Virus.Win32.Sality_6bc954b988 – Adaware

Trojan.Win32.Agent2.fhti (Kaspersky), Virus.Win32.Sality.ah (v) (VIPRE), Trojan.Win32.Webprefix!IK (Emsisoft), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, Worm.Win32.Dorkbot.FD, GenericUSBInfector.YR, GenericProxy.YR, GenericSYNFlooder.YR, GenericUDPFlooder.YR, GenericDNSBlocker.YR, GenericMSNWorm.YR, GenericIRCBot.YR, GenericAutorunWorm.YR, VirusSality.YR, WormDorkbot.YR, GenericPhysicalDrive0.YR, GenericInjector.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Flooder, Worm, Virus, WormAutorun, IRCBot, MSNWorm, DNSBlocker, UDPFlooder, SYNFlooder, Trojan-Proxy, USBInfector

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 6bc954b988e55bf67797604aa526c94f

SHA1: b56fce793ffd91f8f94931699c3e21b9792bed8c

SHA256: a712c82151067a32b784fcea83187f8d939163257c3e0349f51d5e789accb1d3

SSDeep: 6144:dcRcxFMUqd39Yq3LEhySLL 0oBkQTnnrvHNrL2r9Tv0e:dc6be4hySLL 0ZQTnnrHlLW9r0e

Size: 241686 bytes

File type: PE32

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2012-04-05 17:49:35

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
MSNWorm	A worm can spread its copies through the MSN Messanger.
DNSBlocker	A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet.
UDPFlooder	This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.
SYNFlooder	This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.
Trojan-Proxy	This program can launch a proxy server (SOCKS4) on a designated TCP port.
USBInfector	A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Virus creates the following process(es):

WINMINE.EXE:2556
NOTEPAD.EXE:2268
NOTEPAD.EXE:2588
6bc954b988e55bf67797604aa526c94f.exe:1576
6bc954b988e55bf67797604aa526c94f.exe:136
netsh.exe:696
netsh.exe:1752

File activity

The process 6bc954b988e55bf67797604aa526c94f.exe:1576 makes changes in a file system.

The Virus creates and/or writes to the following file(s):

%WinDir%\system.ini (72 bytes)

Registry activity

The process WINMINE.EXE:2556 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 02 DD CB 05 99 82 88 CF 96 98 C3 F3 C3 40 F2"

The process NOTEPAD.EXE:2268 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F C1 D9 97 05 25 49 D0 22 BA 9D 2D 67 84 16 3A"

The process NOTEPAD.EXE:2588 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 AD 2B 08 92 A0 8E E7 31 14 E5 3E 53 D2 37 8A"

The process 6bc954b988e55bf67797604aa526c94f.exe:1576 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\adm914]
"a2_15" = "107541928"

[HKCU\Software\adm914]
"a2_14" = "100362357"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\adm914]
"a2_16" = "114708500"

[HKCU\Software\adm914]
"a2_11" = "78858475"

[HKCU\Software\adm914]
"a2_10" = "71692992"

[HKCU\Software\adm914]
"a2_13" = "93195734"

[HKCU\Software\adm914]
"a2_12" = "86025172"

[HKCU\Software\adm914]
"a2_19" = "136211502"

[HKCU\Software\adm914]
"a2_18" = "129045654"

[HKCU\Software\adm914]
"a4_119" = "853125399"

[HKCU\Software\adm914]
"a4_118" = "845956278"

[HKCU\Software\adm914]
"a4_117" = "838787157"

[HKCU\Software\adm914]
"a4_116" = "831618036"

[HKCU\Software\adm914]
"a4_115" = "824448915"

[HKCU\Software\adm914]
"a4_114" = "817279794"

[HKCU\Software\adm914]
"a4_113" = "810110673"

[HKCU\Software\adm914]
"a4_112" = "802941552"

[HKCU\Software\adm914]
"a4_111" = "795772431"

[HKCU\Software\adm914]
"a4_110" = "788603310"

[HKCU\Software\adm914]
"a2_160" = "1147054589"

[HKCU\Software\adm914]
"a2_161" = "1154232349"

[HKCU\Software\adm914]
"a2_162" = "1161401449"

[HKCU\Software\adm914]
"a2_163" = "1168571903"

[HKCU\Software\adm914]
"a2_164" = "1175739575"

[HKCU\Software\adm914]
"a2_165" = "1182901847"

[HKCU\Software\adm914]
"a2_166" = "1190070601"

[HKCU\Software\adm914]
"a2_167" = "1197240095"

[HKCU\Software\adm914]
"a2_168" = "1204405922"

[HKCU\Software\adm914]
"a2_169" = "1211587105"

[HKCU\Software\adm914]
"a2_17" = "121879737"

[HKCU\Software\adm914]
"a4_337" = "2415993777"

[HKCU\Software\adm914]
"a4_336" = "2408824656"

[HKCU\Software\adm914]
"a4_335" = "2401655535"

[HKCU\Software\adm914]
"a4_334" = "2394486414"

[HKCU\Software\adm914]
"a4_333" = "2387317293"

[HKCU\Software\adm914]
"a4_332" = "2380148172"

[HKCU\Software\adm914]
"a4_331" = "2372979051"

[HKCU\Software\adm914]
"a4_330" = "2365809930"

[HKCU\Software\adm914]
"a4_339" = "2430332019"

[HKCU\Software\adm914]
"a4_338" = "2423162898"

[HKCU\Software\adm914]
"a3_275" = "1954659866"

[HKCU\Software\adm914]
"a3_274" = "1947600379"

[HKCU\Software\adm914]
"a3_277" = "2002712284"

[HKCU\Software\adm914]
"a3_276" = "1962103485"

[HKCU\Software\adm914]
"a3_271" = "1926113414"

[HKCU\Software\adm914]
"a3_270" = "1918678119"

[HKCU\Software\adm914]
"a3_273" = "1974165848"

[HKCU\Software\adm914]
"a3_272" = "1966722361"

[HKCU\Software\adm914]
"a3_279" = "1983582110"

[HKCU\Software\adm914]
"a3_278" = "2009623423"

[HKCU\Software\adm914]
"a3_0" = "17001001"

[HKCU\Software\adm914]
"a3_1" = "23989832"

[HKCU\Software\adm914]
"a2_304" = "2179410456"

[HKCU\Software\adm914]
"a2_305" = "2186579206"

[HKCU\Software\adm914]
"a2_306" = "2193746670"

[HKCU\Software\adm914]
"a2_307" = "2200913305"

[HKCU\Software\adm914]
"a2_300" = "2150740867"

[HKCU\Software\adm914]
"a2_301" = "2157909493"

[HKCU\Software\adm914]
"a2_302" = "2165076604"

[HKCU\Software\adm914]
"a2_303" = "2172247933"

[HKCU\Software\adm914]
"a2_308" = "2208093110"

[HKCU\Software\adm914]
"a2_309" = "2215263727"

[HKCU\Software\adm914]
"a4_249" = "1785111129"

[HKCU\Software\adm914]
"a4_248" = "1777942008"

[HKCU\Software\adm914]
"a4_195" = "1397978595"

[HKCU\Software\adm914]
"a4_243" = "1742096403"

[HKCU\Software\adm914]
"a4_242" = "1734927282"

[HKCU\Software\adm914]
"a4_241" = "1727758161"

[HKCU\Software\adm914]
"a4_240" = "1720589040"

[HKCU\Software\adm914]
"a4_247" = "1770772887"

[HKCU\Software\adm914]
"a4_246" = "1763603766"

[HKCU\Software\adm914]
"a4_245" = "1756434645"

[HKCU\Software\adm914]
"a4_244" = "1749265524"

[HKCU\Software\adm914]
"a3_8" = "40388897"

[HKCU\Software\adm914]
"a3_9" = "47967552"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\adm914]
"a3_189" = "1371566516"

[HKCU\Software\adm914]
"a3_188" = "1364647189"

[HKCU\Software\adm914]
"a3_187" = "1324038386"

[HKCU\Software\adm914]
"a3_186" = "1316586579"

[HKCU\Software\adm914]
"a3_185" = "1309597744"

[HKCU\Software\adm914]
"a3_184" = "1336102801"

[HKCU\Software\adm914]
"a3_183" = "1328655230"

[HKCU\Software\adm914]
"a3_182" = "1288058591"

[HKCU\Software\adm914]
"a3_181" = "1280611004"

[HKCU\Software\adm914]
"a3_180" = "1307180573"

[HKCU\Software\adm914]
"a2_238" = "1706247830"

[HKCU\Software\adm914]
"a2_239" = "1713415320"

[HKCU\Software\adm914]
"a4_39" = "279595719"

[HKCU\Software\adm914]
"a4_38" = "272426598"

[HKCU\Software\adm914]
"a2_230" = "1648899799"

[HKCU\Software\adm914]
"a4_34" = "243750114"

[HKCU\Software\adm914]
"a4_37" = "265257477"

[HKCU\Software\adm914]
"a4_36" = "258088356"

[HKCU\Software\adm914]
"a2_234" = "1677579042"

[HKCU\Software\adm914]
"a4_30" = "215073630"

[HKCU\Software\adm914]
"a4_33" = "236580993"

[HKCU\Software\adm914]
"a4_32" = "229411872"

[HKCU\Software\adm914]
"a4_265" = "1899817065"

[HKCU\Software\adm914]
"a4_264" = "1892647944"

[HKCU\Software\adm914]
"a4_267" = "1914155307"

[HKCU\Software\adm914]
"a4_266" = "1906986186"

[HKCU\Software\adm914]
"a4_261" = "1871140581"

[HKCU\Software\adm914]
"a2_323" = "2315631547"

[HKCU\Software\adm914]
"a4_263" = "1885478823"

[HKCU\Software\adm914]
"a2_321" = "2301284333"

[HKCU\Software\adm914]
"a4_319" = "2286949599"

[HKCU\Software\adm914]
"a3_322" = "2291869739"

[HKCU\Software\adm914]
"a1_279" = "3101924107"

[HKCU\Software\adm914]
"a1_278" = "830985962"

[HKCU\Software\adm914]
"a1_277" = "225245915"

[HKCU\Software\adm914]
"a1_276" = "2444458031"

[HKCU\Software\adm914]
"a1_275" = "4150259818"

[HKCU\Software\adm914]
"a1_274" = "3059160196"

[HKCU\Software\adm914]
"a1_273" = "1888379599"

[HKCU\Software\adm914]
"a1_272" = "3461667756"

[HKCU\Software\adm914]
"a1_271" = "980381825"

[HKCU\Software\adm914]
"a1_270" = "3284595479"

[HKCU\Software\adm914]
"a1_69" = "3462325064"

[HKCU\Software\adm914]
"a1_68" = "1280379305"

[HKCU\Software\adm914]
"a1_65" = "1660376312"

[HKCU\Software\adm914]
"a1_64" = "4216218639"

[HKCU\Software\adm914]
"a1_67" = "2826593338"

[HKCU\Software\adm914]
"a1_66" = "2319861851"

[HKCU\Software\adm914]
"a1_61" = "4180091043"

[HKCU\Software\adm914]
"a1_60" = "1139407603"

[HKCU\Software\adm914]
"a1_63" = "2674683927"

[HKCU\Software\adm914]
"a1_62" = "1015492648"

[HKCU\Software\adm914]
"a3_27" = "176880658"

[HKCU\Software\adm914]
"a3_26" = "169827315"

[HKCU\Software\adm914]
"a1_301" = "2269666774"

[HKCU\Software\adm914]
"a3_24" = "188875569"

[HKCU\Software\adm914]
"a3_23" = "148336286"

[HKCU\Software\adm914]
"a3_22" = "140888703"

[HKCU\Software\adm914]
"a1_305" = "1718990416"

[HKCU\Software\adm914]
"a3_20" = "159956413"

[HKCU\Software\adm914]
"a1_309" = "2361987202"

[HKCU\Software\adm914]
"a1_308" = "1228086497"

[HKCU\Software\adm914]
"a3_29" = "224867540"

[HKCU\Software\adm914]
"a3_28" = "183865525"

[HKCU\Software\adm914\695404737]
"21507363" = "0"

[HKCU\Software\adm914]
"a2_28" = "200729375"

[HKCU\Software\adm914]
"a2_29" = "207896969"

[HKCU\Software\adm914]
"a2_20" = "143379460"

[HKCU\Software\adm914]
"a2_21" = "150548020"

[HKCU\Software\adm914]
"a2_22" = "157725053"

[HKCU\Software\adm914]
"a2_23" = "164893483"

[HKCU\Software\adm914]
"a2_24" = "172063344"

[HKCU\Software\adm914]
"a2_25" = "179231737"

[HKCU\Software\adm914]
"a2_26" = "186395370"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
"DisableTaskMgr" = "1"

[HKCU\Software\adm914]
"a4_17" = "121875057"

[HKCU\Software\adm914]
"a1_349" = "578221156"

[HKCU\Software\adm914]
"a4_16" = "114705936"

[HKCU\Software\adm914]
"a1_348" = "3547300448"

[HKCU\Software\adm914]
"a4_15" = "107536815"

[HKCU\Software\adm914]
"a4_14" = "100367694"

[HKCU\Software\adm914]
"a4_13" = "93198573"

[HKCU\Software\adm914]
"a1_345" = "3796639681"

[HKCU\Software\adm914]
"a4_12" = "86029452"

[HKCU\Software\adm914]
"a1_344" = "1299196163"

[HKCU\Software\adm914]
"a4_11" = "78860331"

[HKCU\Software\adm914]
"a4_10" = "71691210"

[HKCU\Software\adm914]
"a4_108" = "774265068"

[HKCU\Software\adm914]
"a4_109" = "781434189"

[HKCU\Software\adm914]
"a4_104" = "745588584"

[HKCU\Software\adm914]
"a4_105" = "752757705"

[HKCU\Software\adm914]
"a4_106" = "759926826"

[HKCU\Software\adm914]
"a4_107" = "767095947"

[HKCU\Software\adm914]
"a4_100" = "716912100"

[HKCU\Software\adm914]
"a4_101" = "724081221"

[HKCU\Software\adm914]
"a4_102" = "731250342"

[HKCU\Software\adm914]
"a4_103" = "738419463"

[HKCU\Software\adm914]
"a2_155" = "1111216950"

[HKCU\Software\adm914]
"a2_154" = "1104050074"

[HKCU\Software\adm914]
"a2_157" = "1125554360"

[HKCU\Software\adm914]
"a2_156" = "1118387668"

[HKCU\Software\adm914]
"a2_151" = "1082534357"

[HKCU\Software\adm914]
"a2_150" = "1075365694"

[HKCU\Software\adm914]
"a2_153" = "1096870460"

[HKCU\Software\adm914]
"a2_152" = "1089702720"

[HKCU\Software\adm914]
"a2_159" = "1139884494"

[HKCU\Software\adm914]
"a2_158" = "1132716789"

[HKCU\Software\adm914]
"a4_324" = "2322795204"

[HKCU\Software\adm914]
"a4_325" = "2329964325"

[HKCU\Software\adm914]
"a4_326" = "2337133446"

[HKCU\Software\adm914]
"a4_327" = "2344302567"

[HKCU\Software\adm914]
"a4_320" = "2294118720"

[HKCU\Software\adm914]
"a4_321" = "2301287841"

[HKCU\Software\adm914]
"a4_322" = "2308456962"

[HKCU\Software\adm914]
"a4_323" = "2315626083"

[HKCU\Software\adm914]
"a4_328" = "2351471688"

[HKCU\Software\adm914]
"a4_329" = "2358640809"

[HKCU\Software\adm914]
"a3_268" = "1938194341"

[HKCU\Software\adm914]
"a3_269" = "1945179076"

[HKCU\Software\adm914]
"a3_262" = "1861734767"

[HKCU\Software\adm914]
"a3_263" = "1902212494"

[HKCU\Software\adm914]
"a3_260" = "1847236781"

[HKCU\Software\adm914]
"a3_261" = "1854160076"

[HKCU\Software\adm914]
"a3_266" = "1890133731"

[HKCU\Software\adm914]
"a3_267" = "1930746626"

[HKCU\Software\adm914]
"a3_264" = "1909255713"

[HKCU\Software\adm914]
"a3_265" = "1883210304"

[HKCU\Software\adm914]
"a4_258" = "1849633218"

[HKCU\Software\adm914]
"a4_259" = "1856802339"

[HKCU\Software\adm914]
"a4_250" = "1792280250"

[HKCU\Software\adm914]
"a4_251" = "1799449371"

[HKCU\Software\adm914]
"a4_252" = "1806618492"

[HKCU\Software\adm914]
"a2_332" = "2380151004"

[HKCU\Software\adm914]
"a4_254" = "1820956734"

[HKCU\Software\adm914]
"a4_255" = "1828125855"

[HKCU\Software\adm914]
"a4_256" = "1835294976"

[HKCU\Software\adm914]
"a4_257" = "1842464097"

[HKCU\Software\adm914]
"a3_198" = "1436076335"

[HKCU\Software\adm914]
"a3_199" = "1409969486"

[HKCU\Software\adm914]
"a3_194" = "1407548331"

[HKCU\Software\adm914]
"a3_195" = "1380982730"

[HKCU\Software\adm914]
"a3_196" = "1388556397"

[HKCU\Software\adm914]
"a3_197" = "1429034124"

[HKCU\Software\adm914]
"a3_190" = "1345525207"

[HKCU\Software\adm914]
"a3_191" = "1352568438"

[HKCU\Software\adm914]
"a3_192" = "1393042153"

[HKCU\Software\adm914]
"a3_193" = "1400620808"

[HKCU\Software\adm914]
"a2_209" = "1498343941"

[HKCU\Software\adm914]
"a2_208" = "1491180480"

[HKCU\Software\adm914]
"a2_205" = "1469675653"

[HKCU\Software\adm914]
"a2_204" = "1462496824"

[HKCU\Software\adm914]
"a2_207" = "1484012771"

[HKCU\Software\adm914]
"a2_206" = "1476841813"

[HKCU\Software\adm914]
"a2_201" = "1440990288"

[HKCU\Software\adm914]
"a2_200" = "1433822476"

[HKCU\Software\adm914]
"a2_203" = "1455328067"

[HKCU\Software\adm914]
"a2_202" = "1448157296"

[HKCU\Software\adm914]
"a1_268" = "4286088098"

[HKCU\Software\adm914]
"a1_269" = "4039128671"

[HKCU\Software\adm914]
"a1_264" = "3469808241"

[HKCU\Software\adm914]
"a1_265" = "2999849173"

[HKCU\Software\adm914]
"a1_266" = "2581306084"

[HKCU\Software\adm914]
"a1_267" = "1973087377"

[HKCU\Software\adm914]
"a1_260" = "1478942173"

[HKCU\Software\adm914]
"a1_261" = "2614881789"

[HKCU\Software\adm914]
"a1_262" = "1569035039"

[HKCU\Software\adm914]
"a1_263" = "3131733233"

[HKCU\Software\adm914]
"a1_50" = "1358001318"

[HKCU\Software\adm914]
"a1_51" = "1339216394"

[HKCU\Software\adm914]
"a1_52" = "405320346"

[HKCU\Software\adm914]
"a1_53" = "3004335434"

[HKCU\Software\adm914]
"a1_54" = "684436938"

[HKCU\Software\adm914]
"a1_55" = "3420764814"

[HKCU\Software\adm914]
"a1_56" = "4242932591"

[HKCU\Software\adm914]
"a1_57" = "834932436"

[HKCU\Software\adm914]
"a1_58" = "1803979434"

[HKCU\Software\adm914]
"a1_59" = "3482523147"

[HKCU\Software\adm914]
"a4_312" = "2236765752"

[HKCU\Software\adm914]
"a1_310" = "3778072857"

[HKCU\Software\adm914]
"a1_311" = "4071532427"

[HKCU\Software\adm914]
"a1_312" = "1093742446"

[HKCU\Software\adm914]
"a1_313" = "3510873240"

[HKCU\Software\adm914]
"a1_314" = "414100676"

[HKCU\Software\adm914]
"a1_315" = "4044245034"

[HKCU\Software\adm914]
"a1_316" = "2276302016"

[HKCU\Software\adm914]
"a1_317" = "1704725314"

[HKCU\Software\adm914]
"a1_318" = "3161044581"

[HKCU\Software\adm914]
"a1_319" = "1782930285"

[HKCU\Software\adm914]
"a2_39" = "279600970"

[HKCU\Software\adm914]
"a2_38" = "272432311"

[HKCU\Software\adm914]
"a2_37" = "265263321"

[HKCU\Software\adm914]
"a2_36" = "258084820"

[HKCU\Software\adm914]
"a2_35" = "250916352"

[HKCU\Software\adm914]
"a2_34" = "243745215"

[HKCU\Software\adm914]
"a2_33" = "236578777"

[HKCU\Software\adm914]
"a2_32" = "229414621"

[HKCU\Software\adm914]
"a2_31" = "222245903"

[HKCU\Software\adm914]
"a2_30" = "215078234"

[HKCU\Software\adm914]
"a4_131" = "939154851"

[HKCU\Software\adm914]
"a4_130" = "931985730"

[HKCU\Software\adm914]
"a4_133" = "953493093"

[HKCU\Software\adm914]
"a4_132" = "946323972"

[HKCU\Software\adm914]
"a4_135" = "967831335"

[HKCU\Software\adm914]
"a4_134" = "960662214"

[HKCU\Software\adm914]
"a4_137" = "982169577"

[HKCU\Software\adm914]
"a4_136" = "975000456"

[HKCU\Software\adm914]
"a4_139" = "996507819"

[HKCU\Software\adm914]
"a4_138" = "989338698"

[HKCU\Software\adm914]
"a2_148" = "1061034300"

[HKCU\Software\adm914]
"a2_149" = "1068203905"

[HKCU\Software\adm914]
"a2_142" = "1018018037"

[HKCU\Software\adm914]
"a2_143" = "1025181523"

[HKCU\Software\adm914]
"a2_140" = "1003681327"

[HKCU\Software\adm914]
"a2_141" = "1010848538"

[HKCU\Software\adm914]
"a2_146" = "1046688426"

[HKCU\Software\adm914]
"a2_147" = "1053865635"

[HKCU\Software\adm914]
"a2_144" = "1032348975"

[HKCU\Software\adm914]
"a2_145" = "1039519421"

[HKCU\Software\adm914]
"a3_219" = "1553446098"

[HKCU\Software\adm914]
"a3_218" = "1545867443"

[HKCU\Software\adm914]
"a3_217" = "1572437008"

[HKCU\Software\adm914]
"a3_216" = "1565514737"

[HKCU\Software\adm914]
"a3_215" = "1524377438"

[HKCU\Software\adm914]
"a3_214" = "1517454143"

[HKCU\Software\adm914]
"a3_213" = "1510469276"

[HKCU\Software\adm914]
"a3_212" = "1536445053"

[HKCU\Software\adm914]
"a3_211" = "1529532890"

[HKCU\Software\adm914]
"a3_210" = "1488928187"

[HKCU\Software\adm914]
"a4_269" = "1928493549"

[HKCU\Software\adm914]
"a4_268" = "1921324428"

[HKCU\Software\adm914]
"a2_328" = "2351468078"

[HKCU\Software\adm914]
"a2_329" = "2358645866"

[HKCU\Software\adm914]
"a2_326" = "2337129498"

[HKCU\Software\adm914]
"a2_327" = "2344300191"

[HKCU\Software\adm914]
"a2_324" = "2322800568"

[HKCU\Software\adm914]
"a2_325" = "2329966292"

[HKCU\Software\adm914]
"a2_322" = "2308461973"

[HKCU\Software\adm914]
"a4_260" = "1863971460"

[HKCU\Software\adm914]
"a2_320" = "2294113432"

[HKCU\Software\adm914]
"a4_262" = "1878309702"

[HKCU\Software\adm914]
"a3_323" = "2332478538"

[HKCU\Software\adm914]
"a4_318" = "2279780478"

[HKCU\Software\adm914]
"a3_321" = "2284435336"

[HKCU\Software\adm914]
"a3_320" = "2310935401"

[HKCU\Software\adm914]
"a3_327" = "2327338446"

[HKCU\Software\adm914]
"a3_326" = "2320415151"

[HKCU\Software\adm914]
"a3_325" = "2346910988"

[HKCU\Software\adm914]
"a3_324" = "2339397869"

[HKCU\Software\adm914]
"a4_311" = "2229596631"

[HKCU\Software\adm914]
"a4_310" = "2222427510"

[HKCU\Software\adm914]
"a4_313" = "2243934873"

[HKCU\Software\adm914]
"a3_328" = "2368468577"

[HKCU\Software\adm914]
"a4_315" = "2258273115"

[HKCU\Software\adm914]
"a4_314" = "2251103994"

[HKCU\Software\adm914]
"a4_317" = "2272611357"

[HKCU\Software\adm914]
"a4_316" = "2265442236"

[HKCU\Software\adm914]
"a2_212" = "1519860218"

[HKCU\Software\adm914]
"a2_213" = "1527027865"

[HKCU\Software\adm914]
"a2_210" = "1505510530"

[HKCU\Software\adm914]
"a2_211" = "1512679790"

[HKCU\Software\adm914]
"a2_216" = "1548526783"

[HKCU\Software\adm914]
"a2_217" = "1555695331"

[HKCU\Software\adm914]
"a2_214" = "1534197654"

[HKCU\Software\adm914]
"a2_215" = "1541362748"

[HKCU\Software\adm914]
"a2_218" = "1562865110"

[HKCU\Software\adm914]
"a2_219" = "1570031106"

[HKCU\Software\adm914]
"a4_19" = "136213299"

[HKCU\Software\adm914]
"a4_18" = "129044178"

[HKCU\Software\adm914]
"a3_149" = "1051199068"

[HKCU\Software\adm914]
"a3_148" = "1044210237"

[HKCU\Software\adm914]
"a3_143" = "1008236550"

[HKCU\Software\adm914]
"a3_142" = "1034864615"

[HKCU\Software\adm914]
"a3_141" = "1027810116"

[HKCU\Software\adm914]
"a3_140" = "986812197"

[HKCU\Software\adm914]
"a3_147" = "1070844314"

[HKCU\Software\adm914]
"a3_146" = "1063277947"

[HKCU\Software\adm914]
"a3_145" = "1022800088"

[HKCU\Software\adm914]
"a3_144" = "1015749817"

[HKCU\Software\adm914]
"a1_251" = "3282659953"

[HKCU\Software\adm914]
"a1_250" = "427996900"

[HKCU\Software\adm914]
"a1_253" = "3289054956"

[HKCU\Software\adm914]
"a1_252" = "533321152"

[HKCU\Software\adm914]
"a1_255" = "934253857"

[HKCU\Software\adm914]
"a1_254" = "4245086827"

[HKCU\Software\adm914]
"a1_257" = "3452700752"

[HKCU\Software\adm914]
"a1_256" = "3380431647"

[HKCU\Software\adm914]
"a1_259" = "2475579551"

[HKCU\Software\adm914]
"a1_258" = "1834129820"

[HKCU\Software\adm914]
"a1_47" = "1587394966"

[HKCU\Software\adm914]
"a1_46" = "3060974878"

[HKCU\Software\adm914]
"a1_45" = "2474600847"

[HKCU\Software\adm914]
"a1_44" = "4025462209"

[HKCU\Software\adm914]
"a1_43" = "3079473911"

[HKCU\Software\adm914]
"a1_42" = "1434301064"

[HKCU\Software\adm914]
"a1_41" = "2431342519"

[HKCU\Software\adm914]
"a1_40" = "898955380"

[HKCU\Software\adm914]
"a1_49" = "2915596335"

[HKCU\Software\adm914]
"a1_48" = "570486889"

[HKCU\Software\adm914]
"a1_325" = "2701341855"

[HKCU\Software\adm914]
"a1_324" = "1827023773"

[HKCU\Software\adm914]
"a1_327" = "1503107673"

[HKCU\Software\adm914]
"a1_326" = "1410973750"

[HKCU\Software\adm914]
"a1_321" = "1085398813"

[HKCU\Software\adm914]
"a1_320" = "3174894351"

[HKCU\Software\adm914]
"a1_323" = "2597782330"

[HKCU\Software\adm914]
"a1_322" = "860020314"

[HKCU\Software\adm914]
"a1_329" = "83895541"

[HKCU\Software\adm914]
"a1_328" = "1394235382"

[HKCU\Software\adm914]
"a2_242" = "1734930578"

[HKCU\Software\adm914\695404737]
"50183847" = "7329B17EFD1799058CC507B8062C360BD9EAA93FEC92CD8196CE019C2B644F8B5AC11E54BC8D921572BC5C39CB0308531810224E18BC57A14754D33BC6678182373E7B47500C9E1C82FC29BF389B2B6F410B7B9F141B58DC2BA76EF625D3FD2F450761A6DFFF889DE058FDD1002052BDDBCDC8FCA7DFBA8BD347C7A4809EC681"

[HKCU\Software\adm914]
"a4_126" = "903309246"

[HKCU\Software\adm914]
"a4_127" = "910478367"

[HKCU\Software\adm914]
"a4_124" = "888971004"

[HKCU\Software\adm914]
"a4_125" = "896140125"

[HKCU\Software\adm914]
"a4_122" = "874632762"

[HKCU\Software\adm914]
"a4_123" = "881801883"

[HKCU\Software\adm914]
"a4_120" = "860294520"

[HKCU\Software\adm914]
"a4_121" = "867463641"

[HKCU\Software\adm914]
"a4_128" = "917647488"

[HKCU\Software\adm914]
"a4_129" = "924816609"

[HKCU\Software\adm914]
"a2_139" = "996515429"

[HKCU\Software\adm914]
"a2_138" = "989333585"

[HKCU\Software\adm914]
"a2_137" = "982164266"

[HKCU\Software\adm914]
"a2_136" = "974999434"

[HKCU\Software\adm914]
"a2_135" = "967833183"

[HKCU\Software\adm914]
"a2_134" = "960666818"

[HKCU\Software\adm914]
"a2_133" = "953494425"

[HKCU\Software\adm914]
"a2_132" = "946329372"

[HKCU\Software\adm914]
"a2_131" = "939148167"

[HKCU\Software\adm914]
"a2_130" = "931983178"

[HKCU\Software\adm914]
"a4_35" = "250919235"

[HKCU\Software\adm914]
"a3_208" = "1508041977"

[HKCU\Software\adm914]
"a3_209" = "1481480472"

[HKCU\Software\adm914]
"a2_231" = "1656063439"

[HKCU\Software\adm914]
"a3_204" = "1445500773"

[HKCU\Software\adm914]
"a3_205" = "1452936068"

[HKCU\Software\adm914]
"a3_206" = "1493543975"

[HKCU\Software\adm914]
"a3_207" = "1500987462"

[HKCU\Software\adm914]
"a3_200" = "1416954337"

[HKCU\Software\adm914]
"a2_232" = "1663230546"

[HKCU\Software\adm914]
"a3_202" = "1465015971"

[HKCU\Software\adm914]
"a3_203" = "1472066242"

[HKCU\Software\adm914]
"a2_233" = "1670401001"

[HKCU\Software\adm914]
"a4_31" = "222242751"

[HKCU\Software\adm914]
"a2_235" = "1684749448"

[HKCU\Software\adm914]
"a4_272" = "1950000912"

[HKCU\Software\adm914]
"a4_273" = "1957170033"

[HKCU\Software\adm914]
"a4_270" = "1935662670"

[HKCU\Software\adm914]
"a4_271" = "1942831791"

[HKCU\Software\adm914]
"a4_276" = "1978677396"

[HKCU\Software\adm914]
"a4_277" = "1985846517"

[HKCU\Software\adm914]
"a4_274" = "1964339154"

[HKCU\Software\adm914]
"a4_275" = "1971508275"

[HKCU\Software\adm914]
"a4_278" = "1993015638"

[HKCU\Software\adm914]
"a4_279" = "2000184759"

[HKCU\Software\adm914]
"a3_330" = "2348814115"

[HKCU\Software\adm914]
"a3_331" = "2356388674"

[HKCU\Software\adm914]
"a3_332" = "2363312101"

[HKCU\Software\adm914]
"a3_333" = "2403923972"

[HKCU\Software\adm914]
"a3_334" = "2411437223"

[HKCU\Software\adm914]
"a3_335" = "2384801990"

[HKCU\Software\adm914]
"a4_308" = "2208089268"

[HKCU\Software\adm914]
"a4_309" = "2215258389"

[HKCU\Software\adm914]
"a4_306" = "2193751026"

[HKCU\Software\adm914]
"a4_307" = "2200920147"

[HKCU\Software\adm914]
"a4_304" = "2179412784"

[HKCU\Software\adm914]
"a4_305" = "2186581905"

[HKCU\Software\adm914]
"a4_302" = "2165074542"

[HKCU\Software\adm914]
"a4_303" = "2172243663"

[HKCU\Software\adm914]
"a4_300" = "2150736300"

[HKCU\Software\adm914]
"a4_301" = "2157905421"

[HKCU\Software\adm914]
"a2_267" = "1914153043"

[HKCU\Software\adm914]
"a2_266" = "1906989774"

[HKCU\Software\adm914]
"a2_265" = "1899822049"

[HKCU\Software\adm914]
"a2_264" = "1892653040"

[HKCU\Software\adm914]
"a2_263" = "1885472123"

[HKCU\Software\adm914]
"a2_262" = "1878306252"

[HKCU\Software\adm914]
"a2_261" = "1871137857"

[HKCU\Software\adm914]
"a2_260" = "1863967277"

[HKCU\Software\adm914]
"a2_269" = "1928490186"

[HKCU\Software\adm914]
"a2_268" = "1921322684"

[HKCU\Software\adm914]
"a3_158" = "1115724279"

[HKCU\Software\adm914]
"a3_159" = "1123168790"

[HKCU\Software\adm914]
"a3_150" = "1092336383"

[HKCU\Software\adm914]
"a3_151" = "1099259678"

[HKCU\Software\adm914]
"a3_152" = "1106310065"

[HKCU\Software\adm914]
"a3_153" = "1080268752"

[HKCU\Software\adm914]
"a3_154" = "1087178867"

[HKCU\Software\adm914]
"a3_155" = "1127787666"

[HKCU\Software\adm914]
"a3_156" = "1135231285"

[HKCU\Software\adm914]
"a3_157" = "1108731220"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\adm914]
"a4_7" = "50183847"

[HKCU\Software\adm914]
"a4_6" = "43014726"

[HKCU\Software\adm914]
"a4_5" = "35845605"

[HKCU\Software\adm914]
"a4_4" = "28676484"

[HKCU\Software\adm914]
"a2_115" = "824449469"

[HKCU\Software\adm914]
"a4_2" = "14338242"

[HKCU\Software\adm914]
"a4_1" = "7169121"

[HKCU\Software\adm914]
"a4_0" = "0"

[HKCU\Software\adm914]
"a1_246" = "2435045486"

[HKCU\Software\adm914]
"a1_247" = "2264771530"

[HKCU\Software\adm914]
"a1_244" = "4203169184"

[HKCU\Software\adm914]
"a1_245" = "392732811"

[HKCU\Software\adm914]
"a1_242" = "693018621"

[HKCU\Software\adm914]
"a1_243" = "2888879777"

[HKCU\Software\adm914]
"a1_240" = "1666009415"

[HKCU\Software\adm914]
"a1_241" = "1898400527"

[HKCU\Software\adm914]
"a1_248" = "553643569"

[HKCU\Software\adm914]
"a1_249" = "481652711"

[HKCU\Software\adm914]
"a1_338" = "670606411"

[HKCU\Software\adm914]
"a1_339" = "3768556590"

[HKCU\Software\adm914]
"a1_98" = "3890561915"

[HKCU\Software\adm914]
"a1_99" = "4010057438"

[HKCU\Software\adm914]
"a1_94" = "3015868837"

[HKCU\Software\adm914]
"a1_95" = "3505668163"

[HKCU\Software\adm914]
"a1_96" = "2023283767"

[HKCU\Software\adm914]
"a1_97" = "3503124628"

[HKCU\Software\adm914]
"a1_90" = "3721315139"

[HKCU\Software\adm914]
"a1_91" = "1923364805"

[HKCU\Software\adm914]
"a1_92" = "1626295681"

[HKCU\Software\adm914]
"a1_93" = "252240015"

[HKCU\Software\adm914\695404737]
"28676484" = "35"

[HKCU\Software\adm914]
"a3_96" = "671534665"

[HKCU\Software\adm914]
"a3_97" = "678453992"

[HKCU\Software\adm914]
"a3_94" = "690598327"

[HKCU\Software\adm914]
"a3_95" = "698045910"

[HKCU\Software\adm914]
"a3_92" = "643004661"

[HKCU\Software\adm914]
"a3_93" = "649993492"

[HKCU\Software\adm914]
"a3_90" = "662052915"

[HKCU\Software\adm914]
"a3_91" = "669107282"

[HKCU\Software\adm914]
"a3_98" = "685967115"

[HKCU\Software\adm914]
"a3_99" = "726580138"

[HKCU\Software\adm914]
"a2_128" = "917643872"

[HKCU\Software\adm914]
"a2_129" = "924814759"

[HKCU\Software\adm914]
"a2_124" = "888964964"

[HKCU\Software\adm914]
"a2_125" = "896145793"

[HKCU\Software\adm914]
"a2_126" = "903312636"

[HKCU\Software\adm914]
"a2_127" = "910481810"

[HKCU\Software\adm914]
"a2_120" = "860297199"

[HKCU\Software\adm914]
"a2_121" = "867463111"

[HKCU\Software\adm914]
"a2_122" = "874627826"

[HKCU\Software\adm914]
"a2_123" = "881795227"

[HKCU\Software\adm914]
"a3_231" = "1672935854"

[HKCU\Software\adm914]
"a3_230" = "1665877263"

[HKCU\Software\adm914]
"a3_233" = "1653814880"

[HKCU\Software\adm914]
"a3_232" = "1646370241"

[HKCU\Software\adm914]
"a3_235" = "1701334818"

[HKCU\Software\adm914]
"a3_234" = "1660856963"

[HKCU\Software\adm914]
"a3_237" = "1682343908"

[HKCU\Software\adm914]
"a3_236" = "1708909381"

[HKCU\Software\adm914]
"a3_239" = "1730403494"

[HKCU\Software\adm914]
"a3_238" = "1689270279"

[HKCU\Software\adm914]
"a4_211" = "1512684531"

[HKCU\Software\adm914]
"a4_207" = "1484008047"

[HKCU\Software\adm914]
"a4_206" = "1476838926"

[HKCU\Software\adm914]
"a4_205" = "1469669805"

[HKCU\Software\adm914]
"a4_204" = "1462500684"

[HKCU\Software\adm914]
"a4_203" = "1455331563"

[HKCU\Software\adm914]
"a4_202" = "1448162442"

[HKCU\Software\adm914]
"a4_201" = "1440993321"

[HKCU\Software\adm914]
"a4_200" = "1433824200"

[HKCU\Software\adm914]
"a4_209" = "1498346289"

[HKCU\Software\adm914]
"a4_208" = "1491177168"

[HKCU\Software\adm914]
"a3_305" = "2203581880"

[HKCU\Software\adm914]
"a3_304" = "2162448665"

[HKCU\Software\adm914]
"a3_307" = "2183924346"

[HKCU\Software\adm914]
"a3_306" = "2210566619"

[HKCU\Software\adm914]
"a3_301" = "2174512164"

[HKCU\Software\adm914]
"a3_300" = "2167589765"

[HKCU\Software\adm914]
"a3_303" = "2155521254"

[HKCU\Software\adm914]
"a3_302" = "2148466759"

[HKCU\Software\adm914]
"a2_1" = "7168686"

[HKCU\Software\adm914]
"a3_309" = "2231976764"

[HKCU\Software\adm914]
"a3_308" = "2191503005"

[HKCU\Software\adm914]
"a2_0" = "1743"

[HKCU\Software\adm914]
"a2_274" = "1964341718"

[HKCU\Software\adm914]
"a2_275" = "1971504099"

[HKCU\Software\adm914]
"a2_276" = "1978674899"

[HKCU\Software\adm914]
"a2_277" = "1985842985"

[HKCU\Software\adm914]
"a2_270" = "1935657355"

[HKCU\Software\adm914]
"a2_271" = "1942837010"

[HKCU\Software\adm914]
"a2_272" = "1950004428"

[HKCU\Software\adm914]
"a2_273" = "1957172687"

[HKCU\Software\adm914]
"a2_278" = "1993021544"

[HKCU\Software\adm914]
"a2_279" = "2000188335"

[HKCU\Software\adm914]
"a3_169" = "1228156448"

[HKCU\Software\adm914]
"a3_168" = "1187689857"

[HKCU\Software\adm914]
"a3_165" = "1199757484"

[HKCU\Software\adm914]
"a3_164" = "1192698893"

[HKCU\Software\adm914]
"a3_167" = "1180635502"

[HKCU\Software\adm914]
"a3_166" = "1206680783"

[HKCU\Software\adm914]
"a3_161" = "1171213096"

[HKCU\Software\adm914]
"a3_160" = "1163777673"

[HKCU\Software\adm914]
"a3_163" = "1151697898"

[HKCU\Software\adm914]
"a3_162" = "1144713035"

[HKCU\Software\adm914]
"a1_189" = "914444835"

[HKCU\Software\adm914]
"a1_188" = "2215035233"

[HKCU\Software\adm914]
"a1_181" = "1881179945"

[HKCU\Software\adm914]
"a1_180" = "1255580008"

[HKCU\Software\adm914]
"a1_183" = "3170200990"

[HKCU\Software\adm914]
"a1_182" = "1232564911"

[HKCU\Software\adm914]
"a1_185" = "4013744710"

[HKCU\Software\adm914]
"a1_184" = "3501922790"

[HKCU\Software\adm914]
"a1_187" = "1804959940"

[HKCU\Software\adm914]
"a1_186" = "3868835639"

[HKCU\Software\adm914]
"a1_83" = "1977025848"

[HKCU\Software\adm914]
"a1_82" = "247375629"

[HKCU\Software\adm914]
"a1_81" = "1401554396"

[HKCU\Software\adm914]
"a1_80" = "36469472"

[HKCU\Software\adm914]
"a1_87" = "2498183753"

[HKCU\Software\adm914]
"a1_86" = "519098816"

[HKCU\Software\adm914]
"a1_85" = "1010071916"

[HKCU\Software\adm914]
"a1_84" = "2955534499"

[HKCU\Software\adm914]
"a1_347" = "2175931327"

[HKCU\Software\adm914]
"a1_346" = "3459639109"

[HKCU\Software\adm914]
"a1_89" = "1036884228"

[HKCU\Software\adm914]
"a1_88" = "3050758422"

[HKCU\Software\adm914]
"a1_343" = "230641874"

[HKCU\Software\adm914]
"a1_342" = "1754647526"

[HKCU\Software\adm914]
"a1_341" = "2789601147"

[HKCU\Software\adm914]
"a1_340" = "3207357374"

[HKCU\Software\adm914]
"a2_249" = "1785115636"

[HKCU\Software\adm914]
"a2_248" = "1777938330"

[HKCU\Software\adm914]
"a1_299" = "3534571063"

[HKCU\Software\adm914]
"a1_298" = "1671756635"

[HKCU\Software\adm914]
"a1_295" = "3965246874"

[HKCU\Software\adm914]
"a1_294" = "1678911272"

[HKCU\Software\adm914]
"a1_297" = "2968724433"

[HKCU\Software\adm914]
"a1_296" = "1094041492"

[HKCU\Software\adm914]
"a1_291" = "4219779612"

[HKCU\Software\adm914]
"a1_290" = "1756063436"

[HKCU\Software\adm914]
"a1_293" = "2813952587"

[HKCU\Software\adm914]
"a1_292" = "4011089405"

[HKCU\Software\adm914]
"a3_178" = "1292673371"

[HKCU\Software\adm914]
"a3_85" = "626081308"

[HKCU\Software\adm914]
"a3_84" = "585598461"

[HKCU\Software\adm914]
"a3_87" = "607024862"

[HKCU\Software\adm914]
"a3_86" = "633131711"

[HKCU\Software\adm914]
"a3_81" = "597665944"

[HKCU\Software\adm914]
"a3_80" = "590099577"

[HKCU\Software\adm914]
"a3_83" = "578085210"

[HKCU\Software\adm914]
"a3_82" = "571034939"

[HKCU\Software\adm914]
"a3_89" = "654610320"

[HKCU\Software\adm914]
"a3_88" = "614067057"

[HKCU\Software\adm914]
"a1_303" = "2248773794"

[HKCU\Software\adm914]
"a1_302" = "3233686736"

[HKCU\Software\adm914]
"a3_25" = "195929936"

[HKCU\Software\adm914]
"a2_111" = "795775274"

[HKCU\Software\adm914]
"a2_110" = "788607574"

[HKCU\Software\adm914]
"a2_113" = "810112850"

[HKCU\Software\adm914]
"a2_112" = "802943586"

[HKCU\Software\adm914]
"a4_3" = "21507363"

[HKCU\Software\adm914]
"a2_114" = "817277672"

[HKCU\Software\adm914]
"a2_117" = "838791877"

[HKCU\Software\adm914]
"a2_116" = "831614860"

[HKCU\Software\adm914]
"a2_119" = "853129411"

[HKCU\Software\adm914]
"a2_118" = "845962404"

[HKCU\Software\adm914]
"a4_9" = "64522089"

[HKCU\Software\adm914]
"a4_8" = "57352968"

[HKCU\Software\adm914]
"a3_21" = "167399900"

[HKCU\Software\adm914]
"a1_304" = "1767590018"

[HKCU\Software\adm914]
"a3_226" = "1636956043"

[HKCU\Software\adm914]
"a3_227" = "1610836010"

[HKCU\Software\adm914]
"a3_224" = "1588903625"

[HKCU\Software\adm914]
"a3_225" = "1629901672"

[HKCU\Software\adm914]
"a3_222" = "1608410679"

[HKCU\Software\adm914]
"a3_223" = "1581849174"

[HKCU\Software\adm914]
"a3_220" = "1593911669"

[HKCU\Software\adm914]
"a3_221" = "1600966036"

[HKCU\Software\adm914]
"a3_228" = "1617824845"

[HKCU\Software\adm914]
"a3_229" = "1624875244"

[HKCU\Software\adm914]
"a4_214" = "1534191894"

[HKCU\Software\adm914]
"a4_215" = "1541361015"

[HKCU\Software\adm914]
"a4_216" = "1548530136"

[HKCU\Software\adm914]
"a4_217" = "1555699257"

[HKCU\Software\adm914]
"a4_210" = "1505515410"

[HKCU\Software\adm914]
"a2_8" = "57357521"

[HKCU\Software\adm914]
"a4_212" = "1519853652"

[HKCU\Software\adm914]
"a4_213" = "1527022773"

[HKCU\Software\adm914]
"a2_5" = "35841645"

[HKCU\Software\adm914]
"a2_4" = "28672580"

[HKCU\Software\adm914]
"a2_7" = "50177784"

[HKCU\Software\adm914]
"a2_6" = "43011274"

[HKCU\Software\adm914]
"a4_218" = "1562868378"

[HKCU\Software\adm914]
"a4_219" = "1570037499"

[HKCU\Software\adm914]
"a2_3" = "21511075"

[HKCU\Software\adm914]
"a2_2" = "14343887"

[HKCU\Software\adm914]
"a3_318" = "2262948439"

[HKCU\Software\adm914]
"a3_319" = "2303950582"

[HKCU\Software\adm914]
"a3_312" = "2219916305"

[HKCU\Software\adm914]
"a3_313" = "2226966704"

[HKCU\Software\adm914]
"a3_310" = "2239031135"

[HKCU\Software\adm914]
"a3_311" = "2246548478"

[HKCU\Software\adm914]
"a3_316" = "2248445333"

[HKCU\Software\adm914]
"a3_317" = "2255889972"

[HKCU\Software\adm914]
"a3_314" = "2267968723"

[HKCU\Software\adm914]
"a3_315" = "2275010930"

[HKCU\Software\adm914]
"a3_172" = "1216092933"

[HKCU\Software\adm914]
"a3_173" = "1223671716"

[HKCU\Software\adm914]
"a3_170" = "1235731011"

[HKCU\Software\adm914]
"a3_171" = "1209100002"

[HKCU\Software\adm914]
"a3_176" = "1245079705"

[HKCU\Software\adm914]
"a3_177" = "1252068664"

[HKCU\Software\adm914]
"a3_174" = "1264145351"

[HKCU\Software\adm914]
"a3_175" = "1271198822"

[HKCU\Software\adm914]
"a2_241" = "1727754153"

[HKCU\Software\adm914]
"a2_240" = "1720584288"

[HKCU\Software\adm914]
"a2_243" = "1742101674"

[HKCU\Software\adm914]
"a3_179" = "1300121082"

[HKCU\Software\adm914]
"a2_245" = "1756431255"

[HKCU\Software\adm914]
"a2_244" = "1749270312"

[HKCU\Software\adm914]
"a2_247" = "1770766393"

[HKCU\Software\adm914]
"a2_246" = "1763598476"

[HKCU\Software\adm914]
"a1_198" = "1896847192"

[HKCU\Software\adm914]
"a1_199" = "3528695096"

[HKCU\Software\adm914]
"a1_196" = "305360378"

[HKCU\Software\adm914]
"a1_197" = "483053307"

[HKCU\Software\adm914]
"a1_194" = "210646585"

[HKCU\Software\adm914]
"a1_195" = "1383687228"

[HKCU\Software\adm914]
"a1_192" = "3665094894"

[HKCU\Software\adm914]
"a1_193" = "2054832748"

[HKCU\Software\adm914]
"a1_190" = "2480395635"

[HKCU\Software\adm914]
"a1_191" = "494802147"

[HKCU\Software\adm914]
"a1_354" = "1230060779"

[HKCU\Software\adm914]
"a1_355" = "2170288189"

[HKCU\Software\adm914]
"a1_356" = "2208580653"

[HKCU\Software\adm914]
"a1_357" = "3633483816"

[HKCU\Software\adm914]
"a1_350" = "1737181164"

[HKCU\Software\adm914]
"a1_351" = "3395621281"

[HKCU\Software\adm914]
"a1_352" = "1256381136"

[HKCU\Software\adm914]
"a1_353" = "734812063"

[HKCU\Software\adm914]
"a1_282" = "65306612"

[HKCU\Software\adm914]
"a1_283" = "4134133346"

[HKCU\Software\adm914]
"a1_280" = "213364559"

[HKCU\Software\adm914]
"a1_281" = "173539248"

[HKCU\Software\adm914]
"a1_286" = "3465157120"

[HKCU\Software\adm914]
"a1_287" = "650388232"

[HKCU\Software\adm914]
"a1_284" = "3663533102"

[HKCU\Software\adm914]
"a1_285" = "1316320204"

[HKCU\Software\adm914]
"a1_288" = "1142141263"

[HKCU\Software\adm914]
"a1_289" = "3046752236"

[HKCU\Software\adm914]
"a4_197" = "1412316837"

[HKCU\Software\adm914]
"a4_196" = "1405147716"

[HKCU\Software\adm914]
"a2_104" = "745592324"

[HKCU\Software\adm914]
"a4_194" = "1390809474"

[HKCU\Software\adm914]
"a4_193" = "1383640353"

[HKCU\Software\adm914]
"a4_192" = "1376471232"

[HKCU\Software\adm914]
"a4_191" = "1369302111"

[HKCU\Software\adm914]
"a4_190" = "1362132990"

[HKCU\Software\adm914]
"a4_199" = "1426655079"

[HKCU\Software\adm914]
"a4_198" = "1419485958"

[HKCU\Software\adm914]
"a3_201" = "1424013824"

[HKCU\Software\adm914]
"a3_107" = "750493346"

[HKCU\Software\adm914]
"a3_106" = "742980099"

[HKCU\Software\adm914]
"a3_105" = "769475040"

[HKCU\Software\adm914]
"a3_104" = "762555713"

[HKCU\Software\adm914]
"a3_103" = "754977070"

[HKCU\Software\adm914]
"a3_102" = "714511503"

[HKCU\Software\adm914]
"a2_258" = "1849635229"

[HKCU\Software\adm914]
"a2_259" = "1856805700"

[HKCU\Software\adm914]
"a2_256" = "1835302206"

[HKCU\Software\adm914]
"a2_257" = "1842470095"

[HKCU\Software\adm914]
"a2_254" = "1820954524"

[HKCU\Software\adm914]
"a2_255" = "1828120096"

[HKCU\Software\adm914]
"a2_252" = "1806620708"

[HKCU\Software\adm914]
"a2_253" = "1813785389"

[HKCU\Software\adm914]
"a2_250" = "1792284256"

[HKCU\Software\adm914]
"a2_251" = "1799450707"

[HKCU\Software\adm914]
"a4_229" = "1641728709"

[HKCU\Software\adm914]
"a4_228" = "1634559588"

[HKCU\Software\adm914]
"a4_221" = "1584375741"

[HKCU\Software\adm914]
"a4_220" = "1577206620"

[HKCU\Software\adm914]
"a4_223" = "1598713983"

[HKCU\Software\adm914]
"a4_222" = "1591544862"

[HKCU\Software\adm914]
"a4_225" = "1613052225"

[HKCU\Software\adm914]
"a4_224" = "1605883104"

[HKCU\Software\adm914]
"a4_227" = "1627390467"

[HKCU\Software\adm914]
"a4_226" = "1620221346"

[HKCU\Software\adm914]
"a2_107" = "767092457"

[HKCU\Software\adm914]
"a2_27" = "193563159"

[HKCU\Software\adm914]
"a3_336" = "2391856505"

[HKCU\Software\adm914]
"a3_337" = "2432846232"

[HKCU\Software\adm914]
"a3_338" = "2439897659"

[HKCU\Software\adm914]
"a3_339" = "2446886490"

[HKCU\Software\adm914]
"a1_163" = "3437487613"

[HKCU\Software\adm914]
"a1_162" = "3066219311"

[HKCU\Software\adm914]
"a1_161" = "770989148"

[HKCU\Software\adm914]
"a1_160" = "277844182"

[HKCU\Software\adm914]
"a1_167" = "191170846"

[HKCU\Software\adm914]
"a1_166" = "1239700274"

[HKCU\Software\adm914]
"a1_165" = "525262549"

[HKCU\Software\adm914]
"a1_164" = "2881060212"

[HKCU\Software\adm914]
"a1_169" = "2858444471"

[HKCU\Software\adm914]
"a1_168" = "1758456822"

[HKCU\Software\adm914\695404737]
"7169121" = "247"

[HKCU\Software\adm914]
"a2_88" = "630887842"

[HKCU\Software\adm914]
"a2_89" = "638055481"

[HKCU\Software\adm914]
"a2_86" = "616540966"

[HKCU\Software\adm914]
"a2_87" = "623707508"

[HKCU\Software\adm914]
"a2_84" = "602207352"

[HKCU\Software\adm914]
"a2_85" = "609373388"

[HKCU\Software\adm914]
"a2_82" = "587873514"

[HKCU\Software\adm914]
"a2_83" = "595040646"

[HKCU\Software\adm914]
"a2_80" = "573524601"

[HKCU\Software\adm914]
"a2_81" = "580705271"

[HKCU\Software\adm914]
"a2_108" = "774258922"

[HKCU\Software\adm914]
"a4_184" = "1319118264"

[HKCU\Software\adm914]
"a4_185" = "1326287385"

[HKCU\Software\adm914]
"a4_186" = "1333456506"

[HKCU\Software\adm914]
"a4_187" = "1340625627"

[HKCU\Software\adm914]
"a4_180" = "1290441780"

[HKCU\Software\adm914]
"a4_181" = "1297610901"

[HKCU\Software\adm914]
"a4_182" = "1304780022"

[HKCU\Software\adm914]
"a4_183" = "1311949143"

[HKCU\Software\adm914]
"a2_109" = "781429175"

[HKCU\Software\adm914]
"a4_188" = "1347794748"

[HKCU\Software\adm914]
"a4_189" = "1354963869"

[HKCU\Software\adm914]
"a3_114" = "834001179"

[HKCU\Software\adm914]
"a3_115" = "807894458"

[HKCU\Software\adm914]
"a3_116" = "814879197"

[HKCU\Software\adm914]
"a3_117" = "821922428"

[HKCU\Software\adm914]
"a3_110" = "771902343"

[HKCU\Software\adm914]
"a3_111" = "778955814"

[HKCU\Software\adm914]
"a3_112" = "785940569"

[HKCU\Software\adm914]
"a3_113" = "826942712"

[HKCU\Software\adm914]
"a3_118" = "862924447"

[HKCU\Software\adm914]
"a3_119" = "869974846"

[HKCU\Software\adm914]
"a4_238" = "1706250798"

[HKCU\Software\adm914]
"a4_239" = "1713419919"

[HKCU\Software\adm914]
"a4_236" = "1691912556"

[HKCU\Software\adm914]
"a4_237" = "1699081677"

[HKCU\Software\adm914]
"a4_234" = "1677574314"

[HKCU\Software\adm914]
"a4_235" = "1684743435"

[HKCU\Software\adm914]
"a4_232" = "1663236072"

[HKCU\Software\adm914]
"a4_233" = "1670405193"

[HKCU\Software\adm914]
"a4_230" = "1648897830"

[HKCU\Software\adm914]
"a4_231" = "1656066951"

[HKCU\Software\adm914]
"a2_236" = "1691921574"

[HKCU\Software\adm914]
"a2_9" = "64526081"

[HKCU\Software\adm914]
"a2_237" = "1699084432"

[HKCU\Software\adm914]
"a4_88" = "630882648"

[HKCU\Software\adm914]
"a4_89" = "638051769"

[HKCU\Software\adm914]
"a4_80" = "573529680"

[HKCU\Software\adm914]
"a4_81" = "580698801"

[HKCU\Software\adm914]
"a4_82" = "587867922"

[HKCU\Software\adm914]
"a4_83" = "595037043"

[HKCU\Software\adm914]
"a4_84" = "602206164"

[HKCU\Software\adm914]
"a4_85" = "609375285"

[HKCU\Software\adm914]
"a4_86" = "616544406"

[HKCU\Software\adm914]
"a4_87" = "623713527"

[HKCU\Software\adm914]
"a1_170" = "1733515945"

[HKCU\Software\adm914]
"a1_171" = "376274583"

[HKCU\Software\adm914]
"a1_172" = "2351155844"

[HKCU\Software\adm914]
"a1_173" = "3340933586"

[HKCU\Software\adm914]
"a1_174" = "1401565643"

[HKCU\Software\adm914]
"a1_175" = "2511140368"

[HKCU\Software\adm914]
"a1_176" = "606688748"

[HKCU\Software\adm914]
"a1_177" = "3761403983"

[HKCU\Software\adm914]
"a1_178" = "1749332255"

[HKCU\Software\adm914]
"a1_179" = "1341567133"

[HKCU\Software\adm914]
"a2_99" = "709741567"

[HKCU\Software\adm914]
"a2_98" = "702577650"

[HKCU\Software\adm914]
"a2_95" = "681056821"

[HKCU\Software\adm914]
"a2_94" = "673892662"

[HKCU\Software\adm914]
"a2_97" = "695409366"

[HKCU\Software\adm914]
"a2_96" = "688239064"

[HKCU\Software\adm914]
"a2_91" = "652392894"

[HKCU\Software\adm914]
"a2_90" = "645224238"

[HKCU\Software\adm914]
"a2_93" = "666723509"

[HKCU\Software\adm914]
"a2_92" = "659554718"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\adm914]
"a3_52" = "389745053"

[HKCU\Software\adm914]
"a3_53" = "396796476"

[HKCU\Software\adm914]
"a3_50" = "341766363"

[HKCU\Software\adm914]
"a3_51" = "348755322"

[HKCU\Software\adm914]
"a3_56" = "384737041"

[HKCU\Software\adm914]
"a3_57" = "425210800"

[HKCU\Software\adm914]
"a3_54" = "370165343"

[HKCU\Software\adm914]
"a3_55" = "377748222"

[HKCU\Software\adm914]
"a3_58" = "432789459"

[HKCU\Software\adm914]
"a3_59" = "406145138"

[HKCU\Software\adm914]
"a3_297" = "2146049696"

[HKCU\Software\adm914]
"a3_296" = "2139060737"

[HKCU\Software\adm914]
"a3_295" = "2131608046"

[HKCU\Software\adm914]
"a3_294" = "2091003215"

[HKCU\Software\adm914]
"a3_293" = "2083555628"

[HKCU\Software\adm914]
"a3_292" = "2110067853"

[HKCU\Software\adm914]
"a3_291" = "2103079018"

[HKCU\Software\adm914]
"a3_290" = "2062081995"

[HKCU\Software\adm914]
"a3_299" = "2126993250"

[HKCU\Software\adm914]
"a3_298" = "2119545539"

[HKCU\Software\adm914]
"a3_341" = "2427838236"

[HKCU\Software\adm914]
"a3_340" = "2420783869"

[HKCU\Software\adm914]
"a3_343" = "2475825118"

[HKCU\Software\adm914]
"a3_342" = "2468836287"

[HKCU\Software\adm914]
"a3_345" = "2456759440"

[HKCU\Software\adm914]
"a3_344" = "2482866289"

[HKCU\Software\adm914]
"a3_347" = "2504287570"

[HKCU\Software\adm914]
"a3_346" = "2463809843"

[HKCU\Software\adm914]
"a3_349" = "2485301780"

[HKCU\Software\adm914]
"a3_348" = "2511804917"

[HKCU\Software\adm914]
"a3_129" = "907869896"

[HKCU\Software\adm914]
"a3_128" = "934369961"

[HKCU\Software\adm914]
"a3_121" = "850861040"

[HKCU\Software\adm914]
"a3_120" = "843343697"

[HKCU\Software\adm914]
"a3_123" = "898388146"

[HKCU\Software\adm914]
"a3_122" = "891468819"

[HKCU\Software\adm914]
"a3_125" = "879323508"

[HKCU\Software\adm914]
"a3_124" = "905966805"

[HKCU\Software\adm914]
"a3_127" = "927442486"

[HKCU\Software\adm914]
"a3_126" = "886312343"

[HKCU\Software\adm914]
"a2_339" = "2430334941"

[HKCU\Software\adm914]
"a2_338" = "2423167324"

[HKCU\Software\adm914]
"a4_99" = "709742979"

[HKCU\Software\adm914]
"a4_98" = "702573858"

[HKCU\Software\adm914]
"a4_97" = "695404737"

[HKCU\Software\adm914]
"a4_96" = "688235616"

[HKCU\Software\adm914]
"a4_95" = "681066495"

[HKCU\Software\adm914]
"a4_94" = "673897374"

[HKCU\Software\adm914]
"a4_93" = "666728253"

[HKCU\Software\adm914]
"a4_92" = "659559132"

[HKCU\Software\adm914]
"a4_91" = "652390011"

[HKCU\Software\adm914]
"a4_90" = "645220890"

[HKCU\Software\adm914]
"a1_145" = "441329318"

[HKCU\Software\adm914]
"a1_144" = "2400580830"

[HKCU\Software\adm914]
"a1_147" = "2303890671"

[HKCU\Software\adm914]
"a1_146" = "4129073931"

[HKCU\Software\adm914]
"a1_141" = "2775418204"

[HKCU\Software\adm914]
"a1_140" = "3364299848"

[HKCU\Software\adm914]
"a1_143" = "3146960503"

[HKCU\Software\adm914]
"a1_142" = "480663683"

[HKCU\Software\adm914]
"a1_149" = "2859291455"

[HKCU\Software\adm914]
"a1_148" = "3064999490"

[HKCU\Software\adm914]
"a2_331" = "2372983373"

[HKCU\Software\adm914]
"a2_330" = "2365815048"

[HKCU\Software\adm914]
"a2_333" = "2387314576"

[HKCU\Software\adm914]
"a4_253" = "1813787613"

[HKCU\Software\adm914]
"a2_335" = "2401650183"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
"DisableRegistryTools" = "1"

[HKCU\Software\adm914]
"a2_334" = "2394480990"

[HKCU\Software\adm914]
"a2_337" = "2415999365"

[HKCU\Software\adm914]
"a2_336" = "2408817804"

[HKCU\Software\adm914]
"a1_300" = "3499678203"

[HKCU\Software\adm914]
"a1_307" = "3835126016"

[HKCU\Software\adm914]
"a1_306" = "1316851133"

[HKCU\Software\adm914]
"a3_41" = "277248416"

[HKCU\Software\adm914]
"a3_40" = "269796609"

[HKCU\Software\adm914]
"a3_43" = "324843106"

[HKCU\Software\adm914]
"a3_42" = "284237251"

[HKCU\Software\adm914]
"a3_45" = "305778468"

[HKCU\Software\adm914]
"a3_44" = "332278405"

[HKCU\Software\adm914]
"a3_47" = "353765350"

[HKCU\Software\adm914]
"a3_46" = "313221959"

[HKCU\Software\adm914]
"a3_49" = "368270520"

[HKCU\Software\adm914]
"a3_48" = "360822809"

[HKCU\Software\adm914]
"a2_48" = "344114980"

[HKCU\Software\adm914]
"a2_49" = "351285088"

[HKCU\Software\adm914]
"a2_42" = "301097322"

[HKCU\Software\adm914]
"a2_43" = "308268193"

[HKCU\Software\adm914]
"a2_40" = "286767404"

[HKCU\Software\adm914]
"a2_41" = "293930793"

[HKCU\Software\adm914]
"a2_46" = "329781954"

[HKCU\Software\adm914]
"a2_47" = "336951475"

[HKCU\Software\adm914]
"a2_44" = "315447940"

[HKCU\Software\adm914]
"a2_45" = "322615512"

[HKCU\Software\adm914]
"a1_332" = "3340181784"

[HKCU\Software\adm914]
"a1_333" = "958321266"

[HKCU\Software\adm914]
"a1_330" = "400474563"

[HKCU\Software\adm914]
"a1_331" = "1859043108"

[HKCU\Software\adm914]
"a1_336" = "2880690558"

[HKCU\Software\adm914]
"a1_337" = "986856959"

[HKCU\Software\adm914]
"a1_334" = "2257417435"

[HKCU\Software\adm914]
"a1_335" = "3229397693"

[HKCU\Software\adm914]
"a3_284" = "2019045813"

[HKCU\Software\adm914]
"a3_285" = "2026624468"

[HKCU\Software\adm914]
"a3_286" = "2067091063"

[HKCU\Software\adm914]
"a3_287" = "2074141334"

[HKCU\Software\adm914]
"a3_280" = "1990631473"

[HKCU\Software\adm914]
"a3_281" = "2031109200"

[HKCU\Software\adm914]
"a3_282" = "2038692083"

[HKCU\Software\adm914]
"a3_283" = "2045680914"

[HKCU\Software\adm914]
"a3_288" = "2048100105"

[HKCU\Software\adm914]
"a3_289" = "2055027624"

[HKCU\Software\adm914]
"a3_356" = "2568813773"

[HKCU\Software\adm914]
"a3_357" = "2576322924"

[HKCU\Software\adm914]
"a3_354" = "2521277451"

[HKCU\Software\adm914]
"a3_355" = "2528204970"

[HKCU\Software\adm914]
"a3_352" = "2540269385"

[HKCU\Software\adm914]
"a3_353" = "2547254248"

[HKCU\Software\adm914]
"a3_350" = "2492225207"

[HKCU\Software\adm914]
"a3_351" = "2499791574"

[HKCU\Software\adm914]
"a2_285" = "2043194765"

[HKCU\Software\adm914]
"a2_284" = "2036025808"

[HKCU\Software\adm914]
"a2_287" = "2057540211"

[HKCU\Software\adm914]
"a2_286" = "2050360406"

[HKCU\Software\adm914]
"a2_281" = "2014524027"

[HKCU\Software\adm914]
"a2_280" = "2007356291"

[HKCU\Software\adm914]
"a2_283" = "2028856691"

[HKCU\Software\adm914]
"a2_282" = "2021689445"

[HKCU\Software\adm914]
"a2_289" = "2071874550"

[HKCU\Software\adm914]
"a2_288" = "2064710524"

[HKCU\Software\adm914]
"a2_353" = "2530703961"

[HKCU\Software\adm914]
"a2_352" = "2523533473"

[HKCU\Software\adm914]
"a2_351" = "2516368059"

[HKCU\Software\adm914]
"a2_350" = "2509189054"

[HKCU\Software\adm914]
"a2_357" = "2559369986"

[HKCU\Software\adm914]
"a2_356" = "2552202829"

[HKCU\Software\adm914]
"a2_355" = "2545036131"

[HKCU\Software\adm914]
"a2_354" = "2537871806"

[HKCU\Software\adm914]
"a2_106" = "759924654"

[HKCU\Software\adm914]
"a3_138" = "1006335587"

[HKCU\Software\adm914]
"a3_139" = "979823234"

[HKCU\Software\adm914]
"a3_136" = "991836577"

[HKCU\Software\adm914]
"a3_137" = "998890944"

[HKCU\Software\adm914]
"a3_134" = "943841519"

[HKCU\Software\adm914]
"a3_135" = "950830350"

[HKCU\Software\adm914]
"a3_132" = "962897965"

[HKCU\Software\adm914]
"a3_133" = "970345548"

[HKCU\Software\adm914]
"a3_130" = "915379051"

[HKCU\Software\adm914]
"a3_131" = "922302346"

[HKCU\Software\adm914]
"a2_105" = "752759383"

[HKCU\Software\adm914]
"a2_102" = "731245415"

[HKCU\Software\adm914]
"a2_103" = "738423975"

[HKCU\Software\adm914]
"a2_100" = "716910496"

[HKCU\Software\adm914]
"a2_101" = "724077997"

[HKCU\Software\adm914]
"a4_62" = "444485502"

[HKCU\Software\adm914]
"a4_63" = "451654623"

[HKCU\Software\adm914]
"a4_60" = "430147260"

[HKCU\Software\adm914]
"a4_61" = "437316381"

[HKCU\Software\adm914]
"a4_66" = "473161986"

[HKCU\Software\adm914]
"a4_67" = "480331107"

[HKCU\Software\adm914]
"a4_64" = "458823744"

[HKCU\Software\adm914]
"a4_65" = "465992865"

[HKCU\Software\adm914]
"a4_68" = "487500228"

[HKCU\Software\adm914]
"a4_69" = "494669349"

[HKCU\Software\adm914]
"a1_158" = "1211755031"

[HKCU\Software\adm914]
"a1_159" = "2767734922"

[HKCU\Software\adm914]
"a1_152" = "1188095950"

[HKCU\Software\adm914]
"a1_153" = "3021981769"

[HKCU\Software\adm914]
"a1_150" = "116105867"

[HKCU\Software\adm914]
"a1_151" = "3685603426"

[HKCU\Software\adm914]
"a1_156" = "119462560"

[HKCU\Software\adm914]
"a1_157" = "2759231437"

[HKCU\Software\adm914]
"a1_154" = "2817605635"

[HKCU\Software\adm914]
"a1_155" = "3352943077"

[HKCU\Software\adm914]
"a1_32" = "101986929"

[HKCU\Software\adm914]
"a1_33" = "3425540823"

[HKCU\Software\adm914]
"a1_30" = "3235899143"

[HKCU\Software\adm914]
"a1_31" = "2445002986"

[HKCU\Software\adm914]
"a1_36" = "2747891990"

[HKCU\Software\adm914]
"a1_37" = "3264457297"

[HKCU\Software\adm914]
"a1_34" = "3624021679"

[HKCU\Software\adm914]
"a1_35" = "3505374476"

[HKCU\Software\adm914]
"a1_38" = "556860839"

[HKCU\Software\adm914]
"a1_39" = "529159802"

[HKCU\Software\adm914]
"a3_74" = "513568291"

[HKCU\Software\adm914]
"a3_75" = "554631746"

[HKCU\Software\adm914]
"a3_76" = "561686245"

[HKCU\Software\adm914]
"a3_77" = "568613636"

[HKCU\Software\adm914]
"a3_70" = "485103791"

[HKCU\Software\adm914]
"a3_71" = "525712590"

[HKCU\Software\adm914]
"a3_72" = "533156193"

[HKCU\Software\adm914]
"a3_73" = "506656128"

[HKCU\Software\adm914]
"a3_78" = "542637991"

[HKCU\Software\adm914]
"a3_79" = "549622726"

[HKCU\Software\adm914]
"a2_59" = "422971281"

[HKCU\Software\adm914]
"a2_58" = "415803549"

[HKCU\Software\adm914]
"a2_51" = "365619267"

[HKCU\Software\adm914]
"a2_50" = "358453066"

[HKCU\Software\adm914]
"a2_53" = "379968814"

[HKCU\Software\adm914]
"a2_52" = "372800337"

[HKCU\Software\adm914]
"a2_55" = "394298311"

[HKCU\Software\adm914]
"a2_54" = "387135146"

[HKCU\Software\adm914]
"a2_57" = "408633567"

[HKCU\Software\adm914]
"a2_56" = "401468968"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\adm914]
"a4_153" = "1096875513"

[HKCU\Software\adm914]
"a4_152" = "1089706392"

[HKCU\Software\adm914]
"a4_151" = "1082537271"

[HKCU\Software\adm914]
"a4_150" = "1075368150"

[HKCU\Software\adm914]
"a4_157" = "1125551997"

[HKCU\Software\adm914]
"a4_156" = "1118382876"

[HKCU\Software\adm914]
"a4_155" = "1111213755"

[HKCU\Software\adm914]
"a4_154" = "1104044634"

[HKCU\Software\adm914]
"a4_159" = "1139890239"

[HKCU\Software\adm914]
"a4_158" = "1132721118"

[HKCU\Software\adm914\695404737]
"14338242" = "0"

[HKCU\Software\adm914]
"a2_348" = "2494849356"

[HKCU\Software\adm914]
"a2_349" = "2502020853"

[HKCU\Software\adm914]
"a2_340" = "2437499090"

[HKCU\Software\adm914]
"a2_341" = "2444666037"

[HKCU\Software\adm914]
"a2_342" = "2451835486"

[HKCU\Software\adm914]
"a2_343" = "2459004719"

[HKCU\Software\adm914]
"a2_344" = "2466182811"

[HKCU\Software\adm914]
"a2_345" = "2473351537"

[HKCU\Software\adm914]
"a2_346" = "2480517730"

[HKCU\Software\adm914]
"a2_347" = "2487687791"

[HKCU\Software\adm914]
"a2_298" = "2136394597"

[HKCU\Software\adm914]
"a2_299" = "2143560431"

[HKCU\Software\adm914]
"a2_292" = "2093377054"

[HKCU\Software\adm914]
"a2_293" = "2100555957"

[HKCU\Software\adm914]
"a2_290" = "2079041363"

[HKCU\Software\adm914]
"a2_291" = "2086212860"

[HKCU\Software\adm914]
"a2_296" = "2122068030"

[HKCU\Software\adm914]
"a2_297" = "2129223987"

[HKCU\Software\adm914]
"a2_294" = "2107725510"

[HKCU\Software\adm914]
"a2_295" = "2114894540"

[HKCU\Software\adm914]
"a4_71" = "509007591"

[HKCU\Software\adm914]
"a4_70" = "501838470"

[HKCU\Software\adm914]
"a4_73" = "523345833"

[HKCU\Software\adm914]
"a4_72" = "516176712"

[HKCU\Software\adm914]
"a4_75" = "537684075"

[HKCU\Software\adm914]
"a4_74" = "530514954"

[HKCU\Software\adm914]
"a4_77" = "552022317"

[HKCU\Software\adm914]
"a4_76" = "544853196"

[HKCU\Software\adm914]
"a4_79" = "566360559"

[HKCU\Software\adm914]
"a4_78" = "559191438"

[HKCU\Software\adm914]
"a1_129" = "1144976079"

[HKCU\Software\adm914]
"a1_128" = "2249858958"

[HKCU\Software\adm914]
"a1_127" = "4267571147"

[HKCU\Software\adm914]
"a1_126" = "1595139330"

[HKCU\Software\adm914]
"a1_125" = "3771501099"

[HKCU\Software\adm914]
"a1_124" = "3155039873"

[HKCU\Software\adm914]
"a1_123" = "1312745554"

[HKCU\Software\adm914]
"a1_122" = "785636459"

[HKCU\Software\adm914]
"a1_121" = "3955554688"

[HKCU\Software\adm914]
"a1_120" = "3915261217"

[HKCU\Software\adm914]
"a1_233" = "672736796"

[HKCU\Software\adm914]
"a1_232" = "541767866"

[HKCU\Software\adm914]
"a1_231" = "897042143"

[HKCU\Software\adm914]
"a1_230" = "1188635800"

[HKCU\Software\adm914]
"a1_237" = "1674352536"

[HKCU\Software\adm914]
"a1_236" = "3175614416"

[HKCU\Software\adm914]
"a1_235" = "3602011990"

[HKCU\Software\adm914]
"a1_234" = "426180059"

[HKCU\Software\adm914]
"a1_239" = "2960421335"

[HKCU\Software\adm914]
"a1_238" = "572373776"

[HKCU\Software\adm914]
"a1_21" = "3317665355"

[HKCU\Software\adm914]
"a1_20" = "2095818792"

[HKCU\Software\adm914]
"a1_23" = "3704483009"

[HKCU\Software\adm914]
"a1_22" = "1323709287"

[HKCU\Software\adm914]
"a1_25" = "2634357591"

[HKCU\Software\adm914]
"a1_24" = "212424274"

[HKCU\Software\adm914]
"a1_27" = "3399595507"

[HKCU\Software\adm914]
"a1_26" = "1782957987"

[HKCU\Software\adm914]
"a1_29" = "4094789696"

[HKCU\Software\adm914]
"a1_28" = "1044184866"

[HKCU\Software\adm914]
"a3_69" = "478110732"

[HKCU\Software\adm914]
"a3_68" = "470664173"

[HKCU\Software\adm914]
"a3_101" = "707522668"

[HKCU\Software\adm914]
"a3_63" = "468244982"

[HKCU\Software\adm914]
"a3_62" = "461186391"

[HKCU\Software\adm914]
"a3_61" = "454263092"

[HKCU\Software\adm914]
"a3_60" = "413199509"

[HKCU\Software\adm914]
"a3_67" = "497168202"

[HKCU\Software\adm914]
"a3_66" = "489720619"

[HKCU\Software\adm914]
"a3_65" = "449123976"

[HKCU\Software\adm914]
"a3_64" = "442135145"

[HKCU\Software\adm914]
"a3_109" = "798021476"

[HKCU\Software\adm914]
"a3_108" = "790966981"

[HKCU\Software\adm914\695404737]
"35845605" = "315"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 F6 42 08 43 EA 28 08 D3 CE 30 2C D9 C7 DF 75"

[HKCU\Software\adm914]
"a2_68" = "487503302"

[HKCU\Software\adm914]
"a2_69" = "494672373"

[HKCU\Software\adm914]
"a2_64" = "458821318"

[HKCU\Software\adm914]
"a2_65" = "465989506"

[HKCU\Software\adm914]
"a2_66" = "473167039"

[HKCU\Software\adm914]
"a2_67" = "480334831"

[HKCU\Software\adm914]
"a2_60" = "430149809"

[HKCU\Software\adm914]
"a2_61" = "437320021"

[HKCU\Software\adm914]
"a2_62" = "444489198"

[HKCU\Software\adm914]
"a2_63" = "451651524"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\adm914]
"a4_140" = "1003676940"

[HKCU\Software\adm914]
"a4_141" = "1010846061"

[HKCU\Software\adm914]
"a4_142" = "1018015182"

[HKCU\Software\adm914]
"a4_143" = "1025184303"

[HKCU\Software\adm914]
"a4_144" = "1032353424"

[HKCU\Software\adm914]
"a4_145" = "1039522545"

[HKCU\Software\adm914]
"a4_146" = "1046691666"

[HKCU\Software\adm914]
"a4_147" = "1053860787"

[HKCU\Software\adm914]
"a4_148" = "1061029908"

[HKCU\Software\adm914]
"a4_149" = "1068199029"

[HKCU\Software\adm914]
"a2_199" = "1426657919"

[HKCU\Software\adm914]
"a2_198" = "1419491324"

[HKCU\Software\adm914]
"a2_191" = "1369308419"

[HKCU\Software\adm914]
"a2_190" = "1362127985"

[HKCU\Software\adm914]
"a2_193" = "1383642133"

[HKCU\Software\adm914]
"a2_192" = "1376475396"

[HKCU\Software\adm914]
"a2_195" = "1397975307"

[HKCU\Software\adm914]
"a2_194" = "1390806462"

[HKCU\Software\adm914]
"a2_197" = "1412307823"

[HKCU\Software\adm914]
"a2_196" = "1405144041"

[HKCU\Software\adm914]
"a4_26" = "186397146"

[HKCU\Software\adm914]
"a4_27" = "193566267"

[HKCU\Software\adm914]
"a4_24" = "172058904"

[HKCU\Software\adm914]
"a4_25" = "179228025"

[HKCU\Software\adm914]
"a4_22" = "157720662"

[HKCU\Software\adm914]
"a4_23" = "164889783"

[HKCU\Software\adm914]
"a4_20" = "143382420"

[HKCU\Software\adm914]
"a4_21" = "150551541"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\adm914]
"a4_44" = "315441324"

[HKCU\Software\adm914]
"a4_45" = "322610445"

[HKCU\Software\adm914]
"a4_46" = "329779566"

[HKCU\Software\adm914]
"a4_47" = "336948687"

[HKCU\Software\adm914]
"a4_40" = "286764840"

[HKCU\Software\adm914]
"a4_41" = "293933961"

[HKCU\Software\adm914]
"a4_42" = "301103082"

[HKCU\Software\adm914]
"a4_43" = "308272203"

[HKCU\Software\adm914]
"a4_48" = "344117808"

[HKCU\Software\adm914]
"a4_49" = "351286929"

[HKCU\Software\adm914]
"a1_2" = "3040461548"

[HKCU\Software\adm914]
"a1_3" = "1953664334"

[HKCU\Software\adm914]
"a1_0" = "316296286"

[HKCU\Software\adm914]
"a1_1" = "3634571327"

[HKCU\Software\adm914]
"a1_6" = "404048628"

[HKCU\Software\adm914]
"a1_7" = "3288697609"

[HKCU\Software\adm914]
"a1_4" = "2798567239"

[HKCU\Software\adm914]
"a1_5" = "3062179622"

[HKCU\Software\adm914]
"a1_8" = "1320670292"

[HKCU\Software\adm914]
"a1_9" = "3609390596"

[HKCU\Software\adm914]
"a3_4" = "11991981"

[HKCU\Software\adm914]
"a3_5" = "52535244"

[HKCU\Software\adm914]
"a3_6" = "59977839"

[HKCU\Software\adm914]
"a3_7" = "67032206"

[HKCU\Software\adm914]
"a1_138" = "551145595"

[HKCU\Software\adm914]
"a1_139" = "711870474"

[HKCU\Software\adm914]
"a3_2" = "31040235"

[HKCU\Software\adm914]
"a3_3" = "4933386"

[HKCU\Software\adm914]
"a1_134" = "1259015348"

[HKCU\Software\adm914]
"a1_135" = "826388889"

[HKCU\Software\adm914]
"a1_136" = "3699538129"

[HKCU\Software\adm914]
"a1_137" = "1960639924"

[HKCU\Software\adm914]
"a1_130" = "4024664855"

[HKCU\Software\adm914]
"a1_131" = "3490293098"

[HKCU\Software\adm914]
"a1_132" = "2996701812"

[HKCU\Software\adm914]
"a1_133" = "1387473018"

[HKCU\Software\adm914]
"a1_220" = "2074965762"

[HKCU\Software\adm914]
"a1_221" = "1402823041"

[HKCU\Software\adm914]
"a1_222" = "1481607381"

[HKCU\Software\adm914]
"a1_223" = "672270128"

[HKCU\Software\adm914]
"a1_224" = "2041511353"

[HKCU\Software\adm914]
"a1_225" = "2735769375"

[HKCU\Software\adm914]
"a1_226" = "546875646"

[HKCU\Software\adm914]
"a1_227" = "762711067"

[HKCU\Software\adm914]
"a1_228" = "795293705"

[HKCU\Software\adm914]
"a1_229" = "4014889373"

[HKCU\Software\adm914]
"a1_14" = "3182120858"

[HKCU\Software\adm914]
"a1_15" = "72261088"

[HKCU\Software\adm914]
"a1_16" = "2274832198"

[HKCU\Software\adm914]
"a1_17" = "801386796"

[HKCU\Software\adm914]
"a1_10" = "3176508551"

[HKCU\Software\adm914]
"a1_11" = "2063498866"

[HKCU\Software\adm914]
"a1_12" = "236838874"

[HKCU\Software\adm914]
"a1_13" = "27863491"

[HKCU\Software\adm914]
"a1_18" = "3005810055"

[HKCU\Software\adm914]
"a1_19" = "521426794"

[HKCU\Software\adm914]
"a3_18" = "112354555"

[HKCU\Software\adm914]
"a3_19" = "152901914"

[HKCU\Software\adm914]
"a3_16" = "131411001"

[HKCU\Software\adm914]
"a3_17" = "104906840"

[HKCU\Software\adm914]
"a3_14" = "83367783"

[HKCU\Software\adm914]
"a3_15" = "124488582"

[HKCU\Software\adm914]
"a3_12" = "69459621"

[HKCU\Software\adm914]
"a3_13" = "76378820"

[HKCU\Software\adm914]
"a3_10" = "88506851"

[HKCU\Software\adm914]
"a3_11" = "95435266"

[HKCU\Software\adm914]
"a2_73" = "523339815"

[HKCU\Software\adm914]
"a2_72" = "516173060"

[HKCU\Software\adm914]
"a2_71" = "509002952"

[HKCU\Software\adm914]
"a2_70" = "501835640"

[HKCU\Software\adm914]
"a2_77" = "552019553"

[HKCU\Software\adm914]
"a2_76" = "544857639"

[HKCU\Software\adm914]
"a2_75" = "537689141"

[HKCU\Software\adm914]
"a2_74" = "530520826"

[HKCU\Software\adm914]
"a2_79" = "566354409"

[HKCU\Software\adm914]
"a2_78" = "559186584"

[HKCU\Software\adm914]
"a4_175" = "1254596175"

[HKCU\Software\adm914]
"a4_174" = "1247427054"

[HKCU\Software\adm914]
"a4_177" = "1268934417"

[HKCU\Software\adm914]
"a4_176" = "1261765296"

[HKCU\Software\adm914]
"a4_171" = "1225919691"

[HKCU\Software\adm914]
"a4_170" = "1218750570"

[HKCU\Software\adm914]
"a4_173" = "1240257933"

[HKCU\Software\adm914]
"a4_172" = "1233088812"

[HKCU\Software\adm914]
"a4_179" = "1283272659"

[HKCU\Software\adm914]
"a4_178" = "1276103538"

[HKCU\Software\adm914]
"a2_188" = "1347789441"

[HKCU\Software\adm914]
"a2_189" = "1354958751"

[HKCU\Software\adm914]
"a2_186" = "1333460082"

[HKCU\Software\adm914]
"a2_187" = "1340621139"

[HKCU\Software\adm914]
"a2_184" = "1319124296"

[HKCU\Software\adm914]
"a2_185" = "1326291081"

[HKCU\Software\adm914]
"a2_182" = "1304775520"

[HKCU\Software\adm914]
"a2_183" = "1311958173"

[HKCU\Software\adm914]
"a2_180" = "1290440192"

[HKCU\Software\adm914]
"a2_181" = "1297605101"

[HKCU\Software\adm914]
"a4_355" = "2545037955"

[HKCU\Software\adm914]
"a4_354" = "2537868834"

[HKCU\Software\adm914]
"a4_356" = "2552207076"

[HKCU\Software\adm914]
"a4_351" = "2516361471"

[HKCU\Software\adm914]
"a4_350" = "2509192350"

[HKCU\Software\adm914]
"a4_353" = "2530699713"

[HKCU\Software\adm914]
"a4_352" = "2523530592"

[HKCU\Software\adm914]
"a3_253" = "1830771188"

[HKCU\Software\adm914]
"a3_252" = "1789764949"

[HKCU\Software\adm914]
"a3_251" = "1782710578"

[HKCU\Software\adm914]
"a3_250" = "1809280147"

[HKCU\Software\adm914]
"a3_257" = "1825746760"

[HKCU\Software\adm914]
"a3_256" = "1818692393"

[HKCU\Software\adm914]
"a3_255" = "1844811446"

[HKCU\Software\adm914]
"a3_254" = "1837822487"

[HKCU\Software\adm914]
"a3_259" = "1873798154"

[HKCU\Software\adm914]
"a3_258" = "1866220523"

[HKCU\Software\adm914]
"a4_289" = "2071875969"

[HKCU\Software\adm914]
"a4_288" = "2064706848"

[HKCU\Software\adm914]
"a4_287" = "2057537727"

[HKCU\Software\adm914]
"a4_286" = "2050368606"

[HKCU\Software\adm914]
"a4_285" = "2043199485"

[HKCU\Software\adm914]
"a4_284" = "2036030364"

[HKCU\Software\adm914]
"a4_283" = "2028861243"

[HKCU\Software\adm914]
"a4_282" = "2021692122"

[HKCU\Software\adm914]
"a4_281" = "2014523001"

[HKCU\Software\adm914]
"a4_280" = "2007353880"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\adm914]
"a3_100" = "733503437"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914]
"a4_59" = "422978139"

[HKCU\Software\adm914]
"a4_58" = "415809018"

[HKCU\Software\adm914]
"a4_53" = "379963413"

[HKCU\Software\adm914]
"a4_52" = "372794292"

[HKCU\Software\adm914]
"a4_51" = "365625171"

[HKCU\Software\adm914]
"a4_50" = "358456050"

[HKCU\Software\adm914]
"a4_57" = "408639897"

[HKCU\Software\adm914]
"a4_56" = "401470776"

[HKCU\Software\adm914]
"a4_55" = "394301655"

[HKCU\Software\adm914]
"a4_54" = "387132534"

[HKCU\Software\adm914]
"a1_101" = "3139566091"

[HKCU\Software\adm914]
"a1_100" = "3005319207"

[HKCU\Software\adm914]
"a1_103" = "2207187785"

[HKCU\Software\adm914]
"a1_102" = "1364046447"

[HKCU\Software\adm914]
"a1_105" = "44531108"

[HKCU\Software\adm914]
"a1_104" = "3989889841"

[HKCU\Software\adm914]
"a1_107" = "3383761862"

[HKCU\Software\adm914]
"a1_106" = "2961872017"

[HKCU\Software\adm914]
"a1_109" = "2793266435"

[HKCU\Software\adm914]
"a1_108" = "2967381584"

[HKCU\Software\adm914]
"a1_215" = "410176713"

[HKCU\Software\adm914]
"a1_214" = "270366024"

[HKCU\Software\adm914]
"a1_217" = "3776722784"

[HKCU\Software\adm914]
"a1_216" = "1579798165"

[HKCU\Software\adm914]
"a1_211" = "3494238909"

[HKCU\Software\adm914]
"a1_210" = "3773766605"

[HKCU\Software\adm914]
"a1_213" = "170653672"

[HKCU\Software\adm914]
"a1_212" = "3609031651"

[HKCU\Software\adm914]
"a1_219" = "3283751493"

[HKCU\Software\adm914]
"a1_218" = "1187824067"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\adm914\695404737]
"43014726" = "0800687474703A2F2F636174616E682E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F636869656E6773616E672E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F63686163617261626F6E616E7A612E636F6D2E62722F696D6167656E732F6C6F676F2E67696600687474703A2F2F6368616E647261706172612E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6561676C657475726B2E636F6D2F6C6F676F2E67696600687474703A2F2F646F67756167616373616E6179692E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E646F616E686E6768696570766965742E636F6D2E766E2F696D616765732F6C6F676F2E67696600687474703A2F2F64726E682E69722F696D672F69636F6E732F6C6F676F2E676966"

[HKCU\Software\adm914]
"a4_168" = "1204412328"

[HKCU\Software\adm914]
"a4_169" = "1211581449"

[HKCU\Software\adm914]
"a4_162" = "1161397602"

[HKCU\Software\adm914]
"a4_163" = "1168566723"

[HKCU\Software\adm914]
"a4_160" = "1147059360"

[HKCU\Software\adm914]
"a4_161" = "1154228481"

[HKCU\Software\adm914]
"a4_166" = "1190074086"

[HKCU\Software\adm914]
"a4_167" = "1197243207"

[HKCU\Software\adm914]
"a4_164" = "1175735844"

[HKCU\Software\adm914]
"a4_165" = "1182904965"

[HKCU\Software\adm914]
"a2_173" = "1240254196"

[HKCU\Software\adm914]
"a2_172" = "1233084948"

[HKCU\Software\adm914]
"a2_171" = "1225921741"

[HKCU\Software\adm914]
"a2_170" = "1218756474"

[HKCU\Software\adm914]
"a2_177" = "1268937933"

[HKCU\Software\adm914]
"a2_176" = "1261770445"

[HKCU\Software\adm914]
"a2_175" = "1254590212"

[HKCU\Software\adm914]
"a2_174" = "1247424318"

[HKCU\Software\adm914]
"a2_179" = "1283274291"

[HKCU\Software\adm914]
"a2_178" = "1276108335"

[HKCU\Software\adm914]
"a4_342" = "2451839382"

[HKCU\Software\adm914]
"a4_343" = "2459008503"

[HKCU\Software\adm914]
"a4_340" = "2437501140"

[HKCU\Software\adm914]
"a4_341" = "2444670261"

[HKCU\Software\adm914]
"a4_346" = "2480515866"

[HKCU\Software\adm914]
"a4_347" = "2487684987"

[HKCU\Software\adm914]
"a4_344" = "2466177624"

[HKCU\Software\adm914]
"a4_345" = "2473346745"

[HKCU\Software\adm914]
"a4_348" = "2494854108"

[HKCU\Software\adm914]
"a4_349" = "2502023229"

[HKCU\Software\adm914]
"a3_240" = "1737322713"

[HKCU\Software\adm914]
"a3_241" = "1744311672"

[HKCU\Software\adm914]
"a3_242" = "1718323611"

[HKCU\Software\adm914]
"a3_243" = "1725243962"

[HKCU\Software\adm914]
"a3_244" = "1765852765"

[HKCU\Software\adm914]
"a3_245" = "1773304572"

[HKCU\Software\adm914]
"a3_246" = "1746738975"

[HKCU\Software\adm914]
"a3_247" = "1753789374"

[HKCU\Software\adm914]
"a3_248" = "1761236945"

[HKCU\Software\adm914]
"a3_249" = "1801832560"

[HKCU\Software\adm914]
"a4_298" = "2136398058"

[HKCU\Software\adm914]
"a4_299" = "2143567179"

[HKCU\Software\adm914]
"a4_294" = "2107721574"

[HKCU\Software\adm914]
"a4_295" = "2114890695"

[HKCU\Software\adm914]
"a4_296" = "2122059816"

[HKCU\Software\adm914]
"a4_297" = "2129228937"

[HKCU\Software\adm914]
"a4_290" = "2079045090"

[HKCU\Software\adm914]
"a4_291" = "2086214211"

[HKCU\Software\adm914]
"a4_292" = "2093383332"

[HKCU\Software\adm914]
"a4_293" = "2100552453"

[HKCU\Software\adm914]
"a2_317" = "2272616338"

[HKCU\Software\adm914]
"a2_316" = "2265444380"

[HKCU\Software\adm914]
"a2_315" = "2258277967"

[HKCU\Software\adm914]
"a2_314" = "2251098944"

[HKCU\Software\adm914]
"a2_313" = "2243932033"

[HKCU\Software\adm914]
"a2_312" = "2236761840"

[HKCU\Software\adm914]
"a2_311" = "2229592399"

[HKCU\Software\adm914]
"a2_310" = "2222431142"

[HKCU\Software\adm914]
"a2_319" = "2286945164"

[HKCU\Software\adm914]
"a2_318" = "2279777186"

[HKCU\Software\adm914]
"a2_229" = "1641730847"

[HKCU\Software\adm914]
"a2_228" = "1634562578"

[HKCU\Software\adm914]
"a4_28" = "200735388"

[HKCU\Software\adm914]
"a4_29" = "207904509"

[HKCU\Software\adm914]
"a2_223" = "1598710115"

[HKCU\Software\adm914]
"a2_222" = "1591549841"

[HKCU\Software\adm914]
"a2_221" = "1584379829"

[HKCU\Software\adm914]
"a2_220" = "1577212532"

[HKCU\Software\adm914]
"a2_227" = "1627395238"

[HKCU\Software\adm914]
"a2_226" = "1620217687"

[HKCU\Software\adm914]
"a2_225" = "1613049036"

[HKCU\Software\adm914]
"a2_224" = "1605881166"

[HKCU\Software\adm914]
"a3_329" = "2375379584"

[HKCU\Software\adm914]
"a1_116" = "3158563407"

[HKCU\Software\adm914]
"a1_117" = "3901215099"

[HKCU\Software\adm914]
"a1_114" = "374946411"

[HKCU\Software\adm914]
"a1_115" = "1451324763"

[HKCU\Software\adm914]
"a1_112" = "588562735"

[HKCU\Software\adm914]
"a1_113" = "1645951116"

[HKCU\Software\adm914]
"a1_110" = "3168728850"

[HKCU\Software\adm914]
"a1_111" = "3318156628"

[HKCU\Software\adm914]
"a1_118" = "183571694"

[HKCU\Software\adm914]
"a1_119" = "3456946242"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\adm914]
"a1_208" = "2144355950"

[HKCU\Software\adm914]
"a1_209" = "2467766147"

[HKCU\Software\adm914]
"a1_202" = "798458441"

[HKCU\Software\adm914]
"a1_203" = "1337258164"

[HKCU\Software\adm914]
"a1_200" = "1102886551"

[HKCU\Software\adm914]
"a1_201" = "1589779033"

[HKCU\Software\adm914]
"a1_206" = "2921533054"

[HKCU\Software\adm914]
"a1_207" = "2788433457"

[HKCU\Software\adm914]
"a1_204" = "3291525121"

[HKCU\Software\adm914]
"a1_205" = "432820212"

[HKCU\Software\adm914]
"a1_78" = "4257117923"

[HKCU\Software\adm914]
"a1_79" = "929925810"

[HKCU\Software\adm914]
"a1_76" = "3437935235"

[HKCU\Software\adm914]
"a1_77" = "1774144081"

[HKCU\Software\adm914]
"a1_74" = "1474519263"

[HKCU\Software\adm914]
"a1_75" = "2743839651"

[HKCU\Software\adm914]
"a1_72" = "1500754449"

[HKCU\Software\adm914]
"a1_73" = "3175984923"

[HKCU\Software\adm914]
"a1_70" = "4032117979"

[HKCU\Software\adm914]
"a1_71" = "299761865"

[HKCU\Software\adm914]
"a3_30" = "231909751"

[HKCU\Software\adm914]
"a3_31" = "205278614"

[HKCU\Software\adm914]
"a3_32" = "212854281"

[HKCU\Software\adm914]
"a3_33" = "253401768"

[HKCU\Software\adm914]
"a3_34" = "260325067"

[HKCU\Software\adm914]
"a3_35" = "267899754"

[HKCU\Software\adm914]
"a3_36" = "241268621"

[HKCU\Software\adm914]
"a3_37" = "248309804"

[HKCU\Software\adm914]
"a3_38" = "289377359"

[HKCU\Software\adm914]
"a3_39" = "296296686"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"6bc954b988e55bf67797604aa526c94f.exe" = "c:\6bc954b988e55bf67797604aa526c94f.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The process 6bc954b988e55bf67797604aa526c94f.exe:136 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 C2 B7 7C CD AD 2D AF 0D 94 F2 1B 61 FB F8 5A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process netsh.exe:696 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 2C BB 74 9A 12 64 79 A6 9C 83 D0 81 3B 57 EA"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process netsh.exe:1752 makes changes in a system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 2D 3B 12 0D 34 B1 CA 22 B8 4E C8 BE 11 09 2F"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Network activity (URLs)

No activity has been detected.

Rootkit activity

The Virus installs the following user-mode hooks in dnsapi.dll:

DnsQuery_A
DnsQuery_W

The Virus installs the following user-mode hooks in WS2_32.dll:

GetAddrInfoW

The Virus installs the following user-mode hooks in kernel32.dll:

MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA

The Virus installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.A worm can spread its copies through the MSN Messanger.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
WINMINE.EXE:2556
NOTEPAD.EXE:2268
NOTEPAD.EXE:2588
6bc954b988e55bf67797604aa526c94f.exe:1576
6bc954b988e55bf67797604aa526c94f.exe:136
netsh.exe:696
netsh.exe:1752
Delete the original Virus file.
Delete or disinfect the following files created/modified by the Virus:
%WinDir%\system.ini (72 bytes)
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps