3060186770"
"a1_294" = "142728488"
"a1_293" = "1426136094"
"a1_292" = "988617707"
"a1_291" = "1334701055"
"a1_290" = "2126554960"
"a1_299" = "2631574913"
"a1_298" = "2109907135"
"a3_769" = "1234824520"
"a1_600" = "242201099"
"a2_668" = "493997787"
"a1_601" = "191095264"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "2616622407"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774259062"
"a2_109" = "781428218"
"a4_878" = "1999520942"
"a1_603" = "2945007158"
"a2_100" = "716908685"
"a2_101" = "724075667"
"a2_102" = "731241867"
"a2_103" = "738424398"
"a2_104" = "745591115"
"a2_105" = "752759529"
"a2_106" = "759935995"
"a2_107" = "767091498"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "1864418602"
"a1_589" = "1769525855"
"a1_588" = "961253903"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "4215441861"
"a1_748" = "1047585331"
"a2_28" = "200729986"
"a2_29" = "207899049"
"a2_26" = "186394631"
"a2_27" = "193561425"
"a2_24" = "172061141"
"a2_25" = "179236318"
"a2_22" = "157726641"
"a2_23" = "164895772"
"a2_20" = "143376567"
"a2_21" = "150547474"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139224377"
"a2_7" = "50177867"
"a2_6" = "43011346"
"a2_5" = "35842055"
"a2_4" = "28685390"
"a2_3" = "21509940"
"a2_2" = "14341373"
"a2_1" = "7175474"
"a2_0" = "6847"
"a1_639" = "2328016001"
"a1_638" = "3854822912"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64527368"
"a2_8" = "57359091"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124889373"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"
"a3_875" = "1961196962"
"a1_532" = "2824095790"
"a1_533" = "3062366040"
"a4_845" = "1762939949"
"a2_853" = "1820289809"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 1B FF 20 76 C9 FE 7E E3 4C 6A 3E A1 A7 3C 13"

[HKCU\Software\Aas]
"a1_968" = "1277478277"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "3303552995"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "3805189781"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_82" = "1416627475"
"a1_957" = "1178139629"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0A00687474703A2F2F3134302E3133302E3134312E312F696D616765732F696D6167652E67696600687474703A2F2F746F726F737265736964656E63652E636F6D2F696D6167652E67696600687474703A2F2F7777772E62756C75746D616B696E612E636F6D2F696D616765732F627574746F6E2E67696600687474703A2F2F746F6B61746D616E67616C692E636F6D2F696D616765732F696D6167652E67696600687474703A2F2F726164696F32312D616C796E612D666D2D7669702E6869322E726F2F6373732F696D616765732F696D6167652E67696600687474703A2F2F636473647275672E636F6D2F627574746F6E2E67696600687474703A2F2F616A616E73662E636F6D2F696D672F696D6167652E67696600687474703A2F2F6465726B616F746F6D6F7469762E636F6D2F696D6167652E67696600687474703A2F2F696266656D61726167756172692E636F6D2E62722F696D616765732F696D6167652E67696600687474703A2F2F6B6977696D696C6B2D766965742E636F6D2E766E2F696D6167652E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014716897"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "3821312507"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "2100762887"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013860835"
"a1_107" = "3542661337"
"a1_106" = "3415011476"
"a1_105" = "3171488087"
"a1_104" = "1266267444"
"a1_103" = "1664305081"
"a1_102" = "2836111890"
"a1_101" = "1472819763"
"a1_100" = "3176909654"
"a3_134" = "943841519"
"a1_109" = "2598400532"
"a1_62" = "4090918060"
"a1_61" = "3351693679"
"a3_137" = "998890944"
"a2_883" = "2035360179"
"a3_686" = "606179783"
"a2_489" = "3505693990"
"a2_488" = "3498528700"
"a3_687" = "613616230"
"a2_485" = "3477027966"
"a2_484" = "3469859177"
"a2_487" = "3491359021"
"a2_486" = "3484191164"
"a2_481" = "3448356662"
"a2_480" = "3441170071"
"a2_483" = "3462692518"
"a2_482" = "3455510277"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028195165"
"a3_976" = "2685262841"
"a2_809" = "1504843172"
"a2_808" = "1497681016"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447507706"
"a2_800" = "1440321307"
"a2_803" = "1461845026"
"a3_681" = "570649632"
"a2_805" = "1476180406"
"a2_804" = "1469012507"
"a2_807" = "1490514942"
"a2_806" = "1483346257"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049713138"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443822377"
"a2_660" = "436656019"
"a2_663" = "458157072"
"a3_146" = "1063277947"
"a2_665" = "472488499"
"a2_664" = "465367575"
"a2_667" = "486839848"
"a2_666" = "479670547"
"a2_669" = "501173022"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021026867"
"a3_143" = "1008236550"
"a2_249" = "1785118493"
"a2_248" = "1777936222"
"a2_247" = "1770769420"
"a2_246" = "1763594492"
"a2_245" = "1756434020"
"a2_244" = "1749267989"
"a2_243" = "1742099436"
"a2_242" = "1734933349"
"a2_241" = "1727749978"
"a2_240" = "1720584026"
"a1_356" = "524347992"
"a1_357" = "2526093847"
"a1_354" = "1742358125"
"a1_355" = "1327234561"
"a1_352" = "1323005757"
"a1_353" = "1839531503"
"a1_350" = "3534437876"
"a1_351" = "2553717198"
"a2_855" = "1834623335"
"a3_639" = "269411382"
"a1_358" = "2502780216"
"a1_359" = "875123241"
"a3_638" = "295912343"
"a2_887" = "2064044371"
"a2_886" = "2056878314"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583714395"
"a2_119" = "853128495"
"a2_118" = "845961792"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810112969"
"a2_112" = "802944342"
"a2_111" = "795778278"
"a2_110" = "788610606"
"a2_117" = "838795046"
"a2_116" = "831614723"
"a2_115" = "824445998"
"a2_114" = "817278972"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533534010"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422985258"
"a2_58" = "415800875"
"a2_53" = "379968650"
"a2_52" = "372785347"
"a2_51" = "365616592"
"a2_50" = "358450257"
"a2_57" = "408634198"
"a2_56" = "401468609"
"a2_55" = "394299755"
"a2_54" = "387137412"
"a4_842" = "1741432586"
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "2680073821"
"a1_645" = "4095017939"
"a1_646" = "635444121"
"a1_647" = "3166765178"
"a1_640" = "3285140798"
"a1_641" = "3689354785"
"a1_642" = "1159947768"
"a1_643" = "613131398"
"a1_648" = "3605875359"
"a1_649" = "1652486303"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas]
"a2_953" = "2537206352"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "1212738808"
"a1_829" = "1757645080"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "1147471630"
"a1_916" = "1606843481"
"a1_917" = "43501253"
"a1_910" = "2959930494"
"a1_911" = "2595785340"
"a1_912" = "1614837700"
"a1_913" = "1526074799"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "3835935495"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "1666943873"
"a1_139" = "3554061042"
"a3_907" = "2190592386"
"a1_132" = "3284498641"
"a1_133" = "2103544890"
"a1_130" = "3397492508"
"a1_131" = "3813214672"
"a1_136" = "861774116"
"a1_137" = "2469400900"
"a1_134" = "186874813"
"a1_135" = "1671162688"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369490736"
"a2_471" = "3376657312"
"a2_472" = "3383823198"
"a2_473" = "3390992044"
"a2_474" = "3398170717"
"a2_475" = "3405325620"
"a2_476" = "3412505147"
"a2_477" = "3419676458"
"a2_478" = "3426840992"
"a2_479" = "3434017362"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "3922832036"
"a2_878" = "1999525904"
"a2_879" = "2006681920"
"a2_874" = "1970843309"
"a2_875" = "1978010224"
"a2_876" = "1985174459"
"a2_877" = "1992344525"
"a2_870" = "1942174974"
"a2_871" = "1949353410"
"a2_872" = "1956508862"
"a2_873" = "1963676494"
"a1_349" = "2536434560"
"a1_348" = "309934356"
"a2_586" = "4201111029"
"a2_587" = "4208275856"
"a2_580" = "4158091404"
"a2_581" = "4165258572"
"a2_582" = "4172425942"
"a2_583" = "4179591416"
"a1_341" = "362132575"
"a1_340" = "3613534849"
"a1_343" = "3631285658"
"a1_342" = "2260946982"
"a1_345" = "2853513205"
"a1_344" = "4287298449"
"a1_347" = "1091560172"
"a1_346" = "3327935234"
"a2_614" = "106878865"
"a2_615" = "114048399"
"a2_616" = "121214953"
"a2_617" = "128372248"
"a2_610" = "78198371"
"a2_611" = "85373636"
"a2_612" = "92528884"
"a2_613" = "99697499"
"a2_618" = "135546688"
"a2_619" = "142715925"
"a2_272" = "1950006999"
"a2_273" = "1957171342"
"a2_270" = "1935655186"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978672125"
"a2_277" = "1985855170"
"a2_274" = "1964341645"
"a2_275" = "1971507142"
"a2_908" = "2214600499"
"a2_909" = "2221755994"
"a2_278" = "1993021584"
"a2_279" = "2000189906"
"a1_842" = "3028078460"
"a2_298" = "2136392914"
"a2_299" = "2143559908"
"a1_841" = "3233427552"
"a2_290" = "2079042543"
"a2_291" = "2086207709"
"a2_292" = "2093377171"
"a2_293" = "2100557285"
"a2_294" = "2107727521"
"a2_295" = "2114895307"
"a2_296" = "2122057737"
"a2_297" = "2129221544"
"a2_728" = "924151741"
"a2_729" = "931319282"
"a2_720" = "866797367"
"a2_721" = "873965954"
"a2_722" = "881135269"
"a2_723" = "888301721"
"a2_724" = "895480299"
"a2_725" = "902650696"
"a2_726" = "909819121"
"a2_727" = "916985588"
"a1_594" = "1876795098"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917646731"
"a2_129" = "924814326"
"a2_126" = "903300555"
"a2_127" = "910481750"
"a2_124" = "888963841"
"a2_125" = "896145915"
"a2_122" = "874630657"
"a2_123" = "881796104"
"a2_120" = "860297079"
"a2_121" = "867461614"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612382718"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "43939543"
"a1_13" = "4219698867"
"a1_10" = "2015072646"
"a1_11" = "1050830923"
"a1_16" = "2765208486"
"a1_17" = "69922747"
"a1_14" = "3053180724"
"a1_15" = "3905779813"
"a1_18" = "1194644975"
"a1_19" = "3223034244"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128562663"
"a2_48" = "344126398"
"a2_49" = "351278566"
"a1_846" = "1037333951"
"a2_40" = "286767297"
"a2_41" = "293930230"
"a2_42" = "301100564"
"a2_43" = "308267756"
"a2_44" = "315447408"
"a2_45" = "322616391"
"a2_46" = "329788580"
"a2_47" = "336951078"
"a2_897" = "2135731905"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "3957901503"
"a1_656" = "2344625557"
"a1_655" = "4117490205"
"a1_632" = "1698489516"
"a1_653" = "2232668433"
"a1_652" = "1095943620"
"a1_651" = "1532995869"
"a1_650" = "3286034932"
"a3_796" = "1428649909"
"a1_659" = "2953321999"
"a1_658" = "1567102186"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086646"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"
"a4_793" = "1390145657"
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "1779475420"
"a1_838" = "1871912159"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "2907139605"
"a1_906" = "515491572"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "29716072"
"a1_902" = "2360038559"
"a1_901" = "1528386836"
"a1_900" = "838309465"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "1651325407"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "1682982614"
"a2_644" = "321954254"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "509427928"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "3346914128"
"a1_879" = "1452730970"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "1668861658"
"a1_128" = "3315912380"
"a1_125" = "3794510082"
"a1_124" = "1846622006"
"a1_127" = "2909648458"
"a1_126" = "2804694900"
"a1_121" = "418976138"
"a1_120" = "61172425"
"a1_123" = "1932250439"
"a1_122" = "2349231957"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "1306588858"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "2165857646"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a1_830" = "1573017024"
"a1_837" = "705605526"
"a1_836" = "3123798912"
"a1_835" = "2738405436"
"a1_754" = "826271756"
"a1_834" = "2862165595"
"a1_634" = "3208301943"
"a2_463" = "3319305048"
"a2_462" = "3312124755"
"a2_461" = "3304972233"
"a2_460" = "3297789936"
"a2_467" = "3347973384"
"a2_466" = "3340807838"
"a2_465" = "3333639971"
"a2_464" = "3326474887"
"a2_469" = "3362322829"
"a2_468" = "3355156150"
"a1_934" = "1306752440"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKCU\Software\Aas]
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934992358"
"a2_868" = "1927825508"
"a2_867" = "1920655688"
"a2_866" = "1913489381"
"a2_865" = "1906313710"
"a2_864" = "1899127047"
"a2_863" = "1891991386"
"a1_791" = "4040622857"
"a2_861" = "1877639201"
"a2_860" = "1870472012"
"a2_597" = "4279960714"
"a2_596" = "4272793299"
"a2_595" = "4265627886"
"a2_594" = "4258450066"
"a1_338" = "2561421694"
"a1_339" = "4133702154"
"a2_591" = "4236944316"
"a2_590" = "4229775482"
"a1_334" = "3179841587"
"a1_335" = "1554417610"
"a1_336" = "38796270"
"a1_337" = "3142936060"
"a1_330" = "3389608022"
"a1_331" = "3040497456"
"a1_332" = "2613125291"
"a1_333" = "1297681436"
"a2_607" = "56695984"
"a2_606" = "49512451"
"a3_30" = "231909751"
"a2_604" = "35180539"
"a1_64" = "1665318805"
"a2_602" = "20847417"
"a2_601" = "13678670"
"a2_600" = "6510907"
"a4_875" = "1978013579"
"a2_609" = "71029160"
"a2_608" = "63849805"
"a2_265" = "1899822958"
"a2_264" = "1892656700"
"a2_267" = "1914154875"
"a2_266" = "1906988117"
"a2_261" = "1871138754"
"a2_260" = "1863969372"
"a2_263" = "1885486119"
"a2_262" = "1878302533"
"a2_919" = "2293450465"
"a1_908" = "1118666307"
"a2_269" = "1928488924"
"a2_268" = "1921319544"
"a1_905" = "2683631047"
"a2_884" = "2042529851"
"a1_482" = "4003135707"
"a1_483" = "1531055444"
"a2_289" = "2071874221"
"a2_288" = "2064708664"
"a1_486" = "2400680592"
"a1_487" = "3242917784"
"a1_484" = "1215944966"
"a1_485" = "2297520251"
"a2_283" = "2028853203"
"a2_282" = "2021699761"
"a2_281" = "2014513786"
"a2_280" = "2007356357"
"a2_287" = "2057541248"
"a2_286" = "2050374471"
"a2_285" = "2043191714"
"a2_284" = "2036024887"
"a2_739" = "1003019344"
"a2_738" = "995836511"
"a3_522" = "3725445091"
"a2_733" = "960000039"
"a2_732" = "952832534"
"a2_731" = "945665755"
"a2_730" = "938485749"
"a2_737" = "988669260"
"a2_736" = "981500355"
"a2_735" = "974334469"
"a2_734" = "967168331"
"a4_446" = "3197427966"
"a1_637" = "946810181"
"a3_912" = "2226582457"
"a1_240" = "2324186038"
"a1_241" = "1941624654"
"a1_242" = "389487648"
"a1_243" = "1468491581"
"a1_244" = "760185645"
"a1_245" = "2190563939"
"a1_246" = "2253550951"
"a1_247" = "3400871006"
"a1_248" = "3091418277"
"a1_249" = "2130462413"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939148032"
"a2_130" = "931980301"
"a2_133" = "953498614"
"a2_132" = "946331699"
"a2_135" = "967833616"
"a2_134" = "960665104"
"a2_137" = "982164082"
"a2_136" = "974998699"
"a2_139" = "996515052"
"a2_138" = "989333250"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566354108"
"a2_78" = "559189867"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "929961603"
"a1_583" = "3888009150"
"a1_794" = "796013300"
"a1_795" = "1918501601"
"a1_792" = "2117457494"
"a1_793" = "4194777889"
"a1_790" = "70754840"
"a1_582" = "4034292457"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "2162065126"
"a1_798" = "1654619116"
"a1_799" = "1486172393"
"a1_580" = "4031776772"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737945355"
"a1_585" = "1437731327"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "4207537408"
"a1_469" = "1492592951"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "2646756893"
"a1_461" = "2564092447"
"a1_462" = "138483232"
"a1_463" = "1952628051"
"a1_464" = "1117242505"
"a1_465" = "3590688100"
"a1_466" = "2918406021"
"a1_467" = "2765571968"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "3398669095"
"a1_669" = "2126349862"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655400843"
"a3_499" = "3560555322"
"a3_990" = "2785625399"
"a2_831" = "1662567188"
"a3_498" = "3587059355"
"a2_832" = "1669732415"
"a3_497" = "3579611768"
"a2_833" = "1676904693"
"a3_496" = "3539014105"
"a2_834" = "1684086781"
"a3_495" = "3532029350"
"a2_835" = "1691251067"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698421139"
"a3_493" = "3551077604"
"a2_837" = "1705585568"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a2_529" = "3792466733"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "2504073906"
"a1_807" = "357638042"
"a1_804" = "3017140580"
"a1_805" = "2445511260"
"a1_802" = "949967926"
"a1_803" = "4294564605"
"a1_800" = "3824868733"
"a1_801" = "3588010992"
"a1_808" = "1381815702"
"a1_809" = "559377607"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "3567072504"
"a1_939" = "3439980500"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407973539"
"a1_875" = "2939995714"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "3446470747"
"a4_989" = "2795293373"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "2022292783"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269127465"
"a2_457" = "3276286826"
"a2_454" = "3254787456"
"a3_380" = "2741212629"
"a2_452" = "3240436186"
"a2_453" = "3247619634"
"a2_450" = "3226103469"
"a2_451" = "3233271508"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283465993"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "2675762102"
"a2_852" = "1813120799"
"a1_730" = "2950884947"
"a2_850" = "1798791064"
"a2_851" = "1805957556"
"a2_856" = "1841803407"
"a2_857" = "1848974769"
"a2_854" = "1827456663"
"a1_731" = "4225913148"
"a3_632" = "252486993"
"a2_858" = "1856141869"
"a2_859" = "1863304209"
"a1_732" = "4006639891"
"a1_733" = "1741656436"
"a1_329" = "3571908304"
"a1_328" = "889096860"
"a1_327" = "1891981737"
"a1_326" = "4141006281"
"a1_325" = "3318440428"
"a1_324" = "810847513"
"a1_323" = "4285952077"
"a1_322" = "2705190095"
"a1_321" = "2262188819"
"a1_320" = "3055267870"
"a2_650" = "364954525"
"a1_436" = "1062219629"
"a1_736" = "2706786089"
"a3_631" = "211878206"
"a1_737" = "1608301296"
"a2_652" = "379303001"
"a3_923" = "2339079058"
"a2_926" = "2343635772"
"a2_927" = "2350803331"
"a2_924" = "2329302143"
"a2_653" = "386472978"
"a4_887" = "2064043031"
"a2_923" = "2322134364"
"a2_920" = "2300619763"
"a2_921" = "2307785782"
"a2_654" = "393639445"
"a2_928" = "2357969203"
"a2_655" = "400815698"
"a3_630" = "204893343"
"a2_657" = "415139179"
"a3_922" = "2298015603"
"a1_495" = "4128103181"
"a1_494" = "3464396373"
"a1_497" = "1445959919"
"a1_496" = "2386477725"
"a1_491" = "2044149038"
"a1_490" = "941180945"
"a1_493" = "50505659"
"a1_492" = "1760921764"
"a1_499" = "2167062654"
"a1_498" = "2580101103"
"a3_637" = "288468852"
"a2_708" = "780766067"
"a2_709" = "787946370"
"a2_706" = "766430161"
"a2_707" = "773598940"
"a2_704" = "752097007"
"a2_705" = "759254902"
"a2_702" = "737762778"
"a2_703" = "744927408"
"a2_700" = "723411539"
"a2_701" = "730578970"
"a4_885" = "2049704789"
"a2_638" = "278933897"
"a2_639" = "286101608"
"a3_808" = "1481095169"
"a2_632" = "235919555"
"a2_633" = "243083852"
"a2_630" = "221583424"
"a2_631" = "228749477"
"a2_636" = "264598934"
"a2_637" = "271768795"
"a2_634" = "250251247"
"a2_635" = "257418497"
"a1_253" = "382620563"
"a1_252" = "2693797668"
"a1_251" = "1360745937"
"a1_250" = "1273509780"
"a1_257" = "991549630"
"a1_256" = "2511280850"
"a1_255" = "899057353"
"a1_254" = "141763388"
"a3_920" = "2284050097"
"a1_259" = "498156150"
"a1_258" = "1367613810"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032351565"
"a2_145" = "1039516535"
"a2_146" = "1046683906"
"a2_147" = "1053866415"
"a2_140" = "1003669283"
"a2_141" = "1010847979"
"a2_142" = "1018016813"
"a2_143" = "1025180819"
"a1_781" = "1174338899"
"a1_780" = "3658911159"
"a2_68" = "487503021"
"a2_69" = "494677709"
"a2_148" = "1061039582"
"a2_149" = "1068201384"
"a1_787" = "3473635876"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a2_987" = "2780962236"
"a1_904" = "239884753"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "3067811026"
"a1_478" = "3534772800"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "1572651367"
"a1_472" = "401169056"
"a1_471" = "1749188030"
"a1_470" = "617124002"
"a1_477" = "3919548257"
"a1_476" = "3549479954"
"a1_475" = "377324725"
"a1_474" = "2086758100"
"a4_533" = "3821141493"
"a1_679" = "406005918"
"a1_678" = "2634218584"
"a4_532" = "3813972372"
"a1_675" = "520425238"
"a1_674" = "1277414448"
"a1_677" = "798637365"
"a1_676" = "2016624352"
"a1_671" = "461067578"
"a4_531" = "3806803251"
"a1_673" = "1467074239"
"a1_672" = "1332972540"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a3_989" = "2812256404"
"a1_868" = "3184516779"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_985" = "2783204112"
"a3_984" = "2776284913"
"a3_987" = "2764139474"
"a3_986" = "2757228467"
"a2_151" = "1082535703"
"a2_150" = "1075366947"
"a1_869" = "2427179371"
"a2_271" = "1942837832"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "2870512401"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139899200"
"a4_758" = "1139226422"
"a2_158" = "1132712097"
"a1_925" = "2590087977"
"a1_924" = "794386504"
"a1_927" = "860919313"
"a1_926" = "2854864663"
"a1_921" = "3173537467"
"a1_920" = "4042397127"
"a3_787" = "1363737626"
"a1_922" = "2456383750"
"a3_80" = "590099577"
"a1_929" = "3412604508"
"a1_928" = "4136130027"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "817489542"
"a1_818" = "490237755"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "2747179651"
"a1_810" = "2400245076"
"a1_813" = "672709201"
"a1_812" = "592079249"
"a1_815" = "356827088"
"a1_814" = "259142869"
"a1_817" = "3617340704"
"a1_816" = "649642092"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454664793"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"

[HKCU\Software\Aas\695404737]
"50183847" = "06CE9D5A4E9415AF90D2CCEA3A0286C50831BCF06B0443781DA3D8F949B707BFBA0767980DB4A821AE721AD5BE6A78AF6FA93B62141A33BED2B54045FBF64A99BD0B316203969F82754FA1B39A32593CB05CA546CC2C60E1E28B70A5705F39E0A219DBC4AC74310EE57F054F28D60047ECE25E3C6D7D8020EBBDB188A0B5C4B3"

[HKCU\Software\Aas]
"a2_845" = "1762938144"
"a2_844" = "1755771880"
"a2_847" = "1777270942"
"a2_846" = "1770103896"
"a2_841" = "1734271982"
"a2_840" = "1727102309"
"a2_843" = "1748609449"
"a2_842" = "1741434893"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791612674"
"a2_848" = "1784453698"
"a1_312" = "2212621548"
"a1_313" = "2723136188"
"a1_310" = "572897468"
"a1_311" = "1023380888"
"a1_316" = "2970885990"
"a1_317" = "3018091844"
"a1_314" = "748353326"
"a1_315" = "1690204775"
"a3_620" = "166490309"
"a1_318" = "388073524"
"a1_319" = "1287602273"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218936388"
"a2_448" = "3211758297"
"a3_621" = "140449124"
"a2_441" = "3161587160"
"a2_440" = "3154421547"
"a2_443" = "3175916882"
"a2_442" = "3168752791"
"a2_445" = "3190252506"
"a2_444" = "3183084735"
"a2_447" = "3204601940"
"a2_446" = "3197433705"
"a2_939" = "2436840580"
"a2_938" = "2429672589"
"a4_893" = "2107057757"
"a2_931" = "2379495202"
"a2_930" = "2372318443"
"a2_933" = "2393831170"
"a2_932" = "2386645513"
"a2_935" = "2408154286"
"a2_934" = "2400986111"
"a2_937" = "2422504635"
"a2_936" = "2415336574"
"a3_818" = "1552537563"
"a2_711" = "802279504"
"a2_710" = "795115361"
"a2_713" = "816614521"
"a2_712" = "809448680"
"a2_715" = "830948402"
"a2_714" = "823781594"
"a2_717" = "845297317"
"a2_716" = "838113589"
"a2_719" = "859633992"
"a2_718" = "852464481"
"a1_587" = "51982166"
"a3_623" = "187965990"
"a2_629" = "214401722"
"a2_628" = "207235183"
"a2_625" = "185731085"
"a2_624" = "178565594"
"a2_627" = "200065033"
"a2_626" = "192900263"
"a2_621" = "157050196"
"a2_620" = "149882044"
"a2_623" = "171398114"
"a2_622" = "164232607"
"a1_266" = "2031209247"
"a1_267" = "4055879184"
"a1_264" = "3428342220"
"a1_265" = "1136531925"
"a1_262" = "2598127378"
"a1_263" = "3021010798"
"a1_260" = "1475401181"
"a1_261" = "1755251133"
"a1_268" = "2931721879"
"a1_269" = "4277263003"
"a2_157" = "1125553682"
"a2_156" = "1118385846"
"a2_155" = "1111219910"
"a2_154" = "1104051838"
"a2_153" = "1096868852"
"a2_152" = "1089700024"
"a2_99" = "709742054"
"a2_98" = "702576669"
"a2_97" = "695410304"
"a2_96" = "688241315"
"a2_95" = "681057960"
"a2_94" = "673905325"
"a2_93" = "666725078"
"a2_92" = "659555690"
"a2_91" = "652381105"
"a2_90" = "645229245"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "3468375567"
"a1_847" = "2012739761"
"a3_404" = "2913010493"
"a1_844" = "1521625877"
"a3_405" = "2886510428"
"a1_845" = "440151418"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_862" = "1884810169"
"a4_983" = "2752278647"
"a1_961" = "2535709160"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "1069112476"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "96140287"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "2567518513"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "575177236"
"a1_449" = "361185039"
"a1_446" = "1443026602"
"a3_408" = "2941554865"
"a1_444" = "2372505957"
"a1_445" = "2746957000"
"a1_442" = "3903042055"
"a1_443" = "3939190917"
"a1_440" = "2391691780"
"a3_409" = "2949002448"
"a1_680" = "1608375783"
"a1_681" = "1671607997"
"a1_682" = "1261847876"
"a1_683" = "232522357"
"a2_561" = "4021870934"
"a1_685" = "2590911795"
"a1_686" = "912675254"
"a1_687" = "1074698775"
"a1_688" = "2558714382"
"a1_689" = "2428736339"

"a3_834" = "1700949547"
"a3_988" = "2804681845"
"a1_767" = "2312776737"
"a1_766" = "912358528"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294310717"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "3788081847"
"a2_605" = "42345686"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "941288448"
"a2_603" = "28011874"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "3985862150"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "2856176190"
"a1_441" = "3970878887"
"a4_964" = "2616065348"
"a1_744" = "298050592"
"a4_988" = "2788124252"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250433944"
"a1_747" = "2084287932"
"a2_912" = "2243279780"
"a2_911" = "2236099765"
"a2_651" = "372136332"
"a2_910" = "2228931241"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "398"

[HKCU\Software\Aas]
"a2_917" = "2279117572"
"a4_883" = "2035366547"
"a2_916" = "2271949171"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "2630464891"
"a1_867" = "2948023517"
"a1_860" = "1126003565"
"a1_861" = "2472932883"
"a1_862" = "1813253922"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "626180373"
"a2_918" = "2286277559"
"a4_168" = "1204412328"
"a1_194" = "3189269215"
"a1_195" = "1891056563"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287127532"
"a1_192" = "2683321838"
"a1_193" = "7510141"
"a1_969" = "989171445"
"a4_934" = "2400991718"
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "3164237204"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a1_305" = "4282404012"
"a1_304" = "3783751821"
"a1_307" = "296742805"
"a1_306" = "2540329649"
"a1_301" = "504364849"
"a1_300" = "1733285371"
"a1_303" = "1812559207"
"a1_302" = "4063978555"
"a3_792" = "1399711281"
"a1_309" = "4092258219"
"a1_308" = "3324687484"
"a2_540" = "3871318299"
"a2_541" = "3878500831"
"a2_542" = "3885670077"
"a1_481" = "3629623088"
"a2_544" = "3900005547"
"a2_545" = "3907162762"
"a2_546" = "3914334581"
"a2_547" = "3921500568"
"a2_548" = "3928671368"
"a2_549" = "3935852217"
"a2_894" = "2114235385"
"a2_895" = "2121396720"
"a2_892" = "2099894995"
"a2_893" = "2107063665"
"a2_890" = "2085545898"
"a2_891" = "2092715291"
"a2_438" = "3140068397"
"a2_439" = "3147235718"
"a2_434" = "3111400937"
"a2_435" = "3118566509"
"a2_436" = "3125733906"
"a2_437" = "3132914135"
"a2_430" = "3082715208"
"a2_431" = "3089882880"
"a2_432" = "3097065209"
"a2_433" = "3104235398"
"a4_986" = "2773786010"
"a2_948" = "2501356075"
"a2_949" = "2508522234"
"a4_908" = "2214594572"
"a2_944" = "2472686308"
"a2_945" = "2479854187"
"a2_946" = "2487022405"
"a2_947" = "2494189224"
"a2_940" = "2444004975"
"a1_488" = "3643494488"
"a2_942" = "2458337671"
"a2_943" = "2465520792"
"a1_279" = "411106706"
"a1_278" = "598264808"
"a1_489" = "2188111857"
"a1_271" = "695169129"
"a1_270" = "1164905244"
"a1_273" = "2877153735"
"a1_272" = "717391121"
"a1_275" = "1278405477"
"a1_274" = "129177984"
"a1_277" = "23804812"
"a1_276" = "2418481099"
"a2_764" = "1182239369"
"a2_765" = "1189408430"
"a2_766" = "1196573928"
"a2_767" = "1203740082"
"a2_760" = "1153556359"
"a2_761" = "1160726388"
"a2_762" = "1167906913"
"a2_763" = "1175062633"
"a2_768" = "1210922619"
"a2_769" = "1218091616"
"a2_382" = "2738606651"
"a2_383" = "2745774678"
"a2_380" = "2724258187"
"a2_381" = "2731441730"
"a2_386" = "2767288687"
"a2_387" = "2774443556"
"a2_384" = "2752940719"
"a2_385" = "2760071008"
"a2_388" = "2781625171"
"a2_389" = "2788794206"
"a1_613" = "2457976346"
"a1_612" = "3545547090"
"a1_611" = "987248910"
"a2_368" = "2638239257"
"a2_369" = "2645407198"
"a1_610" = "2653596027"
"a2_88" = "630888815"
"a2_89" = "638056701"
"a2_84" = "602207265"
"a2_85" = "609373730"
"a2_86" = "616538869"
"a2_87" = "623707607"
"a2_80" = "573522696"
"a2_81" = "580706542"
"a2_82" = "587870372"
"a2_83" = "595041915"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161401009"
"a2_163" = "1168569406"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190070915"
"a2_167" = "1197239994"
"a2_164" = "1175739353"
"a2_165" = "1182902873"
"a3_690" = "668723035"
"a3_679" = "589715310"
"a1_666" = "3953794606"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "3811491260"
"a1_450" = "2055686028"
"a1_453" = "549674462"
"a1_452" = "2729735930"
"a1_455" = "1054531289"
"a1_454" = "4043757519"
"a1_457" = "3646266975"
"a1_456" = "3916066017"
"a1_459" = "1118212949"
"a1_458" = "88920312"
"a1_693" = "576687909"
"a1_692" = "829878415"
"a1_691" = "2265141101"
"a1_690" = "3155268814"
"a1_697" = "3881024165"
"a1_696" = "1880117254"
"a1_695" = "1103160697"
"a1_694" = "316527081"
"a1_699" = "1072560460"
"a1_698" = "147442116"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "2569638124"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "4193915642"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "2587903561"
"a4_387" = "2774449827"
"a1_940" = "1561844083"
"a1_752" = "1279429548"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537687954"
"a2_74" = "530521427"
"a2_77" = "552020208"
"a2_76" = "544861383"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509002637"
"a2_70" = "501835158"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523339022"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "2137103104"
"a1_876" = "1099609778"
"a4_759" = "1146395543"
"a2_72" = "516173523"
"a1_873" = "3568108438"
"a1_872" = "2925885811"
"a1_871" = "1001646114"
"a1_870" = "3155463560"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "683376628"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_985" = "2766616889"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "2235473052"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "1360949679"
"a1_437" = "2827984832"
"a3_960" = "2604335593"
"a2_553" = "3964522389"
"a2_552" = "3957352644"
"a2_551" = "3950189480"
"a2_550" = "3943019200"
"a2_557" = "3993192010"
"a2_556" = "3986037823"
"a2_555" = "3978854503"
"a2_554" = "3971690340"
"a2_889" = "2078388499"
"a2_888" = "2071211930"
"a2_559" = "4007540207"
"a2_558" = "4000373123"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075550690"
"a2_428" = "3068380257"
"a2_427" = "3061216155"
"a2_426" = "3054047703"
"a2_425" = "3046880030"
"a2_424" = "3039714142"
"a2_423" = "3032532434"
"a2_422" = "3025366909"
"a2_421" = "3018198978"
"a2_420" = "3011032450"
"a1_758" = "1834404705"
"a2_565" = "4050563039"
"a4_984" = "2759447768"
"a2_959" = "2580227432"
"a2_958" = "2573056879"
"a2_957" = "2565874506"
"a2_956" = "2558707123"
"a2_955" = "2551539784"
"a2_954" = "2544371936"
"a1_785" = "1167996344"
"a2_952" = "2530038061"
"a2_951" = "2522859386"
"a2_950" = "2515692286"
"a1_208" = "476150156"
"a1_209" = "2946771556"
"a1_204" = "788936434"
"a1_205" = "3893003007"
"a1_206" = "1203452505"
"a1_207" = "13613428"
"a1_200" = "129397110"
"a1_201" = "2281697106"
"a1_202" = "1295828569"
"a1_203" = "2443533765"
"a2_777" = "1275431354"
"a2_776" = "1268273231"
"a2_775" = "1261106848"
"a2_774" = "1253926058"
"a2_773" = "1246758151"
"a2_772" = "1239591939"
"a2_771" = "1232423886"
"a2_770" = "1225257442"
"a2_779" = "1289775793"
"a2_778" = "1282609549"
"a2_395" = "2831809094"
"a2_394" = "2824627100"
"a2_397" = "2846143746"
"a2_396" = "2838975236"
"a2_391" = "2803135981"
"a2_390" = "2795961679"
"a2_393" = "2817458889"
"a2_392" = "2810287277"
"a2_399" = "2860472510"
"a2_398" = "2853318339"
"a2_568" = "4072057994"
"a2_569" = "4079223470"
"a2_379" = "2717105745"
"a2_378" = "2709922465"
"a2_373" = "2674088758"
"a2_372" = "2666906146"
"a2_371" = "2659740636"
"a2_370" = "2652572258"
"a2_377" = "2702756638"
"a2_376" = "2695590949"
"a2_375" = "2688421899"
"a2_374" = "2681257636"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283264000"
"a2_178" = "1276111865"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254588670"
"a2_174" = "1247422417"
"a2_177" = "1268936755"
"a2_176" = "1261773546"
"a2_171" = "1225920796"
"a2_170" = "1218756271"
"a2_173" = "1240254901"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
"a1_510" = "2573480836"
"a1_511" = "271414938"
"a1_512" = "3737235548"
"a1_513" = "1600434266"
"a1_514" = "2063194011"
"a1_515" = "2357884284"
"a1_516" = "205616344"
"a1_517" = "1088677204"
"a1_518" = "3966457848"
"a1_519" = "3372469712"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "994727998"
"a3_514" = "3667976427"
"a2_543" = "3892834456"
"a1_424" = "754190616"
"a1_425" = "3230432477"
"a1_426" = "314917917"
"a1_427" = "3613940341"
"a1_420" = "1974254369"
"a1_421" = "418032348"
"a1_422" = "3361800369"
"a1_423" = "1114215011"
"a3_199" = "1409969486"
"a1_428" = "1150560797"
"a1_429" = "3463033798"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623241250"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "2202649324"
"a1_739" = "3251497818"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "3761584953"
"a2_915" = "2264783360"
"a1_865" = "2630526234"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_863" = "1425454915"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"
"a4_871" = "1949337095"
"a1_990" = "1711785386"
"a1_991" = "2572582632"
"a3_689" = "661144376"
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "3804388363"
"a1_849" = "1022432269"
"a1_439" = "3794860394"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450988845"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "3039680124"
"a1_199" = "1026262825"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "3334916509"
"a4_145" = "1039522545"
"a1_190" = "25480867"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752277461"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "129301357"

"a1_663" = "3783854246"
"a3_965" = "2639793036"
"a1_660" = "3564685583"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "2525688044"
"a1_664" = "1190736629"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "3451562528"
"a1_0" = "2169305196"
"a1_1" = "1660883163"
"a1_2" = "1243490590"
"a1_3" = "3337546098"
"a1_4" = "269545523"
"a1_5" = "207377311"
"a1_6" = "2529715340"
"a1_7" = "2267482477"
"a1_8" = "1714583675"
"a1_9" = "1807461430"
"a2_566" = "4057714228"
"a2_567" = "4064900848"
"a2_564" = "4043387000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029053981"
"a2_563" = "4036222723"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953686555"
"a2_413" = "2960845460"
"a2_410" = "2939346015"
"a2_411" = "2946513669"
"a2_416" = "2982347381"
"a2_417" = "2989531114"
"a2_414" = "2968013210"
"a2_415" = "2975177234"
"a2_418" = "2996697901"
"a2_419" = "3003866239"
"a2_962" = "2601725372"
"a2_963" = "2608889908"
"a2_960" = "2587391437"
"a2_961" = "2594557430"
"a2_966" = "2630408659"
"a2_967" = "2637574215"
"a2_964" = "2616059093"
"a4_950" = "2515697654"
"a1_631" = "2711233882"
"a2_968" = "2644743003"
"a2_969" = "2651908818"
"a4_564" = "4043384244"
"a1_219" = "1357959396"
"a1_218" = "3401883715"
"a1_217" = "1342643223"
"a1_216" = "3642318070"
"a1_215" = "3273602251"
"a1_214" = "3295069705"
"a1_213" = "1183105633"
"a1_212" = "1077559555"
"a1_211" = "2848010922"
"a1_210" = "636769827"
"a2_988" = "2788130357"
"a2_989" = "2795294942"
"a4_567" = "4064891607"
"a1_630" = "2670847918"
"a2_980" = "2730777204"
"a4_560" = "4014707760"
"a2_982" = "2745110643"
"a4_956" = "2558712380"
"a2_984" = "2759445826"
"a2_985" = "2766611290"
"a2_986" = "2773779517"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a3_991" = "2792683862"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "1422581869"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

Dropped PE files

MD5	File path
976524e681abba35621a3eef9fe8494d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00158602_Rar\%original file name%.exe
de3863de0a59e512dd879207429dd80d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\f.exe
00321d477f76e401373c1fc71c7c4502	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsfE.tmp\Convert.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   wmic.exe:1204
   

2. Delete the original Virus file.
   
3. Delete or disinfect the following files created/modified by the Virus:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button[1].png (458 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\DynamicOfferScreen[1].htm (6591 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_over[1].png (921 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\obhhelper.txt (238 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\f.exe (149252 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (28018 bytes)
   %WinDir%\system.ini (72 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jyyrbr.exe (741 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (952 bytes)
   C:\lyim.pif (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00158602_Rar\%original file name%.exe (7433 bytes)
   C:\autorun.inf (313 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsfE.tmp\Convert.dll (3005 bytes)
   

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: setup
Product Version: 4.0
Legal Copyright: setup
Legal Trademarks: setup
Original Filename:
Internal Name:
File Version:
File Description: setup
Comments: setup Installer
Language: Language Neutral

Company Name: Product Name: setup Product Version: 4.0Legal Copyright: setupLegal Trademarks: setupOriginal Filename: Internal Name: File Version: File Description: setup Comments: setup InstallerLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.47446	f13029054d2580aa2501094fb7699316
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	45056	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	237568	81920	81408	5.50658	3e252384bbcbad972246f3bd417c24d9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=3022&distid=3509&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:AC:63:98&netv=&d1=1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2
hxxp://ppdownloadoffers.outbrowse.netdna-cdn.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://installer.apps-track.com/Installer/Flow?pubid=3022&distid=3509&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:AC:63:98&netv=&d1=1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2	54.243.114.89
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg	198.232.124.224
hxxp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&	108.161.189.33
hxxp://static.revenyou.com/offers/images/Theme8/button.png	198.232.124.224
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg	198.232.124.224

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 03 Jul 2014 00:31:09 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<

<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 03 Jul 2014 00:31:10 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<

<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 03 Jul 2014 00:31:10 GMT

Content-Type: image/png

Content-Length: 921

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT

ETag: "f072da2a092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 10 Jul 2014 00:31:10 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."%=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[........sL..?@.o....y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K........YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N........*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..tsvP!.U0.q.......9z.e ..0.ALt..@l..2iR.2............. .>=...{WVim....f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o6......@..........n.^......IEND.B`.....

GET /offers/images/Theme8/button.png HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 03 Jul 2014 00:31:10 GMT

Content-Type: image/png

Content-Length: 458

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT

ETag: "1b5642f092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 10 Jul 2014 00:31:10 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`.HTTP/1.1 200 OK..Date: Thu, 03 Jul 2014 00:31:10 GMT..Content-Type: image/png..Content-Length: 458..Connection: keep-alive..Cache-Control: max-age=604800..Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT..ETag: "1b5642f092ce1:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..Expires: Thu, 10 Jul 2014 00:31:10 GMT..X-Cache: HIT..Accept-Ranges: bytes...PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...

<<

<<< skipped >>>

GET /Installer/Flow?pubid=3022&distid=3509&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:AC:63:98&netv=&d1=1&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&diskserial=-1465484763&version=4.2 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: installer.apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 03 Jul 2014 00:31:18 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 12223

Connection: keep-alive

..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"83$.Fmkcsez_oajgRvjdo"8.)( 0'3)7 ,/() ).QagI`q.3 .&!NeeF]t/2.4!., M]khpqH`ie 5.Qbpqo`h .QjnRr\d.Aa^]g^p^nnn ).>j\sp\`oe.&.?bqqlh^ur`\.=_q[!("Nmg_naqCC.:02$.:jt[xoOda]m.8-&!EsU\ao?moCmot_gd.3/).DteSMD.3 .&!?okhYi]Jfhd.: .$.Hdc_qQRJ.2.arqj9 /ma^`kq nga-_khn&ro[bg.aje*(mc`dns-?qiZkf]NbfcmK^kcbh>kfd`jd];/1/"dgnld];0//5&j`Y_i;.080&ajmimpvcc924-.nrq_cs930!\a[;- g^=0.$.K_q_!6-/'.<]bfnhkn_g<\m_.4!-5241(*2107)130(2.*.;mpitdjplcpLdcKctk.3 .&!Lawjmo.8* .Eda]^mgs_!6-/'.KkmjiseolMYo^ 7'0("Bdk^kcm[m_yP\l`.8* .Sj`]k:dq_qEnqoYge 7*|({ KgnmCu_!6" '.KkcBrd.: .$.<mjjnjeloLtic.47("Kjfdmgw[seolOqk^q.4!--/2%,0 -. .RcbC`r 7.!("P`_F^w3.!6" '.M^nllsJak`.5.Tflsqaj.%.Ijrm,DD.&.Aharma]sc.#.=gpnqebso]_.B^n`., Kjj]s`nH@"8.,'.?iq`usMa^`k 7* .IqRYdmDllHjsr\dg.8.&!AxcPJG.8.. .Cmhe\gbIcma"8..'.Mc`dnUPG.5.fqno6/-j^a^pp(sde \hkl ql`_k,^gh(-l`earq*<tg_jcbKfd`jN\pb_m;oda]mbb:,63&bdkobb:-4,9$g]\]n: 554$^gpgrosh`=01*!lwp\hp=1-.__`:*Û;-.'.P^nd.: ,$.:bacseol\d?Zr^.9.11-13&/1.54-/0- 0 ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7'0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0("Qg]`i?cndnIlnl\ej.4/y,y.HjlrBrd.: .$.Ipb?wa"8..'.AlgokncilOrnb.94, Hgibrft`pimiLticp.9.1 -%.&2*1,-7 '.M^eH_x.: .$.KcdEdu62.2..*.LdlopoF\fc.4!Ripom\e.*.XkuRpZ`.?`]dhep\ljk.(.EkcsnZ\lc.&!Lrm_m^mGA.9.8*.9gp_vmNbfcm.5)*.CrSago>jkGkms]lj.2,%

<<

<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offers.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 03 Jul 2014 00:31:09 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 32737

Connection: keep-alive

Cache-Control: max-age=86400

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Fri, 04 Jul 2014 00:31:09 GMT

X-Cache: MISS

<html>. <head>. <title>265 - NonProduct (FLV Player)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-left:1px; right: 1%; background:url("hXXp://static.revenyou.com/offers/images/Theme8/button.png");} .divAccept { text-align:center; font-family:Arial halvetica; width:89px; position:absolute; font-size:12px; bottom: 7px; margin-left:1px; right: 2%;} .divDecline { text-align:center;height:26px; bottom: 8px; cursor:pointer; font-family:Arial helvetica; font-size:12px; position:absolute; left:1%; padding-top: 4px;} .divAgreementLeadP{ position:absolute; bottom:46px; left:3px;font-size:10px; } #divAgreementLeadPWelcome {bottom:46px;position:absolute;left:187px;font-size:10px;} a:visited { color:Blue

<<

<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 03 Jul 2014 00:31:09 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<

<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 03 Jul 2014 00:31:10 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<

<<< skipped >>>

GET /offers/images/Theme8/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offers.the-apps-track.com//offers/DynamicOfferScreen?offerid=265&distid=3509&leadp=1694&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 03 Jul 2014 00:31:10 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 03 Jul 2014 00:31:10 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv

<<

<<< skipped >>>

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1072:

.text

.text

.rdata

.rdata

.data

.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

http://nsis.sf.net/NSIS_Error

http://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|<>/":

*?|<>/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe /PID=3022 /SUBPID=0 /NETWORKID=0 /DISTID=3509 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=Z2dXVpZD1mNGM3NTk1Zi0wY2YxLTQ4NmMtYmQ0ZS05YzZmZDcwNGM2NDI /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1403544134 /VM=2 /DS1= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\f.exe /PID=3022 /SUBPID=0 /NETWORKID=0 /DISTID=3509 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=Z2dXVpZD1mNGM3NTk1Zi0wY2YxLTQ4NmMtYmQ0ZS05YzZmZDcwNGM2NDI /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1403544134 /VM=2 /DS1= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfE.tmp\Convert.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfE.tmp\Convert.dll

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

Convert.dll

Convert.dll

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

> >$>(>,>

> >$>(>,>

2 2$2(2,2

2 2$2(2,2

1,2024282

1,2024282

? ?$?(?0?4?@?`?

? ?$?(?0?4?@?`?

operator

operator

GetProcessWindowStation

GetProcessWindowStation

portuguese-brazilian

portuguese-brazilian

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

9#gyI%S

9#gyI%S

.MGV1'

.MGV1'

zDs.DhLA

zDs.DhLA

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.dat

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.dat

instructionsBv3.dat

instructionsBv3.dat

INSTRU~1.DAT

INSTRU~1.DAT

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfE.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfE.tmp

c:\%original file name%.exe

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskD.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskD.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfE.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfE.tmp

http://installer.apps-track.com

http://installer.apps-track.com

/PID=3022 /SUBPID=0 /NETWORKID=0 /DISTID=3509 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=Z2dXVpZD1mNGM3NTk1Zi0wY2YxLTQ4NmMtYmQ0ZS05YzZmZDcwNGM2NDI /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1403544134 /VM=2 /DS1= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

/PID=3022 /SUBPID=0 /NETWORKID=0 /DISTID=3509 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=Z2dXVpZD1mNGM3NTk1Zi0wY2YxLTQ4NmMtYmQ0ZS05YzZmZDcwNGM2NDI /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1403544134 /VM=2 /DS1= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly>

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly>

SHELL32.DLL

SHELL32.DLL

KERNEL32.DLL

KERNEL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00158602_Rar\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00158602_Rar\%original file name%.exe

http://140.130.141.1/images/image.gif

http://140.130.141.1/images/image.gif

http://torosresidence.com/image.gif

http://torosresidence.com/image.gif

http://www.bulutmakina.com/images/button.gif

http://www.bulutmakina.com/images/button.gif

http://tokatmangali.com/images/image.gif

http://tokatmangali.com/images/image.gif

http://radio21-alyna-fm-vip.hi2.ro/css/images/image.gif

http://radio21-alyna-fm-vip.hi2.ro/css/images/image.gif

http://cdsdrug.com/button.gif

http://cdsdrug.com/button.gif

http://ajansf.com/img/image.gif

http://ajansf.com/img/image.gif

http://derkaotomotiv.com/image.gif

http://derkaotomotiv.com/image.gif

http://ibfemaraguari.com.br/images/image.gif

http://ibfemaraguari.com.br/images/image.gif

http://kiwimilk-viet.com.vn/image.gif

http://kiwimilk-viet.com.vn/image.gif

'r/img/icons/logo.gif

'r/img/icons/logo.gif

http://ayurvedclinic.in/logo.gif

http://ayurvedclinic.in/logo.gif

uCo9%f

uCo9%f

%F`;O

%F`;O

http://89.11

http://89.11

.info/home.gifI

.info/home.gifI

W.text

W.text

L32.dll

L32.dll

^p.At%

^p.At%

rnl.exe?

rnl.exe?

= =$=(=,=0=4=8=<=@

= =$=(=,=0=4=8=<=@

rv:1.9.2.3)

rv:1.9.2.3)

.NEtCLR

.NEtCLR

.klkjw:9fqwiBu

.klkjw:9fqwiBu

f3a.sysB

f3a.sysB

D6c.pBTab

D6c.pBTab

drfig%s:*:

drfig%s:*:

0}.T&?%x=

0}.T&?%x=

~UrlA'W

~UrlA'W

\'Web%

\'Web%

HTTP)s'PJ

HTTP)s'PJ

o.ENHCD

o.ENHCD

KPCKwWEBWUPD

KPCKwWEBWUPD

>*?456789:;<=

>*?456789:;<=

!"#$%&'()* ,-./01230 0

!"#$%&'()* ,-./01230 0

MSVCRT.dll

MSVCRT.dll

WS2_32.dll

WS2_32.dll

k W.sL

k W.sL

$Fu.Pa$

$Fu.Pa$

1.0.0.1

1.0.0.1

convert.dll

convert.dll

1.0.0.2

1.0.0.2

WUSER32.DLL

WUSER32.DLL

- floating point support not loaded

- floating point support not loaded

%original file name%.exe_1072_rwx_0043B000_00011000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00158602_Rar\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\00158602_Rar\%original file name%.exe

%original file name%.exe

%original file name%.exe

.rsrc

.rsrc

.text

.text

c:\%original file name%.exe

c:\%original file name%.exe

http://140.130.141.1/images/image.gif

http://140.130.141.1/images/image.gif

http://torosresidence.com/image.gif

http://torosresidence.com/image.gif

http://www.bulutmakina.com/images/button.gif

http://www.bulutmakina.com/images/button.gif

http://tokatmangali.com/images/image.gif

http://tokatmangali.com/images/image.gif

http://radio21-alyna-fm-vip.hi2.ro/css/images/image.gif

http://radio21-alyna-fm-vip.hi2.ro/css/images/image.gif

http://cdsdrug.com/button.gif

http://cdsdrug.com/button.gif

http://ajansf.com/img/image.gif

http://ajansf.com/img/image.gif

http://derkaotomotiv.com/image.gif

http://derkaotomotiv.com/image.gif

http://ibfemaraguari.com.br/images/image.gif

http://ibfemaraguari.com.br/images/image.gif

http://kiwimilk-viet.com.vn/image.gif

http://kiwimilk-viet.com.vn/image.gif

'r/img/icons/logo.gif

'r/img/icons/logo.gif

http://ayurvedclinic.in/logo.gif

http://ayurvedclinic.in/logo.gif

uCo9%f

uCo9%f

%F`;O

%F`;O

http://89.11

http://89.11

.info/home.gifI

.info/home.gifI

W.text

W.text

L32.dll

L32.dll

^p.At%

^p.At%

rnl.exe?

rnl.exe?

= =$=(=,=0=4=8=<=@

= =$=(=,=0=4=8=<=@

rv:1.9.2.3)

rv:1.9.2.3)

.NEtCLR

.NEtCLR

.klkjw:9fqwiBu

.klkjw:9fqwiBu

f3a.sysB

f3a.sysB

D6c.pBTab

D6c.pBTab

drfig%s:*:

drfig%s:*:

0}.T&?%x=

0}.T&?%x=

~UrlA'W

~UrlA'W

\'Web%

\'Web%

HTTP)s'PJ

HTTP)s'PJ

o.ENHCD

o.ENHCD

KPCKwWEBWUPD

KPCKwWEBWUPD

>*?456789:;<=

>*?456789:;<=

!"#$%&'()* ,-./01230 0

!"#$%&'()* ,-./01230 0

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

f.exe_1976:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

spKey

spKey

szKey

szKey

keyCur

keyCur

hKey

hKey

cSubKeys

cSubKeys

cmdline

cmdline

urlStr

urlStr

wurl

wurl

bstrLicKey

bstrLicKey

cchLicKey

cchLicKey

nMsg

nMsg

vurl

vurl

bstrURLOut

bstrURLOut

rtExecmd

rtExecmd

rtExeurl

rtExeurl

reportURL

reportURL

zErrMsg

zErrMsg

compiledSql

compiledSql

sqliteCookieFiles

sqliteCookieFiles

htmlDecodedUrlValue

htmlDecodedUrlValue

endParamKeys

endParamKeys

dynamicProductKeys

dynamicProductKeys

wUrlQS

wUrlQS

wUrl

wUrl

sqliteHistoryFiles

sqliteHistoryFiles

readDownloadUrl

readDownloadUrl

.hL3Q

.hL3Q

searchUrl

searchUrl

finishUrlForOuterInstaller

finishUrlForOuterInstaller

reportUrl

reportUrl

httpResponse

httpResponse

fullCmd

fullCmd

subkey

subkey

hostBrwCmd

hostBrwCmd

tyUrl

tyUrl

baseKeys

baseKeys

cmdLineW

cmdLineW

cmdW

cmdW

exeUrlW

exeUrlW

urlW

urlW

cmdLine

cmdLine

exeUrl

exeUrl

cbMaxSubKey

cbMaxSubKey

achKey

achKey

offersMainUrl

offersMainUrl

antivirusesRegKeys64Arr

antivirusesRegKeys64Arr

antivirusesRegKeys32Arr

antivirusesRegKeys32Arr

reg64Key

reg64Key

postExe

postExe

preExe

preExe

regKey

regKey

offerUrl

offerUrl

regKey64

regKey64

cbSubKeys

cbSubKeys

zMsg

zMsg

nCellKey

nCellKey

nMaxKey

nMaxKey

nMinKey

nMinKey

nKey

nKey

zErrmsg

zErrmsg

keyInfo

keyInfo

errMsg

errMsg

t.hx3S

t.hx3S

osCmd

osCmd

finalExePath

finalExePath

urlComp

urlComp

szURLPath

szURLPath

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

RegDeleteKeyExW

RegDeleteKeyExW

RegDeleteKeyTransactedW

RegDeleteKeyTransactedW

RegCreateKeyTransactedW

RegCreateKeyTransactedW

RegOpenKeyTransactedW

RegOpenKeyTransactedW

.vector<T> too long</T>

.vector<T> too long</T>