Virus.Win32.Sality_0df23b2368 – Adaware

Trojan-Dropper.Win32.Dapato.bhqx (Kaspersky), Virus.Win32.Sality.at (v) (VIPRE), P2P-Worm.Win32.Palevo!IK (Emsisoft), GenericUSBInfector.YR, GenericProxy.YR, GenericSYNFlooder.YR, GenericUDPFlooder.YR, GenericDNSBlocker.YR, GenericMSNWorm.YR, GenericIRCBot.YR, GenericAutorunWorm.YR, VirusSality.YR, WormDorkbot.YR, GenericPhysicalDrive0.YR, GenericInjector.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Banker, Trojan, Flooder, Worm, P2P-Worm, Virus, WormAutorun, IRCBot, MSNWorm, DNSBlocker, UDPFlooder, SYNFlooder, Trojan-Proxy, USBInfector

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0df23b236896bd103bda905d61633c33

SHA1: a5b986198018c4998509ff25d0de079e8ad6b4a8

SHA256: 2aaa845d8c08c97b4808316dc158fdc8babac21217138a669fc9ee5c6c3d8388

SSDeep: 6144:mO0bgt5Nh8Xi0oc9wToz6GyGg2LYawMrMbYWSAHzE3lbkFf2s:m9Ih6np7z6GyELYAQVSaE3lbkFOs

Size: 329728 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: RealTimeGaming Software

Created at: 2011-09-03 07:53:36

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
MSNWorm	A worm can spread its copies through the MSN Messanger.
DNSBlocker	A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet.
UDPFlooder	This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.
SYNFlooder	This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.
Trojan-Proxy	This program can launch a proxy server (SOCKS4) on a designated TCP port.
USBInfector	A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Virus creates the following process(es):

TELNET.EXE:2724
TELNET.EXE:840
TELNET.EXE:2328
TELNET.EXE:2436
TELNET.EXE:2632
TELNET.EXE:3140
TELNET.EXE:2380
TELNET.EXE:3144
TELNET.EXE:3652
TELNET.EXE:3076
TELNET.EXE:3268
TELNET.EXE:2072
TELNET.EXE:3292
NOTEPAD.EXE:3596
NOTEPAD.EXE:2292
NOTEPAD.EXE:664
NOTEPAD.EXE:2968
NOTEPAD.EXE:3416
NOTEPAD.EXE:3008
NOTEPAD.EXE:2804
NOTEPAD.EXE:2524
NOTEPAD.EXE:3236
NOTEPAD.EXE:3380
NOTEPAD.EXE:1772
NOTEPAD.EXE:3512
NOTEPAD.EXE:2888
NOTEPAD.EXE:3792
NOTEPAD.EXE:2152
NOTEPAD.EXE:1292
NOTEPAD.EXE:1464
NOTEPAD.EXE:2112
NOTEPAD.EXE:2364
NOTEPAD.EXE:2668
NOTEPAD.EXE:2604
NOTEPAD.EXE:2872
NOTEPAD.EXE:2456
NOTEPAD.EXE:3764
NOTEPAD.EXE:2916
NOTEPAD.EXE:2628
NOTEPAD.EXE:2608
NOTEPAD.EXE:3624
NOTEPAD.EXE:2764
NOTEPAD.EXE:2696
NOTEPAD.EXE:3368
NOTEPAD.EXE:3176
NOTEPAD.EXE:2212
NOTEPAD.EXE:3204
NOTEPAD.EXE:3540
NOTEPAD.EXE:3472
NOTEPAD.EXE:3564
NOTEPAD.EXE:2272
NOTEPAD.EXE:3500
NOTEPAD.EXE:3444
NOTEPAD.EXE:2408
NOTEPAD.EXE:2256
NOTEPAD.EXE:3252
0df23b236896bd103bda905d61633c33.exe:640
0df23b236896bd103bda905d61633c33.exe:404
0df23b236896bd103bda905d61633c33.exe:1748
Ctkmko.exe:744
Ctkmko.exe:1576
Ctkmko.exe:940

File activity

The process 0df23b236896bd103bda905d61633c33.exe:404 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\J7ygghyk6L1AItgfM1t.tmp (3 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)

The process 0df23b236896bd103bda905d61633c33.exe:1748 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Ctkmko.exe (2105 bytes)

The process Ctkmko.exe:744 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\J7ygghyk6L1AItgfM1t.tmp (3 bytes)

The Virus deletes the following file(s):

C:\7edd8 (0 bytes)

Registry activity

The process TELNET.EXE:2724 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 4D 48 1D 6E FF 6E DF E5 08 30 12 92 C2 C6 47"

The process TELNET.EXE:840 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 32 5A 54 C1 1D 45 CD 92 28 A9 C5 75 94 94 7D"

The process TELNET.EXE:2328 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 17 76 92 9B 92 E0 7A 3B B0 23 C9 30 DD 72 4E"

The process TELNET.EXE:2436 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 38 93 35 8B 1D 93 91 B9 AD 20 BF F9 54 AD 8E"

The process TELNET.EXE:2632 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC F5 51 E3 40 44 C7 BD F3 C9 23 01 11 6E B6 47"

The process TELNET.EXE:3140 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 6A 91 05 DC 18 7A C4 02 B7 B7 D8 A5 5B 56 7B"

The process TELNET.EXE:2380 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 8F 7D 08 E5 83 78 D9 72 BC 48 90 75 2F 17 5E"

The process TELNET.EXE:3144 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 12 47 AF 7C 9C B4 6C 29 19 FA 07 D5 DD 1F F5"

The process TELNET.EXE:3652 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 81 5A B4 06 12 FD 44 33 D3 A0 4D 24 31 CD 4D"

The process TELNET.EXE:3076 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 7A CB 0C 58 7A 11 B6 08 0D 35 E2 AF 60 24 CB"

The process TELNET.EXE:3268 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 64 12 87 D5 28 B8 E3 72 E4 92 DB 12 61 9E 6C"

The process TELNET.EXE:2072 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 67 42 72 96 5D 32 E1 0C A7 E5 95 0D B5 D2 D0"

The process TELNET.EXE:3292 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 31 3D A3 93 41 17 63 70 87 51 C7 CC CA 70 10"

The process NOTEPAD.EXE:3596 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B A7 8C 70 41 40 71 09 E4 1A 1E 9B F3 FE AD B2"

The process NOTEPAD.EXE:2292 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 66 39 AD 76 96 C4 B2 BA 2B 0C D3 CE 2A 67 91"

The process NOTEPAD.EXE:664 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 B7 65 98 1E 8F 41 90 5B 04 1B 8D 1C 41 DA 22"

The process NOTEPAD.EXE:2968 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 6B ED 87 DC A8 C9 EE 62 A6 B9 49 38 7B E8 22"

The process NOTEPAD.EXE:3416 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 C4 3A AE B9 09 D8 3D E5 9F 19 12 69 DC E0 D9"

The process NOTEPAD.EXE:3008 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 F7 06 19 8A 29 B8 BC E9 14 EF 60 D9 F6 ED 4C"

The process NOTEPAD.EXE:2804 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 E5 7F F1 E1 FA B3 D9 A0 11 E1 E6 AA 3E 0E BC"

The process NOTEPAD.EXE:2524 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 79 B6 3D F5 60 3E F2 77 59 9D D8 51 7F ED 8E"

The process NOTEPAD.EXE:3236 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 A3 92 67 8C 8D 9D 93 39 C5 6E 73 96 4C 10 B9"

The process NOTEPAD.EXE:3380 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 2D 8B C4 18 DC C9 18 2F 4E FF 0B A4 4C 2D 76"

The process NOTEPAD.EXE:1772 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 A2 02 61 02 9D 04 64 EB 15 27 38 A6 62 BA 53"

The process NOTEPAD.EXE:3512 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 58 EB 40 3A 60 7A 71 33 86 31 20 58 BE AD AF"

The process NOTEPAD.EXE:2888 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 E6 68 84 7D 1A CA B6 1B 4E C3 B6 10 6D A2 82"

The process NOTEPAD.EXE:3792 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 14 4F 1F D5 A1 FF 4F F2 6C 41 A4 92 96 66 6E"

The process NOTEPAD.EXE:2152 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 17 0C 71 AD 42 D4 8F 57 02 C1 12 73 48 CF 50"

The process NOTEPAD.EXE:1292 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 50 BB 19 3A 02 12 78 B3 FD 3F 04 64 AC C9 8D"

The process NOTEPAD.EXE:1464 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 B4 5A 26 99 BF B7 68 57 B3 14 36 24 57 00 29"

The process NOTEPAD.EXE:2112 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D F9 92 EF A5 7E 97 FE 68 49 A6 65 B1 B8 2D 91"

The process NOTEPAD.EXE:2364 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 3C E3 E5 00 1E D0 68 1B 12 20 40 6F 59 31 99"

The process NOTEPAD.EXE:2668 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD AF 73 E7 C7 B4 88 E0 F8 A5 A2 B6 31 26 D9 55"

The process NOTEPAD.EXE:2604 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 13 8B 57 E0 11 D3 D1 BB 3F DF 0B 88 9C E2 CC"

The process NOTEPAD.EXE:2872 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 55 37 B6 6E C1 37 B4 09 69 49 4F EE 50 5A F4"

The process NOTEPAD.EXE:2456 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED A3 67 EF 40 EC 14 43 CB D7 EE 17 C9 29 7B FB"

The process NOTEPAD.EXE:3764 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 9D 49 FA 99 A9 A1 0E A7 F9 15 53 22 52 2E BB"

The process NOTEPAD.EXE:2916 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 83 30 9D EC 41 98 1D 38 0D AE 0B 9E F5 40 38"

The process NOTEPAD.EXE:2628 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 00 F5 63 9A 90 4F FB D2 BC C2 0F E9 FD 82 21"

The process NOTEPAD.EXE:2608 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 92 5F 48 2F F4 0B 7D 5E 75 D9 03 1C 87 A5 A0"

The process NOTEPAD.EXE:3624 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA E6 51 13 40 1E 74 19 62 A6 C1 8D 80 76 02 BA"

The process NOTEPAD.EXE:2764 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 EA A9 94 B0 27 AF 1B 2E 79 A6 79 15 78 3D 27"

The process NOTEPAD.EXE:2696 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 27 FC 3F A3 A3 7A 72 9D EE 0D D8 8F 1C 24 00"

The process NOTEPAD.EXE:3368 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 F8 1B EA 56 0B 2D 27 8F 2E C1 62 D3 78 A7 00"

The process NOTEPAD.EXE:3176 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 D7 36 91 1F 06 8E 2F B5 89 E6 89 B6 2E DB 62"

The process NOTEPAD.EXE:2212 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 79 17 74 41 62 B4 DE 70 40 EA FE 75 93 85 6F"

The process NOTEPAD.EXE:3204 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 5E E7 A0 87 00 C1 D3 B7 94 C8 D1 6B 43 FB 73"

The process NOTEPAD.EXE:3540 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED AA 62 99 9E AE 06 2D 74 2D E0 C8 6B 50 4A 83"

The process NOTEPAD.EXE:3472 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 2E DA 7B 79 BC 47 BC D2 D0 0C C6 D5 E8 EC 60"

The process NOTEPAD.EXE:3564 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8B CE 06 6A 83 23 D5 51 DD A2 3B 49 D7 D9 7F"

The process NOTEPAD.EXE:2272 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 4F 34 43 CA 01 0A FD B7 68 70 C4 A4 3D DE CE"

The process NOTEPAD.EXE:3500 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 A2 F2 87 14 A2 DD 64 D7 16 8F 03 90 DE 56 6A"

The process NOTEPAD.EXE:3444 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 3B 16 CC B7 82 0D C9 5C A0 3B 58 99 7A 3C C7"

The process NOTEPAD.EXE:2408 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 28 2B 5D F0 12 6B BA D6 8B C0 97 AF B0 1B CB"

The process NOTEPAD.EXE:2256 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 4D EA A0 69 01 BF A1 DD 69 56 F8 24 60 22 6C"

The process NOTEPAD.EXE:3252 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 60 61 56 51 D1 77 DC D3 48 4F 14 5B BA 9F 9C"

The process 0df23b236896bd103bda905d61633c33.exe:640 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 14 68 9C 85 A2 A6 86 59 30 8E 1E DB 0D 97 39"

The process 0df23b236896bd103bda905d61633c33.exe:404 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\adm914]
"a2_15" = "107543312"

[HKCU\Software\adm914]
"a2_14" = "100363151"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\adm914]
"a2_16" = "114709912"

[HKCU\Software\adm914]
"a2_11" = "78857559"

[HKCU\Software\adm914]
"a2_10" = "71696266"

[HKCU\Software\adm914]
"a2_13" = "93193583"

[HKCU\Software\adm914]
"a2_12" = "86026876"

[HKCU\Software\adm914]
"a2_19" = "136211138"

[HKCU\Software\adm914]
"a2_18" = "129054174"

[HKCU\Software\Aas]
"a3_78" = "542637991"

[HKCU\Software\Aas]
"a3_79" = "549622726"

[HKCU\Software\Aas]
"a3_72" = "533156193"

[HKCU\Software\Aas]
"a3_73" = "506656128"

[HKCU\Software\Aas]
"a3_70" = "485103791"

[HKCU\Software\Aas]
"a3_71" = "525712590"

[HKCU\Software\Aas]
"a3_76" = "561686245"

[HKCU\Software\Aas]
"a3_77" = "568613636"

[HKCU\Software\Aas]
"a3_74" = "513568291"

[HKCU\Software\Aas]
"a3_75" = "554631746"

[HKCU\Software\adm914]
"a4_119" = "853125399"

[HKCU\Software\adm914]
"a4_118" = "845956278"

[HKCU\Software\adm914]
"a4_117" = "838787157"

[HKCU\Software\adm914]
"a4_116" = "831618036"

[HKCU\Software\adm914]
"a4_115" = "824448915"

[HKCU\Software\adm914]
"a4_114" = "817279794"

[HKCU\Software\adm914]
"a4_113" = "810110673"

[HKCU\Software\adm914]
"a4_112" = "802941552"

[HKCU\Software\adm914]
"a4_111" = "795772431"

[HKCU\Software\adm914]
"a4_110" = "788603310"

[HKCU\Software\adm914]
"a2_160" = "1147056472"

[HKCU\Software\adm914]
"a2_161" = "1154234543"

[HKCU\Software\adm914]
"a2_162" = "1161403562"

[HKCU\Software\adm914]
"a2_163" = "1168571250"

[HKCU\Software\adm914]
"a2_164" = "1175737890"

[HKCU\Software\adm914]
"a2_165" = "1182903889"

[HKCU\Software\adm914]
"a2_166" = "1190071476"

[HKCU\Software\adm914]
"a2_167" = "1197236939"

[HKCU\Software\adm914]
"a2_168" = "1204407238"

[HKCU\Software\adm914]
"a2_169" = "1211585321"

[HKCU\Software\adm914]
"a2_17" = "121877337"

[HKCU\Software\adm914]
"a4_337" = "2415993777"

[HKCU\Software\adm914]
"a4_336" = "2408824656"

[HKCU\Software\adm914]
"a4_335" = "2401655535"

[HKCU\Software\adm914]
"a4_334" = "2394486414"

[HKCU\Software\adm914]
"a4_333" = "2387317293"

[HKCU\Software\adm914]
"a4_332" = "2380148172"

[HKCU\Software\adm914]
"a4_331" = "2372979051"

[HKCU\Software\adm914]
"a4_330" = "2365809930"

[HKCU\Software\adm914]
"a4_339" = "2430332019"

[HKCU\Software\adm914]
"a4_338" = "2423162898"

[HKCU\Software\Aas]
"a3_94" = "690598327"

[HKCU\Software\Aas]
"a3_95" = "698045910"

[HKCU\Software\Aas]
"a3_96" = "671534665"

[HKCU\Software\Aas]
"a3_97" = "678453992"

[HKCU\Software\Aas]
"a3_90" = "662052915"

[HKCU\Software\Aas]
"a3_91" = "669107282"

[HKCU\Software\Aas]
"a3_92" = "643004661"

[HKCU\Software\Aas]
"a3_93" = "649993492"

[HKCU\Software\Aas]
"a3_98" = "685967115"

[HKCU\Software\Aas]
"a3_99" = "726580138"

[HKCU\Software\adm914]
"a1_138" = "3171167751"

[HKCU\Software\adm914]
"a1_139" = "2341783782"

[HKCU\Software\adm914]
"a2_304" = "2179410504"

[HKCU\Software\adm914]
"a2_305" = "2186577562"

[HKCU\Software\adm914]
"a2_306" = "2193743886"

[HKCU\Software\adm914]
"a2_307" = "2200925371"

[HKCU\Software\adm914]
"a2_300" = "2150741924"

[HKCU\Software\adm914]
"a2_301" = "2157911883"

[HKCU\Software\adm914]
"a2_302" = "2165078270"

[HKCU\Software\adm914]
"a2_303" = "2172246219"

[HKCU\Software\adm914]
"a2_308" = "2208095467"

[HKCU\Software\adm914]
"a2_309" = "2215261475"

[HKCU\Software\adm914]
"a4_249" = "1785111129"

[HKCU\Software\adm914]
"a4_248" = "1777942008"

[HKCU\Software\adm914]
"a4_243" = "1742096403"

[HKCU\Software\adm914]
"a4_242" = "1734927282"

[HKCU\Software\adm914]
"a4_241" = "1727758161"

[HKCU\Software\adm914]
"a4_240" = "1720589040"

[HKCU\Software\adm914]
"a4_247" = "1770772887"

[HKCU\Software\adm914]
"a4_246" = "1763603766"

[HKCU\Software\adm914]
"a4_245" = "1756434645"

[HKCU\Software\adm914]
"a4_244" = "1749265524"

[HKCU\Software\adm914]
"a3_8" = "40387913"

[HKCU\Software\adm914]
"a3_9" = "47964456"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\adm914]
"a3_189" = "1371569628"

[HKCU\Software\adm914]
"a3_188" = "1364644221"

[HKCU\Software\adm914]
"a3_187" = "1324037274"

[HKCU\Software\adm914]
"a3_186" = "1316587579"

[HKCU\Software\adm914]
"a3_185" = "1309600856"

[HKCU\Software\adm914]
"a3_184" = "1336099833"

[HKCU\Software\adm914]
"a3_183" = "1328654102"

[HKCU\Software\adm914]
"a3_182" = "1288059575"

[HKCU\Software\adm914]
"a3_181" = "1280614100"

[HKCU\Software\adm914]
"a3_180" = "1307177589"

[HKCU\Software\adm914]
"a2_238" = "1706247957"

[HKCU\Software\adm914]
"a2_239" = "1713415629"

[HKCU\Software\adm914]
"a4_39" = "279595719"

[HKCU\Software\adm914]
"a4_38" = "272426598"

[HKCU\Software\adm914]
"a4_35" = "250919235"

[HKCU\Software\adm914]
"a4_34" = "243750114"

[HKCU\Software\adm914]
"a4_37" = "265257477"

[HKCU\Software\adm914]
"a4_36" = "258088356"

[HKCU\Software\adm914]
"a4_31" = "222242751"

[HKCU\Software\adm914]
"a4_30" = "215073630"

[HKCU\Software\adm914]
"a4_33" = "236580993"

[HKCU\Software\adm914]
"a4_32" = "229411872"

[HKCU\Software\adm914]
"a2_326" = "2337130055"

[HKCU\Software\adm914]
"a2_327" = "2344298123"

[HKCU\Software\adm914]
"a2_324" = "2322794254"

[HKCU\Software\adm914]
"a2_325" = "2329965885"

[HKCU\Software\adm914]
"a2_322" = "2308460798"

[HKCU\Software\adm914]
"a2_323" = "2315630381"

[HKCU\Software\adm914]
"a2_320" = "2294115624"

[HKCU\Software\adm914]
"a2_321" = "2301283115"

[HKCU\Software\adm914]
"a3_323" = "2332475426"

[HKCU\Software\adm914]
"a3_322" = "2291868739"

[HKCU\Software\adm914]
"a1_279" = "3333054149"

[HKCU\Software\adm914]
"a1_278" = "3396303332"

[HKCU\Software\adm914]
"a1_277" = "1535034522"

[HKCU\Software\adm914]
"a1_276" = "2161660610"

[HKCU\Software\adm914]
"a1_275" = "653172334"

[HKCU\Software\adm914]
"a1_274" = "2809140328"

[HKCU\Software\adm914]
"a1_273" = "2513820068"

[HKCU\Software\adm914]
"a1_272" = "713187758"

[HKCU\Software\adm914]
"a1_271" = "2470656250"

[HKCU\Software\adm914]
"a1_270" = "3203378195"

[HKCU\Software\adm914]
"a1_69" = "863327213"

[HKCU\Software\adm914]
"a1_68" = "1139659412"

[HKCU\Software\adm914]
"a1_65" = "1253200888"

[HKCU\Software\adm914]
"a1_64" = "2263005744"

[HKCU\Software\adm914]
"a1_67" = "3917127482"

[HKCU\Software\adm914]
"a1_66" = "1122324168"

[HKCU\Software\adm914]
"a1_61" = "526944451"

[HKCU\Software\adm914]
"a1_60" = "216298613"

[HKCU\Software\adm914]
"a1_63" = "705891456"

[HKCU\Software\adm914]
"a1_62" = "3408893221"

[HKCU\Software\adm914]
"a3_27" = "176877690"

[HKCU\Software\adm914]
"a3_26" = "169826203"

[HKCU\Software\adm914]
"a3_25" = "195930936"

[HKCU\Software\adm914]
"a3_24" = "188878681"

[HKCU\Software\adm914]
"a3_23" = "148333302"

[HKCU\Software\adm914]
"a3_22" = "140887575"

[HKCU\Software\adm914]
"a3_21" = "167402932"

[HKCU\Software\adm914]
"a3_20" = "159953365"

[HKCU\Software\adm914]
"a1_309" = "415457451"

[HKCU\Software\adm914]
"a1_308" = "4117673960"

[HKCU\Software\adm914]
"a3_29" = "224868540"

[HKCU\Software\adm914]
"a3_28" = "183868637"

[HKCU\Software\adm914\695404737]
"21507363" = "0"

[HKCU\Software\adm914]
"a2_28" = "200731438"

[HKCU\Software\adm914]
"a2_29" = "207897738"

[HKCU\Software\Aas]
"a1_89" = "2071781484"

[HKCU\Software\Aas]
"a1_88" = "491780109"

[HKCU\Software\adm914]
"a2_20" = "143380476"

[HKCU\Software\adm914]
"a2_21" = "150547569"

[HKCU\Software\adm914]
"a2_22" = "157726065"

[HKCU\Software\adm914]
"a2_23" = "164893607"

[HKCU\Software\adm914]
"a2_24" = "172061464"

[HKCU\Software\adm914]
"a2_25" = "179229623"

[HKCU\Software\adm914]
"a2_26" = "186393229"

[HKCU\Software\adm914]
"a2_27" = "193561806"

[HKCU\Software\adm914]
"a2_212" = "1519858722"

[HKCU\Software\adm914]
"a1_349" = "3729119627"

[HKCU\Software\adm914]
"a2_213" = "1527027297"

[HKCU\Software\adm914]
"a1_348" = "2091554144"

[HKCU\Software\adm914]
"a2_210" = "1505513445"

[HKCU\Software\Aas]
"a1_67" = "4119458877"

[HKCU\Software\Aas]
"a1_66" = "93695069"

[HKCU\Software\Aas]
"a1_65" = "1852518166"

[HKCU\Software\Aas]
"a1_64" = "1717919766"

[HKCU\Software\Aas]
"a1_63" = "246012800"

[HKCU\Software\Aas]
"a1_62" = "1477084113"

[HKCU\Software\Aas]
"a1_61" = "62762562"

[HKCU\Software\Aas]
"a1_60" = "757761128"

[HKCU\Software\adm914]
"a2_216" = "1548525874"

[HKCU\Software\adm914]
"a4_198" = "1419485958"

[HKCU\Software\adm914]
"a1_345" = "1754163460"

[HKCU\Software\Aas]
"a1_69" = "204564083"

[HKCU\Software\Aas]
"a1_68" = "3305735837"

[HKCU\Software\adm914]
"a1_344" = "4246894853"

[HKCU\Software\adm914]
"a2_214" = "1534193757"

[HKCU\Software\adm914]
"a2_215" = "1541364727"

[HKCU\Software\adm914]
"a4_108" = "774265068"

[HKCU\Software\adm914]
"a4_109" = "781434189"

[HKCU\Software\adm914]
"a4_104" = "745588584"

[HKCU\Software\adm914]
"a4_105" = "752757705"

[HKCU\Software\adm914]
"a4_106" = "759926826"

[HKCU\Software\adm914]
"a4_107" = "767095947"

[HKCU\Software\adm914]
"a4_100" = "716912100"

[HKCU\Software\adm914]
"a4_101" = "724081221"

[HKCU\Software\adm914]
"a4_102" = "731250342"

[HKCU\Software\adm914]
"a4_103" = "738419463"

[HKCU\Software\adm914]
"a2_155" = "1111220115"

[HKCU\Software\adm914]
"a2_154" = "1104050978"

[HKCU\Software\Aas]
"a4_35" = "250919235"

[HKCU\Software\adm914]
"a2_156" = "1118386199"

[HKCU\Software\adm914]
"a2_151" = "1082533341"

[HKCU\Software\adm914]
"a2_150" = "1075364232"

[HKCU\Software\adm914]
"a2_153" = "1096870095"

[HKCU\Software\adm914]
"a2_152" = "1089703344"

[HKCU\Software\adm914]
"a2_159" = "1139887126"

[HKCU\Software\adm914]
"a2_158" = "1132718388"

[HKCU\Software\Aas]
"a4_39" = "279595719"

[HKCU\Software\Aas]
"a4_38" = "272426598"

[HKCU\Software\adm914]
"a4_324" = "2322795204"

[HKCU\Software\adm914]
"a4_325" = "2329964325"

[HKCU\Software\adm914]
"a4_326" = "2337133446"

[HKCU\Software\adm914]
"a4_327" = "2344302567"

[HKCU\Software\adm914]
"a4_320" = "2294118720"

[HKCU\Software\adm914]
"a4_321" = "2301287841"

[HKCU\Software\adm914]
"a4_322" = "2308456962"

[HKCU\Software\adm914]
"a4_323" = "2315626083"

[HKCU\Software\adm914]
"a4_328" = "2351471688"

[HKCU\Software\adm914]
"a4_329" = "2358640809"

[HKCU\Software\adm914]
"a3_268" = "1938191309"

[HKCU\Software\adm914]
"a3_269" = "1945182124"

[HKCU\Software\adm914]
"a3_262" = "1861737735"

[HKCU\Software\adm914]
"a3_263" = "1902213606"

[HKCU\Software\adm914]
"a3_260" = "1847235781"

[HKCU\Software\adm914]
"a3_261" = "1854156964"

[HKCU\Software\adm914]
"a3_266" = "1890134667"

[HKCU\Software\adm914]
"a3_267" = "1930745706"

[HKCU\Software\adm914]
"a3_264" = "1909252681"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\adm914]
"a4_258" = "1849633218"

[HKCU\Software\adm914]
"a4_259" = "1856802339"

[HKCU\Software\adm914]
"a4_250" = "1792280250"

[HKCU\Software\adm914]
"a4_251" = "1799449371"

[HKCU\Software\adm914]
"a4_252" = "1806618492"

[HKCU\Software\adm914]
"a4_253" = "1813787613"

[HKCU\Software\adm914]
"a4_254" = "1820956734"

[HKCU\Software\adm914]
"a4_255" = "1828125855"

[HKCU\Software\adm914]
"a4_256" = "1835294976"

[HKCU\Software\adm914]
"a4_257" = "1842464097"

[HKCU\Software\adm914]
"a4_184" = "1319118264"

[HKCU\Software\adm914]
"a4_185" = "1326287385"

[HKCU\Software\adm914]
"a4_186" = "1333456506"

[HKCU\Software\adm914]
"a4_187" = "1340625627"

[HKCU\Software\adm914]
"a3_198" = "1436075335"

[HKCU\Software\adm914]
"a3_199" = "1409966374"

[HKCU\Software\adm914]
"a3_194" = "1407547331"

[HKCU\Software\adm914]
"a4_180" = "1290441780"

[HKCU\Software\adm914]
"a3_196" = "1388559365"

[HKCU\Software\adm914]
"a3_197" = "1429035236"

[HKCU\Software\adm914]
"a3_190" = "1345526207"

[HKCU\Software\adm914]
"a3_191" = "1352565278"

[HKCU\Software\adm914]
"a3_192" = "1393045121"

[HKCU\Software\adm914]
"a3_193" = "1400621920"

[HKCU\Software\adm914]
"a2_209" = "1498342833"

[HKCU\Software\adm914]
"a2_208" = "1491180608"

[HKCU\Software\adm914]
"a2_205" = "1469675498"

[HKCU\Software\adm914]
"a2_204" = "1462495236"

[HKCU\Software\adm914]
"a2_207" = "1484013127"

[HKCU\Software\adm914]
"a2_206" = "1476843175"

[HKCU\Software\adm914]
"a2_201" = "1440991623"

[HKCU\Software\adm914]
"a2_200" = "1433827399"

[HKCU\Software\adm914]
"a2_203" = "1455328763"

[HKCU\Software\adm914]
"a2_202" = "1448158542"

[HKCU\Software\Aas]
"a4_124" = "888971004"

[HKCU\Software\Aas]
"a4_125" = "896140125"

[HKCU\Software\Aas]
"a4_126" = "903309246"

[HKCU\Software\Aas]
"a4_127" = "910478367"

[HKCU\Software\Aas]
"a4_120" = "860294520"

[HKCU\Software\Aas]
"a4_121" = "867463641"

[HKCU\Software\Aas]
"a4_122" = "874632762"

[HKCU\Software\Aas]
"a4_123" = "881801883"

[HKCU\Software\Aas]
"a4_128" = "917647488"

[HKCU\Software\Aas]
"a4_129" = "924816609"

[HKCU\Software\adm914]
"a4_188" = "1347794748"

[HKCU\Software\adm914]
"a2_259" = "1856806241"

[HKCU\Software\adm914]
"a4_189" = "1354963869"

[HKCU\Software\adm914]
"a1_268" = "2812747517"

[HKCU\Software\adm914]
"a1_269" = "4136284573"

[HKCU\Software\adm914]
"a1_264" = "2202286417"

[HKCU\Software\adm914]
"a1_265" = "2631068218"

[HKCU\Software\adm914]
"a1_266" = "3984715384"

[HKCU\Software\adm914]
"a1_267" = "1876077034"

[HKCU\Software\adm914]
"a1_260" = "2343665496"

[HKCU\Software\adm914]
"a1_261" = "2409181081"

[HKCU\Software\adm914]
"a1_262" = "2913063979"

[HKCU\Software\adm914]
"a1_263" = "3724924636"

[HKCU\Software\adm914]
"a1_50" = "3037244495"

[HKCU\Software\adm914]
"a1_51" = "84923402"

[HKCU\Software\adm914]
"a1_52" = "3532743143"

[HKCU\Software\adm914]
"a1_53" = "1380953928"

[HKCU\Software\adm914]
"a1_54" = "2895274536"

[HKCU\Software\adm914]
"a1_55" = "898188062"

[HKCU\Software\adm914]
"a1_56" = "1305042517"

[HKCU\Software\adm914]
"a1_57" = "2134548263"

[HKCU\Software\adm914]
"a1_58" = "3220039986"

[HKCU\Software\adm914]
"a1_59" = "1346469779"

[HKCU\Software\adm914]
"a1_310" = "808116161"

[HKCU\Software\adm914]
"a1_311" = "1679132056"

[HKCU\Software\adm914]
"a1_312" = "2039064701"

[HKCU\Software\adm914]
"a1_313" = "3141014309"

[HKCU\Software\adm914]
"a1_314" = "185096225"

[HKCU\Software\adm914]
"a1_315" = "3061113621"

[HKCU\Software\adm914]
"a1_316" = "2414973683"

[HKCU\Software\adm914]
"a1_317" = "1784097870"

[HKCU\Software\adm914]
"a1_318" = "4191349444"

[HKCU\Software\adm914]
"a1_319" = "704336039"

[HKCU\Software\Aas]
"a1_98" = "2882187097"

[HKCU\Software\Aas]
"a1_99" = "210035629"

[HKCU\Software\adm914]
"a2_39" = "279600646"

[HKCU\Software\adm914]
"a2_38" = "272430984"

[HKCU\Software\Aas]
"a1_92" = "3493780652"

[HKCU\Software\Aas]
"a1_93" = "261033320"

[HKCU\Software\Aas]
"a1_90" = "3338953283"

[HKCU\Software\Aas]
"a1_91" = "1630638117"

[HKCU\Software\Aas]
"a1_96" = "2566002270"

[HKCU\Software\adm914]
"a2_32" = "229414769"

[HKCU\Software\Aas]
"a1_94" = "374296148"

[HKCU\Software\Aas]
"a1_95" = "229793713"

[HKCU\Software\adm914]
"a3_338" = "2439900755"

[HKCU\Software\adm914]
"a4_350" = "2509192350"

[HKCU\Software\Aas]
"a1_74" = "935266911"

[HKCU\Software\Aas]
"a1_75" = "2706934840"

[HKCU\Software\Aas]
"a1_76" = "1244824946"

[HKCU\Software\Aas]
"a1_77" = "1825708404"

[HKCU\Software\Aas]
"a1_70" = "1480917211"

[HKCU\Software\Aas]
"a1_71" = "3891553977"

[HKCU\Software\Aas]
"a1_72" = "1345938947"

[HKCU\Software\Aas]
"a1_73" = "2906370183"

[HKCU\Software\Aas]
"a3_129" = "907869896"

[HKCU\Software\Aas]
"a3_128" = "934369961"

[HKCU\Software\Aas]
"a1_78" = "3192889554"

[HKCU\Software\Aas]
"a1_79" = "4113178550"

[HKCU\Software\Aas]
"a4_50" = "358456050"

[HKCU\Software\adm914]
"a4_131" = "939154851"

[HKCU\Software\adm914]
"a4_130" = "931985730"

[HKCU\Software\adm914]
"a4_133" = "953493093"

[HKCU\Software\adm914]
"a4_132" = "946323972"

[HKCU\Software\adm914]
"a4_135" = "967831335"

[HKCU\Software\adm914]
"a4_134" = "960662214"

[HKCU\Software\adm914]
"a4_137" = "982169577"

[HKCU\Software\adm914]
"a4_136" = "975000456"

[HKCU\Software\adm914]
"a4_139" = "996507819"

[HKCU\Software\adm914]
"a4_138" = "989338698"

[HKCU\Software\Aas]
"a4_24" = "172058904"

[HKCU\Software\Aas]
"a4_25" = "179228025"

[HKCU\Software\Aas]
"a4_26" = "186397146"

[HKCU\Software\Aas]
"a4_27" = "193566267"

[HKCU\Software\Aas]
"a4_20" = "143382420"

[HKCU\Software\Aas]
"a4_21" = "150551541"

[HKCU\Software\Aas]
"a4_22" = "157720662"

[HKCU\Software\Aas]
"a4_23" = "164889783"

[HKCU\Software\Aas]
"a4_28" = "200735388"

[HKCU\Software\Aas]
"a4_29" = "207904509"

[HKCU\Software\adm914]
"a2_148" = "1061034316"

[HKCU\Software\adm914]
"a2_149" = "1068201133"

[HKCU\Software\adm914]
"a2_142" = "1018017840"

[HKCU\Software\adm914]
"a2_143" = "1025181643"

[HKCU\Software\adm914]
"a2_140" = "1003682430"

[HKCU\Software\adm914]
"a2_141" = "1010854469"

[HKCU\Software\adm914]
"a2_146" = "1046686266"

[HKCU\Software\adm914]
"a2_147" = "1053865339"

[HKCU\Software\adm914]
"a2_144" = "1032348936"

[HKCU\Software\adm914]
"a2_145" = "1039518621"

[HKCU\Software\adm914]
"a3_273" = "1974168880"

[HKCU\Software\adm914]
"a3_272" = "1966719313"

[HKCU\Software\adm914]
"a3_219" = "1553447098"

[HKCU\Software\adm914]
"a3_218" = "1545870555"

[HKCU\Software\adm914]
"a3_217" = "1572434040"

[HKCU\Software\adm914]
"a3_216" = "1565513625"

[HKCU\Software\adm914]
"a3_215" = "1524378422"

[HKCU\Software\adm914]
"a3_214" = "1517457239"

[HKCU\Software\adm914]
"a3_213" = "1510466292"

[HKCU\Software\adm914]
"a3_212" = "1536443925"

[HKCU\Software\adm914]
"a3_211" = "1529535922"

[HKCU\Software\adm914]
"a3_210" = "1488925139"

[HKCU\Software\adm914]
"a3_279" = "1983579126"

[HKCU\Software\adm914]
"a3_278" = "2009622295"

[HKCU\Software\adm914]
"a4_269" = "1928493549"

[HKCU\Software\adm914]
"a4_268" = "1921324428"

[HKCU\Software\adm914]
"a2_328" = "2351466867"

[HKCU\Software\adm914]
"a2_329" = "2358645417"

[HKCU\Software\adm914]
"a4_265" = "1899817065"

[HKCU\Software\adm914]
"a4_264" = "1892647944"

[HKCU\Software\adm914]
"a4_267" = "1914155307"

[HKCU\Software\adm914]
"a4_266" = "1906986186"

[HKCU\Software\adm914]
"a4_261" = "1871140581"

[HKCU\Software\adm914]
"a4_260" = "1863971460"

[HKCU\Software\adm914]
"a4_263" = "1885478823"

[HKCU\Software\adm914]
"a4_262" = "1878309702"

[HKCU\Software\adm914]
"a4_319" = "2286949599"

[HKCU\Software\adm914]
"a4_318" = "2279780478"

[HKCU\Software\adm914]
"a3_321" = "2284436448"

[HKCU\Software\adm914]
"a3_320" = "2310938369"

[HKCU\Software\adm914]
"a3_327" = "2327335334"

[HKCU\Software\adm914]
"a3_326" = "2320414151"

[HKCU\Software\adm914]
"a3_325" = "2346912100"

[HKCU\Software\adm914]
"a3_324" = "2339400837"

[HKCU\Software\adm914]
"a4_311" = "2229596631"

[HKCU\Software\adm914]
"a4_310" = "2222427510"

[HKCU\Software\adm914]
"a4_313" = "2243934873"

[HKCU\Software\adm914]
"a4_312" = "2236765752"

[HKCU\Software\adm914]
"a4_315" = "2258273115"

[HKCU\Software\adm914]
"a4_314" = "2251103994"

[HKCU\Software\adm914]
"a4_317" = "2272611357"

[HKCU\Software\adm914]
"a4_316" = "2265442236"

[HKCU\Software\adm914]
"a4_17" = "121875057"

[HKCU\Software\adm914]
"a4_16" = "114705936"

[HKCU\Software\adm914]
"a4_15" = "107536815"

[HKCU\Software\adm914]
"a4_14" = "100367694"

[HKCU\Software\adm914]
"a4_13" = "93198573"

[HKCU\Software\adm914]
"a4_12" = "86029452"

[HKCU\Software\adm914]
"a4_11" = "78860331"

[HKCU\Software\adm914]
"a4_10" = "71691210"

[HKCU\Software\adm914]
"a2_218" = "1562862801"

[HKCU\Software\adm914]
"a2_219" = "1570032971"

[HKCU\Software\adm914]
"a4_19" = "136213299"

[HKCU\Software\adm914]
"a4_18" = "129044178"

[HKCU\Software\adm914]
"a3_149" = "1051200052"

[HKCU\Software\adm914]
"a3_148" = "1044213333"

[HKCU\Software\Aas]
"a4_132" = "946323972"

[HKCU\Software\Aas]
"a4_131" = "939154851"

[HKCU\Software\Aas]
"a4_130" = "931985730"

[HKCU\Software\adm914]
"a3_143" = "1008235630"

[HKCU\Software\adm914]
"a3_142" = "1034865551"

[HKCU\Software\adm914]
"a3_141" = "1027813164"

[HKCU\Software\adm914]
"a3_140" = "986809165"

[HKCU\Software\adm914]
"a3_147" = "1070843378"

[HKCU\Software\adm914]
"a3_146" = "1063278867"

[HKCU\Software\adm914]
"a3_145" = "1022803120"

[HKCU\Software\adm914]
"a3_144" = "1015746769"

[HKCU\Software\adm914]
"a1_251" = "2919043682"

[HKCU\Software\adm914]
"a1_250" = "3084023169"

[HKCU\Software\adm914]
"a1_253" = "1528101542"

[HKCU\Software\adm914]
"a1_252" = "1114212034"

[HKCU\Software\adm914]
"a1_255" = "2000788710"

[HKCU\Software\adm914]
"a1_254" = "992275817"

[HKCU\Software\adm914]
"a1_257" = "1922436168"

[HKCU\Software\adm914]
"a1_256" = "3055552863"

[HKCU\Software\adm914]
"a1_259" = "3807333454"

[HKCU\Software\adm914]
"a1_258" = "4146909054"

[HKCU\Software\adm914]
"a1_47" = "465783481"

[HKCU\Software\adm914]
"a1_46" = "4000112082"

[HKCU\Software\adm914]
"a1_45" = "1726306644"

[HKCU\Software\adm914]
"a1_44" = "995960538"

[HKCU\Software\adm914]
"a1_43" = "2052613637"

[HKCU\Software\adm914]
"a1_42" = "340920785"

[HKCU\Software\adm914]
"a1_41" = "2436737764"

[HKCU\Software\adm914]
"a1_40" = "3972802422"

[HKCU\Software\adm914]
"a1_49" = "2655932100"

[HKCU\Software\adm914]
"a1_48" = "98244193"

[HKCU\Software\adm914]
"a1_325" = "169846171"

[HKCU\Software\adm914]
"a1_324" = "767784856"

[HKCU\Software\adm914]
"a1_327" = "3103198648"

[HKCU\Software\adm914]
"a1_326" = "3435600886"

[HKCU\Software\adm914]
"a1_321" = "268661353"

[HKCU\Software\adm914]
"a1_320" = "4226158614"

[HKCU\Software\adm914]
"a1_323" = "3448092346"

[HKCU\Software\adm914]
"a1_322" = "3451291225"

[HKCU\Software\adm914]
"a1_329" = "1460532117"

[HKCU\Software\adm914]
"a1_328" = "2633680627"

[HKCU\Software\adm914]
"a2_242" = "1734930040"

[HKCU\Software\Aas]
"a3_116" = "814879197"

[HKCU\Software\Aas]
"a3_117" = "821922428"

[HKCU\Software\Aas]
"a3_114" = "834001179"

[HKCU\Software\Aas]
"a3_115" = "807894458"

[HKCU\Software\Aas]
"a3_112" = "785940569"

[HKCU\Software\Aas]
"a3_113" = "826942712"

[HKCU\Software\Aas]
"a3_110" = "771902343"

[HKCU\Software\Aas]
"a3_111" = "778955814"

[HKCU\Software\Aas]
"a1_49" = "111303492"

[HKCU\Software\Aas]
"a1_48" = "2544725102"

[HKCU\Software\Aas]
"a3_118" = "862924447"

[HKCU\Software\Aas]
"a3_119" = "869974846"

[HKCU\Software\adm914\695404737]
"50183847" = "7329B17EFD1799058CC507B8062C360BD9EAA93FEC92CD8196CE019C2B644F8B5AC11E54BC8D921572BC5C39CB0308531810224E18BC57A14754D33BC6678182373E7B47500C9E1C82FC29BF389B2B6F410B7B9F141B58DC2BA76EF625D3FD2F450761A6DFFF889DE058FDD1002052BDDBCDC8FCA7DFBA8BD347C7A4809EC681"

[HKCU\Software\adm914]
"a4_126" = "903309246"

[HKCU\Software\adm914]
"a4_127" = "910478367"

[HKCU\Software\adm914]
"a4_124" = "888971004"

[HKCU\Software\adm914]
"a4_125" = "896140125"

[HKCU\Software\adm914]
"a4_122" = "874632762"

[HKCU\Software\adm914]
"a4_123" = "881801883"

[HKCU\Software\adm914]
"a4_120" = "860294520"

[HKCU\Software\adm914]
"a4_121" = "867463641"

[HKCU\Software\adm914]
"a4_128" = "917647488"

[HKCU\Software\adm914]
"a4_129" = "924816609"

[HKCU\Software\Aas]
"a4_11" = "78860331"

[HKCU\Software\Aas]
"a4_10" = "71691210"

[HKCU\Software\Aas]
"a4_13" = "93198573"

[HKCU\Software\Aas]
"a4_12" = "86029452"

[HKCU\Software\Aas]
"a4_15" = "107536815"

[HKCU\Software\Aas]
"a4_14" = "100367694"

[HKCU\Software\Aas]
"a4_17" = "121875057"

[HKCU\Software\Aas]
"a4_16" = "114705936"

[HKCU\Software\Aas]
"a4_19" = "136213299"

[HKCU\Software\Aas]
"a4_18" = "129044178"

[HKCU\Software\adm914]
"a2_139" = "996513270"

[HKCU\Software\adm914]
"a2_138" = "989346896"

[HKCU\Software\adm914]
"a2_137" = "982164416"

[HKCU\Software\adm914]
"a2_136" = "974996864"

[HKCU\Software\adm914]
"a2_135" = "967833302"

[HKCU\Software\adm914]
"a2_134" = "960663611"

[HKCU\Software\adm914]
"a2_133" = "953497873"

[HKCU\Software\adm914]
"a2_132" = "946328028"

[HKCU\Software\adm914]
"a2_131" = "939148507"

[HKCU\Software\adm914]
"a2_130" = "931980608"

[HKCU\Software\adm914]
"a2_230" = "1648901324"

[HKCU\Software\adm914]
"a3_208" = "1508042897"

[HKCU\Software\adm914]
"a3_209" = "1481479536"

[HKCU\Software\adm914]
"a2_231" = "1656063195"

[HKCU\Software\adm914]
"a3_204" = "1445501709"

[HKCU\Software\adm914]
"a3_205" = "1452935148"

[HKCU\Software\adm914]
"a3_206" = "1493540943"

[HKCU\Software\adm914]
"a3_207" = "1500990510"

[HKCU\Software\adm914]
"a3_200" = "1416957321"

[HKCU\Software\adm914]
"a3_201" = "1424012904"

[HKCU\Software\adm914]
"a3_202" = "1465012939"

[HKCU\Software\adm914]
"a3_203" = "1472069290"

[HKCU\Software\adm914]
"a2_233" = "1670401941"

[HKCU\Software\adm914]
"a2_234" = "1677581726"

[HKCU\Software\adm914]
"a2_235" = "1684746288"

[HKCU\Software\adm914]
"a4_272" = "1950000912"

[HKCU\Software\adm914]
"a4_273" = "1957170033"

[HKCU\Software\adm914]
"a4_270" = "1935662670"

[HKCU\Software\adm914]
"a4_271" = "1942831791"

[HKCU\Software\adm914]
"a4_276" = "1978677396"

[HKCU\Software\adm914]
"a2_236" = "1691920496"

[HKCU\Software\adm914]
"a4_274" = "1964339154"

[HKCU\Software\adm914]
"a4_275" = "1971508275"

[HKCU\Software\adm914]
"a4_278" = "1993015638"

[HKCU\Software\adm914]
"a2_237" = "1699085890"

[HKCU\Software\adm914]
"a3_330" = "2348811083"

[HKCU\Software\adm914]
"a3_331" = "2356391722"

[HKCU\Software\adm914]
"a3_332" = "2363313037"

[HKCU\Software\adm914]
"a3_333" = "2403923052"

[HKCU\Software\adm914]
"a3_334" = "2411434191"

[HKCU\Software\adm914]
"a3_335" = "2384805038"

[HKCU\Software\adm914]
"a4_308" = "2208089268"

[HKCU\Software\adm914]
"a4_309" = "2215258389"

[HKCU\Software\adm914]
"a4_306" = "2193751026"

[HKCU\Software\adm914]
"a4_307" = "2200920147"

[HKCU\Software\adm914]
"a4_304" = "2179412784"

[HKCU\Software\adm914]
"a4_305" = "2186581905"

[HKCU\Software\adm914]
"a4_302" = "2165074542"

[HKCU\Software\adm914]
"a4_303" = "2172243663"

[HKCU\Software\adm914]
"a4_300" = "2150736300"

[HKCU\Software\adm914]
"a4_301" = "2157905421"

[HKCU\Software\adm914]
"a2_267" = "1914152086"

[HKCU\Software\adm914]
"a2_266" = "1906988098"

[HKCU\Software\adm914]
"a2_265" = "1899822087"

[HKCU\Software\adm914]
"a2_264" = "1892651599"

[HKCU\Software\adm914]
"a2_263" = "1885473017"

[HKCU\Software\adm914]
"a2_262" = "1878304772"

[HKCU\Software\adm914]
"a2_261" = "1871134882"

[HKCU\Software\adm914]
"a2_260" = "1863969668"

[HKCU\Software\adm914]
"a2_269" = "1928487143"

[HKCU\Software\adm914]
"a2_268" = "1921320872"

[HKCU\Software\adm914]
"a3_158" = "1115723167"

[HKCU\Software\adm914]
"a3_159" = "1123171966"

[HKCU\Software\adm914]
"a3_150" = "1092335255"

[HKCU\Software\adm914]
"a3_151" = "1099256694"

[HKCU\Software\adm914]
"a3_152" = "1106313177"

[HKCU\Software\adm914]
"a3_153" = "1080269752"

[HKCU\Software\adm914]
"a3_154" = "1087177755"

[HKCU\Software\adm914]
"a3_155" = "1127784698"

[HKCU\Software\adm914]
"a3_156" = "1135234397"

[HKCU\Software\adm914]
"a3_157" = "1108732220"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\adm914]
"a4_7" = "50183847"

[HKCU\Software\Aas]
"a4_108" = "774265068"

[HKCU\Software\Aas]
"a4_109" = "781434189"

[HKCU\Software\adm914]
"a4_6" = "43014726"

[HKCU\Software\Aas]
"a4_102" = "731250342"

[HKCU\Software\Aas]
"a4_103" = "738419463"

[HKCU\Software\Aas]
"a4_100" = "716912100"

[HKCU\Software\Aas]
"a4_101" = "724081221"

[HKCU\Software\Aas]
"a4_106" = "759926826"

[HKCU\Software\Aas]
"a4_107" = "767095947"

[HKCU\Software\Aas]
"a4_104" = "745588584"

[HKCU\Software\Aas]
"a4_105" = "752757705"

[HKCU\Software\adm914]
"a4_4" = "28676484"

[HKCU\Software\adm914]
"a2_115" = "824443997"

[HKCU\Software\adm914]
"a4_2" = "14338242"

[HKCU\Software\adm914]
"a4_1" = "7169121"

[HKCU\Software\adm914]
"a4_0" = "0"

[HKCU\Software\adm914]
"a1_246" = "1599801723"

[HKCU\Software\adm914]
"a1_247" = "2791605932"

[HKCU\Software\adm914]
"a1_244" = "1749265525"

[HKCU\Software\adm914]
"a1_245" = "4219613981"

[HKCU\Software\adm914]
"a1_242" = "326590121"

[HKCU\Software\adm914]
"a1_243" = "3307781967"

[HKCU\Software\adm914]
"a1_240" = "2484361038"

[HKCU\Software\adm914]
"a1_241" = "1818349970"

[HKCU\Software\adm914]
"a1_248" = "3123496614"

[HKCU\Software\adm914]
"a1_249" = "2955553327"

[HKCU\Software\adm914]
"a4_175" = "1254596175"

[HKCU\Software\Aas]
"a4_87" = "623713527"

[HKCU\Software\Aas]
"a4_84" = "602206164"

[HKCU\Software\adm914]
"a1_338" = "1090896973"

[HKCU\Software\Aas]
"a4_85" = "609375285"

[HKCU\Software\adm914]
"a1_98" = "4234808684"

[HKCU\Software\adm914]
"a1_99" = "3404479033"

[HKCU\Software\adm914]
"a1_94" = "1416239086"

[HKCU\Software\adm914]
"a1_95" = "2484280132"

[HKCU\Software\adm914]
"a1_96" = "2504028987"

[HKCU\Software\adm914]
"a1_97" = "3654627199"

[HKCU\Software\adm914]
"a1_90" = "1856110118"

[HKCU\Software\adm914]
"a1_91" = "720289477"

[HKCU\Software\adm914]
"a1_92" = "3941104652"

[HKCU\Software\adm914]
"a1_93" = "3161102918"

[HKCU\Software\adm914]
"a4_173" = "1240257933"

[HKCU\Software\Aas]
"a4_81" = "580698801"

[HKCU\Software\adm914]
"a2_211" = "1512681358"

[HKCU\Software\adm914]
"a3_223" = "1581848126"

[HKCU\Software\adm914\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a1_58" = "2451557287"

[HKCU\Software\Aas]
"a1_59" = "4143869700"

[HKCU\Software\Aas]
"a1_56" = "29606934"

[HKCU\Software\Aas]
"a1_57" = "808725188"

[HKCU\Software\Aas]
"a1_54" = "1230601921"

[HKCU\Software\Aas]
"a1_55" = "2453986149"

[HKCU\Software\Aas]
"a1_52" = "2080816108"

[HKCU\Software\Aas]
"a1_53" = "3844715075"

[HKCU\Software\Aas]
"a1_50" = "2999411359"

[HKCU\Software\Aas]
"a1_51" = "4124553996"

[HKCU\Software\adm914]
"a3_96" = "671531553"

[HKCU\Software\adm914]
"a3_97" = "678456960"

[HKCU\Software\adm914]
"a3_94" = "690601439"

[HKCU\Software\adm914]
"a3_95" = "698046910"

[HKCU\Software\adm914]
"a3_92" = "643003549"

[HKCU\Software\adm914]
"a3_93" = "649990524"

[HKCU\Software\adm914]
"a3_90" = "662056027"

[HKCU\Software\adm914]
"a3_91" = "669108282"

[HKCU\Software\adm914]
"a3_98" = "685968227"

[HKCU\Software\adm914]
"a3_99" = "726579138"

[HKCU\Software\Aas]
"a3_109" = "798021476"

[HKCU\Software\Aas]
"a3_108" = "790966981"

[HKCU\Software\Aas]
"a3_101" = "707522668"

[HKCU\Software\Aas]
"a3_100" = "733503437"

[HKCU\Software\Aas]
"a3_103" = "754977070"

[HKCU\Software\Aas]
"a3_102" = "714511503"

[HKCU\Software\Aas]
"a3_105" = "769475040"

[HKCU\Software\Aas]
"a3_104" = "762555713"

[HKCU\Software\Aas]
"a3_107" = "750493346"

[HKCU\Software\Aas]
"a3_106" = "742980099"

[HKCU\Software\adm914]
"a2_128" = "917646656"

[HKCU\Software\adm914]
"a2_129" = "924811965"

[HKCU\Software\adm914]
"a2_124" = "888965678"

[HKCU\Software\adm914]
"a2_125" = "896145269"

[HKCU\Software\adm914]
"a2_126" = "903315384"

[HKCU\Software\adm914]
"a2_127" = "910480913"

[HKCU\Software\adm914]
"a2_120" = "860296554"

[HKCU\Software\adm914]
"a2_121" = "867462120"

[HKCU\Software\adm914]
"a2_122" = "874628913"

[HKCU\Software\adm914]
"a2_123" = "881795187"

[HKCU\Software\adm914]
"a3_231" = "1672934854"

[HKCU\Software\adm914]
"a3_230" = "1665878375"

[HKCU\Software\adm914]
"a3_233" = "1653815816"

[HKCU\Software\adm914]
"a3_232" = "1646367145"

[HKCU\Software\adm914]
"a3_235" = "1701331786"

[HKCU\Software\adm914]
"a3_234" = "1660856043"

[HKCU\Software\adm914]
"a3_237" = "1682344844"

[HKCU\Software\adm914]
"a3_236" = "1708912429"

[HKCU\Software\adm914]
"a3_239" = "1730400462"

[HKCU\Software\adm914]
"a4_210" = "1505515410"

[HKCU\Software\adm914]
"a4_211" = "1512684531"

[HKCU\Software\adm914]
"a4_207" = "1484008047"

[HKCU\Software\adm914]
"a4_206" = "1476838926"

[HKCU\Software\adm914]
"a4_205" = "1469669805"

[HKCU\Software\adm914]
"a4_204" = "1462500684"

[HKCU\Software\adm914]
"a4_203" = "1455331563"

[HKCU\Software\adm914]
"a4_202" = "1448162442"

[HKCU\Software\adm914]
"a4_201" = "1440993321"

[HKCU\Software\adm914]
"a4_200" = "1433824200"

[HKCU\Software\adm914]
"a4_209" = "1498346289"

[HKCU\Software\adm914]
"a4_208" = "1491177168"

[HKCU\Software\adm914]
"a3_305" = "2203578832"

[HKCU\Software\adm914]
"a3_304" = "2162447729"

[HKCU\Software\adm914]
"a3_307" = "2183923218"

[HKCU\Software\adm914]
"a3_306" = "2210569651"

[HKCU\Software\adm914]
"a3_301" = "2174509132"

[HKCU\Software\adm914]
"a3_300" = "2167588845"

[HKCU\Software\adm914]
"a3_303" = "2155522190"

[HKCU\Software\adm914]
"a3_302" = "2148469807"

[HKCU\Software\adm914]
"a4_218" = "1562868378"

[HKCU\Software\adm914]
"a3_309" = "2231979860"

[HKCU\Software\adm914]
"a3_308" = "2191500021"

[HKCU\Software\adm914]
"a4_219" = "1570037499"

[HKCU\Software\adm914]
"a2_274" = "1964340771"

[HKCU\Software\adm914]
"a2_275" = "1971506914"

[HKCU\Software\adm914]
"a2_276" = "1978671548"

[HKCU\Software\adm914]
"a2_277" = "1985842911"

[HKCU\Software\adm914]
"a2_270" = "1935658786"

[HKCU\Software\adm914]
"a2_271" = "1942836586"

[HKCU\Software\adm914]
"a2_272" = "1950003950"

[HKCU\Software\adm914]
"a2_273" = "1957175128"

[HKCU\Software\adm914]
"a2_278" = "1993020414"

[HKCU\Software\adm914]
"a2_279" = "2000188572"

[HKCU\Software\adm914]
"a3_250" = "1809277179"

[HKCU\Software\adm914]
"a3_169" = "1228153416"

[HKCU\Software\adm914]
"a3_168" = "1187690985"

[HKCU\Software\adm914]
"a3_165" = "1199756484"

[HKCU\Software\adm914]
"a3_164" = "1192700005"

[HKCU\Software\adm914]
"a3_167" = "1180638470"

[HKCU\Software\adm914]
"a3_166" = "1206677671"

[HKCU\Software\adm914]
"a3_161" = "1171212096"

[HKCU\Software\adm914]
"a3_160" = "1163778785"

[HKCU\Software\adm914]
"a3_163" = "1151700866"

[HKCU\Software\adm914]
"a3_162" = "1144709923"

[HKCU\Software\Aas]
"a1_41" = "3135876567"

[HKCU\Software\Aas]
"a1_40" = "4279178621"

[HKCU\Software\Aas]
"a1_43" = "1471861889"

[HKCU\Software\Aas]
"a1_42" = "4071168545"

[HKCU\Software\Aas]
"a1_45" = "1043434068"

[HKCU\Software\Aas]
"a1_44" = "2409623832"

[HKCU\Software\Aas]
"a1_47" = "756112097"

[HKCU\Software\Aas]
"a1_46" = "683917008"

[HKCU\Software\Aas]
"a4_119" = "853125399"

[HKCU\Software\Aas]
"a4_118" = "845956278"

[HKCU\Software\Aas]
"a4_115" = "824448915"

[HKCU\Software\Aas]
"a4_114" = "817279794"

[HKCU\Software\Aas]
"a4_117" = "838787157"

[HKCU\Software\Aas]
"a4_116" = "831618036"

[HKCU\Software\Aas]
"a4_111" = "795772431"

[HKCU\Software\Aas]
"a4_110" = "788603310"

[HKCU\Software\Aas]
"a4_113" = "810110673"

[HKCU\Software\Aas]
"a4_112" = "802941552"

[HKCU\Software\adm914]
"a4_284" = "2036030364"

[HKCU\Software\adm914]
"a1_189" = "945208641"

[HKCU\Software\adm914]
"a1_188" = "1413222388"

[HKCU\Software\adm914]
"a2_363" = "2602388293"

[HKCU\Software\adm914]
"a1_181" = "2749519830"

[HKCU\Software\adm914]
"a1_180" = "1516723528"

[HKCU\Software\adm914]
"a1_183" = "3352771849"

[HKCU\Software\adm914]
"a1_182" = "4015010445"

[HKCU\Software\adm914]
"a1_185" = "2895395652"

[HKCU\Software\adm914]
"a1_184" = "79196930"

[HKCU\Software\adm914]
"a1_187" = "3123323820"

[HKCU\Software\adm914]
"a1_186" = "1664689162"

[HKCU\Software\adm914]
"a1_83" = "377333054"

[HKCU\Software\adm914]
"a1_82" = "1625840196"

[HKCU\Software\adm914]
"a1_81" = "2448829423"

[HKCU\Software\adm914]
"a1_80" = "935954181"

[HKCU\Software\adm914]
"a1_87" = "1218686378"

[HKCU\Software\adm914]
"a1_86" = "123825220"

[HKCU\Software\adm914]
"a1_85" = "3239556598"

[HKCU\Software\adm914]
"a1_84" = "3261945242"

[HKCU\Software\adm914]
"a1_347" = "1393311936"

[HKCU\Software\adm914]
"a1_346" = "933764932"

[HKCU\Software\adm914]
"a1_89" = "1012791786"

[HKCU\Software\adm914]
"a1_88" = "3592706161"

[HKCU\Software\adm914]
"a1_343" = "3810743214"

[HKCU\Software\adm914]
"a1_342" = "786371525"

[HKCU\Software\adm914]
"a1_341" = "1727392135"

[HKCU\Software\adm914]
"a1_340" = "3291488905"

[HKCU\Software\adm914]
"a2_365" = "2616723612"

[HKCU\Software\adm914]
"a2_217" = "1555695378"

[HKCU\Software\adm914]
"a2_249" = "1785118119"

[HKCU\Software\adm914]
"a2_248" = "1777936191"

[HKCU\Software\adm914]
"a1_299" = "426982199"

[HKCU\Software\adm914]
"a1_298" = "2023232084"

[HKCU\Software\adm914]
"a1_295" = "737081205"

[HKCU\Software\adm914]
"a1_294" = "2508400437"

[HKCU\Software\adm914]
"a1_297" = "2431381557"

[HKCU\Software\adm914]
"a1_296" = "4092084581"

[HKCU\Software\adm914]
"a1_291" = "2159963390"

[HKCU\Software\adm914]
"a1_290" = "1745536173"

[HKCU\Software\adm914]
"a1_293" = "4245745086"

[HKCU\Software\adm914]
"a1_292" = "3391844633"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_29" = "2081206081"

[HKCU\Software\Aas]
"a1_28" = "692068557"

[HKCU\Software\Aas]
"a1_23" = "1393522403"

[HKCU\Software\Aas]
"a1_22" = "767601794"

[HKCU\Software\Aas]
"a1_21" = "3088289700"

[HKCU\Software\Aas]
"a1_20" = "1050578346"

[HKCU\Software\Aas]
"a1_27" = "3455136104"

[HKCU\Software\Aas]
"a1_26" = "1522734467"

[HKCU\Software\Aas]
"a1_25" = "1333846048"

[HKCU\Software\Aas]
"a1_24" = "2020335726"

[HKCU\Software\adm914]
"a3_85" = "626078324"

[HKCU\Software\adm914]
"a3_84" = "585599381"

[HKCU\Software\adm914]
"a3_87" = "607025846"

[HKCU\Software\adm914]
"a3_86" = "633134807"

[HKCU\Software\adm914]
"a3_81" = "597665008"

[HKCU\Software\adm914]
"a3_80" = "590100497"

[HKCU\Software\adm914]
"a3_83" = "578088242"

[HKCU\Software\adm914]
"a3_82" = "571031891"

[HKCU\Software\adm914]
"a3_89" = "654607352"

[HKCU\Software\adm914]
"a3_88" = "614065945"

[HKCU\Software\Aas]
"a2_31" = "222248444"

[HKCU\Software\Aas]
"a2_30" = "215079225"

[HKCU\Software\Aas]
"a2_33" = "236580588"

[HKCU\Software\Aas]
"a2_32" = "229415593"

[HKCU\Software\Aas]
"a2_35" = "250913468"

[HKCU\Software\Aas]
"a2_34" = "243745065"

[HKCU\Software\Aas]
"a2_37" = "265264706"

[HKCU\Software\Aas]
"a2_36" = "258082163"

[HKCU\Software\Aas]
"a2_39" = "279604744"

[HKCU\Software\Aas]
"a2_38" = "272418805"

[HKCU\Software\adm914]
"a1_303" = "3702958993"

[HKCU\Software\Aas]
"a4_79" = "566360559"

[HKCU\Software\Aas]
"a4_78" = "559191438"

[HKCU\Software\adm914]
"a1_302" = "1088951352"

[HKCU\Software\Aas]
"a4_73" = "523345833"

[HKCU\Software\Aas]
"a4_72" = "516176712"

[HKCU\Software\Aas]
"a4_71" = "509007591"

[HKCU\Software\Aas]
"a4_70" = "501838470"

[HKCU\Software\Aas]
"a4_77" = "552022317"

[HKCU\Software\Aas]
"a4_76" = "544853196"

[HKCU\Software\Aas]
"a4_75" = "537684075"

[HKCU\Software\Aas]
"a4_74" = "530514954"

[HKCU\Software\adm914]
"a2_111" = "795778589"

[HKCU\Software\adm914]
"a2_110" = "788607526"

[HKCU\Software\adm914]
"a2_113" = "810114601"

[HKCU\Software\adm914]
"a2_112" = "802946900"

[HKCU\Software\adm914]
"a4_3" = "21507363"

[HKCU\Software\adm914]
"a2_114" = "817276151"

[HKCU\Software\adm914]
"a2_117" = "838794269"

[HKCU\Software\adm914]
"a2_116" = "831611214"

[HKCU\Software\adm914]
"a2_119" = "853127391"

[HKCU\Software\adm914]
"a2_118" = "845962619"

[HKCU\Software\adm914]
"a4_9" = "64522089"

[HKCU\Software\adm914]
"a4_8" = "57352968"

[HKCU\Software\adm914]
"a1_305" = "2558885445"

[HKCU\Software\adm914]
"a2_360" = "2580888747"

[HKCU\Software\adm914]
"a1_304" = "2857129101"

[HKCU\Software\adm914]
"a3_226" = "1636957155"

[HKCU\Software\adm914]
"a3_227" = "1610835010"

[HKCU\Software\adm914]
"a3_224" = "1588900513"

[HKCU\Software\adm914]
"a3_225" = "1629904640"

[HKCU\Software\adm914]
"a3_222" = "1608411743"

[HKCU\Software\adm914]
"a4_199" = "1426655079"

[HKCU\Software\adm914]
"a3_220" = "1593910557"

[HKCU\Software\adm914]
"a3_221" = "1600963068"

[HKCU\Software\Aas\695404737]
"7169121" = "145"

[HKCU\Software\adm914]
"a3_228" = "1617821733"

[HKCU\Software\adm914]
"a3_229" = "1624878212"

[HKCU\Software\adm914]
"a4_214" = "1534191894"

[HKCU\Software\adm914]
"a4_215" = "1541361015"

[HKCU\Software\adm914]
"a4_216" = "1548530136"

[HKCU\Software\adm914]
"a4_217" = "1555699257"

[HKCU\Software\adm914]
"a2_9" = "64524657"

[HKCU\Software\adm914]
"a2_8" = "57358257"

[HKCU\Software\adm914]
"a4_212" = "1519853652"

[HKCU\Software\adm914]
"a4_213" = "1527022773"

[HKCU\Software\adm914]
"a2_5" = "35843092"

[HKCU\Software\adm914]
"a2_4" = "28675436"

[HKCU\Software\adm914]
"a2_7" = "50178272"

[HKCU\Software\adm914]
"a2_6" = "43011046"

[HKCU\Software\adm914]
"a2_1" = "7168686"

[HKCU\Software\adm914]
"a2_0" = "1743"

[HKCU\Software\adm914]
"a2_3" = "21511777"

[HKCU\Software\adm914]
"a2_2" = "14340484"

[HKCU\Software\adm914]
"a3_318" = "2262947391"

[HKCU\Software\adm914]
"a3_319" = "2303947422"

[HKCU\Software\adm914]
"a3_312" = "2219913337"

[HKCU\Software\adm914]
"a3_313" = "2226969816"

[HKCU\Software\adm914]
"a3_310" = "2239032119"

[HKCU\Software\adm914]
"a3_311" = "2246547350"

[HKCU\Software\adm914]
"a3_316" = "2248442365"

[HKCU\Software\adm914]
"a3_317" = "2255891036"

[HKCU\Software\adm914]
"a3_314" = "2267969723"

[HKCU\Software\adm914]
"a3_315" = "2275009818"

[HKCU\Software\adm914]
"a3_172" = "1216092013"

[HKCU\Software\adm914]
"a3_173" = "1223668684"

[HKCU\Software\adm914]
"a3_170" = "1235734059"

[HKCU\Software\adm914]
"a3_171" = "1209100938"

[HKCU\Software\adm914]
"a3_176" = "1245078769"

[HKCU\Software\adm914]
"a3_177" = "1252065616"

[HKCU\Software\adm914]
"a3_174" = "1264148399"

[HKCU\Software\adm914]
"a3_175" = "1271199758"

[HKCU\Software\adm914]
"a2_241" = "1727754663"

[HKCU\Software\adm914]
"a2_240" = "1720585179"

[HKCU\Software\adm914]
"a3_178" = "1292676403"

[HKCU\Software\adm914]
"a3_179" = "1300122002"

[HKCU\Software\adm914]
"a2_245" = "1756432715"

[HKCU\Software\adm914]
"a2_244" = "1749237620"

[HKCU\Software\adm914]
"a2_247" = "1770770330"

[HKCU\Software\adm914]
"a2_246" = "1763601659"

[HKCU\Software\Aas]
"a2_17" = "121878036"

[HKCU\Software\Aas]
"a2_16" = "114708582"

[HKCU\Software\Aas]
"a2_15" = "107543232"

[HKCU\Software\Aas]
"a2_14" = "100362012"

[HKCU\Software\Aas]
"a2_13" = "93206883"

[HKCU\Software\Aas]
"a2_12" = "86027549"

[HKCU\Software\Aas]
"a2_11" = "78860252"

[HKCU\Software\Aas]
"a2_10" = "71693673"

[HKCU\Software\Aas]
"a2_19" = "136209430"

[HKCU\Software\Aas]
"a2_18" = "129046589"

[HKCU\Software\Aas]
"a1_114" = "4142330733"

[HKCU\Software\Aas]
"a1_115" = "1894606031"

[HKCU\Software\Aas]
"a1_116" = "626655673"

[HKCU\Software\Aas]
"a1_117" = "988171753"

[HKCU\Software\Aas]
"a1_110" = "1279945363"

[HKCU\Software\Aas]
"a1_111" = "3240937175"

[HKCU\Software\Aas]
"a1_112" = "1878724137"

[HKCU\Software\Aas]
"a1_113" = "3431131162"

[HKCU\Software\Aas]
"a1_118" = "55546378"

[HKCU\Software\Aas]
"a1_119" = "2729215545"

[HKCU\Software\adm914]
"a1_198" = "2854621040"

[HKCU\Software\adm914]
"a1_199" = "963191513"

[HKCU\Software\adm914]
"a1_196" = "1573477366"

[HKCU\Software\adm914]
"a1_197" = "1001114838"

[HKCU\Software\adm914]
"a1_194" = "3602187070"

[HKCU\Software\adm914]
"a1_195" = "3688046891"

[HKCU\Software\adm914]
"a1_192" = "2380425869"

[HKCU\Software\adm914]
"a1_193" = "1683601952"

[HKCU\Software\adm914]
"a1_190" = "1138529712"

[HKCU\Software\adm914]
"a1_191" = "2060290789"

[HKCU\Software\adm914]
"a1_358" = "3998000841"

[HKCU\Software\adm914]
"a1_359" = "1923847098"

[HKCU\Software\adm914]
"a1_354" = "2718269565"

[HKCU\Software\adm914]
"a1_355" = "1500464094"

[HKCU\Software\adm914]
"a1_356" = "3983006554"

[HKCU\Software\adm914]
"a1_357" = "1451092364"

[HKCU\Software\adm914]
"a1_350" = "1870158802"

[HKCU\Software\adm914]
"a1_351" = "1144639119"

[HKCU\Software\adm914]
"a1_352" = "3303266605"

[HKCU\Software\adm914]
"a1_353" = "40691176"

[HKCU\Software\adm914]
"a1_282" = "211693751"

[HKCU\Software\adm914]
"a1_283" = "1039399297"

[HKCU\Software\adm914]
"a1_280" = "1384688470"

[HKCU\Software\adm914]
"a1_281" = "1024194757"

[HKCU\Software\adm914]
"a1_286" = "33465094"

[HKCU\Software\adm914]
"a1_287" = "1740559735"

[HKCU\Software\adm914]
"a1_284" = "2358067232"

[HKCU\Software\adm914]
"a1_285" = "2101462187"

[HKCU\Software\adm914]
"a1_288" = "1212706677"

[HKCU\Software\adm914]
"a1_289" = "3589026620"

[HKCU\Software\Aas]
"a1_38" = "3950349360"

[HKCU\Software\Aas]
"a1_39" = "3712091800"

[HKCU\Software\Aas]
"a1_30" = "2726533860"

[HKCU\Software\Aas]
"a1_31" = "3097054589"

[HKCU\Software\Aas]
"a1_32" = "4166483356"

[HKCU\Software\Aas]
"a1_33" = "3225505503"

[HKCU\Software\Aas]
"a1_34" = "2116925849"

[HKCU\Software\Aas]
"a1_35" = "1699808796"

[HKCU\Software\Aas]
"a1_36" = "376427999"

[HKCU\Software\Aas]
"a1_37" = "3345409366"

[HKCU\Software\Aas]
"a2_108" = "774273211"

[HKCU\Software\Aas]
"a2_109" = "781427187"

[HKCU\Software\Aas]
"a2_100" = "716908704"

[HKCU\Software\Aas]
"a2_101" = "724078558"

[HKCU\Software\Aas]
"a2_102" = "731244617"

[HKCU\Software\Aas]
"a2_103" = "738426246"

[HKCU\Software\Aas]
"a2_104" = "745594442"

[HKCU\Software\Aas]
"a2_105" = "752760480"

[HKCU\Software\Aas]
"a2_106" = "759925927"

[HKCU\Software\Aas]
"a2_107" = "767091684"

[HKCU\Software\Aas]
"a2_28" = "200727421"

[HKCU\Software\Aas]
"a2_29" = "207912618"

[HKCU\Software\Aas]
"a2_26" = "186394818"

[HKCU\Software\Aas]
"a2_27" = "193574378"

[HKCU\Software\Aas]
"a2_24" = "172061634"

[HKCU\Software\Aas]
"a2_25" = "179231562"

[HKCU\Software\Aas]
"a2_22" = "157728729"

[HKCU\Software\Aas]
"a2_23" = "164896728"

[HKCU\Software\Aas]
"a2_20" = "143379083"

[HKCU\Software\Aas]
"a2_21" = "150544185"

[HKCU\Software\Aas]
"a4_68" = "487500228"

[HKCU\Software\Aas]
"a4_69" = "494669349"

[HKCU\Software\Aas]
"a4_60" = "430147260"

[HKCU\Software\Aas]
"a4_61" = "437316381"

[HKCU\Software\Aas]
"a4_62" = "444485502"

[HKCU\Software\Aas]
"a4_63" = "451654623"

[HKCU\Software\Aas]
"a4_64" = "458823744"

[HKCU\Software\Aas]
"a4_65" = "465992865"

[HKCU\Software\Aas]
"a4_66" = "473161986"

[HKCU\Software\Aas]
"a4_67" = "480331107"

[HKCU\Software\adm914]
"a4_197" = "1412316837"

[HKCU\Software\adm914]
"a4_196" = "1405147716"

[HKCU\Software\adm914]
"a4_195" = "1397978595"

[HKCU\Software\adm914]
"a4_194" = "1390809474"

[HKCU\Software\adm914]
"a4_193" = "1383640353"

[HKCU\Software\adm914]
"a4_192" = "1376471232"

[HKCU\Software\adm914]
"a4_191" = "1369302111"

[HKCU\Software\adm914]
"a4_190" = "1362132990"

[HKCU\Software\adm914]
"a2_108" = "774261223"

[HKCU\Software\adm914]
"a2_109" = "781429583"

[HKCU\Software\Aas]
"a2_7" = "50176954"

[HKCU\Software\Aas]
"a2_6" = "43009444"

[HKCU\Software\Aas]
"a2_5" = "35841042"

[HKCU\Software\Aas]
"a2_4" = "28673537"

[HKCU\Software\Aas]
"a2_3" = "21498089"

[HKCU\Software\Aas]
"a2_2" = "14346572"

[HKCU\Software\Aas]
"a2_1" = "7173091"

[HKCU\Software\Aas]
"a2_0" = "9832"

[HKCU\Software\Aas]
"a2_9" = "64528830"

[HKCU\Software\Aas]
"a2_8" = "57360172"

[HKCU\Software\Aas]
"a4_5" = "35845605"

[HKCU\Software\Aas]
"a4_4" = "28676484"

[HKCU\Software\Aas]
"a4_7" = "50183847"

[HKCU\Software\Aas]
"a4_6" = "43014726"

[HKCU\Software\Aas]
"a4_1" = "7169121"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKCU\Software\Aas]
"a4_3" = "21507363"

[HKCU\Software\Aas]
"a4_2" = "14338242"

[HKCU\Software\Aas]
"a4_9" = "64522089"

[HKCU\Software\Aas]
"a4_8" = "57352968"

[HKCU\Software\adm914]
"a3_369" = "2628700560"

[HKCU\Software\adm914]
"a3_368" = "2621648177"

[HKCU\Software\adm914]
"a3_367" = "2647753038"

[HKCU\Software\adm914]
"a3_366" = "2640766191"

[HKCU\Software\adm914]
"a3_365" = "2600171532"

[HKCU\Software\adm914]
"a3_364" = "2592726957"

[HKCU\Software\adm914]
"a3_363" = "2585670602"

[HKCU\Software\adm914]
"a3_362" = "2611779435"

[HKCU\Software\adm914]
"a3_361" = "2604788360"

[HKCU\Software\adm914]
"a3_360" = "2564181545"

[HKCU\Software\adm914]
"a3_107" = "750490314"

[HKCU\Software\Aas]
"a1_85" = "3925022304"

[HKCU\Software\adm914]
"a3_105" = "769478024"

[HKCU\Software\adm914]
"a3_104" = "762552617"

[HKCU\Software\adm914]
"a3_103" = "754976070"

[HKCU\Software\adm914]
"a3_102" = "714512615"

[HKCU\Software\adm914]
"a3_101" = "707525636"

[HKCU\Software\Aas]
"a1_84" = "272775309"

[HKCU\Software\adm914]
"a2_256" = "1835299369"

[HKCU\Software\adm914]
"a2_257" = "1842468513"

[HKCU\Software\adm914]
"a2_254" = "1820951494"

[HKCU\Software\adm914]
"a2_255" = "1828121687"

[HKCU\Software\adm914]
"a2_252" = "1806626676"

[HKCU\Software\Aas]
"a1_87" = "3855615690"

[HKCU\Software\adm914]
"a3_109" = "798022412"

[HKCU\Software\adm914]
"a3_108" = "790970029"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 72 0C D1 E2 15 FA C6 7B DB 81 FA 15 51 D8 0B"

[HKCU\Software\adm914]
"a4_228" = "1634559588"

[HKCU\Software\Aas]
"a1_86" = "1452634312"

[HKCU\Software\adm914]
"a4_221" = "1584375741"

[HKCU\Software\Aas]
"a1_81" = "2418611688"

[HKCU\Software\adm914]
"a4_223" = "1598713983"

[HKCU\Software\adm914]
"a4_222" = "1591544862"

[HKCU\Software\adm914]
"a4_225" = "1613052225"

[HKCU\Software\adm914]
"a4_224" = "1605883104"

[HKCU\Software\adm914]
"a4_227" = "1627390467"

[HKCU\Software\Aas]
"a1_80" = "3532132381"

[HKCU\Software\Aas]
"a1_83" = "291880385"

[HKCU\Software\adm914]
"a2_107" = "767093411"

[HKCU\Software\Aas]
"a1_82" = "104579502"

[HKCU\Software\adm914]
"a4_277" = "1985846517"

[HKCU\Software\adm914]
"a2_104" = "745594769"

[HKCU\Software\adm914]
"a4_372" = "2666913012"

[HKCU\Software\Aas\695404737]
"43014726" = "0B00687474703A2F2F6A6577656C6C65727962617A6161722E6E65742F6C6F676F2E67696600687474703A2F2F63617361656261722E636F6D2E62722F6C6F676F2E67696600687474703A2F2F63616E6F7373616468756C652E696E2F6C6F676F2E67696600687474703A2F2F63616E7365736961736B6E65666573692E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F686F773267657468617A616E61742E686F2E66756E7069632E64652F6C6F676F2E67696600687474703A2F2F7777772E65766973686F702E64652F6C6F676F2E67696600687474703A2F2F6368696875616875617570696E67686F6D652E636F6D2F6C6F676F2E67696600687474703A2F2F64656861737061732E636F6D2F6C6F676F2E67696600687474703A2F2F64657664696A6974616C2E636F6D2F6C6F676F2E67696600687474703A2F2F736F6272656E61747572616C62722E6E65742F6C6F676F2E67696600687474703A2F2F6469726569746F7075626C69636F2E636F6D2E62722F6C6F676F2E676966"

[HKCU\Software\adm914]
"a4_279" = "2000184759"

[HKCU\Software\adm914]
"a4_374" = "2681251254"

[HKCU\Software\Aas]
"a3_130" = "915379051"

[HKCU\Software\adm914]
"a3_336" = "2391857425"

[HKCU\Software\Aas]
"a3_131" = "922302346"

[HKCU\Software\adm914]
"a3_337" = "2432845296"

[HKCU\Software\Aas]
"a3_132" = "962897965"

[HKCU\Software\Aas]
"a1_107" = "516131805"

[HKCU\Software\Aas]
"a1_106" = "262120564"

[HKCU\Software\Aas]
"a1_105" = "3215812354"

[HKCU\Software\Aas]
"a1_104" = "2383000628"

[HKCU\Software\Aas]
"a1_103" = "2423355730"

[HKCU\Software\Aas]
"a1_102" = "1883199335"

[HKCU\Software\Aas]
"a1_101" = "2040266006"

[HKCU\Software\Aas]
"a1_100" = "3607084284"

[HKCU\Software\Aas]
"a1_109" = "2801603352"

[HKCU\Software\Aas]
"a1_108" = "2565570386"

[HKCU\Software\adm914]
"a1_163" = "966804654"

[HKCU\Software\adm914]
"a1_162" = "3321320267"

[HKCU\Software\adm914]
"a1_161" = "2331962963"

[HKCU\Software\adm914]
"a1_160" = "1762984053"

[HKCU\Software\adm914]
"a1_167" = "3864368019"

[HKCU\Software\adm914]
"a1_166" = "176056251"

[HKCU\Software\adm914]
"a1_165" = "615351609"

[HKCU\Software\adm914]
"a1_164" = "2403705695"

[HKCU\Software\adm914]
"a1_169" = "897746008"

[HKCU\Software\adm914]
"a1_168" = "749536876"

[HKCU\Software\adm914]
"a1_361" = "1623409593"

[HKCU\Software\adm914]
"a1_360" = "890147540"

[HKCU\Software\adm914]
"a1_363" = "1397392968"

[HKCU\Software\adm914]
"a1_362" = "791951508"

[HKCU\Software\adm914]
"a1_365" = "3312262809"

[HKCU\Software\adm914]
"a1_364" = "13189590"

[HKCU\Software\adm914]
"a1_367" = "4286678865"

[HKCU\Software\adm914]
"a1_366" = "3964976403"

[HKCU\Software\adm914]
"a1_369" = "3654170534"

[HKCU\Software\adm914]
"a1_368" = "4111584259"

[HKCU\Software\adm914\695404737]
"7169121" = "247"

[HKCU\Software\adm914]
"a2_88" = "630888632"

[HKCU\Software\adm914]
"a2_89" = "638043297"

[HKCU\Software\adm914]
"a2_86" = "616539736"

[HKCU\Software\adm914]
"a2_87" = "623709791"

[HKCU\Software\adm914]
"a2_84" = "602206888"

[HKCU\Software\adm914]
"a2_85" = "609372171"

[HKCU\Software\adm914]
"a2_82" = "587871058"

[HKCU\Software\adm914]
"a2_83" = "595041933"

[HKCU\Software\adm914]
"a2_80" = "573523991"

[HKCU\Software\adm914]
"a2_81" = "580704205"

[HKCU\Software\Aas]
"a2_119" = "853127912"

[HKCU\Software\Aas]
"a2_118" = "845961369"

[HKCU\Software\Aas]
"a2_113" = "810111668"

[HKCU\Software\Aas]
"a2_112" = "802943979"

[HKCU\Software\Aas]
"a2_111" = "795778724"

[HKCU\Software\Aas]
"a2_110" = "788611070"

[HKCU\Software\Aas]
"a2_117" = "838792606"

[HKCU\Software\Aas]
"a2_116" = "831612746"

[HKCU\Software\Aas]
"a2_115" = "824446933"

[HKCU\Software\Aas]
"a2_114" = "817276726"

[HKCU\Software\adm914]
"a1_335" = "2554481235"

[HKCU\Software\Aas]
"a2_59" = "422983812"

[HKCU\Software\Aas]
"a2_58" = "415804053"

[HKCU\Software\Aas]
"a2_53" = "379965865"

[HKCU\Software\Aas]
"a2_52" = "372798767"

[HKCU\Software\Aas]
"a2_51" = "365618012"

[HKCU\Software\Aas]
"a2_50" = "358449786"

[HKCU\Software\Aas]
"a2_57" = "408648142"

[HKCU\Software\Aas]
"a2_56" = "401468783"

[HKCU\Software\Aas]
"a2_55" = "394309773"

[HKCU\Software\Aas]
"a2_54" = "387134182"

[HKCU\Software\Aas]
"a4_55" = "394301655"

[HKCU\Software\Aas]
"a4_54" = "387132534"

[HKCU\Software\Aas]
"a4_57" = "408639897"

[HKCU\Software\Aas]
"a4_56" = "401470776"

[HKCU\Software\Aas]
"a4_51" = "365625171"

[HKCU\Software\adm914]
"a4_181" = "1297610901"

[HKCU\Software\Aas]
"a4_53" = "379963413"

[HKCU\Software\Aas]
"a4_52" = "372794292"

[HKCU\Software\Aas]
"a4_59" = "422978139"

[HKCU\Software\Aas]
"a4_58" = "415809018"

[HKCU\Software\adm914]
"a2_232" = "1663233809"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\adm914]
"a3_374" = "2664678391"

[HKCU\Software\adm914]
"a3_375" = "2705157206"

[HKCU\Software\adm914]
"a3_370" = "2669179507"

[HKCU\Software\adm914]
"a3_371" = "2676694738"

[HKCU\Software\adm914]
"a3_372" = "2683746997"

[HKCU\Software\adm914]
"a3_373" = "2657101588"

[HKCU\Software\adm914]
"a3_114" = "834000243"

[HKCU\Software\adm914]
"a3_115" = "807891410"

[HKCU\Software\adm914]
"a3_116" = "814882229"

[HKCU\Software\adm914]
"a3_117" = "821921300"

[HKCU\Software\adm914]
"a3_110" = "771901423"

[HKCU\Software\adm914]
"a3_111" = "778952782"

[HKCU\Software\adm914]
"a3_112" = "785943601"

[HKCU\Software\adm914]
"a3_113" = "826943632"

[HKCU\Software\adm914]
"a3_118" = "862921463"

[HKCU\Software\adm914]
"a3_119" = "869977942"

[HKCU\Software\adm914]
"a4_238" = "1706250798"

[HKCU\Software\adm914]
"a4_239" = "1713419919"

[HKCU\Software\adm914]
"a4_236" = "1691912556"

[HKCU\Software\adm914]
"a4_237" = "1699081677"

[HKCU\Software\adm914]
"a4_234" = "1677574314"

[HKCU\Software\adm914]
"a4_235" = "1684743435"

[HKCU\Software\adm914]
"a4_232" = "1663236072"

[HKCU\Software\adm914]
"a4_233" = "1670405193"

[HKCU\Software\adm914]
"a4_230" = "1648897830"

[HKCU\Software\adm914]
"a4_231" = "1656066951"

[HKCU\Software\Aas]
"a1_132" = "384144711"

[HKCU\Software\Aas]
"a1_130" = "690441866"

[HKCU\Software\Aas]
"a1_131" = "56680544"

[HKCU\Software\adm914]
"a4_88" = "630882648"

[HKCU\Software\adm914]
"a4_89" = "638051769"

[HKCU\Software\adm914]
"a4_80" = "573529680"

[HKCU\Software\adm914]
"a4_81" = "580698801"

[HKCU\Software\adm914]
"a4_82" = "587867922"

[HKCU\Software\adm914]
"a4_83" = "595037043"

[HKCU\Software\adm914]
"a4_84" = "602206164"

[HKCU\Software\adm914]
"a4_85" = "609375285"

[HKCU\Software\adm914]
"a4_86" = "616544406"

[HKCU\Software\adm914]
"a4_87" = "623713527"

[HKCU\Software\adm914]
"a1_170" = "2238620606"

[HKCU\Software\adm914]
"a1_171" = "1447519901"

[HKCU\Software\adm914]
"a1_172" = "1611864581"

[HKCU\Software\adm914]
"a1_173" = "2379136987"

[HKCU\Software\adm914]
"a1_174" = "4256917077"

[HKCU\Software\adm914]
"a1_175" = "1466278913"

[HKCU\Software\adm914]
"a1_176" = "3950792717"

[HKCU\Software\adm914]
"a1_177" = "20918364"

[HKCU\Software\adm914]
"a1_178" = "650829222"

[HKCU\Software\adm914]
"a1_179" = "1393574301"

[HKCU\Software\adm914]
"a1_376" = "2492070604"

[HKCU\Software\adm914]
"a1_374" = "4095118314"

[HKCU\Software\adm914]
"a1_375" = "2261616965"

[HKCU\Software\adm914]
"a1_372" = "3182957444"

[HKCU\Software\adm914]
"a1_373" = "3658752926"

[HKCU\Software\adm914]
"a1_370" = "3677953032"

[HKCU\Software\adm914]
"a1_371" = "2762866927"

[HKCU\Software\Aas]
"a4_37" = "265257477"

[HKCU\Software\adm914]
"a2_99" = "709739701"

[HKCU\Software\adm914]
"a2_98" = "702575721"

[HKCU\Software\Aas]
"a4_36" = "258088356"

[HKCU\Software\adm914]
"a2_95" = "681061311"

[HKCU\Software\adm914]
"a2_94" = "673890964"

[HKCU\Software\adm914]
"a2_97" = "695408991"

[HKCU\Software\adm914]
"a2_96" = "688241727"

[HKCU\Software\adm914]
"a2_91" = "652392760"

[HKCU\Software\adm914]
"a2_90" = "645226082"

[HKCU\Software\adm914]
"a2_93" = "666724073"

[HKCU\Software\adm914]
"a2_92" = "659555708"

[HKCU\Software\Aas]
"a4_34" = "243750114"

[HKCU\Software\Aas]
"a4_33" = "236580993"

[HKCU\Software\Aas]
"a4_32" = "229411872"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_31" = "222242751"

[HKCU\Software\Aas]
"a4_30" = "215073630"

[HKCU\Software\adm914]
"a3_52" = "389744117"

[HKCU\Software\adm914]
"a3_53" = "396799572"

[HKCU\Software\adm914]
"a3_50" = "341769395"

[HKCU\Software\adm914]
"a3_51" = "348756242"

[HKCU\Software\adm914]
"a3_56" = "384734073"

[HKCU\Software\adm914]
"a3_57" = "425213912"

[HKCU\Software\adm914]
"a3_54" = "370166327"

[HKCU\Software\adm914]
"a3_55" = "377747094"

[HKCU\Software\adm914]
"a3_58" = "432790459"

[HKCU\Software\adm914]
"a3_59" = "406144026"

[HKCU\Software\Aas]
"a2_128" = "917645562"

[HKCU\Software\Aas]
"a2_129" = "924811966"

[HKCU\Software\Aas]
"a2_126" = "903315315"

[HKCU\Software\Aas]
"a2_127" = "910482024"

[HKCU\Software\Aas]
"a2_124" = "888963725"

[HKCU\Software\Aas]
"a2_125" = "896147150"

[HKCU\Software\Aas]
"a2_122" = "874630597"

[HKCU\Software\Aas]
"a2_123" = "881799036"

[HKCU\Software\Aas]
"a2_120" = "860297105"

[HKCU\Software\Aas]
"a2_121" = "867460638"

[HKCU\Software\Aas]
"a1_12" = "1174665665"

[HKCU\Software\Aas]
"a1_13" = "4076776892"

[HKCU\Software\Aas]
"a1_10" = "1071546649"

[HKCU\Software\Aas]
"a1_11" = "2318739959"

[HKCU\Software\Aas]
"a1_16" = "1472144990"

[HKCU\Software\Aas]
"a1_17" = "3772702960"

[HKCU\Software\Aas]
"a1_14" = "4170948361"

[HKCU\Software\Aas]
"a1_15" = "247433699"

[HKCU\Software\Aas]
"a1_18" = "1449162629"

[HKCU\Software\Aas]
"a1_19" = "3052690794"

[HKCU\Software\Aas]
"a2_48" = "344116756"

[HKCU\Software\Aas]
"a2_49" = "351283759"

[HKCU\Software\Aas]
"a2_40" = "286767228"

[HKCU\Software\Aas]
"a2_41" = "293931777"

[HKCU\Software\Aas]
"a2_42" = "301093791"

[HKCU\Software\Aas]
"a2_43" = "308281026"

[HKCU\Software\Aas]
"a2_44" = "315449125"

[HKCU\Software\Aas]
"a2_45" = "322602330"

[HKCU\Software\Aas]
"a2_46" = "329787477"

[HKCU\Software\Aas]
"a2_47" = "336949694"

[HKCU\Software\Aas]
"a4_42" = "301103082"

[HKCU\Software\Aas]
"a4_43" = "308272203"

[HKCU\Software\Aas]
"a4_40" = "286764840"

[HKCU\Software\Aas]
"a4_41" = "293933961"

[HKCU\Software\Aas]
"a4_46" = "329779566"

[HKCU\Software\Aas]
"a4_47" = "336948687"

[HKCU\Software\Aas]
"a4_44" = "315441324"

[HKCU\Software\Aas]
"a4_45" = "322610445"

[HKCU\Software\Aas]
"a4_48" = "344117808"

[HKCU\Software\Aas]
"a4_49" = "351286929"

[HKCU\Software\Aas]
"a3_18" = "112354555"

[HKCU\Software\Aas]
"a3_19" = "152901914"

[HKCU\Software\Aas]
"a3_14" = "83367783"

[HKCU\Software\Aas]
"a3_15" = "124488582"

[HKCU\Software\Aas]
"a3_16" = "131411001"

[HKCU\Software\Aas]
"a3_17" = "104906840"

[HKCU\Software\Aas]
"a3_10" = "88506851"

[HKCU\Software\Aas]
"a3_11" = "95435266"

[HKCU\Software\Aas]
"a3_12" = "69459621"

[HKCU\Software\Aas]
"a3_13" = "76378820"

[HKCU\Software\adm914]
"a3_297" = "2146046664"

[HKCU\Software\adm914]
"a3_296" = "2139059817"

[HKCU\Software\adm914]
"a3_295" = "2131611014"

[HKCU\Software\adm914]
"a3_294" = "2091000103"

[HKCU\Software\adm914]
"a3_293" = "2083554628"

[HKCU\Software\adm914]
"a3_292" = "2110068965"

[HKCU\Software\adm914]
"a3_291" = "2103081986"

[HKCU\Software\adm914]
"a3_290" = "2062078883"

[HKCU\Software\adm914]
"a3_299" = "2126994186"

[HKCU\Software\adm914]
"a3_298" = "2119548587"

[HKCU\Software\adm914]
"a3_341" = "2427835252"

[HKCU\Software\adm914]
"a3_340" = "2420782741"

[HKCU\Software\adm914]
"a3_343" = "2475826102"

[HKCU\Software\adm914]
"a3_342" = "2468839383"

[HKCU\Software\adm914]
"a3_345" = "2456756472"

[HKCU\Software\adm914]
"a3_344" = "2482865177"

[HKCU\Software\adm914]
"a3_347" = "2504288570"

[HKCU\Software\adm914]
"a3_346" = "2463812955"

[HKCU\Software\adm914]
"a3_349" = "2485304956"

[HKCU\Software\adm914]
"a3_348" = "2511803805"

[HKCU\Software\adm914]
"a3_265" = "1883213352"

[HKCU\Software\adm914]
"a1_127" = "3174105194"

[HKCU\Software\adm914]
"a3_129" = "907866784"

[HKCU\Software\adm914]
"a3_128" = "934368961"

[HKCU\Software\adm914]
"a3_121" = "850859928"

[HKCU\Software\adm914]
"a3_120" = "843344697"

[HKCU\Software\adm914]
"a3_123" = "898391258"

[HKCU\Software\adm914]
"a3_122" = "891465851"

[HKCU\Software\adm914]
"a3_125" = "879322396"

[HKCU\Software\adm914]
"a3_124" = "905967805"

[HKCU\Software\adm914]
"a3_127" = "927443550"

[HKCU\Software\adm914]
"a3_126" = "886309375"

[HKCU\Software\Aas]
"a1_129" = "1432010424"

[HKCU\Software\Aas]
"a1_128" = "3127333326"

[HKCU\Software\Aas]
"a1_125" = "970875667"

[HKCU\Software\Aas]
"a1_124" = "4115117989"

[HKCU\Software\Aas]
"a1_127" = "65565130"

[HKCU\Software\Aas]
"a1_126" = "3464254432"

[HKCU\Software\Aas]
"a1_121" = "3106539700"

[HKCU\Software\Aas]
"a1_120" = "1615142597"

[HKCU\Software\Aas]
"a1_123" = "2505493287"

[HKCU\Software\Aas]
"a1_122" = "2493032295"

[HKCU\Software\adm914]
"a2_339" = "2430334219"

[HKCU\Software\adm914]
"a2_338" = "2423167815"

[HKCU\Software\adm914]
"a4_99" = "709742979"

[HKCU\Software\adm914]
"a4_98" = "702573858"

[HKCU\Software\adm914]
"a4_97" = "695404737"

[HKCU\Software\adm914]
"a4_96" = "688235616"

[HKCU\Software\adm914]
"a4_95" = "681066495"

[HKCU\Software\adm914]
"a4_94" = "673897374"

[HKCU\Software\adm914]
"a4_93" = "666728253"

[HKCU\Software\adm914]
"a4_92" = "659559132"

[HKCU\Software\adm914]
"a4_91" = "652390011"

[HKCU\Software\adm914]
"a4_90" = "645220890"

[HKCU\Software\adm914]
"a1_145" = "3645288382"

[HKCU\Software\adm914]
"a1_144" = "2534413805"

[HKCU\Software\adm914]
"a1_147" = "1951668958"

[HKCU\Software\adm914]
"a1_146" = "2981584161"

[HKCU\Software\adm914]
"a1_141" = "1684382998"

[HKCU\Software\adm914]
"a1_140" = "2480394453"

[HKCU\Software\adm914]
"a1_143" = "3275705441"

[HKCU\Software\adm914]
"a1_142" = "726793849"

[HKCU\Software\adm914]
"a1_149" = "1925051335"

[HKCU\Software\adm914]
"a1_148" = "2243725224"

[HKCU\Software\adm914]
"a2_331" = "2372980967"

[HKCU\Software\adm914]
"a2_330" = "2365802436"

[HKCU\Software\adm914]
"a2_333" = "2387314261"

[HKCU\Software\adm914]
"a2_332" = "2380151848"

[HKCU\Software\adm914]
"a2_335" = "2401648865"

[HKCU\Software\adm914]
"a2_334" = "2394483196"

[HKCU\Software\adm914]
"a2_337" = "2415998834"

[HKCU\Software\adm914]
"a2_336" = "2408817918"

[HKCU\Software\adm914]
"a1_301" = "4237116504"

[HKCU\Software\adm914]
"a1_300" = "4276499423"

[HKCU\Software\adm914]
"a1_307" = "1017085073"

[HKCU\Software\adm914]
"a1_306" = "1306362696"

[HKCU\Software\adm914]
"a3_41" = "277247432"

[HKCU\Software\adm914]
"a3_40" = "269797737"

[HKCU\Software\adm914]
"a3_43" = "324844042"

[HKCU\Software\adm914]
"a3_42" = "284234155"

[HKCU\Software\adm914]
"a3_45" = "305775436"

[HKCU\Software\adm914]
"a3_44" = "332277485"

[HKCU\Software\adm914]
"a3_47" = "353766286"

[HKCU\Software\adm914]
"a3_46" = "313225007"

[HKCU\Software\adm914]
"a3_49" = "368267472"

[HKCU\Software\adm914]
"a3_48" = "360821873"

[HKCU\Software\Aas]
"a2_75" = "537686322"

[HKCU\Software\Aas]
"a2_74" = "530521781"

[HKCU\Software\Aas]
"a2_77" = "552021526"

[HKCU\Software\Aas]
"a2_76" = "544856747"

[HKCU\Software\Aas]
"a2_71" = "509004939"

[HKCU\Software\Aas]
"a2_70" = "501834977"

[HKCU\Software\Aas]
"a2_73" = "523353208"

[HKCU\Software\Aas]
"a2_72" = "516170361"

[HKCU\Software\Aas]
"a2_79" = "566353720"

[HKCU\Software\Aas]
"a2_78" = "559189800"

[HKCU\Software\adm914]
"a3_195" = "1380979618"

[HKCU\Software\adm914]
"a3_271" = "1926112494"

[HKCU\Software\adm914]
"a2_48" = "344114656"

[HKCU\Software\adm914]
"a2_49" = "351284652"

[HKCU\Software\adm914]
"a2_42" = "301099138"

[HKCU\Software\adm914]
"a2_43" = "308267784"

[HKCU\Software\adm914]
"a2_40" = "286769120"

[HKCU\Software\adm914]
"a2_41" = "293930025"

[HKCU\Software\adm914]
"a2_46" = "329784791"

[HKCU\Software\adm914]
"a2_47" = "336952331"

[HKCU\Software\adm914]
"a2_44" = "315445554"

[HKCU\Software\adm914]
"a2_45" = "322614021"

[HKCU\Software\adm914]
"a1_339" = "1987469261"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\adm914]
"a1_332" = "3955351922"

[HKCU\Software\adm914]
"a1_333" = "2417009907"

[HKCU\Software\adm914]
"a1_330" = "1398682454"

[HKCU\Software\adm914]
"a1_331" = "4002165766"

[HKCU\Software\adm914]
"a1_336" = "439451965"

[HKCU\Software\adm914]
"a1_337" = "3872239598"

[HKCU\Software\Aas]
"a3_29" = "224867540"

[HKCU\Software\Aas]
"a3_28" = "183865525"

[HKCU\Software\adm914]
"a1_334" = "3329301475"

[HKCU\Software\Aas]
"a3_21" = "167399900"

[HKCU\Software\Aas]
"a3_20" = "159956413"

[HKCU\Software\Aas]
"a3_23" = "148336286"

[HKCU\Software\Aas]
"a3_22" = "140888703"

[HKCU\Software\Aas]
"a3_25" = "195929936"

[HKCU\Software\Aas]
"a3_24" = "188875569"

[HKCU\Software\Aas]
"a3_27" = "176880658"

[HKCU\Software\Aas]
"a3_26" = "169827315"

[HKCU\Software\adm914]
"a3_339" = "2446887474"

[HKCU\Software\adm914]
"a3_284" = "2019048925"

[HKCU\Software\adm914]
"a3_285" = "2026625468"

[HKCU\Software\adm914]
"a3_286" = "2067087903"

[HKCU\Software\adm914]
"a3_287" = "2074144510"

[HKCU\Software\adm914]
"a3_280" = "1990634585"

[HKCU\Software\adm914]
"a3_281" = "2031110200"

[HKCU\Software\adm914]
"a3_282" = "2038690971"

[HKCU\Software\adm914]
"a3_283" = "2045677946"

[HKCU\Software\adm914]
"a3_288" = "2048101217"

[HKCU\Software\adm914]
"a3_289" = "2055026624"

[HKCU\Software\adm914]
"a3_356" = "2568810661"

[HKCU\Software\adm914]
"a3_357" = "2576325892"

[HKCU\Software\adm914]
"a3_354" = "2521278563"

[HKCU\Software\adm914]
"a3_355" = "2528203970"

[HKCU\Software\adm914]
"a3_352" = "2540266273"

[HKCU\Software\adm914]
"a3_353" = "2547257216"

[HKCU\Software\adm914]
"a3_350" = "2492226271"

[HKCU\Software\adm914]
"a3_351" = "2499790526"

[HKCU\Software\adm914]
"a3_358" = "2583247335"

[HKCU\Software\adm914]
"a3_359" = "2556731974"

[HKCU\Software\adm914]
"a2_285" = "2043192915"

[HKCU\Software\adm914]
"a2_284" = "2036025645"

[HKCU\Software\adm914]
"a2_287" = "2057540039"

[HKCU\Software\adm914]
"a2_286" = "2050374657"

[HKCU\Software\adm914]
"a2_281" = "2014519636"

[HKCU\Software\adm914]
"a2_280" = "2007357620"

[HKCU\Software\adm914]
"a2_283" = "2028856134"

[HKCU\Software\adm914]
"a2_282" = "2021687343"

[HKCU\Software\adm914]
"a2_289" = "2071871817"

[HKCU\Software\adm914]
"a2_288" = "2064710373"

[HKCU\Software\adm914]
"a2_359" = "2573720879"

[HKCU\Software\adm914]
"a2_358" = "2566540758"

[HKCU\Software\adm914]
"a2_353" = "2530703881"

[HKCU\Software\adm914]
"a2_352" = "2523537048"

[HKCU\Software\adm914]
"a2_351" = "2516368103"

[HKCU\Software\adm914]
"a2_350" = "2509186333"

[HKCU\Software\adm914]
"a2_357" = "2559372926"

[HKCU\Software\adm914]
"a2_356" = "2552201376"

[HKCU\Software\adm914]
"a2_355" = "2545034019"

[HKCU\Software\adm914]
"a2_354" = "2537870973"

[HKCU\Software\adm914]
"a2_106" = "759924122"

[HKCU\Software\adm914]
"a3_138" = "1006336523"

[HKCU\Software\adm914]
"a3_139" = "979822314"

[HKCU\Software\adm914]
"a3_136" = "991835593"

[HKCU\Software\adm914]
"a3_137" = "998887848"

[HKCU\Software\adm914]
"a3_134" = "943844487"

[HKCU\Software\adm914]
"a3_135" = "950831462"

[HKCU\Software\adm914]
"a3_132" = "962896965"

[HKCU\Software\adm914]
"a3_133" = "970342436"

[HKCU\Software\adm914]
"a3_130" = "915382019"

[HKCU\Software\adm914]
"a3_131" = "922303458"

[HKCU\Software\adm914]
"a2_105" = "752759399"

[HKCU\Software\adm914]
"a2_102" = "731245355"

[HKCU\Software\adm914]
"a2_103" = "738426159"

[HKCU\Software\adm914]
"a2_100" = "716909504"

[HKCU\Software\adm914]
"a2_101" = "724075213"

[HKCU\Software\adm914]
"a4_62" = "444485502"

[HKCU\Software\adm914]
"a4_63" = "451654623"

[HKCU\Software\adm914]
"a4_60" = "430147260"

[HKCU\Software\adm914]
"a4_61" = "437316381"

[HKCU\Software\adm914]
"a4_66" = "473161986"

[HKCU\Software\adm914]
"a4_67" = "480331107"

[HKCU\Software\adm914]
"a4_64" = "458823744"

[HKCU\Software\adm914]
"a4_65" = "465992865"

[HKCU\Software\adm914]
"a4_68" = "487500228"

[HKCU\Software\adm914]
"a4_69" = "494669349"

[HKCU\Software\adm914]
"a1_158" = "3429317294"

[HKCU\Software\adm914]
"a1_159" = "262552674"

[HKCU\Software\adm914]
"a1_152" = "1468321015"

[HKCU\Software\adm914]
"a1_153" = "3289807497"

[HKCU\Software\adm914]
"a1_150" = "550246822"

[HKCU\Software\adm914]
"a1_151" = "4272000866"

[HKCU\Software\adm914]
"a1_156" = "3204113880"

[HKCU\Software\adm914]
"a1_157" = "813479202"

[HKCU\Software\adm914]
"a1_154" = "1886340580"

[HKCU\Software\adm914]
"a1_155" = "681561320"

[HKCU\Software\adm914]
"a1_32" = "2358265154"

[HKCU\Software\adm914]
"a1_33" = "1105670463"

[HKCU\Software\adm914]
"a1_30" = "1056644102"

[HKCU\Software\adm914]
"a1_31" = "297416461"

[HKCU\Software\adm914]
"a1_36" = "2477746923"

[HKCU\Software\adm914]
"a1_37" = "180481150"

[HKCU\Software\adm914]
"a1_34" = "2671267259"

[HKCU\Software\adm914]
"a1_35" = "2863077402"

[HKCU\Software\adm914]
"a1_38" = "3401221928"

[HKCU\Software\adm914]
"a1_39" = "448516541"

[HKCU\Software\adm914]
"a3_74" = "513565259"

[HKCU\Software\adm914]
"a3_75" = "554634794"

[HKCU\Software\adm914]
"a3_76" = "561687181"

[HKCU\Software\adm914]
"a3_77" = "568612716"

[HKCU\Software\adm914]
"a3_70" = "485102791"

[HKCU\Software\adm914]
"a3_71" = "525709478"

[HKCU\Software\adm914]
"a3_72" = "533159177"

[HKCU\Software\adm914]
"a3_73" = "506657256"

[HKCU\Software\adm914]
"a3_78" = "542634959"

[HKCU\Software\adm914]
"a3_79" = "549625774"

[HKCU\Software\Aas]
"a2_62" = "444486125"

[HKCU\Software\Aas]
"a2_63" = "451651644"

[HKCU\Software\Aas]
"a2_60" = "430153204"

[HKCU\Software\Aas]
"a2_61" = "437320174"

[HKCU\Software\Aas]
"a2_66" = "473168565"

[HKCU\Software\Aas]
"a2_67" = "480334400"

[HKCU\Software\Aas]
"a2_64" = "458819180"

[HKCU\Software\Aas]
"a2_65" = "465986063"

[HKCU\Software\Aas]
"a2_68" = "487502283"

[HKCU\Software\Aas]
"a2_69" = "494669941"

[HKCU\Software\adm914]
"a2_59" = "422984483"

[HKCU\Software\adm914]
"a2_58" = "415803538"

[HKCU\Software\adm914]
"a2_51" = "365619350"

[HKCU\Software\adm914]
"a2_50" = "358465336"

[HKCU\Software\adm914]
"a2_53" = "379967613"

[HKCU\Software\adm914]
"a2_52" = "372798985"

[HKCU\Software\adm914]
"a2_55" = "394310941"

[HKCU\Software\adm914]
"a2_54" = "387137454"

[HKCU\Software\adm914]
"a2_57" = "408633569"

[HKCU\Software\adm914]
"a2_56" = "401466109"

[HKCU\Software\Aas]
"a3_36" = "241268621"

[HKCU\Software\Aas]
"a3_37" = "248309804"

[HKCU\Software\Aas]
"a3_34" = "260325067"

[HKCU\Software\Aas]
"a3_35" = "267899754"

[HKCU\Software\Aas]
"a3_32" = "212854281"

[HKCU\Software\Aas]
"a3_33" = "253401768"

[HKCU\Software\Aas]
"a3_30" = "231909751"

[HKCU\Software\Aas]
"a3_31" = "205278614"

[HKCU\Software\Aas]
"a3_38" = "289377359"

[HKCU\Software\Aas]
"a3_39" = "296296686"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\adm914]
"a4_153" = "1096875513"

[HKCU\Software\adm914]
"a4_152" = "1089706392"

[HKCU\Software\adm914]
"a4_151" = "1082537271"

[HKCU\Software\adm914]
"a4_150" = "1075368150"

[HKCU\Software\adm914]
"a4_157" = "1125551997"

[HKCU\Software\adm914]
"a4_156" = "1118382876"

[HKCU\Software\adm914]
"a4_155" = "1111213755"

[HKCU\Software\adm914]
"a4_154" = "1104044634"

[HKCU\Software\adm914]
"a4_159" = "1139890239"

[HKCU\Software\adm914]
"a4_158" = "1132721118"

[HKCU\Software\adm914\695404737]
"14338242" = "0"

[HKCU\Software\adm914]
"a3_240" = "1737325745"

[HKCU\Software\adm914]
"a3_241" = "1744312592"

[HKCU\Software\adm914]
"a3_242" = "1718322675"

[HKCU\Software\adm914]
"a3_243" = "1725247058"

[HKCU\Software\adm914]
"a4_373" = "2674082133"

[HKCU\Software\adm914]
"a3_244" = "1765853749"

[HKCU\Software\adm914]
"a4_371" = "2659743891"

[HKCU\Software\adm914]
"a4_370" = "2652574770"

[HKCU\Software\adm914]
"a4_375" = "2688420375"

[HKCU\Software\adm914]
"a3_245" = "1773303444"

[HKCU\Software\adm914]
"a3_246" = "1746735991"

[HKCU\Software\adm914]
"a3_247" = "1753792470"

[HKCU\Software\adm914]
"a2_348" = "2494850390"

[HKCU\Software\adm914]
"a2_349" = "2502018695"

[HKCU\Software\adm914]
"a2_340" = "2437499400"

[HKCU\Software\adm914]
"a2_341" = "2444666735"

[HKCU\Software\adm914]
"a2_342" = "2451835390"

[HKCU\Software\adm914]
"a2_343" = "2459003898"

[HKCU\Software\adm914]
"a2_344" = "2466182356"

[HKCU\Software\adm914]
"a2_345" = "2473350233"

[HKCU\Software\adm914]
"a2_346" = "2480520434"

[HKCU\Software\adm914]
"a2_347" = "2487687484"

[HKCU\Software\adm914]
"a2_298" = "2136392322"

[HKCU\Software\adm914]
"a2_299" = "2143561147"

[HKCU\Software\adm914]
"a2_292" = "2093379064"

[HKCU\Software\adm914]
"a2_293" = "2100557637"

[HKCU\Software\adm914]
"a2_290" = "2079040745"

[HKCU\Software\adm914]
"a2_291" = "2086208081"

[HKCU\Software\adm914]
"a2_296" = "2122056199"

[HKCU\Software\adm914]
"a2_297" = "2129223728"

[HKCU\Software\adm914]
"a2_294" = "2107724990"

[HKCU\Software\adm914]
"a2_295" = "2114892377"

[HKCU\Software\adm914]
"a4_226" = "1620221346"

[HKCU\Software\adm914]
"a4_71" = "509007591"

[HKCU\Software\adm914]
"a4_70" = "501838470"

[HKCU\Software\adm914]
"a4_73" = "523345833"

[HKCU\Software\adm914]
"a4_72" = "516176712"

[HKCU\Software\adm914]
"a4_75" = "537684075"

[HKCU\Software\adm914]
"a4_74" = "530514954"

[HKCU\Software\adm914]
"a4_77" = "552022317"

[HKCU\Software\adm914]
"a4_76" = "544853196"

[HKCU\Software\adm914]
"a4_79" = "566360559"

[HKCU\Software\adm914]
"a4_78" = "559191438"

[HKCU\Software\adm914]
"a1_129" = "1363229339"

[HKCU\Software\adm914]
"a1_128" = "3569686334"

[HKCU\Software\Aas\695404737]
"50183847" = "8D482144D6AB9E65AB5D732E35BA327F2DCEC983D41A37D56DAFF40919CA9630CDF6902C1C5EAEE675386957562866F4069CED404BFAB7C8B60A4167F6A7847BEF830A6F30C03ADD6EA841B65CA653F5F5B7C53F251A450424A27E7AC478835F982AE213A3634E32F62DF34219E6C9D7744EEF2F97FD353F0C698D9D20F10EC0"

[HKCU\Software\adm914]
"a1_126" = "2516362451"

[HKCU\Software\adm914]
"a1_125" = "207109344"

[HKCU\Software\adm914]
"a1_124" = "1044358562"

[HKCU\Software\adm914]
"a1_123" = "3336436262"

[HKCU\Software\adm914]
"a1_122" = "1099123300"

[HKCU\Software\adm914]
"a1_121" = "929154436"

[HKCU\Software\adm914]
"a1_120" = "3449063968"

[HKCU\Software\adm914]
"a1_233" = "2120623396"

[HKCU\Software\adm914]
"a1_232" = "2442429620"

[HKCU\Software\adm914]
"a1_231" = "2066778684"

[HKCU\Software\adm914]
"a1_230" = "2481674857"

[HKCU\Software\adm914]
"a1_237" = "769112704"

[HKCU\Software\adm914]
"a1_236" = "1234903553"

[HKCU\Software\adm914]
"a1_235" = "2881438981"

[HKCU\Software\adm914]
"a1_234" = "326109402"

[HKCU\Software\adm914]
"a1_239" = "2750214484"

[HKCU\Software\adm914]
"a1_238" = "2295441239"

[HKCU\Software\adm914]
"a1_21" = "724125091"

[HKCU\Software\adm914]
"a1_20" = "3668784221"

[HKCU\Software\adm914]
"a1_23" = "2352108523"

[HKCU\Software\adm914]
"a1_22" = "247144938"

[HKCU\Software\adm914]
"a1_25" = "201460524"

[HKCU\Software\adm914]
"a1_24" = "493865126"

[HKCU\Software\adm914]
"a1_27" = "1858394245"

[HKCU\Software\adm914]
"a1_26" = "796654978"

[HKCU\Software\adm914]
"a1_29" = "586135848"

[HKCU\Software\adm914]
"a1_28" = "4090607394"

[HKCU\Software\adm914]
"a3_69" = "478111844"

[HKCU\Software\adm914]
"a3_68" = "470667141"

[HKCU\Software\adm914]
"a2_258" = "1849637039"

[HKCU\Software\adm914]
"a3_63" = "468243870"

[HKCU\Software\adm914]
"a3_62" = "461187391"

[HKCU\Software\adm914]
"a3_61" = "454266204"

[HKCU\Software\adm914]
"a3_60" = "413196541"

[HKCU\Software\adm914]
"a3_67" = "497165090"

[HKCU\Software\adm914]
"a3_66" = "489719619"

[HKCU\Software\adm914]
"a3_65" = "449125088"

[HKCU\Software\adm914]
"a3_64" = "442138113"

[HKCU\Software\adm914]
"a2_253" = "1813784225"

[HKCU\Software\adm914]
"a2_250" = "1792285901"

[HKCU\Software\adm914]
"a2_251" = "1799453755"

[HKCU\Software\adm914\695404737]
"35845605" = "315"

[HKCU\Software\adm914]
"a4_229" = "1641728709"

[HKCU\Software\Aas]
"a2_99" = "709740984"

[HKCU\Software\Aas]
"a2_98" = "702575865"

[HKCU\Software\Aas]
"a2_97" = "695407343"

[HKCU\Software\Aas]
"a2_96" = "688226730"

[HKCU\Software\Aas]
"a2_95" = "681060488"

[HKCU\Software\Aas]
"a2_94" = "673892335"

[HKCU\Software\Aas]
"a2_93" = "666725570"

[HKCU\Software\Aas]
"a2_92" = "659557986"

[HKCU\Software\Aas]
"a2_91" = "652381936"

[HKCU\Software\Aas]
"a2_90" = "645225620"

[HKCU\Software\adm914]
"a2_157" = "1125553891"

[HKCU\Software\adm914]
"a2_68" = "487504040"

[HKCU\Software\adm914]
"a2_69" = "494671782"

[HKCU\Software\adm914]
"a2_64" = "458820154"

[HKCU\Software\adm914]
"a2_65" = "465988943"

[HKCU\Software\adm914]
"a2_66" = "473168672"

[HKCU\Software\adm914]
"a2_67" = "480334863"

[HKCU\Software\adm914]
"a2_60" = "430151254"

[HKCU\Software\adm914]
"a2_61" = "437318761"

[HKCU\Software\adm914]
"a2_62" = "444487712"

[HKCU\Software\adm914]
"a2_63" = "451650193"

[HKCU\Software\adm914]
"a4_220" = "1577206620"

[HKCU\Software\Aas]
"a3_43" = "324843106"

[HKCU\Software\Aas]
"a3_42" = "284237251"

[HKCU\Software\Aas]
"a3_41" = "277248416"

[HKCU\Software\Aas]
"a3_40" = "269796609"

[HKCU\Software\Aas]
"a3_47" = "353765350"

[HKCU\Software\Aas]
"a3_46" = "313221959"

[HKCU\Software\Aas]
"a3_45" = "305778468"

[HKCU\Software\Aas]
"a3_44" = "332278405"

[HKCU\Software\Aas]
"a3_49" = "368270520"

[HKCU\Software\Aas]
"a3_48" = "360822809"

[HKCU\Software\Aas]
"a4_99" = "709742979"

[HKCU\Software\Aas]
"a4_98" = "702573858"

[HKCU\Software\Aas]
"a4_91" = "652390011"

[HKCU\Software\Aas]
"a4_90" = "645220890"

[HKCU\Software\Aas]
"a4_93" = "666728253"

[HKCU\Software\Aas]
"a4_92" = "659559132"

[HKCU\Software\Aas]
"a4_95" = "681066495"

[HKCU\Software\Aas]
"a4_94" = "673897374"

[HKCU\Software\Aas]
"a4_97" = "695404737"

[HKCU\Software\Aas]
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\adm914]
"a4_140" = "1003676940"

[HKCU\Software\adm914]
"a4_141" = "1010846061"

[HKCU\Software\adm914]
"a4_142" = "1018015182"

[HKCU\Software\adm914]
"a4_143" = "1025184303"

[HKCU\Software\adm914]
"a4_144" = "1032353424"

[HKCU\Software\adm914]
"a4_145" = "1039522545"

[HKCU\Software\adm914]
"a4_146" = "1046691666"

[HKCU\Software\adm914]
"a4_147" = "1053860787"

[HKCU\Software\adm914]
"a4_148" = "1061029908"

[HKCU\Software\adm914]
"a4_149" = "1068199029"

[HKCU\Software\adm914]
"a2_199" = "1426661152"

[HKCU\Software\adm914]
"a2_198" = "1419492382"

[HKCU\Software\adm914]
"a2_191" = "1369306793"

[HKCU\Software\adm914]
"a2_190" = "1362126619"

[HKCU\Software\adm914]
"a2_193" = "1383641683"

[HKCU\Software\adm914]
"a2_192" = "1376476342"

[HKCU\Software\adm914]
"a2_195" = "1397968937"

[HKCU\Software\adm914]
"a2_194" = "1390808448"

[HKCU\Software\adm914]
"a2_197" = "1412310629"

[HKCU\Software\adm914]
"a2_196" = "1405141531"

[HKCU\Software\adm914]
"a4_368" = "2638236528"

[HKCU\Software\adm914]
"a4_369" = "2645405649"

[HKCU\Software\adm914]
"a4_360" = "2580883560"

[HKCU\Software\adm914]
"a4_361" = "2588052681"

[HKCU\Software\adm914]
"a4_362" = "2595221802"

[HKCU\Software\adm914]
"a4_363" = "2602390923"

[HKCU\Software\adm914]
"a4_364" = "2609560044"

[HKCU\Software\adm914]
"a4_365" = "2616729165"

[HKCU\Software\adm914]
"a4_366" = "2623898286"

[HKCU\Software\adm914]
"a4_367" = "2631067407"

[HKCU\Software\adm914]
"a2_223" = "1598710152"

[HKCU\Software\adm914]
"a2_222" = "1591547878"

[HKCU\Software\adm914]
"a2_221" = "1584380479"

[HKCU\Software\adm914]
"a2_220" = "1577211620"

[HKCU\Software\adm914]
"a2_375" = "2688425158"

[HKCU\Software\adm914]
"a2_227" = "1627395477"

[HKCU\Software\adm914]
"a2_376" = "2695593107"

[HKCU\Software\adm914]
"a2_371" = "2659741417"

[HKCU\Software\adm914]
"a3_275" = "1954656882"

[HKCU\Software\adm914]
"a2_373" = "2674086423"

[HKCU\Software\adm914]
"a2_226" = "1620215286"

[HKCU\Software\adm914]
"a2_225" = "1613049496"

[HKCU\Software\Aas\695404737]
"35845605" = "390"

[HKCU\Software\adm914]
"a2_224" = "1605881128"

[HKCU\Software\adm914]
"a3_274" = "1947601299"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\adm914]
"a3_277" = "2002713268"

[HKCU\Software\adm914]
"a3_276" = "1962106581"

[HKCU\Software\adm914]
"a4_44" = "315441324"

[HKCU\Software\adm914]
"a4_45" = "322610445"

[HKCU\Software\adm914]
"a4_46" = "329779566"

[HKCU\Software\adm914]
"a4_47" = "336948687"

[HKCU\Software\adm914]
"a4_40" = "286764840"

[HKCU\Software\adm914]
"a4_41" = "293933961"

[HKCU\Software\adm914]
"a4_42" = "301103082"

[HKCU\Software\adm914]
"a4_43" = "308272203"

[HKCU\Software\adm914]
"a4_48" = "344117808"

[HKCU\Software\adm914]
"a4_49" = "351286929"

[HKCU\Software\adm914]
"a1_2" = "3348585627"

[HKCU\Software\adm914]
"a1_3" = "16369780"

[HKCU\Software\adm914]
"a1_0" = "316296286"

[HKCU\Software\adm914]
"a1_1" = "3634571327"

[HKCU\Software\adm914]
"a1_6" = "1867218184"

[HKCU\Software\adm914]
"a1_7" = "1040413911"

[HKCU\Software\adm914]
"a1_4" = "3274530548"

[HKCU\Software\adm914]
"a1_5" = "3408654500"

[HKCU\Software\adm914]
"a1_8" = "1202476373"

[HKCU\Software\adm914]
"a1_9" = "526911189"

[HKCU\Software\adm914]
"a3_4" = "11990981"

[HKCU\Software\adm914]
"a3_5" = "52532132"

[HKCU\Software\adm914]
"a3_6" = "59980807"

[HKCU\Software\adm914]
"a3_7" = "67033318"

[HKCU\Software\adm914]
"a3_0" = "17000001"

[HKCU\Software\adm914]
"a3_1" = "23986720"

[HKCU\Software\adm914]
"a3_2" = "31043203"

[HKCU\Software\adm914]
"a3_3" = "4934498"

[HKCU\Software\adm914]
"a1_134" = "202097528"

[HKCU\Software\adm914]
"a1_135" = "1059660697"

[HKCU\Software\adm914]
"a1_136" = "3520048340"

[HKCU\Software\adm914]
"a1_137" = "172859312"

[HKCU\Software\adm914]
"a1_130" = "3962194684"

[HKCU\Software\adm914]
"a1_131" = "3614184221"

[HKCU\Software\adm914]
"a1_132" = "1149537502"

[HKCU\Software\adm914]
"a1_133" = "1909136556"

[HKCU\Software\adm914]
"a3_270" = "1918679055"

[HKCU\Software\adm914]
"a1_220" = "2634686505"

[HKCU\Software\adm914]
"a1_221" = "1235126500"

[HKCU\Software\adm914]
"a1_222" = "3307499586"

[HKCU\Software\adm914]
"a1_223" = "3369548577"

[HKCU\Software\adm914]
"a1_224" = "150564533"

[HKCU\Software\adm914]
"a1_225" = "3299376178"

[HKCU\Software\adm914]
"a1_226" = "712989413"

[HKCU\Software\adm914]
"a1_227" = "3546205299"

[HKCU\Software\adm914]
"a1_228" = "115138071"

[HKCU\Software\adm914]
"a1_229" = "3999383422"

[HKCU\Software\adm914]
"a1_14" = "3480573719"

[HKCU\Software\adm914]
"a1_15" = "2222496226"

[HKCU\Software\adm914]
"a1_16" = "3116007854"

[HKCU\Software\adm914]
"a1_17" = "1086842789"

[HKCU\Software\adm914]
"a1_10" = "3287597971"

[HKCU\Software\adm914]
"a1_11" = "3200708678"

[HKCU\Software\adm914]
"a1_12" = "275850998"

[HKCU\Software\adm914]
"a1_13" = "2744150430"

[HKCU\Software\adm914]
"a1_18" = "2267350554"

[HKCU\Software\adm914]
"a1_19" = "3657197192"

[HKCU\Software\adm914]
"a3_18" = "112355475"

[HKCU\Software\adm914]
"a3_19" = "152900978"

[HKCU\Software\adm914]
"a3_16" = "131407953"

[HKCU\Software\adm914]
"a3_17" = "104909872"

[HKCU\Software\adm914]
"a3_14" = "83368719"

[HKCU\Software\adm914]
"a3_15" = "124487662"

[HKCU\Software\adm914]
"a3_12" = "69456589"

[HKCU\Software\adm914]
"a3_13" = "76381868"

[HKCU\Software\adm914]
"a3_10" = "88509835"

[HKCU\Software\adm914]
"a3_11" = "95434346"

[HKCU\Software\Aas]
"a2_88" = "630890778"

[HKCU\Software\Aas]
"a2_89" = "638015649"

[HKCU\Software\Aas]
"a2_84" = "602208489"

[HKCU\Software\Aas]
"a2_85" = "609373386"

[HKCU\Software\Aas]
"a2_86" = "616536473"

[HKCU\Software\Aas]
"a2_87" = "623708852"

[HKCU\Software\Aas]
"a2_80" = "573524375"

[HKCU\Software\Aas]
"a2_81" = "580705222"

[HKCU\Software\Aas]
"a2_82" = "587874202"

[HKCU\Software\Aas]
"a2_83" = "595041850"

[HKCU\Software\adm914]
"a2_73" = "523338869"

[HKCU\Software\adm914]
"a2_72" = "516172888"

[HKCU\Software\adm914]
"a2_71" = "509004945"

[HKCU\Software\adm914]
"a2_70" = "501835016"

[HKCU\Software\adm914]
"a2_77" = "552021599"

[HKCU\Software\adm914]
"a2_76" = "544857725"

[HKCU\Software\adm914]
"a2_75" = "537686426"

[HKCU\Software\adm914]
"a2_74" = "530520772"

[HKCU\Software\adm914]
"a2_79" = "566356701"

[HKCU\Software\adm914]
"a2_78" = "559189254"

[HKCU\Software\Aas]
"a3_50" = "341766363"

[HKCU\Software\Aas]
"a3_51" = "348755322"

[HKCU\Software\Aas]
"a3_52" = "389745053"

[HKCU\Software\Aas]
"a3_53" = "396796476"

[HKCU\Software\Aas]
"a3_54" = "370165343"

[HKCU\Software\Aas]
"a3_55" = "377748222"

[HKCU\Software\Aas]
"a3_56" = "384737041"

[HKCU\Software\Aas]
"a3_57" = "425210800"

[HKCU\Software\Aas]
"a3_58" = "432789459"

[HKCU\Software\Aas]
"a3_59" = "406145138"

[HKCU\Software\adm914]
"a3_238" = "1689269359"

[HKCU\Software\adm914]
"a3_106" = "742979179"

[HKCU\Software\adm914]
"a4_171" = "1225919691"

[HKCU\Software\Aas]
"a4_86" = "616544406"

[HKCU\Software\adm914]
"a4_174" = "1247427054"

[HKCU\Software\adm914]
"a4_177" = "1268934417"

[HKCU\Software\adm914]
"a4_176" = "1261765296"

[HKCU\Software\Aas]
"a4_82" = "587867922"

[HKCU\Software\Aas]
"a4_83" = "595037043"

[HKCU\Software\Aas]
"a4_80" = "573529680"

[HKCU\Software\adm914]
"a4_172" = "1233088812"

[HKCU\Software\adm914]
"a4_179" = "1283272659"

[HKCU\Software\adm914]
"a4_178" = "1276103538"

[HKCU\Software\Aas]
"a4_88" = "630882648"

[HKCU\Software\Aas]
"a4_89" = "638051769"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\adm914]
"a4_170" = "1218750570"

[HKCU\Software\adm914]
"a2_188" = "1347792652"

[HKCU\Software\adm914]
"a2_189" = "1354958751"

[HKCU\Software\adm914]
"a2_186" = "1333458306"

[HKCU\Software\adm914]
"a2_187" = "1340622499"

[HKCU\Software\adm914]
"a2_184" = "1319124160"

[HKCU\Software\adm914]
"a2_185" = "1326292936"

[HKCU\Software\adm914]
"a2_182" = "1304774615"

[HKCU\Software\adm914]
"a2_183" = "1311952044"

[HKCU\Software\adm914]
"a2_180" = "1290443748"

[HKCU\Software\adm914]
"a2_181" = "1297607070"

[HKCU\Software\adm914]
"a2_37" = "265263169"

[HKCU\Software\adm914]
"a4_359" = "2573714439"

[HKCU\Software\adm914]
"a4_358" = "2566545318"

[HKCU\Software\adm914]
"a2_36" = "258083753"

[HKCU\Software\adm914]
"a4_355" = "2545037955"

[HKCU\Software\adm914]
"a4_354" = "2537868834"

[HKCU\Software\adm914]
"a4_357" = "2559376197"

[HKCU\Software\adm914]
"a4_356" = "2552207076"

[HKCU\Software\adm914]
"a4_351" = "2516361471"

[HKCU\Software\adm914]
"a2_35" = "250915970"

[HKCU\Software\adm914]
"a4_353" = "2530699713"

[HKCU\Software\adm914]
"a4_352" = "2523530592"

[HKCU\Software\adm914]
"a3_253" = "1830770076"

[HKCU\Software\adm914]
"a3_252" = "1789765949"

[HKCU\Software\adm914]
"a3_251" = "1782713690"

[HKCU\Software\adm914]
"a2_34" = "243748044"

[HKCU\Software\adm914]
"a3_257" = "1825743648"

[HKCU\Software\adm914]
"a3_256" = "1818691393"

[HKCU\Software\adm914]
"a3_255" = "1844812510"

[HKCU\Software\adm914]
"a3_254" = "1837825663"

[HKCU\Software\adm914]
"a2_33" = "236577550"

[HKCU\Software\adm914]
"a3_259" = "1873799266"

[HKCU\Software\adm914]
"a3_258" = "1866223491"

[HKCU\Software\Aas]
"a1_97" = "1008675328"

[HKCU\Software\adm914]
"a2_31" = "222245039"

[HKCU\Software\adm914]
"a4_289" = "2071875969"

[HKCU\Software\adm914]
"a4_288" = "2064706848"

[HKCU\Software\adm914]
"a4_287" = "2057537727"

[HKCU\Software\adm914]
"a4_286" = "2050368606"

[HKCU\Software\adm914]
"a4_285" = "2043199485"

[HKCU\Software\adm914]
"a2_30" = "215079138"

[HKCU\Software\adm914]
"a4_283" = "2028861243"

[HKCU\Software\adm914]
"a4_282" = "2021692122"

[HKCU\Software\adm914]
"a4_281" = "2014523001"

[HKCU\Software\adm914]
"a4_280" = "2007353880"

[HKCU\Software\adm914]
"a2_362" = "2595220334"

[HKCU\Software\Aas]
"a2_131" = "939149988"

[HKCU\Software\adm914]
"a4_5" = "35845605"

[HKCU\Software\adm914]
"a2_361" = "2588053635"

[HKCU\Software\adm914]
"a2_366" = "2623904676"

[HKCU\Software\adm914]
"a2_367" = "2631070803"

[HKCU\Software\adm914]
"a2_364" = "2609557115"

[HKCU\Software\Aas]
"a2_130" = "931977420"

[HKCU\Software\adm914]
"a2_368" = "2638238446"

[HKCU\Software\adm914]
"a2_369" = "2645408025"

[HKCU\Software\Aas]
"a2_132" = "946328972"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\adm914]
"a3_100" = "733500325"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914]
"a4_59" = "422978139"

[HKCU\Software\adm914]
"a4_58" = "415809018"

[HKCU\Software\adm914]
"a4_53" = "379963413"

[HKCU\Software\adm914]
"a4_52" = "372794292"

[HKCU\Software\adm914]
"a4_51" = "365625171"

[HKCU\Software\adm914]
"a4_50" = "358456050"

[HKCU\Software\adm914]
"a4_57" = "408639897"

[HKCU\Software\adm914]
"a4_56" = "401470776"

[HKCU\Software\adm914]
"a4_55" = "394301655"

[HKCU\Software\adm914]
"a4_54" = "387132534"

[HKCU\Software\Aas]
"a3_123" = "898388146"

[HKCU\Software\Aas]
"a3_122" = "891468819"

[HKCU\Software\Aas]
"a3_121" = "850861040"

[HKCU\Software\Aas]
"a3_120" = "843343697"

[HKCU\Software\Aas]
"a3_127" = "927442486"

[HKCU\Software\Aas]
"a3_126" = "886312343"

[HKCU\Software\Aas]
"a3_125" = "879323508"

[HKCU\Software\Aas]
"a3_124" = "905966805"

[HKCU\Software\adm914]
"a1_101" = "3785023991"

[HKCU\Software\adm914]
"a1_100" = "88592944"

[HKCU\Software\adm914]
"a1_103" = "1946363603"

[HKCU\Software\adm914]
"a1_102" = "397400826"

[HKCU\Software\adm914]
"a1_105" = "932009851"

[HKCU\Software\adm914]
"a1_104" = "181921329"

[HKCU\Software\adm914]
"a1_107" = "910990040"

[HKCU\Software\adm914]
"a1_106" = "4149406833"

[HKCU\Software\adm914]
"a1_109" = "4002948867"

[HKCU\Software\adm914]
"a1_108" = "1972058266"

[HKCU\Software\adm914]
"a1_215" = "4166259982"

[HKCU\Software\adm914]
"a1_214" = "2959089090"

[HKCU\Software\adm914]
"a1_217" = "2446813046"

[HKCU\Software\adm914]
"a1_216" = "3284467845"

[HKCU\Software\adm914]
"a1_211" = "4210471869"

[HKCU\Software\adm914]
"a1_210" = "81345723"

[HKCU\Software\adm914]
"a1_213" = "2382904302"

[HKCU\Software\adm914]
"a1_212" = "588583546"

[HKCU\Software\adm914]
"a1_219" = "1783867015"

[HKCU\Software\adm914]
"a1_218" = "2602965972"

[HKCU\Software\adm914]
"a1_209" = "2753790052"

[HKCU\Software\Aas]
"a3_6" = "59977839"

[HKCU\Software\Aas]
"a3_7" = "67032206"

[HKCU\Software\Aas]
"a3_4" = "11991981"

[HKCU\Software\Aas]
"a3_5" = "52535244"

[HKCU\Software\Aas]
"a3_2" = "31040235"

[HKCU\Software\Aas]
"a3_3" = "4933386"

[HKCU\Software\adm914]
"a2_243" = "1742102235"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKCU\Software\adm914]
"a2_374" = "2681255668"

[HKCU\Software\Aas]
"a3_1" = "23989832"

[HKCU\Software\adm914]
"a2_370" = "2652570229"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914]
"a2_372" = "2666907708"

[HKCU\Software\Aas]
"a3_69" = "478110732"

[HKCU\Software\Aas]
"a3_68" = "470664173"

[HKCU\Software\Aas]
"a3_65" = "449123976"

[HKCU\Software\Aas]
"a3_64" = "442135145"

[HKCU\Software\Aas]
"a3_67" = "497168202"

[HKCU\Software\Aas]
"a3_66" = "489720619"

[HKCU\Software\Aas]
"a3_61" = "454263092"

[HKCU\Software\Aas]
"a3_60" = "413199509"

[HKCU\Software\Aas]
"a3_63" = "468244982"

[HKCU\Software\Aas]
"a3_62" = "461186391"

[HKCU\Software\adm914\695404737]
"43014726" = "0800687474703A2F2F636174616E682E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F636869656E6773616E672E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F63686163617261626F6E616E7A612E636F6D2E62722F696D6167656E732F6C6F676F2E67696600687474703A2F2F6368616E647261706172612E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6561676C657475726B2E636F6D2F6C6F676F2E67696600687474703A2F2F646F67756167616373616E6179692E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E646F616E686E6768696570766965742E636F6D2E766E2F696D616765732F6C6F676F2E67696600687474703A2F2F64726E682E69722F696D672F69636F6E732F6C6F676F2E676966"

[HKCU\Software\adm914]
"a4_168" = "1204412328"

[HKCU\Software\adm914]
"a4_169" = "1211581449"

[HKCU\Software\adm914]
"a4_162" = "1161397602"

[HKCU\Software\adm914]
"a4_163" = "1168566723"

[HKCU\Software\adm914]
"a4_160" = "1147059360"

[HKCU\Software\adm914]
"a4_161" = "1154228481"

[HKCU\Software\adm914]
"a4_166" = "1190074086"

[HKCU\Software\adm914]
"a4_167" = "1197243207"

[HKCU\Software\adm914]
"a4_164" = "1175735844"

[HKCU\Software\adm914]
"a4_165" = "1182904965"

[HKCU\Software\adm914]
"a2_173" = "1240255829"

[HKCU\Software\adm914]
"a2_172" = "1233085066"

[HKCU\Software\adm914]
"a2_171" = "1225923078"

[HKCU\Software\adm914]
"a2_170" = "1218754562"

[HKCU\Software\adm914]
"a2_177" = "1268937886"

[HKCU\Software\adm914]
"a2_176" = "1261772376"

[HKCU\Software\adm914]
"a2_175" = "1254591719"

[HKCU\Software\adm914]
"a2_174" = "1247420864"

[HKCU\Software\adm914]
"a2_179" = "1283276043"

[HKCU\Software\adm914]
"a2_178" = "1276111647"

[HKCU\Software\adm914]
"a4_342" = "2451839382"

[HKCU\Software\adm914]
"a4_343" = "2459008503"

[HKCU\Software\adm914]
"a4_340" = "2437501140"

[HKCU\Software\adm914]
"a4_341" = "2444670261"

[HKCU\Software\adm914]
"a4_346" = "2480515866"

[HKCU\Software\adm914]
"a4_347" = "2487684987"

[HKCU\Software\adm914]
"a4_344" = "2466177624"

[HKCU\Software\adm914]
"a4_345" = "2473346745"

[HKCU\Software\adm914]
"a4_348" = "2494854108"

[HKCU\Software\adm914]
"a4_349" = "2502023229"

[HKCU\Software\Aas]
"a3_87" = "607024862"

[HKCU\Software\Aas]
"a3_86" = "633131711"

[HKCU\Software\Aas]
"a3_85" = "626081308"

[HKCU\Software\Aas]
"a3_84" = "585598461"

[HKCU\Software\Aas]
"a3_83" = "578085210"

[HKCU\Software\Aas]
"a3_82" = "571034939"

[HKCU\Software\Aas]
"a3_81" = "597665944"

[HKCU\Software\Aas]
"a3_80" = "590099577"

[HKCU\Software\adm914]
"a3_248" = "1761237945"

[HKCU\Software\adm914]
"a3_249" = "1801831448"

[HKCU\Software\Aas]
"a3_89" = "654610320"

[HKCU\Software\Aas]
"a3_88" = "614067057"

[HKCU\Software\adm914]
"a4_298" = "2136398058"

[HKCU\Software\adm914]
"a4_299" = "2143567179"

[HKCU\Software\adm914]
"a4_294" = "2107721574"

[HKCU\Software\adm914]
"a4_295" = "2114890695"

[HKCU\Software\adm914]
"a4_296" = "2122059816"

[HKCU\Software\adm914]
"a4_297" = "2129228937"

[HKCU\Software\adm914]
"a4_290" = "2079045090"

[HKCU\Software\adm914]
"a4_291" = "2086214211"

[HKCU\Software\adm914]
"a4_292" = "2093383332"

[HKCU\Software\adm914]
"a4_293" = "2100552453"

[HKCU\Software\adm914]
"a2_317" = "2272614773"

[HKCU\Software\adm914]
"a2_316" = "2265448222"

[HKCU\Software\adm914]
"a2_315" = "2258277779"

[HKCU\Software\adm914]
"a2_314" = "2251100514"

[HKCU\Software\adm914]
"a2_313" = "2243931155"

[HKCU\Software\adm914]
"a2_312" = "2236761860"

[HKCU\Software\adm914]
"a2_311" = "2229595363"

[HKCU\Software\adm914]
"a2_310" = "2222430070"

[HKCU\Software\adm914]
"a2_319" = "2286946791"

[HKCU\Software\adm914]
"a2_318" = "2279778703"

[HKCU\Software\adm914]
"a2_229" = "1641733821"

[HKCU\Software\adm914]
"a2_228" = "1634565935"

[HKCU\Software\adm914]
"a4_28" = "200735388"

[HKCU\Software\adm914]
"a4_29" = "207904509"

[HKCU\Software\adm914]
"a4_26" = "186397146"

[HKCU\Software\adm914]
"a4_27" = "193566267"

[HKCU\Software\adm914]
"a4_24" = "172058904"

[HKCU\Software\adm914]
"a4_25" = "179228025"

[HKCU\Software\adm914]
"a4_22" = "157720662"

[HKCU\Software\adm914]
"a4_23" = "164889783"

[HKCU\Software\adm914]
"a4_20" = "143382420"

[HKCU\Software\adm914]
"a4_21" = "150551541"

[HKCU\Software\adm914]
"a4_182" = "1304780022"

[HKCU\Software\adm914]
"a3_329" = "2375378664"

[HKCU\Software\adm914]
"a4_183" = "1311949143"

[HKCU\Software\adm914]
"a3_328" = "2368469513"

[HKCU\Software\adm914]
"a1_116" = "159039649"

[HKCU\Software\adm914]
"a1_117" = "1934464514"

[HKCU\Software\adm914]
"a1_114" = "1519992940"

[HKCU\Software\adm914]
"a1_115" = "3371496394"

[HKCU\Software\adm914]
"a1_112" = "1784381990"

[HKCU\Software\adm914]
"a1_113" = "3733321404"

[HKCU\Software\adm914]
"a1_110" = "4288617319"

[HKCU\Software\adm914]
"a1_111" = "4099666907"

[HKCU\Software\adm914]
"a1_118" = "1436715634"

[HKCU\Software\adm914]
"a1_119" = "646730558"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_0" = "3299283285"

[HKCU\Software\Aas]
"a1_1" = "3386940473"

[HKCU\Software\Aas]
"a1_2" = "3712339979"

[HKCU\Software\Aas]
"a1_3" = "2620474486"

[HKCU\Software\Aas]
"a1_4" = "83174613"

[HKCU\Software\Aas]
"a1_5" = "616562248"

[HKCU\Software\Aas]
"a1_6" = "454656014"

[HKCU\Software\Aas]
"a1_7" = "2401786110"

[HKCU\Software\Aas]
"a1_8" = "310532945"

[HKCU\Software\Aas]
"a1_9" = "2948510009"

[HKCU\Software\adm914]
"a1_208" = "2506712221"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a3_8" = "40388897"

[HKCU\Software\Aas]
"a3_9" = "47967552"

[HKCU\Software\adm914]
"a1_202" = "4285074132"

[HKCU\Software\adm914]
"a1_203" = "2118543422"

[HKCU\Software\adm914]
"a1_200" = "950353061"

[HKCU\Software\adm914]
"a1_201" = "305143927"

[HKCU\Software\adm914]
"a1_206" = "2407344757"

[HKCU\Software\adm914]
"a1_207" = "795506210"

[HKCU\Software\adm914]
"a1_204" = "565106930"

[HKCU\Software\adm914]
"a1_205" = "4160484247"

[HKCU\Software\adm914]
"a1_78" = "2414112985"

[HKCU\Software\adm914]
"a1_79" = "2077633716"

[HKCU\Software\adm914]
"a1_76" = "563290551"

[HKCU\Software\adm914]
"a1_77" = "3497485029"

[HKCU\Software\adm914]
"a1_74" = "3321854686"

[HKCU\Software\adm914]
"a1_75" = "3807761568"

[HKCU\Software\adm914]
"a1_72" = "1172368884"

[HKCU\Software\adm914]
"a1_73" = "1356707169"

[HKCU\Software\adm914]
"a1_70" = "719109944"

[HKCU\Software\adm914]
"a1_71" = "758794937"

[HKCU\Software\adm914]
"a3_30" = "231908639"

[HKCU\Software\adm914]
"a3_31" = "205275646"

[HKCU\Software\adm914]
"a3_32" = "212855393"

[HKCU\Software\adm914]
"a3_33" = "253400768"

[HKCU\Software\adm914]
"a3_34" = "260321955"

[HKCU\Software\adm914]
"a3_35" = "267902722"

[HKCU\Software\adm914]
"a3_36" = "241269733"

[HKCU\Software\adm914]
"a3_37" = "248308804"

[HKCU\Software\adm914]
"a3_38" = "289374247"

[HKCU\Software\adm914]
"a3_39" = "296299654"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"0df23b236896bd103bda905d61633c33.exe" = "c:\0df23b236896bd103bda905d61633c33.exe:*:Enabled:ipsec"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Virus deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LanmanServer]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\ip6fw.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmio.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Messenger]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Browser]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Boot file system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\EventLog]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmboot.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AFD]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBT]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Base]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\DnsCache]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\File system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\HelpSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Netlogon]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Ndisuio]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmserver]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LmHosts]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\CryptSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmserver]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Dhcp]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBIOS]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetMan]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Base]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AppMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NDIS]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\File system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmload.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmadmin]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

The Virus deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\SafeBoot]
"AlternateShell"

The process 0df23b236896bd103bda905d61633c33.exe:1748 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 8C FB 1D FA A1 40 65 6F 0F AD FF 90 05 D9 1A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ctkmko" = "%Documents and Settings%\%current user%\Application Data\Ctkmko.exe"

The process Ctkmko.exe:744 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas\695404737]
"35845605" = "390"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "8D482144D6AB9E65AB5D732E35BA327F2DCEC983D41A37D56DAFF40919CA9630CDF6902C1C5EAEE675386957562866F4069CED404BFAB7C8B60A4167F6A7847BEF830A6F30C03ADD6EA841B65CA653F5F5B7C53F251A450424A27E7AC478835F982AE213A3634E32F62DF34219E6C9D7744EEF2F97FD353F0C698D9D20F10EC0"

[HKCU\Software\Aas\695404737]
"43014726" = "0B00687474703A2F2F6A6577656C6C65727962617A6161722E6E65742F6C6F676F2E67696600687474703A2F2F63617361656261722E636F6D2E62722F6C6F676F2E67696600687474703A2F2F63616E6F7373616468756C652E696E2F6C6F676F2E67696600687474703A2F2F63616E7365736961736B6E65666573692E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F686F773267657468617A616E61742E686F2E66756E7069632E64652F6C6F676F2E67696600687474703A2F2F7777772E65766973686F702E64652F6C6F676F2E67696600687474703A2F2F6368696875616875617570696E67686F6D652E636F6D2F6C6F676F2E67696600687474703A2F2F64656861737061732E636F6D2F6C6F676F2E67696600687474703A2F2F64657664696A6974616C2E636F6D2F6C6F676F2E67696600687474703A2F2F736F6272656E61747572616C62722E6E65742F6C6F676F2E67696600687474703A2F2F6469726569746F7075626C69636F2E636F6D2E62722F6C6F676F2E676966"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas\695404737]
"7169121" = "145"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 4B 6B 41 43 E2 C1 7F 4F 0B 77 0C 9F 04 A5 B0"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"Ctkmko.exe" = "%Documents and Settings%\%current user%\Application Data\Ctkmko.exe:*:Enabled:ipsec"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process Ctkmko.exe:1576 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 98 9F 15 2E B1 EE E2 C2 C8 DF 38 EB 8E 2E BA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process Ctkmko.exe:940 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 23 15 33 5D C6 59 E0 16 DF F9 B3 F4 78 9B 7D"

Network activity (URLs)

No activity has been detected.

Rootkit activity

The Virus installs the following user-mode hooks in WININET.dll:

HttpSendRequestW
InternetWriteFile
HttpSendRequestA

The Virus installs the following user-mode hooks in ADVAPI32.dll:

RegCreateKeyExA
RegCreateKeyExW

The Virus installs the following user-mode hooks in WS2_32.dll:

send
getaddrinfo

The Virus installs the following user-mode hooks in kernel32.dll:

MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA

The Virus installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.A worm can spread its copies through the MSN Messanger.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
TELNET.EXE:2724
TELNET.EXE:840
TELNET.EXE:2328
TELNET.EXE:2436
TELNET.EXE:2632
TELNET.EXE:3140
TELNET.EXE:2380
TELNET.EXE:3144
TELNET.EXE:3652
TELNET.EXE:3076
TELNET.EXE:3268
TELNET.EXE:2072
TELNET.EXE:3292
NOTEPAD.EXE:3596
NOTEPAD.EXE:2292
NOTEPAD.EXE:664
NOTEPAD.EXE:2968
NOTEPAD.EXE:3416
NOTEPAD.EXE:3008
NOTEPAD.EXE:2804
NOTEPAD.EXE:2524
NOTEPAD.EXE:3236
NOTEPAD.EXE:3380
NOTEPAD.EXE:1772
NOTEPAD.EXE:3512
NOTEPAD.EXE:2888
NOTEPAD.EXE:3792
NOTEPAD.EXE:2152
NOTEPAD.EXE:1292
NOTEPAD.EXE:1464
NOTEPAD.EXE:2112
NOTEPAD.EXE:2364
NOTEPAD.EXE:2668
NOTEPAD.EXE:2604
NOTEPAD.EXE:2872
NOTEPAD.EXE:2456
NOTEPAD.EXE:3764
NOTEPAD.EXE:2916
NOTEPAD.EXE:2628
NOTEPAD.EXE:2608
NOTEPAD.EXE:3624
NOTEPAD.EXE:2764
NOTEPAD.EXE:2696
NOTEPAD.EXE:3368
NOTEPAD.EXE:3176
NOTEPAD.EXE:2212
NOTEPAD.EXE:3204
NOTEPAD.EXE:3540
NOTEPAD.EXE:3472
NOTEPAD.EXE:3564
NOTEPAD.EXE:2272
NOTEPAD.EXE:3500
NOTEPAD.EXE:3444
NOTEPAD.EXE:2408
NOTEPAD.EXE:2256
NOTEPAD.EXE:3252
0df23b236896bd103bda905d61633c33.exe:640
0df23b236896bd103bda905d61633c33.exe:404
0df23b236896bd103bda905d61633c33.exe:1748
Ctkmko.exe:744
Ctkmko.exe:1576
Ctkmko.exe:940
Delete the original Virus file.
Delete or disinfect the following files created/modified by the Virus:
%Documents and Settings%\%current user%\Local Settings\Temp\J7ygghyk6L1AItgfM1t.tmp (3 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Application Data\Ctkmko.exe (2105 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ctkmko" = "%Documents and Settings%\%current user%\Application Data\Ctkmko.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps