PE_SALITY.EM

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It disables Task Manager, Registry Editor, and Folder Options.

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This file infector drops the following copies of itself into the affected system:

• %User Temp%\0000a587_rar\{malware file name}

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %User Temp%\0000A587_Rar

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This file infector deletes the following files:

• %User Temp%\nsf1.tmp
• %User Temp%\jlfa.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\policies\
system

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc

HKEY_CURRENT_USER\Software\Administrator914\
-993627007

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:enabled:ipsec"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
1768776769 = "f4"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
-757413758 = "0"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
1011363011 = "0"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
-1514827516 = "23"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
253949253 = "138"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
2022726022 = "{random characters}"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
-503464505 = "{random characters}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\userinit.exe = "%System%\userinit.exe:*:Enabled:ipsec"

HKEY_CURRENT_USER\Software\Administrator914
A1_0 = "12da4c5e"

HKEY_CURRENT_USER\Software\Administrator914
A2_0 = "6cf"

HKEY_CURRENT_USER\Software\Administrator914
A3_0 = "136a29"

HKEY_CURRENT_USER\Software\Administrator914
A4_0 = "0"

HKEY_CURRENT_USER\Software\Administrator914
A1_1 = "b1a3281f"

HKEY_CURRENT_USER\Software\Administrator914
A2_1 = "696d628e"

HKEY_CURRENT_USER\Software\Administrator914
A3_1 = "686ee68"

HKEY_CURRENT_USER\Software\Administrator914
A4_1 = "696d6441"

HKEY_CURRENT_USER\Software\Administrator914
A1_2 = "847a46c9"

HKEY_CURRENT_USER\Software\Administrator914
A2_2 = "d2dada77"

HKEY_CURRENT_USER\Software\Administrator914
A3_2 = "d3d9a2ab"

HKEY_CURRENT_USER\Software\Administrator914
A4_2 = "d2dac882"

HKEY_CURRENT_USER\Software\Administrator914
A1_3 = "5f719a9c"

HKEY_CURRENT_USER\Software\Administrator914
A2_3 = "3c48355d"

HKEY_CURRENT_USER\Software\Administrator914
A3_3 = "3d4b46ea"

HKEY_CURRENT_USER\Software\Administrator914
A4_3 = "3c482cc3"

HKEY_CURRENT_USER\Software\Administrator914
A1_4 = "b141a4a"

HKEY_CURRENT_USER\Software\Administrator914
A2_4 = "a5b586c1"

HKEY_CURRENT_USER\Software\Administrator914
A3_4 = "a4b6fb2d"

HKEY_CURRENT_USER\Software\Administrator914
A4_4 = "a5b5914"

HKEY_CURRENT_USER\Software\Administrator914
A1_5 = "fe5fbcf5"

HKEY_CURRENT_USER\Software\Administrator914
A2_5 = "f22e26"

HKEY_CURRENT_USER\Software\Administrator914
A3_5 = "e219f6c"

HKEY_CURRENT_USER\Software\Administrator914
A4_5 = "f22f545"

HKEY_CURRENT_USER\Software\Administrator914
A1_6 = "b5b3d9c8"

HKEY_CURRENT_USER\Software\Administrator914
A2_6 = "7894bf6"

HKEY_CURRENT_USER\Software\Administrator914
A3_6 = "799333af"

HKEY_CURRENT_USER\Software\Administrator914
A4_6 = "7895986"

HKEY_CURRENT_USER\Software\Administrator914
A1_7 = "2f5cc382"

HKEY_CURRENT_USER\Software\Administrator914
A2_7 = "e1fda669"

HKEY_CURRENT_USER\Software\Administrator914
A3_7 = "efed7ee"

HKEY_CURRENT_USER\Software\Administrator914
A4_7 = "e1fdbdc7"

HKEY_CURRENT_USER\Software\Administrator914
A1_8 = "c8ece1c"

HKEY_CURRENT_USER\Software\Administrator914
A2_8 = "4b6b3656"

HKEY_CURRENT_USER\Software\Administrator914
A3_8 = "4a684821"

HKEY_CURRENT_USER\Software\Administrator914
A4_8 = "4b6b228"

HKEY_CURRENT_USER\Software\Administrator914
A1_9 = "4ce11dfb"

HKEY_CURRENT_USER\Software\Administrator914
A2_9 = "b4d896e"

HKEY_CURRENT_USER\Software\Administrator914
A3_9 = "b5dbec6"

HKEY_CURRENT_USER\Software\Administrator914
A4_9 = "b4d88649"

HKEY_CURRENT_USER\Software\Administrator914
A1_10 = "61498d6"

HKEY_CURRENT_USER\Software\Administrator914
A2_10 = "1e45fccd"

HKEY_CURRENT_USER\Software\Administrator914
A3_10 = "1f468a3"

HKEY_CURRENT_USER\Software\Administrator914
A4_10 = "1e45ea8a"

HKEY_CURRENT_USER\Software\Administrator914
A1_11 = "11529679"

HKEY_CURRENT_USER\Software\Administrator914
A2_11 = "87b35667"

HKEY_CURRENT_USER\Software\Administrator914
A3_11 = "86b24e2"

HKEY_CURRENT_USER\Software\Administrator914
A4_11 = "87b34ecb"

HKEY_CURRENT_USER\Software\Administrator914
A1_12 = "7e8f251"

HKEY_CURRENT_USER\Software\Administrator914
A2_12 = "f12ab53"

HKEY_CURRENT_USER\Software\Administrator914
A3_12 = "f23d925"

HKEY_CURRENT_USER\Software\Administrator914
A4_12 = "f12b3c"

HKEY_CURRENT_USER\Software\Administrator914
A1_13 = "42e83a14"

HKEY_CURRENT_USER\Software\Administrator914
A2_13 = "5a8efb4"

HKEY_CURRENT_USER\Software\Administrator914
A3_13 = "5b8d7d64"

HKEY_CURRENT_USER\Software\Administrator914
A4_13 = "5a8e174d"

HKEY_CURRENT_USER\Software\Administrator914
A1_14 = "6621b7fe"

HKEY_CURRENT_USER\Software\Administrator914
A2_14 = "c3fb622"

HKEY_CURRENT_USER\Software\Administrator914
A3_14 = "c2f811a7"

HKEY_CURRENT_USER\Software\Administrator914
A4_14 = "c3fb7b8e"

HKEY_CURRENT_USER\Software\Administrator914
A1_15 = "6ae1a59a"

HKEY_CURRENT_USER\Software\Administrator914
A2_15 = "2d68ce21"

HKEY_CURRENT_USER\Software\Administrator914
A3_15 = "2c6bb5e6"

HKEY_CURRENT_USER\Software\Administrator914
A4_15 = "2d68dfcf"

HKEY_CURRENT_USER\Software\Administrator914
A1_16 = "9ca24c9"

HKEY_CURRENT_USER\Software\Administrator914
A2_16 = "96d6516c"

HKEY_CURRENT_USER\Software\Administrator914
A3_16 = "97d52e39"

HKEY_CURRENT_USER\Software\Administrator914
A4_16 = "96d6441"

HKEY_CURRENT_USER\Software\Administrator914
A1_17 = "d3a5dec"

HKEY_CURRENT_USER\Software\Administrator914
A2_17 = "43b215"

HKEY_CURRENT_USER\Software\Administrator914
A3_17 = "14c278"

HKEY_CURRENT_USER\Software\Administrator914
A4_17 = "43a851"

HKEY_CURRENT_USER\Software\Administrator914
A1_18 = "3839429"

HKEY_CURRENT_USER\Software\Administrator914
A2_18 = "69b114e6"

HKEY_CURRENT_USER\Software\Administrator914
A3_18 = "68b266bb"

HKEY_CURRENT_USER\Software\Administrator914
A4_18 = "69b1c92"

HKEY_CURRENT_USER\Software\Administrator914
A1_19 = "8aebb6d"

HKEY_CURRENT_USER\Software\Administrator914
A2_19 = "d31e6e2e"

HKEY_CURRENT_USER\Software\Administrator914
A3_19 = "d21d1afa"

HKEY_CURRENT_USER\Software\Administrator914
A4_19 = "d31e7d3"

HKEY_CURRENT_USER\Software\Administrator914
A1_20 = "98ddbb"

HKEY_CURRENT_USER\Software\Administrator914
A2_20 = "3c8bccba"

HKEY_CURRENT_USER\Software\Administrator914
A3_20 = "3d88bf3d"

HKEY_CURRENT_USER\Software\Administrator914
A4_20 = "3c8bd514"

HKEY_CURRENT_USER\Software\Administrator914
A1_21 = "c521c9b"

HKEY_CURRENT_USER\Software\Administrator914
A2_21 = "a5f92374"

HKEY_CURRENT_USER\Software\Administrator914
A3_21 = "a4fa537c"

HKEY_CURRENT_USER\Software\Administrator914
A4_21 = "a5f93955"

HKEY_CURRENT_USER\Software\Administrator914
A1_22 = "ceb46324"

HKEY_CURRENT_USER\Software\Administrator914
A2_22 = "f668675"

HKEY_CURRENT_USER\Software\Administrator914
A3_22 = "e65f7bf"

HKEY_CURRENT_USER\Software\Administrator914
A4_22 = "f669d96"

HKEY_CURRENT_USER\Software\Administrator914
A1_23 = "56e14e6a"

HKEY_CURRENT_USER\Software\Administrator914
A2_23 = "78d41cf8"

HKEY_CURRENT_USER\Software\Administrator914
A3_23 = "79d76bfe"

HKEY_CURRENT_USER\Software\Administrator914
A4_23 = "78d41d7"

HKEY_CURRENT_USER\Software\Administrator914
A1_24 = "524b7a4"

HKEY_CURRENT_USER\Software\Administrator914
A2_24 = "e241758"

HKEY_CURRENT_USER\Software\Administrator914
A3_24 = "e342c31"

HKEY_CURRENT_USER\Software\Administrator914
A4_24 = "e2416618"

HKEY_CURRENT_USER\Software\Administrator914
A1_25 = "2b9339"

HKEY_CURRENT_USER\Software\Administrator914
A2_25 = "4baede86"

HKEY_CURRENT_USER\Software\Administrator914
A3_25 = "4aada7"

HKEY_CURRENT_USER\Software\Administrator914
A4_25 = "4baeca59"

HKEY_CURRENT_USER\Software\Administrator914
A1_26 = "adda762"

HKEY_CURRENT_USER\Software\Administrator914
A2_26 = "b51c381"

HKEY_CURRENT_USER\Software\Administrator914
A3_26 = "b41f44b3"

HKEY_CURRENT_USER\Software\Administrator914
A4_26 = "b51c2e9a"

HKEY_CURRENT_USER\Software\Administrator914
A1_27 = "b45a8c95"

HKEY_CURRENT_USER\Software\Administrator914
A2_27 = "1e8988ef"

HKEY_CURRENT_USER\Software\Administrator914
A3_27 = "1f8af8f2"

HKEY_CURRENT_USER\Software\Administrator914
A4_27 = "1e8992db"

HKEY_CURRENT_USER\Software\Administrator914
A1_28 = "52476943"

HKEY_CURRENT_USER\Software\Administrator914
A2_28 = "87f6e123"

HKEY_CURRENT_USER\Software\Administrator914
A3_28 = "86f59d35"

HKEY_CURRENT_USER\Software\Administrator914
A4_28 = "87f6f71c"

HKEY_CURRENT_USER\Software\Administrator914
A1_29 = "a3a2b51"

HKEY_CURRENT_USER\Software\Administrator914
A2_29 = "f1644257"

HKEY_CURRENT_USER\Software\Administrator914
A3_29 = "f673174"

HKEY_CURRENT_USER\Software\Administrator914
A4_29 = "f1645b5d"

HKEY_CURRENT_USER\Software\Administrator914
A1_30 = "698b9cc7"

HKEY_CURRENT_USER\Software\Administrator914
A2_30 = "5ad1a465"

HKEY_CURRENT_USER\Software\Administrator914
A3_30 = "5bd2d5b7"

HKEY_CURRENT_USER\Software\Administrator914
A4_30 = "5ad1bf9e"

HKEY_CURRENT_USER\Software\Administrator914
A1_31 = "36628c"

HKEY_CURRENT_USER\Software\Administrator914
A2_31 = "c43f3598"

HKEY_CURRENT_USER\Software\Administrator914
A3_31 = "c53c49f6"

HKEY_CURRENT_USER\Software\Administrator914
A4_31 = "c43f23df"

HKEY_CURRENT_USER\Software\Administrator914
A1_32 = "7f7ac772"

HKEY_CURRENT_USER\Software\Administrator914
A2_32 = "2dac99be"

HKEY_CURRENT_USER\Software\Administrator914
A3_32 = "2cafe29"

HKEY_CURRENT_USER\Software\Administrator914
A4_32 = "2dac882"

HKEY_CURRENT_USER\Software\Administrator914
A1_33 = "d2ae1ddd"

HKEY_CURRENT_USER\Software\Administrator914
A2_33 = "9719faa9"

HKEY_CURRENT_USER\Software\Administrator914
A3_33 = "961a8648"

HKEY_CURRENT_USER\Software\Administrator914
A4_33 = "9719ec61"

HKEY_CURRENT_USER\Software\Administrator914
A1_34 = "1762afc"

HKEY_CURRENT_USER\Software\Administrator914
A2_34 = "8747fa"

HKEY_CURRENT_USER\Software\Administrator914
A3_34 = "1843a8b"

HKEY_CURRENT_USER\Software\Administrator914
A4_34 = "875a2"

HKEY_CURRENT_USER\Software\Administrator914
A1_35 = "c1d8c3b4"

HKEY_CURRENT_USER\Software\Administrator914
A2_35 = "69f4a77b"

HKEY_CURRENT_USER\Software\Administrator914
A3_35 = "68f7deca"

HKEY_CURRENT_USER\Software\Administrator914
A4_35 = "69f4b4e3"

HKEY_CURRENT_USER\Software\Administrator914
A1_36 = "96cef77"

HKEY_CURRENT_USER\Software\Administrator914
A2_36 = "d362c9c"

HKEY_CURRENT_USER\Software\Administrator914
A3_36 = "d26173d"

HKEY_CURRENT_USER\Software\Administrator914
A4_36 = "d3621924"

HKEY_CURRENT_USER\Software\Administrator914
A1_37 = "9981524b"

HKEY_CURRENT_USER\Software\Administrator914
A2_37 = "3ccf6875"

HKEY_CURRENT_USER\Software\Administrator914
A3_37 = "3dcc174c"

HKEY_CURRENT_USER\Software\Administrator914
A4_37 = "3ccf7d65"

HKEY_CURRENT_USER\Software\Administrator914
A1_38 = "fc24ccff"

HKEY_CURRENT_USER\Software\Administrator914
A2_38 = "a63cf2b6"

HKEY_CURRENT_USER\Software\Administrator914
A3_38 = "a73f8b8f"

HKEY_CURRENT_USER\Software\Administrator914
A4_38 = "a63ce1a6"

HKEY_CURRENT_USER\Software\Administrator914
A1_39 = "fd3e9b"

HKEY_CURRENT_USER\Software\Administrator914
A2_39 = "faa5c79"

HKEY_CURRENT_USER\Software\Administrator914
A3_39 = "ea92fce"

HKEY_CURRENT_USER\Software\Administrator914
A4_39 = "faa45e7"

HKEY_CURRENT_USER\Software\Administrator914
A1_40 = "cd6ba894"

HKEY_CURRENT_USER\Software\Administrator914
A2_40 = "7917bec"

HKEY_CURRENT_USER\Software\Administrator914
A3_40 = "7814c1"

HKEY_CURRENT_USER\Software\Administrator914
A4_40 = "7917aa28"

HKEY_CURRENT_USER\Software\Administrator914
A1_41 = "119743f"

HKEY_CURRENT_USER\Software\Administrator914
A2_41 = "e2851db5"

HKEY_CURRENT_USER\Software\Administrator914
A3_41 = "e386644"

HKEY_CURRENT_USER\Software\Administrator914
A4_41 = "e285e69"

HKEY_CURRENT_USER\Software\Administrator914
A1_42 = "1c3aeef4"

HKEY_CURRENT_USER\Software\Administrator914
A2_42 = "4bf26ee2"

HKEY_CURRENT_USER\Software\Administrator914
A3_42 = "4af11883"

HKEY_CURRENT_USER\Software\Administrator914
A4_42 = "4bf272aa"

HKEY_CURRENT_USER\Software\Administrator914
A1_43 = "23975457"

HKEY_CURRENT_USER\Software\Administrator914
A2_43 = "b55fceac"

HKEY_CURRENT_USER\Software\Administrator914
A3_43 = "b45cbcc2"

HKEY_CURRENT_USER\Software\Administrator914
A4_43 = "b55fd6eb"

HKEY_CURRENT_USER\Software\Administrator914
A1_44 = "b267a79e"

HKEY_CURRENT_USER\Software\Administrator914
A2_44 = "1ecd295c"

HKEY_CURRENT_USER\Software\Administrator914
A3_44 = "1fce515"

HKEY_CURRENT_USER\Software\Administrator914
A4_44 = "1ecd3b2c"

HKEY_CURRENT_USER\Software\Administrator914
A1_45 = "6a6f3e34"

HKEY_CURRENT_USER\Software\Administrator914
A2_45 = "883a88cf"

HKEY_CURRENT_USER\Software\Administrator914
A3_45 = "8939f544"

HKEY_CURRENT_USER\Software\Administrator914
A4_45 = "883a9f6d"

HKEY_CURRENT_USER\Software\Administrator914
A1_46 = "2fb37fe1"

HKEY_CURRENT_USER\Software\Administrator914
A2_46 = "f1a814ed"

HKEY_CURRENT_USER\Software\Administrator914
A3_46 = "fab6987"

HKEY_CURRENT_USER\Software\Administrator914
A4_46 = "f1a83ae"

HKEY_CURRENT_USER\Software\Administrator914
A1_47 = "6c3435f"

HKEY_CURRENT_USER\Software\Administrator914
A2_47 = "5b157b7f"

HKEY_CURRENT_USER\Software\Administrator914
A3_47 = "5a16dc6"

HKEY_CURRENT_USER\Software\Administrator914
A4_47 = "5b1567ef"

HKEY_CURRENT_USER\Software\Administrator914
A1_48 = "5aaeff8"

HKEY_CURRENT_USER\Software\Administrator914
A2_48 = "c482d1c"

HKEY_CURRENT_USER\Software\Administrator914
A3_48 = "c581a619"

HKEY_CURRENT_USER\Software\Administrator914
A4_48 = "c482cc3"

HKEY_CURRENT_USER\Software\Administrator914
A1_49 = "57287cb8"

HKEY_CURRENT_USER\Software\Administrator914
A2_49 = "2df25b"

HKEY_CURRENT_USER\Software\Administrator914
A3_49 = "2cf35a58"

HKEY_CURRENT_USER\Software\Administrator914
A4_49 = "2df371"

HKEY_CURRENT_USER\Software\Administrator914
A1_50 = "ffe124ec"

HKEY_CURRENT_USER\Software\Administrator914
A2_50 = "975d8d1c"

HKEY_CURRENT_USER\Software\Administrator914
A3_50 = "965efe9b"

HKEY_CURRENT_USER\Software\Administrator914
A4_50 = "975d94b2"

HKEY_CURRENT_USER\Software\Administrator914
A1_51 = "bd2db49"

HKEY_CURRENT_USER\Software\Administrator914
A2_51 = "cae575"

HKEY_CURRENT_USER\Software\Administrator914
A3_51 = "1c992da"

HKEY_CURRENT_USER\Software\Administrator914
A4_51 = "caf8f3"

HKEY_CURRENT_USER\Software\Administrator914
A1_52 = "764dfd59"

HKEY_CURRENT_USER\Software\Administrator914
A2_52 = "6a384a77"

HKEY_CURRENT_USER\Software\Administrator914
A3_52 = "6b3b371d"

HKEY_CURRENT_USER\Software\Administrator914
A4_52 = "6a385d34"

HKEY_CURRENT_USER\Software\Administrator914
A1_53 = "8582472e"

HKEY_CURRENT_USER\Software\Administrator914
A2_53 = "d3a5d95b"

HKEY_CURRENT_USER\Software\Administrator914
A3_53 = "d2a6ab5c"

HKEY_CURRENT_USER\Software\Administrator914
A4_53 = "d3a5c175"

HKEY_CURRENT_USER\Software\Administrator914
A1_54 = "7c25ce3"

HKEY_CURRENT_USER\Software\Administrator914
A2_54 = "3d1331f"

HKEY_CURRENT_USER\Software\Administrator914
A3_54 = "3c14f9f"

HKEY_CURRENT_USER\Software\Administrator914
A4_54 = "3d1325b6"

HKEY_CURRENT_USER\Software\Administrator914
A1_55 = "ae4f3ba"

HKEY_CURRENT_USER\Software\Administrator914
A2_55 = "a689ff3"

HKEY_CURRENT_USER\Software\Administrator914
A3_55 = "a783e3de"

HKEY_CURRENT_USER\Software\Administrator914
A4_55 = "a6889f7"

HKEY_CURRENT_USER\Software\Administrator914
A1_56 = "2bfc875"

HKEY_CURRENT_USER\Software\Administrator914
A2_56 = "fedf8e8"

HKEY_CURRENT_USER\Software\Administrator914
A3_56 = "eee8411"

HKEY_CURRENT_USER\Software\Administrator914
A4_56 = "fedee38"

HKEY_CURRENT_USER\Software\Administrator914
A1_57 = "4467c2"

HKEY_CURRENT_USER\Software\Administrator914
A2_57 = "795b499"

HKEY_CURRENT_USER\Software\Administrator914
A3_57 = "7858385"

HKEY_CURRENT_USER\Software\Administrator914
A4_57 = "795b5279"

HKEY_CURRENT_USER\Software\Administrator914
A1_58 = "621dd6e"

HKEY_CURRENT_USER\Software\Administrator914
A2_58 = "e2c8a24"

HKEY_CURRENT_USER\Software\Administrator914
A3_58 = "e3cbdc93"

HKEY_CURRENT_USER\Software\Administrator914
A4_58 = "e2c8b6ba"

HKEY_CURRENT_USER\Software\Administrator914
A1_59 = "1d69ba96"

HKEY_CURRENT_USER\Software\Administrator914
A2_59 = "4c366f9"

HKEY_CURRENT_USER\Software\Administrator914
A3_59 = "4d357d2"

HKEY_CURRENT_USER\Software\Administrator914
A4_59 = "4c361afb"

HKEY_CURRENT_USER\Software\Administrator914
A1_60 = "349e1912"

HKEY_CURRENT_USER\Software\Administrator914
A2_60 = "b5a3656e"

HKEY_CURRENT_USER\Software\Administrator914
A3_60 = "b4a1515"

HKEY_CURRENT_USER\Software\Administrator914
A4_60 = "b5a37f3c"

HKEY_CURRENT_USER\Software\Administrator914
A1_61 = "6b79cc1"

HKEY_CURRENT_USER\Software\Administrator914
A2_61 = "1f1f8ed"

HKEY_CURRENT_USER\Software\Administrator914
A3_61 = "1e138954"

HKEY_CURRENT_USER\Software\Administrator914
A4_61 = "1f1e37d"

HKEY_CURRENT_USER\Software\Administrator914
A1_62 = "69a8d874"

HKEY_CURRENT_USER\Software\Administrator914
A2_62 = "887e531e"

HKEY_CURRENT_USER\Software\Administrator914
A3_62 = "897d2d97"

HKEY_CURRENT_USER\Software\Administrator914
A4_62 = "887e47be"

HKEY_CURRENT_USER\Software\Administrator914
A1_63 = "cabed1a9"

HKEY_CURRENT_USER\Software\Administrator914
A2_63 = "f1ebb55b"

HKEY_CURRENT_USER\Software\Administrator914
A3_63 = "fe8c1d6"

HKEY_CURRENT_USER\Software\Administrator914
A4_63 = "f1ebabff"

HKEY_CURRENT_USER\Software\Administrator914
A1_64 = "de8359f"

HKEY_CURRENT_USER\Software\Administrator914
A2_64 = "5b593d8"

HKEY_CURRENT_USER\Software\Administrator914
A3_64 = "5a5a7a69"

HKEY_CURRENT_USER\Software\Administrator914
A4_64 = "5b5914"

HKEY_CURRENT_USER\Software\Administrator914
A1_65 = "c54f4a"

HKEY_CURRENT_USER\Software\Administrator914
A2_65 = "c4c66d65"

HKEY_CURRENT_USER\Software\Administrator914
A3_65 = "c5c51ea8"

HKEY_CURRENT_USER\Software\Administrator914
A4_65 = "c4c67481"

HKEY_CURRENT_USER\Software\Administrator914
A1_66 = "25b572dd"

HKEY_CURRENT_USER\Software\Administrator914
A2_66 = "2e33c184"

HKEY_CURRENT_USER\Software\Administrator914
A3_66 = "2f3b2eb"

HKEY_CURRENT_USER\Software\Administrator914
A4_66 = "2e33d8c2"

HKEY_CURRENT_USER\Software\Administrator914
A1_67 = "6933d357"

HKEY_CURRENT_USER\Software\Administrator914
A2_67 = "97a12437"

HKEY_CURRENT_USER\Software\Administrator914
A3_67 = "96a2572a"

HKEY_CURRENT_USER\Software\Administrator914
A4_67 = "97a13d3"

HKEY_CURRENT_USER\Software\Administrator914
A1_68 = "82f3a186"

HKEY_CURRENT_USER\Software\Administrator914
A2_68 = "1eb654"

HKEY_CURRENT_USER\Software\Administrator914
A3_68 = "dcb6d"

HKEY_CURRENT_USER\Software\Administrator914
A4_68 = "1ea144"

HKEY_CURRENT_USER\Software\Administrator914
A1_69 = "971fcde8"

HKEY_CURRENT_USER\Software\Administrator914
A2_69 = "6a7c1425"

HKEY_CURRENT_USER\Software\Administrator914
A3_69 = "6b7f6fac"

HKEY_CURRENT_USER\Software\Administrator914
A4_69 = "6a7c585"

HKEY_CURRENT_USER\Software\Administrator914
A1_70 = "91cb8557"

HKEY_CURRENT_USER\Software\Administrator914
A2_70 = "d3e97df6"

HKEY_CURRENT_USER\Software\Administrator914
A3_70 = "d2ea3ef"

HKEY_CURRENT_USER\Software\Administrator914
A4_70 = "d3e969c6"

HKEY_CURRENT_USER\Software\Administrator914
A1_71 = "15d1555a"

HKEY_CURRENT_USER\Software\Administrator914
A2_71 = "3d56d8cf"

HKEY_CURRENT_USER\Software\Administrator914
A3_71 = "3c55a42e"

HKEY_CURRENT_USER\Software\Administrator914
A4_71 = "3d56ce7"

HKEY_CURRENT_USER\Software\Administrator914
A1_72 = "428e4e7"

HKEY_CURRENT_USER\Software\Administrator914
A2_72 = "a6c42a4e"

HKEY_CURRENT_USER\Software\Administrator914
A3_72 = "a7c75861"

HKEY_CURRENT_USER\Software\Administrator914
A4_72 = "a6c43248"

HKEY_CURRENT_USER\Software\Administrator914
A1_73 = "4119d7cf"

HKEY_CURRENT_USER\Software\Administrator914
A2_73 = "131818b"

HKEY_CURRENT_USER\Software\Administrator914
A3_73 = "1132fca"

HKEY_CURRENT_USER\Software\Administrator914
A4_73 = "1319689"

HKEY_CURRENT_USER\Software\Administrator914
A1_74 = "ddebd29e"

HKEY_CURRENT_USER\Software\Administrator914
A2_74 = "799ee975"

HKEY_CURRENT_USER\Software\Administrator914
A3_74 = "789d9e3"

HKEY_CURRENT_USER\Software\Administrator914
A4_74 = "799efaca"

HKEY_CURRENT_USER\Software\Administrator914
A1_75 = "51fa1b9"

HKEY_CURRENT_USER\Software\Administrator914
A2_75 = "e3c4dd3"

HKEY_CURRENT_USER\Software\Administrator914
A3_75 = "e2f3522"

HKEY_CURRENT_USER\Software\Administrator914
A4_75 = "e3c5fb"

HKEY_CURRENT_USER\Software\Administrator914
A1_76 = "4bb8dd95"

HKEY_CURRENT_USER\Software\Administrator914
A2_76 = "4c79d7b6"

HKEY_CURRENT_USER\Software\Administrator914
A3_76 = "4d7aa965"

HKEY_CURRENT_USER\Software\Administrator914
A4_76 = "4c79c34c"

HKEY_CURRENT_USER\Software\Administrator914
A1_77 = "7f8d4"

HKEY_CURRENT_USER\Software\Administrator914
A2_77 = "b5e7351d"

HKEY_CURRENT_USER\Software\Administrator914
A3_77 = "b4e44da4"

HKEY_CURRENT_USER\Software\Administrator914
A4_77 = "b5e7278d"

HKEY_CURRENT_USER\Software\Administrator914
A1_78 = "dddcad97"

HKEY_CURRENT_USER\Software\Administrator914
A2_78 = "1f549fde"

HKEY_CURRENT_USER\Software\Administrator914
A3_78 = "1e57e1e7"

HKEY_CURRENT_USER\Software\Administrator914
A4_78 = "1f548bce"

HKEY_CURRENT_USER\Software\Administrator914
A1_79 = "a5ed8253"

HKEY_CURRENT_USER\Software\Administrator914
A2_79 = "88c1fc2e"

HKEY_CURRENT_USER\Software\Administrator914
A3_79 = "89c29a26"

HKEY_CURRENT_USER\Software\Administrator914
A4_79 = "88c1ff"

HKEY_CURRENT_USER\Software\Administrator914
A1_80 = "f8d3aaec"

HKEY_CURRENT_USER\Software\Administrator914
A2_80 = "f22f4248"

HKEY_CURRENT_USER\Software\Administrator914
A3_80 = "f32c3e79"

HKEY_CURRENT_USER\Software\Administrator914
A4_80 = "f22f545"

HKEY_CURRENT_USER\Software\Administrator914
A1_81 = "e1885ccf"

HKEY_CURRENT_USER\Software\Administrator914
A2_81 = "5b9cacec"

HKEY_CURRENT_USER\Software\Administrator914
A3_81 = "5a9fd2b8"

HKEY_CURRENT_USER\Software\Administrator914
A4_81 = "5b9cb891"

HKEY_CURRENT_USER\Software\Administrator914
A1_82 = "7ddbf49f"

HKEY_CURRENT_USER\Software\Administrator914
A2_82 = "c5ab5c"

HKEY_CURRENT_USER\Software\Administrator914
A3_82 = "c4976fb"

HKEY_CURRENT_USER\Software\Administrator914
A4_82 = "c5a1cd2"

HKEY_CURRENT_USER\Software\Administrator914
A1_83 = "7971a4e"

HKEY_CURRENT_USER\Software\Administrator914
A2_83 = "2e779819"

HKEY_CURRENT_USER\Software\Administrator914
A3_83 = "2f74eb3a"

HKEY_CURRENT_USER\Software\Administrator914
A4_83 = "2e778113"

HKEY_CURRENT_USER\Software\Administrator914
A1_84 = "a5d957b"

HKEY_CURRENT_USER\Software\Administrator914
A2_84 = "97e4fec"

HKEY_CURRENT_USER\Software\Administrator914
A3_84 = "96e78f7d"

HKEY_CURRENT_USER\Software\Administrator914
A4_84 = "97e4e554"

HKEY_CURRENT_USER\Software\Administrator914
A1_85 = "78935e94"

HKEY_CURRENT_USER\Software\Administrator914
A2_85 = "1525a5d"

HKEY_CURRENT_USER\Software\Administrator914
A3_85 = "5123bc"

HKEY_CURRENT_USER\Software\Administrator914
A4_85 = "1524995"

HKEY_CURRENT_USER\Software\Administrator914
A1_86 = "42c1fabb"

HKEY_CURRENT_USER\Software\Administrator914
A2_86 = "6abfa4e"

HKEY_CURRENT_USER\Software\Administrator914
A3_86 = "6bbcc7ff"

HKEY_CURRENT_USER\Software\Administrator914
A4_86 = "6abfadd6"

HKEY_CURRENT_USER\Software\Administrator914
A1_87 = "6ea7bedc"

HKEY_CURRENT_USER\Software\Administrator914
A2_87 = "d42dab5"

HKEY_CURRENT_USER\Software\Administrator914
A3_87 = "d52e783e"

HKEY_CURRENT_USER\Software\Administrator914
A4_87 = "d42d1217"

HKEY_CURRENT_USER\Software\Administrator914
A1_88 = "a9834976"

HKEY_CURRENT_USER\Software\Administrator914
A2_88 = "3d9a6ea1"

HKEY_CURRENT_USER\Software\Administrator914
A3_88 = "3c991c71"

HKEY_CURRENT_USER\Software\Administrator914
A4_88 = "3d9a7658"

HKEY_CURRENT_USER\Software\Administrator914
A1_89 = "1b699527"

HKEY_CURRENT_USER\Software\Administrator914
A2_89 = "a77c3e1"

HKEY_CURRENT_USER\Software\Administrator914
A3_89 = "a64bb"

HKEY_CURRENT_USER\Software\Administrator914
A4_89 = "a77da99"

HKEY_CURRENT_USER\Software\Administrator914
A1_90 = "d53c7187"

HKEY_CURRENT_USER\Software\Administrator914
A2_90 = "17524a6"

HKEY_CURRENT_USER\Software\Administrator914
A3_90 = "117654f3"

HKEY_CURRENT_USER\Software\Administrator914
A4_90 = "1753eda"

HKEY_CURRENT_USER\Software\Administrator914
A1_91 = "6f175345"

HKEY_CURRENT_USER\Software\Administrator914
A2_91 = "79e2be9d"

HKEY_CURRENT_USER\Software\Administrator914
A3_91 = "78e1c932"

HKEY_CURRENT_USER\Software\Administrator914
A4_91 = "79e2a31b"

HKEY_CURRENT_USER\Software\Administrator914
A1_92 = "a2b6f3"

HKEY_CURRENT_USER\Software\Administrator914
A2_92 = "e35163"

HKEY_CURRENT_USER\Software\Administrator914
A3_92 = "e2536d75"

HKEY_CURRENT_USER\Software\Administrator914
A4_92 = "e3575c"

HKEY_CURRENT_USER\Software\Administrator914
A1_93 = "b9e4afcc"

HKEY_CURRENT_USER\Software\Administrator914
A2_93 = "4cbd7c3d"

HKEY_CURRENT_USER\Software\Administrator914
A3_93 = "4dbe1b4"

HKEY_CURRENT_USER\Software\Administrator914
A4_93 = "4cbd6b9d"

HKEY_CURRENT_USER\Software\Administrator914
A1_94 = "9fe4bd83"

HKEY_CURRENT_USER\Software\Administrator914
A2_94 = "b62adeb2"

HKEY_CURRENT_USER\Software\Administrator914
A3_94 = "b729a5f7"

HKEY_CURRENT_USER\Software\Administrator914
A4_94 = "b62acfde"

HKEY_CURRENT_USER\Software\Administrator914
A1_95 = "6bc35c4"

HKEY_CURRENT_USER\Software\Administrator914
A2_95 = "1f9822ad"

HKEY_CURRENT_USER\Software\Administrator914
A3_95 = "1e9b5e36"

HKEY_CURRENT_USER\Software\Administrator914
A4_95 = "1f98341f"

HKEY_CURRENT_USER\Software\Administrator914
A1_96 = "374cfe4e"

HKEY_CURRENT_USER\Software\Administrator914
A2_96 = "8958d3d"

HKEY_CURRENT_USER\Software\Administrator914
A3_96 = "886f249"

HKEY_CURRENT_USER\Software\Administrator914
A4_96 = "895986"

HKEY_CURRENT_USER\Software\Administrator914
A1_97 = "c5bfe278"

HKEY_CURRENT_USER\Software\Administrator914
A2_97 = "f272e888"

HKEY_CURRENT_USER\Software\Administrator914
A3_97 = "f3719688"

HKEY_CURRENT_USER\Software\Administrator914
A4_97 = "f272fca1"

HKEY_CURRENT_USER\Software\Administrator914
A1_98 = "52e21ac"

HKEY_CURRENT_USER\Software\Administrator914
A2_98 = "5be71e9"

HKEY_CURRENT_USER\Software\Administrator914
A3_98 = "5ae3acb"

HKEY_CURRENT_USER\Software\Administrator914
A4_98 = "5be6e2"

HKEY_CURRENT_USER\Software\Administrator914
A1_99 = "945d826e"

HKEY_CURRENT_USER\Software\Administrator914
A2_99 = "c54dd359"

HKEY_CURRENT_USER\Software\Administrator914
A3_99 = "c44eafa"

HKEY_CURRENT_USER\Software\Administrator914
A4_99 = "c54dc523"

HKEY_CURRENT_USER\Software\Administrator914
A1_100 = "f83f6d4"

HKEY_CURRENT_USER\Software\Administrator914
A2_100 = "2ebb3a9"

HKEY_CURRENT_USER\Software\Administrator914
A3_100 = "2fb8434d"

HKEY_CURRENT_USER\Software\Administrator914
A4_100 = "2ebb2964"

HKEY_CURRENT_USER\Software\Administrator914
A1_101 = "cc63edeb"

HKEY_CURRENT_USER\Software\Administrator914
A2_101 = "9828927"

HKEY_CURRENT_USER\Software\Administrator914
A3_101 = "992be78c"

HKEY_CURRENT_USER\Software\Administrator914
A4_101 = "98288da5"

HKEY_CURRENT_USER\Software\Administrator914
A1_102 = "14fcbeb4"

HKEY_CURRENT_USER\Software\Administrator914
A2_102 = "195e66"

HKEY_CURRENT_USER\Software\Administrator914
A3_102 = "969bcf"

HKEY_CURRENT_USER\Software\Administrator914
A4_102 = "195f1e6"

HKEY_CURRENT_USER\Software\Administrator914
A1_103 = "8892277a"

HKEY_CURRENT_USER\Software\Administrator914
A2_103 = "6b34f2d"

HKEY_CURRENT_USER\Software\Administrator914
A3_103 = "6a3ce"

HKEY_CURRENT_USER\Software\Administrator914
A4_103 = "6b35627"

HKEY_CURRENT_USER\Software\Administrator914
A1_104 = "227b1fda"

HKEY_CURRENT_USER\Software\Administrator914
A2_104 = "d47af14"

HKEY_CURRENT_USER\Software\Administrator914
A3_104 = "d573d41"

HKEY_CURRENT_USER\Software\Administrator914
A4_104 = "d47ba68"

HKEY_CURRENT_USER\Software\Administrator914
A1_105 = "8d1377ff"

HKEY_CURRENT_USER\Software\Administrator914
A2_105 = "3dde879"

HKEY_CURRENT_USER\Software\Administrator914
A3_105 = "3cdd748"

HKEY_CURRENT_USER\Software\Administrator914
A4_105 = "3dde1ea9"

HKEY_CURRENT_USER\Software\Administrator914
A1_106 = "4878a5a"

HKEY_CURRENT_USER\Software\Administrator914
A2_106 = "a74b9a2"

HKEY_CURRENT_USER\Software\Administrator914
A3_106 = "a648e8c3"

HKEY_CURRENT_USER\Software\Administrator914
A4_106 = "a74b82ea"

HKEY_CURRENT_USER\Software\Administrator914
A1_107 = "d6499176"

HKEY_CURRENT_USER\Software\Administrator914
A2_107 = "1b8f3f9"

HKEY_CURRENT_USER\Software\Administrator914
A3_107 = "11bb8d2"

HKEY_CURRENT_USER\Software\Administrator914
A4_107 = "1b8e72b"

HKEY_CURRENT_USER\Software\Administrator914
A1_108 = "6313ae35"

HKEY_CURRENT_USER\Software\Administrator914
A2_108 = "7a26537e"

HKEY_CURRENT_USER\Software\Administrator914
A3_108 = "7b252145"

HKEY_CURRENT_USER\Software\Administrator914
A4_108 = "7a264b6c"

HKEY_CURRENT_USER\Software\Administrator914
A1_109 = "b1db1ff3"

HKEY_CURRENT_USER\Software\Administrator914
A2_109 = "e393b8d"

HKEY_CURRENT_USER\Software\Administrator914
A3_109 = "e29c584"

HKEY_CURRENT_USER\Software\Administrator914
A4_109 = "e393afad"

HKEY_CURRENT_USER\Software\Administrator914
A1_110 = "158936b7"

HKEY_CURRENT_USER\Software\Administrator914
A2_110 = "4d1de2"

HKEY_CURRENT_USER\Software\Administrator914
A3_110 = "4c279c7"

HKEY_CURRENT_USER\Software\Administrator914
A4_110 = "4d113ee"

HKEY_CURRENT_USER\Software\Administrator914
A1_111 = "c778bf42"

HKEY_CURRENT_USER\Software\Administrator914
A2_111 = "b66e6ada"

HKEY_CURRENT_USER\Software\Administrator914
A3_111 = "b76d126"

HKEY_CURRENT_USER\Software\Administrator914
A4_111 = "b66e782f"

HKEY_CURRENT_USER\Software\Administrator914
A1_112 = "cb21b51d"

HKEY_CURRENT_USER\Software\Administrator914
A2_112 = "1fdbceed"

HKEY_CURRENT_USER\Software\Administrator914
A3_112 = "1ed8b659"

HKEY_CURRENT_USER\Software\Administrator914
A4_112 = "1fdbdc7"

HKEY_CURRENT_USER\Software\Administrator914
A1_113 = "d9723bfc"

HKEY_CURRENT_USER\Software\Administrator914
A2_113 = "89495774"

HKEY_CURRENT_USER\Software\Administrator914
A3_113 = "884a2a98"

HKEY_CURRENT_USER\Software\Administrator914
A4_113 = "89494b1"

HKEY_CURRENT_USER\Software\Administrator914
A1_114 = "e2afebc"

HKEY_CURRENT_USER\Software\Administrator914
A2_114 = "f2b6bb35"

HKEY_CURRENT_USER\Software\Administrator914
A3_114 = "f3b5cedb"

HKEY_CURRENT_USER\Software\Administrator914
A4_114 = "f2b6a4f2"

HKEY_CURRENT_USER\Software\Administrator914
A1_115 = "6aab86e"

HKEY_CURRENT_USER\Software\Administrator914
A2_115 = "5c241e93"

HKEY_CURRENT_USER\Software\Administrator914
A3_115 = "5d27631a"

HKEY_CURRENT_USER\Software\Administrator914
A4_115 = "5c24933"

HKEY_CURRENT_USER\Software\Administrator914
A1_116 = "d91bd3a"

HKEY_CURRENT_USER\Software\Administrator914
A2_116 = "c5914d4"

HKEY_CURRENT_USER\Software\Administrator914
A3_116 = "c49275d"

HKEY_CURRENT_USER\Software\Administrator914
A4_116 = "c5916d74"

HKEY_CURRENT_USER\Software\Administrator914
A1_117 = "c26da7fa"

HKEY_CURRENT_USER\Software\Administrator914
A2_117 = "2efec78a"

HKEY_CURRENT_USER\Software\Administrator914
A3_117 = "2ffdbb9c"

HKEY_CURRENT_USER\Software\Administrator914
A4_117 = "2efed1b5"

HKEY_CURRENT_USER\Software\Administrator914
A1_118 = "18a6ae"

HKEY_CURRENT_USER\Software\Administrator914
A2_118 = "986c97fe"

HKEY_CURRENT_USER\Software\Administrator914
A3_118 = "996f5fdf"

HKEY_CURRENT_USER\Software\Administrator914
A4_118 = "986c35f6"

HKEY_CURRENT_USER\Software\Administrator914
A1_119 = "fc94b19"

HKEY_CURRENT_USER\Software\Administrator914
A2_119 = "1d982d2"

HKEY_CURRENT_USER\Software\Administrator914
A3_119 = "daf1e"

HKEY_CURRENT_USER\Software\Administrator914
A4_119 = "1d99a37"

HKEY_CURRENT_USER\Software\Administrator914
A1_120 = "96e6a3b9"

HKEY_CURRENT_USER\Software\Administrator914
A2_120 = "6b4654bc"

HKEY_CURRENT_USER\Software\Administrator914
A3_120 = "6a459451"

HKEY_CURRENT_USER\Software\Administrator914
A4_120 = "6b46fe78"

HKEY_CURRENT_USER\Software\Administrator914
A1_121 = "f7481e4"

HKEY_CURRENT_USER\Software\Administrator914
A2_121 = "d4b477d1"

HKEY_CURRENT_USER\Software\Administrator914
A3_121 = "d5b789"

HKEY_CURRENT_USER\Software\Administrator914
A4_121 = "d4b462b9"

HKEY_CURRENT_USER\Software\Administrator914
A1_122 = "75ff6aa5"

HKEY_CURRENT_USER\Software\Administrator914
A2_122 = "3e21d2"

HKEY_CURRENT_USER\Software\Administrator914
A3_122 = "3f22acd3"

HKEY_CURRENT_USER\Software\Administrator914
A4_122 = "3e21c6fa"

HKEY_CURRENT_USER\Software\Administrator914
A1_123 = "4888c476"

HKEY_CURRENT_USER\Software\Administrator914
A2_123 = "a78f3d33"

HKEY_CURRENT_USER\Software\Administrator914
A3_123 = "a68c4112"

HKEY_CURRENT_USER\Software\Administrator914
A4_123 = "a78f2b3b"

HKEY_CURRENT_USER\Software\Administrator914
A1_124 = "5412e42a"

HKEY_CURRENT_USER\Software\Administrator914
A2_124 = "1fc9564"

HKEY_CURRENT_USER\Software\Administrator914
A3_124 = "11ffe555"

HKEY_CURRENT_USER\Software\Administrator914
A4_124 = "1fc8f7c"

HKEY_CURRENT_USER\Software\Administrator914
A1_125 = "8f81ef5"

HKEY_CURRENT_USER\Software\Administrator914
A2_125 = "7a69e9cd"

HKEY_CURRENT_USER\Software\Administrator914
A3_125 = "7b6a9994"

HKEY_CURRENT_USER\Software\Administrator914
A4_125 = "7a69f3bd"

HKEY_CURRENT_USER\Software\Administrator914
A1_126 = "87898637"

HKEY_CURRENT_USER\Software\Administrator914
A2_126 = "e3d745d1"

HKEY_CURRENT_USER\Software\Administrator914
A3_126 = "e2d43dd7"

HKEY_CURRENT_USER\Software\Administrator914
A4_126 = "e3d757fe"

HKEY_CURRENT_USER\Software\Administrator914
A1_127 = "5a2b22"

HKEY_CURRENT_USER\Software\Administrator914
A2_127 = "4d44ae77"

HKEY_CURRENT_USER\Software\Administrator914
A3_127 = "4c47d616"

HKEY_CURRENT_USER\Software\Administrator914
A4_127 = "4d44bc3f"

HKEY_CURRENT_USER\Software\Administrator914
A1_128 = "c1c6bfd2"

HKEY_CURRENT_USER\Software\Administrator914
A2_128 = "b6b22fa1"

HKEY_CURRENT_USER\Software\Administrator914
A3_128 = "b7b14aa9"

HKEY_CURRENT_USER\Software\Administrator914
A4_128 = "b6b228"

HKEY_CURRENT_USER\Software\Administrator914
A1_129 = "3bd5f87c"

HKEY_CURRENT_USER\Software\Administrator914
A2_129 = "21f97d9"

HKEY_CURRENT_USER\Software\Administrator914
A3_129 = "211ceee8"

HKEY_CURRENT_USER\Software\Administrator914
A4_129 = "21f84c1"

HKEY_CURRENT_USER\Software\Administrator914
A1_130 = "f55e112c"

HKEY_CURRENT_USER\Software\Administrator914
A2_130 = "898cfec7"

HKEY_CURRENT_USER\Software\Administrator914
A3_130 = "888f832b"

HKEY_CURRENT_USER\Software\Administrator914
A4_130 = "898ce92"

HKEY_CURRENT_USER\Software\Administrator914
A1_131 = "cc5ff96"

HKEY_CURRENT_USER\Software\Administrator914
A2_131 = "f2fa551c"

HKEY_CURRENT_USER\Software\Administrator914
A3_131 = "f3f9276a"

HKEY_CURRENT_USER\Software\Administrator914
A4_131 = "f2fa4d43"

HKEY_CURRENT_USER\Software\Administrator914
A1_132 = "b2defc3a"

HKEY_CURRENT_USER\Software\Administrator914
A2_132 = "5c67a5ac"

HKEY_CURRENT_USER\Software\Administrator914
A3_132 = "5d64dbad"

HKEY_CURRENT_USER\Software\Administrator914
A4_132 = "5c67b184"

HKEY_CURRENT_USER\Software\Administrator914
A1_133 = "5456c179"

HKEY_CURRENT_USER\Software\Administrator914
A2_133 = "c5d53f"

HKEY_CURRENT_USER\Software\Administrator914
A3_133 = "c4d67fec"

HKEY_CURRENT_USER\Software\Administrator914
A4_133 = "c5d515c5"

HKEY_CURRENT_USER\Software\Administrator914
A1_134 = "d5d62c3c"

HKEY_CURRENT_USER\Software\Administrator914
A2_134 = "2f426ace"

HKEY_CURRENT_USER\Software\Administrator914
A3_134 = "2e4112f"

HKEY_CURRENT_USER\Software\Administrator914
A4_134 = "2f427a6"

HKEY_CURRENT_USER\Software\Administrator914
A1_135 = "83896fa"

HKEY_CURRENT_USER\Software\Administrator914
A2_135 = "98afc465"

HKEY_CURRENT_USER\Software\Administrator914
A3_135 = "99acb46e"

HKEY_CURRENT_USER\Software\Administrator914
A4_135 = "98afde47"

HKEY_CURRENT_USER\Software\Administrator914
A1_136 = "24664dc"

HKEY_CURRENT_USER\Software\Administrator914
A2_136 = "21d5316"

HKEY_CURRENT_USER\Software\Administrator914
A3_136 = "31e28a1"

HKEY_CURRENT_USER\Software\Administrator914
A4_136 = "21d4288"

HKEY_CURRENT_USER\Software\Administrator914
A1_137 = "9d8b775"

HKEY_CURRENT_USER\Software\Administrator914
A2_137 = "6b8ab9e"

HKEY_CURRENT_USER\Software\Administrator914
A3_137 = "6a89cce"

HKEY_CURRENT_USER\Software\Administrator914
A4_137 = "6b8aa6c9"

HKEY_CURRENT_USER\Software\Administrator914
A1_138 = "5e4c8253"

HKEY_CURRENT_USER\Software\Administrator914
A2_138 = "d4f8182a"

HKEY_CURRENT_USER\Software\Administrator914
A3_138 = "d5fb6123"

HKEY_CURRENT_USER\Software\Administrator914
A4_138 = "d4f8ba"

HKEY_CURRENT_USER\Software\Administrator914
A1_139 = "eeff8525"

HKEY_CURRENT_USER\Software\Administrator914
A2_139 = "3e657d11"

HKEY_CURRENT_USER\Software\Administrator914
A3_139 = "3f66562"

HKEY_CURRENT_USER\Software\Administrator914
A4_139 = "3e656f4b"

HKEY_CURRENT_USER\Software\Administrator914
A1_140 = "3764d5"

HKEY_CURRENT_USER\Software\Administrator914
A2_140 = "a7d2dc4"

HKEY_CURRENT_USER\Software\Administrator914
A3_140 = "a6d1b9a5"

HKEY_CURRENT_USER\Software\Administrator914
A4_140 = "a7d2d38c"

HKEY_CURRENT_USER\Software\Administrator914
A1_141 = "1fabe94"

HKEY_CURRENT_USER\Software\Administrator914
A2_141 = "11423d6"

HKEY_CURRENT_USER\Software\Administrator914
A3_141 = "1435de4"

HKEY_CURRENT_USER\Software\Administrator914
A4_141 = "11437cd"

HKEY_CURRENT_USER\Software\Administrator914
A1_142 = "342c496c"

HKEY_CURRENT_USER\Software\Administrator914
A2_142 = "7aad8916"

HKEY_CURRENT_USER\Software\Administrator914
A3_142 = "7baef627"

HKEY_CURRENT_USER\Software\Administrator914
A4_142 = "7aad9ce"

HKEY_CURRENT_USER\Software\Administrator914
A1_143 = "58717a1a"

HKEY_CURRENT_USER\Software\Administrator914
A2_143 = "e41b1a9e"

HKEY_CURRENT_USER\Software\Administrator914
A3_143 = "e5186a66"

HKEY_CURRENT_USER\Software\Administrator914
A4_143 = "e41b4f"

HKEY_CURRENT_USER\Software\Administrator914
A1_144 = "773d5cd"

HKEY_CURRENT_USER\Software\Administrator914
A2_144 = "4d887fb1"

HKEY_CURRENT_USER\Software\Administrator914
A3_144 = "4c8beb9"

HKEY_CURRENT_USER\Software\Administrator914
A4_144 = "4d88649"

HKEY_CURRENT_USER\Software\Administrator914
A1_145 = "d7d8a387"

HKEY_CURRENT_USER\Software\Administrator914
A2_145 = "b6f5d2f3"

HKEY_CURRENT_USER\Software\Administrator914
A3_145 = "b7f6a2f8"

HKEY_CURRENT_USER\Software\Administrator914
A4_145 = "b6f5c8d1"

HKEY_CURRENT_USER\Software\Administrator914
A1_146 = "d366d4d"

HKEY_CURRENT_USER\Software\Administrator914
A2_146 = "2633e7a"

HKEY_CURRENT_USER\Software\Administrator914
A3_146 = "216473b"

HKEY_CURRENT_USER\Software\Administrator914
A4_146 = "2632d12"

HKEY_CURRENT_USER\Software\Administrator914
A1_147 = "453fbda"

HKEY_CURRENT_USER\Software\Administrator914
A2_147 = "89d876c"

HKEY_CURRENT_USER\Software\Administrator914
A3_147 = "88d3fb7a"

HKEY_CURRENT_USER\Software\Administrator914
A4_147 = "89d9153"

HKEY_CURRENT_USER\Software\Administrator914
A1_148 = "99574bca"

HKEY_CURRENT_USER\Software\Administrator914
A2_148 = "f33de234"

HKEY_CURRENT_USER\Software\Administrator914
A3_148 = "f23e9fbd"

HKEY_CURRENT_USER\Software\Administrator914
A4_148 = "f33df594"

HKEY_CURRENT_USER\Software\Administrator914
A1_149 = "2fbbf8a"

HKEY_CURRENT_USER\Software\Administrator914
A2_149 = "5cab4b11"

HKEY_CURRENT_USER\Software\Administrator914
A3_149 = "5da833fc"

HKEY_CURRENT_USER\Software\Administrator914
A4_149 = "5cab59d5"

HKEY_CURRENT_USER\Software\Administrator914
A1_150 = "9f9b9c4f"

HKEY_CURRENT_USER\Software\Administrator914
A2_150 = "c618a884"

HKEY_CURRENT_USER\Software\Administrator914
A3_150 = "c71bd43f"

HKEY_CURRENT_USER\Software\Administrator914
A4_150 = "c618be16"

HKEY_CURRENT_USER\Software\Administrator914
A1_151 = "94faf479"

HKEY_CURRENT_USER\Software\Administrator914
A2_151 = "2f86372b"

HKEY_CURRENT_USER\Software\Administrator914
A3_151 = "2e85487e"

HKEY_CURRENT_USER\Software\Administrator914
A4_151 = "2f862257"

HKEY_CURRENT_USER\Software\Administrator914
A1_152 = "bf487acf"

HKEY_CURRENT_USER\Software\Administrator914
A2_152 = "98f392d4"

HKEY_CURRENT_USER\Software\Administrator914
A3_152 = "99fecb1"

HKEY_CURRENT_USER\Software\Administrator914
A4_152 = "98f38698"

HKEY_CURRENT_USER\Software\Administrator914
A1_153 = "1a14ab86"

HKEY_CURRENT_USER\Software\Administrator914
A2_153 = "26f951"

HKEY_CURRENT_USER\Software\Administrator914
A3_153 = "3638f"

HKEY_CURRENT_USER\Software\Administrator914
A4_153 = "26ead9"

HKEY_CURRENT_USER\Software\Administrator914
A1_154 = "717734c"

HKEY_CURRENT_USER\Software\Administrator914
A2_154 = "6bce575d"

HKEY_CURRENT_USER\Software\Administrator914
A3_154 = "6acd2533"

HKEY_CURRENT_USER\Software\Administrator914
A4_154 = "6bce4f1a"

HKEY_CURRENT_USER\Software\Administrator914
A1_155 = "f666692"

HKEY_CURRENT_USER\Software\Administrator914
A2_155 = "d53ba99"

HKEY_CURRENT_USER\Software\Administrator914
A3_155 = "d438d972"

HKEY_CURRENT_USER\Software\Administrator914
A4_155 = "d53bb35b"

HKEY_CURRENT_USER\Software\Administrator914
A1_156 = "41376d2"

HKEY_CURRENT_USER\Software\Administrator914
A2_156 = "3ea9db4"

HKEY_CURRENT_USER\Software\Administrator914
A3_156 = "3faa7db5"

HKEY_CURRENT_USER\Software\Administrator914
A4_156 = "3ea9179c"

HKEY_CURRENT_USER\Software\Administrator914
A1_157 = "33c76d9"

HKEY_CURRENT_USER\Software\Administrator914
A2_157 = "a8166e1d"

HKEY_CURRENT_USER\Software\Administrator914
A3_157 = "a91511f4"

HKEY_CURRENT_USER\Software\Administrator914
A4_157 = "a8167bdd"

HKEY_CURRENT_USER\Software\Administrator914
A1_158 = "b88ccf1"

HKEY_CURRENT_USER\Software\Administrator914
A2_158 = "1183f955"

HKEY_CURRENT_USER\Software\Administrator914
A3_158 = "188a37"

HKEY_CURRENT_USER\Software\Administrator914
A4_158 = "1183e1e"

HKEY_CURRENT_USER\Software\Administrator914
A1_159 = "ddc7b71"

HKEY_CURRENT_USER\Software\Administrator914
A2_159 = "7af156aa"

HKEY_CURRENT_USER\Software\Administrator914
A3_159 = "7bf22e76"

HKEY_CURRENT_USER\Software\Administrator914
A4_159 = "7af1445f"

HKEY_CURRENT_USER\Software\Administrator914
A1_160 = "a38b83ed"

HKEY_CURRENT_USER\Software\Administrator914
A2_160 = "e45ebc89"

HKEY_CURRENT_USER\Software\Administrator914
A3_160 = "e55dc289"

HKEY_CURRENT_USER\Software\Administrator914
A4_160 = "e45ea8a"

HKEY_CURRENT_USER\Software\Administrator914
A1_161 = "3bdb39bd"

HKEY_CURRENT_USER\Software\Administrator914
A2_161 = "4dcc16d5"

HKEY_CURRENT_USER\Software\Administrator914
A3_161 = "4ccf66c8"

HKEY_CURRENT_USER\Software\Administrator914
A4_161 = "4dccce1"

HKEY_CURRENT_USER\Software\Administrator914
A1_162 = "617a1974"

HKEY_CURRENT_USER\Software\Administrator914
A2_162 = "b7396b22"

HKEY_CURRENT_USER\Software\Administrator914
A3_162 = "b63a1bb"

HKEY_CURRENT_USER\Software\Administrator914
A4_162 = "b7397122"

HKEY_CURRENT_USER\Software\Administrator914
A1_163 = "fb267f7c"

HKEY_CURRENT_USER\Software\Administrator914
A2_163 = "2a6c796"

HKEY_CURRENT_USER\Software\Administrator914
A3_163 = "21a5bf4a"

HKEY_CURRENT_USER\Software\Administrator914
A4_163 = "2a6d563"

HKEY_CURRENT_USER\Software\Administrator914
A1_164 = "174158ea"

HKEY_CURRENT_USER\Software\Administrator914
A2_164 = "8a142b7c"

HKEY_CURRENT_USER\Software\Administrator914
A3_164 = "8b17538d"

HKEY_CURRENT_USER\Software\Administrator914
A4_164 = "8a1439a4"

HKEY_CURRENT_USER\Software\Administrator914
A1_165 = "2ec17b59"

HKEY_CURRENT_USER\Software\Administrator914
A2_165 = "f38187d4"

HKEY_CURRENT_USER\Software\Administrator914
A3_165 = "f282f7cc"

HKEY_CURRENT_USER\Software\Administrator914
A4_165 = "f3819de5"

HKEY_CURRENT_USER\Software\Administrator914
A1_166 = "c5434173"

HKEY_CURRENT_USER\Software\Administrator914
A2_166 = "5cef1b6"

HKEY_CURRENT_USER\Software\Administrator914
A3_166 = "5dec68f"

HKEY_CURRENT_USER\Software\Administrator914
A4_166 = "5cef226"

HKEY_CURRENT_USER\Software\Administrator914
A1_167 = "e235f278"

HKEY_CURRENT_USER\Software\Administrator914
A2_167 = "c65c7e75"

HKEY_CURRENT_USER\Software\Administrator914
A3_167 = "c75fc4e"

HKEY_CURRENT_USER\Software\Administrator914
A4_167 = "c65c6667"

HKEY_CURRENT_USER\Software\Administrator914
A1_168 = "8848316"

HKEY_CURRENT_USER\Software\Administrator914
A2_168 = "2fc9d359"

HKEY_CURRENT_USER\Software\Administrator914
A3_168 = "2ecaa81"

HKEY_CURRENT_USER\Software\Administrator914
A4_168 = "2fc9caa8"

HKEY_CURRENT_USER\Software\Administrator914
A1_169 = "f4c5595"

HKEY_CURRENT_USER\Software\Administrator914
A2_169 = "9937319b"

HKEY_CURRENT_USER\Software\Administrator914
A3_169 = "983444c"

HKEY_CURRENT_USER\Software\Administrator914
A4_169 = "99372ee9"

HKEY_CURRENT_USER\Software\Administrator914
A1_170 = "d8724871"

HKEY_CURRENT_USER\Software\Administrator914
A2_170 = "2a4871a"

HKEY_CURRENT_USER\Software\Administrator914
A3_170 = "3a7f93"

HKEY_CURRENT_USER\Software\Administrator914
A4_170 = "2a4932a"

HKEY_CURRENT_USER\Software\Administrator914
A1_171 = "ea78f5d7"

HKEY_CURRENT_USER\Software\Administrator914
A2_171 = "6c11e5b3"

HKEY_CURRENT_USER\Software\Administrator914
A3_171 = "6d129d42"

HKEY_CURRENT_USER\Software\Administrator914
A4_171 = "6c11f76b"

HKEY_CURRENT_USER\Software\Administrator914
A1_172 = "29af41e"

HKEY_CURRENT_USER\Software\Administrator914
A2_172 = "d57f49ca"

HKEY_CURRENT_USER\Software\Administrator914
A3_172 = "d47c3185"

HKEY_CURRENT_USER\Software\Administrator914
A4_172 = "d57f5bac"

HKEY_CURRENT_USER\Software\Administrator914
A1_173 = "c9255bb4"

HKEY_CURRENT_USER\Software\Administrator914
A2_173 = "3eeca3d3"

HKEY_CURRENT_USER\Software\Administrator914
A3_173 = "3fefd5c4"

HKEY_CURRENT_USER\Software\Administrator914
A4_173 = "3eecbfed"

HKEY_CURRENT_USER\Software\Administrator914
A1_174 = "c6a5e7"

HKEY_CURRENT_USER\Software\Administrator914
A2_174 = "a85a3c69"

HKEY_CURRENT_USER\Software\Administrator914
A3_174 = "a9594e7"

HKEY_CURRENT_USER\Software\Administrator914
A4_174 = "a85a242e"

HKEY_CURRENT_USER\Software\Administrator914
A1_175 = "1eddd21"

HKEY_CURRENT_USER\Software\Administrator914
A2_175 = "11c79aab"

HKEY_CURRENT_USER\Software\Administrator914
A3_175 = "1c4e246"

HKEY_CURRENT_USER\Software\Administrator914
A4_175 = "11c7886f"

HKEY_CURRENT_USER\Software\Administrator914
A1_176 = "861b17ee"

HKEY_CURRENT_USER\Software\Administrator914
A2_176 = "7b34f62"

HKEY_CURRENT_USER\Software\Administrator914
A3_176 = "7a378699"

HKEY_CURRENT_USER\Software\Administrator914
A4_176 = "7b34ecb"

HKEY_CURRENT_USER\Software\Administrator914
A1_177 = "b2d26df"

HKEY_CURRENT_USER\Software\Administrator914
A2_177 = "e4a24259"

HKEY_CURRENT_USER\Software\Administrator914
A3_177 = "e5a13ad8"

HKEY_CURRENT_USER\Software\Administrator914
A4_177 = "e4a25f1"

HKEY_CURRENT_USER\Software\Administrator914
A1_178 = "7e74938c"

HKEY_CURRENT_USER\Software\Administrator914
A2_178 = "4efacc3"

HKEY_CURRENT_USER\Software\Administrator914
A3_178 = "4fcdf1b"

HKEY_CURRENT_USER\Software\Administrator914
A4_178 = "4efb532"

HKEY_CURRENT_USER\Software\Administrator914
A1_179 = "9ce26e2e"

HKEY_CURRENT_USER\Software\Administrator914
A2_179 = "b77dbb"

HKEY_CURRENT_USER\Software\Administrator914
A3_179 = "b67e735a"

HKEY_CURRENT_USER\Software\Administrator914
A4_179 = "b77d1973"

HKEY_CURRENT_USER\Software\Administrator914
A1_180 = "a54c8"

HKEY_CURRENT_USER\Software\Administrator914
A2_180 = "2ea6ffc"

HKEY_CURRENT_USER\Software\Administrator914
A3_180 = "21e9179d"

HKEY_CURRENT_USER\Software\Administrator914
A4_180 = "2ea7db4"

HKEY_CURRENT_USER\Software\Administrator914
A1_181 = "2c9ffb8"

HKEY_CURRENT_USER\Software\Administrator914
A2_181 = "8a57fa16"

HKEY_CURRENT_USER\Software\Administrator914
A3_181 = "8b548bdc"

HKEY_CURRENT_USER\Software\Administrator914
A4_181 = "8a57e1f5"

HKEY_CURRENT_USER\Software\Administrator914
A1_182 = "c987dff"

HKEY_CURRENT_USER\Software\Administrator914
A2_182 = "f3c5541c"

HKEY_CURRENT_USER\Software\Administrator914
A3_182 = "f2c62c1f"

HKEY_CURRENT_USER\Software\Administrator914
A4_182 = "f3c54636"

HKEY_CURRENT_USER\Software\Administrator914
A1_183 = "f246ff3c"

HKEY_CURRENT_USER\Software\Administrator914
A2_183 = "5d32b27e"

HKEY_CURRENT_USER\Software\Administrator914
A3_183 = "5c31c5e"

HKEY_CURRENT_USER\Software\Administrator914
A4_183 = "5d32aa77"

HKEY_CURRENT_USER\Software\Administrator914
A1_184 = "e3f75a7"

HKEY_CURRENT_USER\Software\Administrator914
A2_184 = "c6a1c66"

HKEY_CURRENT_USER\Software\Administrator914
A3_184 = "c7a36491"

HKEY_CURRENT_USER\Software\Administrator914
A4_184 = "c6aeb8"

HKEY_CURRENT_USER\Software\Administrator914
A1_185 = "6c133da4"

HKEY_CURRENT_USER\Software\Administrator914
A2_185 = "3d64f1"

HKEY_CURRENT_USER\Software\Administrator914
A3_185 = "31e18d"

HKEY_CURRENT_USER\Software\Administrator914
A4_185 = "3d72f9"

HKEY_CURRENT_USER\Software\Administrator914
A1_186 = "974dd96f"

HKEY_CURRENT_USER\Software\Administrator914
A2_186 = "997af2f"

HKEY_CURRENT_USER\Software\Administrator914
A3_186 = "9879bd13"

HKEY_CURRENT_USER\Software\Administrator914
A4_186 = "997ad73a"

HKEY_CURRENT_USER\Software\Administrator914
A1_187 = "8e617511"

HKEY_CURRENT_USER\Software\Administrator914
A2_187 = "2e82d5d"

HKEY_CURRENT_USER\Software\Administrator914
A3_187 = "3eb5152"

HKEY_CURRENT_USER\Software\Administrator914
A4_187 = "2e83b7b"

HKEY_CURRENT_USER\Software\Administrator914
A1_188 = "1de3e8d3"

HKEY_CURRENT_USER\Software\Administrator914
A2_188 = "6c558ed"

HKEY_CURRENT_USER\Software\Administrator914
A3_188 = "6d56f595"

HKEY_CURRENT_USER\Software\Administrator914
A4_188 = "6c559fbc"

HKEY_CURRENT_USER\Software\Administrator914
A1_189 = "8baf274c"

HKEY_CURRENT_USER\Software\Administrator914
A2_189 = "d5c31a35"

HKEY_CURRENT_USER\Software\Administrator914
A3_189 = "d4c69d4"

HKEY_CURRENT_USER\Software\Administrator914
A4_189 = "d5c33fd"

HKEY_CURRENT_USER\Software\Administrator914
A1_190 = "6b5716b"

HKEY_CURRENT_USER\Software\Administrator914
A2_190 = "3f37f9e"

HKEY_CURRENT_USER\Software\Administrator914
A3_190 = "3e33217"

HKEY_CURRENT_USER\Software\Administrator914
A4_190 = "3f3683e"

HKEY_CURRENT_USER\Software\Administrator914
A1_191 = "ecbfee26"

HKEY_CURRENT_USER\Software\Administrator914
A2_191 = "a89dd737"

HKEY_CURRENT_USER\Software\Administrator914
A3_191 = "a99ea656"

HKEY_CURRENT_USER\Software\Administrator914
A4_191 = "a89dcc7f"

HKEY_CURRENT_USER\Software\Administrator914
A1_192 = "843e9ad"

HKEY_CURRENT_USER\Software\Administrator914
A2_192 = "12b2268"

HKEY_CURRENT_USER\Software\Administrator914
A3_192 = "1385ae9"

HKEY_CURRENT_USER\Software\Administrator914
A4_192 = "12b3c"

HKEY_CURRENT_USER\Software\Administrator914
A1_193 = "15dc763f"

HKEY_CURRENT_USER\Software\Administrator914
A2_193 = "7b788f96"

HKEY_CURRENT_USER\Software\Administrator914
A3_193 = "7a7bff28"

HKEY_CURRENT_USER\Software\Administrator914
A4_193 = "7b78951"

HKEY_CURRENT_USER\Software\Administrator914
A1_194 = "d5e81a83"

HKEY_CURRENT_USER\Software\Administrator914
A2_194 = "e4e5e393"

HKEY_CURRENT_USER\Software\Administrator914
A3_194 = "e5e6936b"

HKEY_CURRENT_USER\Software\Administrator914
A4_194 = "e4e5f942"

HKEY_CURRENT_USER\Software\Administrator914
A1_195 = "688beddd"

HKEY_CURRENT_USER\Software\Administrator914
A2_195 = "4e537849"

HKEY_CURRENT_USER\Software\Administrator914
A3_195 = "4f537aa"

HKEY_CURRENT_USER\Software\Administrator914
A4_195 = "4e535d83"

HKEY_CURRENT_USER\Software\Administrator914
A1_196 = "12f39373"

HKEY_CURRENT_USER\Software\Administrator914
A2_196 = "b7cd824"

HKEY_CURRENT_USER\Software\Administrator914
A3_196 = "b6c3abed"

HKEY_CURRENT_USER\Software\Administrator914
A4_196 = "b7cc1c4"

HKEY_CURRENT_USER\Software\Administrator914
A1_197 = "cdd31759"

HKEY_CURRENT_USER\Software\Administrator914
A2_197 = "212e322c"

HKEY_CURRENT_USER\Software\Administrator914
A3_197 = "22d4c2c"

HKEY_CURRENT_USER\Software\Administrator914
A4_197 = "212e265"

HKEY_CURRENT_USER\Software\Administrator914
A1_198 = "72f7f5fa"

HKEY_CURRENT_USER\Software\Administrator914
A2_198 = "8a9baf8c"

HKEY_CURRENT_USER\Software\Administrator914
A3_198 = "8b98e6f"

HKEY_CURRENT_USER\Software\Administrator914
A4_198 = "8a9b8a46"

HKEY_CURRENT_USER\Software\Administrator914
A1_199 = "851ea3a"

HKEY_CURRENT_USER\Software\Administrator914
A2_199 = "f48f7ff"

HKEY_CURRENT_USER\Software\Administrator914
A3_199 = "f5b84ae"

HKEY_CURRENT_USER\Software\Administrator914
A4_199 = "f48ee87"

HKEY_CURRENT_USER\Software\Administrator914
A1_200 = "5d59c75"

HKEY_CURRENT_USER\Software\Administrator914
A2_200 = "5d7647b4"

HKEY_CURRENT_USER\Software\Administrator914
A3_200 = "5c7538e1"

HKEY_CURRENT_USER\Software\Administrator914
A4_200 = "5d7652c8"

HKEY_CURRENT_USER\Software\Administrator914
A1_201 = "aa7df75c"

HKEY_CURRENT_USER\Software\Administrator914
A2_201 = "c6e3aeed"

HKEY_CURRENT_USER\Software\Administrator914
A3_201 = "c7edd2"

HKEY_CURRENT_USER\Software\Administrator914
A4_201 = "c6e3b79"

HKEY_CURRENT_USER\Software\Administrator914
A1_202 = "185b391c"

HKEY_CURRENT_USER\Software\Administrator914
A2_202 = "35192c"

HKEY_CURRENT_USER\Software\Administrator914
A3_202 = "31527163"

HKEY_CURRENT_USER\Software\Administrator914
A4_202 = "3511b4a"

HKEY_CURRENT_USER\Software\Administrator914
A1_203 = "b9bd5b3b"

HKEY_CURRENT_USER\Software\Administrator914
A2_203 = "99be6ba2"

HKEY_CURRENT_USER\Software\Administrator914
A3_203 = "98bd15a2"

HKEY_CURRENT_USER\Software\Administrator914
A4_203 = "99be7f8b"

HKEY_CURRENT_USER\Software\Administrator914
A1_204 = "f628cc95"

HKEY_CURRENT_USER\Software\Administrator914
A2_204 = "32bf2f"

HKEY_CURRENT_USER\Software\Administrator914
A3_204 = "22889e5"

HKEY_CURRENT_USER\Software\Administrator914
A4_204 = "32be3cc"

HKEY_CURRENT_USER\Software\Administrator914
A1_205 = "99e8323"

HKEY_CURRENT_USER\Software\Administrator914
A2_205 = "6c995a1"

HKEY_CURRENT_USER\Software\Administrator914
A3_205 = "6d9a2224"

HKEY_CURRENT_USER\Software\Administrator914
A4_205 = "6c9948d"

HKEY_CURRENT_USER\Software\Administrator914
A1_206 = "7ed1e513"

HKEY_CURRENT_USER\Software\Administrator914
A2_206 = "d66bd8a"

HKEY_CURRENT_USER\Software\Administrator914
A3_206 = "d75c667"

HKEY_CURRENT_USER\Software\Administrator914
A4_206 = "d66ac4e"

HKEY_CURRENT_USER\Software\Administrator914
A1_207 = "e6d95"

HKEY_CURRENT_USER\Software\Administrator914
A2_207 = "3f749c4"

HKEY_CURRENT_USER\Software\Administrator914
A3_207 = "3e777aa6"

HKEY_CURRENT_USER\Software\Administrator914
A4_207 = "3f7418f"

HKEY_CURRENT_USER\Software\Administrator914
A1_208 = "9cfe9719"

HKEY_CURRENT_USER\Software\Administrator914
A2_208 = "a8e16d3"

HKEY_CURRENT_USER\Software\Administrator914
A3_208 = "a9e21ef9"

HKEY_CURRENT_USER\Software\Administrator914
A4_208 = "a8e174d"

HKEY_CURRENT_USER\Software\Administrator914
A1_209 = "5a5991af"

HKEY_CURRENT_USER\Software\Administrator914
A2_209 = "124efcdb"

HKEY_CURRENT_USER\Software\Administrator914
A3_209 = "134db338"

HKEY_CURRENT_USER\Software\Administrator914
A4_209 = "124ed911"

HKEY_CURRENT_USER\Software\Administrator914
A1_210 = "9b6614ee"

HKEY_CURRENT_USER\Software\Administrator914
A2_210 = "7bbc7722"

HKEY_CURRENT_USER\Software\Administrator914
A3_210 = "7abf577b"

HKEY_CURRENT_USER\Software\Administrator914
A4_210 = "7bbc3d52"

HKEY_CURRENT_USER\Software\Administrator914
A1_211 = "5ed5445a"

HKEY_CURRENT_USER\Software\Administrator914
A2_211 = "e529bddb"

HKEY_CURRENT_USER\Software\Administrator914
A3_211 = "e42acbba"

HKEY_CURRENT_USER\Software\Administrator914
A4_211 = "e529a193"

HKEY_CURRENT_USER\Software\Administrator914
A1_212 = "fb9f258d"

HKEY_CURRENT_USER\Software\Administrator914
A2_212 = "4e97164c"

HKEY_CURRENT_USER\Software\Administrator914
A3_212 = "4f946ffd"

HKEY_CURRENT_USER\Software\Administrator914
A4_212 = "4e975d4"

HKEY_CURRENT_USER\Software\Administrator914
A1_213 = "37b2ab"

HKEY_CURRENT_USER\Software\Administrator914
A2_213 = "b84799d"

HKEY_CURRENT_USER\Software\Administrator914
A3_213 = "b973c"

HKEY_CURRENT_USER\Software\Administrator914
A4_213 = "b846a15"

HKEY_CURRENT_USER\Software\Administrator914
A1_214 = "6dde4ae"

HKEY_CURRENT_USER\Software\Administrator914
A2_214 = "2171eb9c"

HKEY_CURRENT_USER\Software\Administrator914
A3_214 = "272a47f"

HKEY_CURRENT_USER\Software\Administrator914
A4_214 = "2171ce56"

HKEY_CURRENT_USER\Software\Administrator914
A1_215 = "b17f6f2d"

HKEY_CURRENT_USER\Software\Administrator914
A2_215 = "8adf2edd"

HKEY_CURRENT_USER\Software\Administrator914
A3_215 = "8bdc58be"

HKEY_CURRENT_USER\Software\Administrator914
A4_215 = "8adf3297"

HKEY_CURRENT_USER\Software\Administrator914
A1_216 = "4bfe78a3"

HKEY_CURRENT_USER\Software\Administrator914
A2_216 = "f44c86b"

HKEY_CURRENT_USER\Software\Administrator914
A3_216 = "f54ffcf1"

HKEY_CURRENT_USER\Software\Administrator914
A4_216 = "f44c96d8"

HKEY_CURRENT_USER\Software\Administrator914
A1_217 = "d1b228da"

HKEY_CURRENT_USER\Software\Administrator914
A2_217 = "5db9e13b"

HKEY_CURRENT_USER\Software\Administrator914
A3_217 = "5cba913"

HKEY_CURRENT_USER\Software\Administrator914
A4_217 = "5db9fb19"

HKEY_CURRENT_USER\Software\Administrator914
A1_218 = "ea42883"

HKEY_CURRENT_USER\Software\Administrator914
A2_218 = "c7274aa4"

HKEY_CURRENT_USER\Software\Administrator914
A3_218 = "c6243573"

HKEY_CURRENT_USER\Software\Administrator914
A4_218 = "c7275f5a"

HKEY_CURRENT_USER\Software\Administrator914
A1_219 = "33c48b25"

HKEY_CURRENT_USER\Software\Administrator914
A2_219 = "394d8a6"

HKEY_CURRENT_USER\Software\Administrator914
A3_219 = "3197a9b2"

HKEY_CURRENT_USER\Software\Administrator914
A4_219 = "394c39b"

HKEY_CURRENT_USER\Software\Administrator914
A1_220 = "b37d746b"

HKEY_CURRENT_USER\Software\Administrator914
A2_220 = "9a232a2"

HKEY_CURRENT_USER\Software\Administrator914
A3_220 = "9b14df5"

HKEY_CURRENT_USER\Software\Administrator914
A4_220 = "9a227dc"

HKEY_CURRENT_USER\Software\Administrator914
A1_221 = "fe22b7d4"

HKEY_CURRENT_USER\Software\Administrator914
A2_221 = "36f96f7"

HKEY_CURRENT_USER\Software\Administrator914
A3_221 = "26ce634"

HKEY_CURRENT_USER\Software\Administrator914
A4_221 = "36f8c1d"

HKEY_CURRENT_USER\Software\Administrator914
A1_222 = "9a4cae"

HKEY_CURRENT_USER\Software\Administrator914
A2_222 = "6cdce496"

HKEY_CURRENT_USER\Software\Administrator914
A3_222 = "6ddf9a77"

HKEY_CURRENT_USER\Software\Administrator914
A4_222 = "6cdcf5e"

HKEY_CURRENT_USER\Software\Administrator914
A1_223 = "f1a65d2"

HKEY_CURRENT_USER\Software\Administrator914
A2_223 = "d64a4e4e"

HKEY_CURRENT_USER\Software\Administrator914
A3_223 = "d7493eb6"

HKEY_CURRENT_USER\Software\Administrator914
A4_223 = "d64a549f"

HKEY_CURRENT_USER\Software\Administrator914
A1_224 = "89f5cabc"

HKEY_CURRENT_USER\Software\Administrator914
A2_224 = "3fb7ab14"

HKEY_CURRENT_USER\Software\Administrator914
A3_224 = "3eb4d2c9"

HKEY_CURRENT_USER\Software\Administrator914
A4_224 = "3fb7b8e"

HKEY_CURRENT_USER\Software\Administrator914
A1_225 = "b3661e54"

HKEY_CURRENT_USER\Software\Administrator914
A2_225 = "a925765"

HKEY_CURRENT_USER\Software\Administrator914
A3_225 = "a826778"

HKEY_CURRENT_USER\Software\Administrator914
A4_225 = "a9251d21"

HKEY_CURRENT_USER\Software\Administrator914
A1_226 = "22d7acb6"

HKEY_CURRENT_USER\Software\Administrator914
A2_226 = "1292942a"

HKEY_CURRENT_USER\Software\Administrator914
A3_226 = "1391eb4b"

HKEY_CURRENT_USER\Software\Administrator914
A4_226 = "12928162"

HKEY_CURRENT_USER\Software\Administrator914
A1_227 = "b3871fa"

HKEY_CURRENT_USER\Software\Administrator914
A2_227 = "7bffe85b"

HKEY_CURRENT_USER\Software\Administrator914
A3_227 = "7afc8f8a"

HKEY_CURRENT_USER\Software\Administrator914
A4_227 = "7bffe5a3"

HKEY_CURRENT_USER\Software\Administrator914
A1_228 = "3e33c54b"

HKEY_CURRENT_USER\Software\Administrator914
A2_228 = "e56d5da"

HKEY_CURRENT_USER\Software\Administrator914
A3_228 = "e46e23cd"

HKEY_CURRENT_USER\Software\Administrator914
A4_228 = "e56d49e4"

HKEY_CURRENT_USER\Software\Administrator914
A1_229 = "d3b4b7c"

HKEY_CURRENT_USER\Software\Administrator914
A2_229 = "4edab4b5"

HKEY_CURRENT_USER\Software\Administrator914
A3_229 = "4fd9c4c"

HKEY_CURRENT_USER\Software\Administrator914
A4_229 = "4edaae25"

HKEY_CURRENT_USER\Software\Administrator914
A1_230 = "e1386329"

HKEY_CURRENT_USER\Software\Administrator914
A2_230 = "b848c2"

HKEY_CURRENT_USER\Software\Administrator914
A3_230 = "b94b784f"

HKEY_CURRENT_USER\Software\Administrator914
A4_230 = "b8481266"

HKEY_CURRENT_USER\Software\Administrator914
A1_231 = "c85bf8e"

HKEY_CURRENT_USER\Software\Administrator914
A2_231 = "21b56c4d"

HKEY_CURRENT_USER\Software\Administrator914
A3_231 = "2b61c8e"

HKEY_CURRENT_USER\Software\Administrator914
A4_231 = "21b576a7"

HKEY_CURRENT_USER\Software\Administrator914
A1_232 = "71f5fc56"

HKEY_CURRENT_USER\Software\Administrator914
A2_232 = "8b22c3c"

HKEY_CURRENT_USER\Software\Administrator914
A3_232 = "8a21bc1"

HKEY_CURRENT_USER\Software\Administrator914
A4_232 = "8b22dae8"

HKEY_CURRENT_USER\Software\Administrator914
A1_233 = "39d68a97"

HKEY_CURRENT_USER\Software\Administrator914
A2_233 = "f492ae8"

HKEY_CURRENT_USER\Software\Administrator914
A3_233 = "f59355"

HKEY_CURRENT_USER\Software\Administrator914
A4_233 = "f493f29"

HKEY_CURRENT_USER\Software\Administrator914
A1_234 = "6337d137"

HKEY_CURRENT_USER\Software\Administrator914
A2_234 = "5dfdb572"

HKEY_CURRENT_USER\Software\Administrator914
A3_234 = "5cfec943"

HKEY_CURRENT_USER\Software\Administrator914
A4_234 = "5dfda36a"

HKEY_CURRENT_USER\Software\Administrator914
A1_235 = "3e4deac6"

HKEY_CURRENT_USER\Software\Administrator914
A2_235 = "c76b1911"

HKEY_CURRENT_USER\Software\Administrator914
A3_235 = "c6686d82"

HKEY_CURRENT_USER\Software\Administrator914
A4_235 = "c76b7ab"

HKEY_CURRENT_USER\Software\Administrator914
A1_236 = "c39393d2"

HKEY_CURRENT_USER\Software\Administrator914
A2_236 = "3d87c35"

HKEY_CURRENT_USER\Software\Administrator914
A3_236 = "31db1c5"

HKEY_CURRENT_USER\Software\Administrator914
A4_236 = "3d86bec"

HKEY_CURRENT_USER\Software\Administrator914
A1_237 = "bd59cfe"

HKEY_CURRENT_USER\Software\Administrator914
A2_237 = "9a45c3f5"

HKEY_CURRENT_USER\Software\Administrator914
A3_237 = "9b46ba4"

HKEY_CURRENT_USER\Software\Administrator914
A4_237 = "9a45d2d"

HKEY_CURRENT_USER\Software\Administrator914
A1_238 = "347931d"

HKEY_CURRENT_USER\Software\Administrator914
A2_238 = "3b32c72"

HKEY_CURRENT_USER\Software\Administrator914
A3_238 = "2b5e47"

HKEY_CURRENT_USER\Software\Administrator914
A4_238 = "3b3346e"

HKEY_CURRENT_USER\Software\Administrator914
A1_239 = "1c2d71d"

HKEY_CURRENT_USER\Software\Administrator914
A2_239 = "6d28bbf"

HKEY_CURRENT_USER\Software\Administrator914
A3_239 = "6c23f286"

HKEY_CURRENT_USER\Software\Administrator914
A4_239 = "6d298af"

HKEY_CURRENT_USER\Software\Administrator914
A1_240 = "67a9ac"

HKEY_CURRENT_USER\Software\Administrator914
A2_240 = "d68deb74"

HKEY_CURRENT_USER\Software\Administrator914
A3_240 = "d78e96d9"

HKEY_CURRENT_USER\Software\Administrator914
A4_240 = "d68dfcf"

HKEY_CURRENT_USER\Software\Administrator914
A1_241 = "9491738f"

HKEY_CURRENT_USER\Software\Administrator914
A2_241 = "3ffb7387"

HKEY_CURRENT_USER\Software\Administrator914
A3_241 = "3ef8b18"

HKEY_CURRENT_USER\Software\Administrator914
A4_241 = "3ffb6131"

HKEY_CURRENT_USER\Software\Administrator914
A1_242 = "d59ed2b"

HKEY_CURRENT_USER\Software\Administrator914
A2_242 = "a968d651"

HKEY_CURRENT_USER\Software\Administrator914
A3_242 = "a86baf5b"

HKEY_CURRENT_USER\Software\Administrator914
A4_242 = "a968c572"

HKEY_CURRENT_USER\Software\Administrator914
A1_243 = "41c11cef"

HKEY_CURRENT_USER\Software\Administrator914
A2_243 = "12d63f72"

HKEY_CURRENT_USER\Software\Administrator914
A3_243 = "13d5439a"

HKEY_CURRENT_USER\Software\Administrator914
A4_243 = "12d629b3"

HKEY_CURRENT_USER\Software\Administrator914
A1_244 = "edd1674"

HKEY_CURRENT_USER\Software\Administrator914
A2_244 = "7c439bb3"

HKEY_CURRENT_USER\Software\Administrator914
A3_244 = "7d4e7dd"

HKEY_CURRENT_USER\Software\Administrator914
A4_244 = "7c438df4"

HKEY_CURRENT_USER\Software\Administrator914
A1_245 = "33358878"

HKEY_CURRENT_USER\Software\Administrator914
A2_245 = "e5be4dc"

HKEY_CURRENT_USER\Software\Administrator914
A3_245 = "e4b3981c"

HKEY_CURRENT_USER\Software\Administrator914
A4_245 = "e5bf235"

HKEY_CURRENT_USER\Software\Administrator914
A1_246 = "6f75e52f"

HKEY_CURRENT_USER\Software\Administrator914
A2_246 = "4f1e494"

HKEY_CURRENT_USER\Software\Administrator914
A3_246 = "4e1d3c5f"

HKEY_CURRENT_USER\Software\Administrator914
A4_246 = "4f1e5676"

HKEY_CURRENT_USER\Software\Administrator914
A1_247 = "9cdde4"

HKEY_CURRENT_USER\Software\Administrator914
A2_247 = "b88bac91"

HKEY_CURRENT_USER\Software\Administrator914
A3_247 = "b988d9e"

HKEY_CURRENT_USER\Software\Administrator914
A4_247 = "b88bbab7"

HKEY_CURRENT_USER\Software\Administrator914
A1_248 = "65beaea6"

HKEY_CURRENT_USER\Software\Administrator914
A2_248 = "21f9a41"

HKEY_CURRENT_USER\Software\Administrator914
A3_248 = "2fa74d1"

HKEY_CURRENT_USER\Software\Administrator914
A4_248 = "21f91ef8"

HKEY_CURRENT_USER\Software\Administrator914
A1_249 = "aabbb767"

HKEY_CURRENT_USER\Software\Administrator914
A2_249 = "8b669139"

HKEY_CURRENT_USER\Software\Administrator914
A3_249 = "8a65e91"

HKEY_CURRENT_USER\Software\Administrator914
A4_249 = "8b668339"

HKEY_CURRENT_USER\Software\Administrator914
A1_250 = "186c423"

HKEY_CURRENT_USER\Software\Administrator914
A2_250 = "f4d3f1bb"

HKEY_CURRENT_USER\Software\Administrator914
A3_250 = "f5d8d53"

HKEY_CURRENT_USER\Software\Administrator914
A4_250 = "f4d3e77a"

HKEY_CURRENT_USER\Software\Administrator914
A1_251 = "eeb1b57"

HKEY_CURRENT_USER\Software\Administrator914
A2_251 = "5e415863"

HKEY_CURRENT_USER\Software\Administrator914
A3_251 = "5f422192"

HKEY_CURRENT_USER\Software\Administrator914
A4_251 = "5e414bbb"

HKEY_CURRENT_USER\Software\Administrator914
A1_252 = "292954e7"

HKEY_CURRENT_USER\Software\Administrator914
A2_252 = "c7aeb5ae"

HKEY_CURRENT_USER\Software\Administrator914
A3_252 = "c6adc5d5"

HKEY_CURRENT_USER\Software\Administrator914
A4_252 = "c7aeaffc"

HKEY_CURRENT_USER\Software\Administrator914
A1_253 = "b62bd422"

HKEY_CURRENT_USER\Software\Administrator914
A2_253 = "311c366"

HKEY_CURRENT_USER\Software\Administrator914
A3_253 = "31f7e14"

HKEY_CURRENT_USER\Software\Administrator914
A4_253 = "311c143d"

HKEY_CURRENT_USER\Software\Administrator914
A1_254 = "d8d21c5"

HKEY_CURRENT_USER\Software\Administrator914
A2_254 = "9a896d16"

HKEY_CURRENT_USER\Software\Administrator914
A3_254 = "9b8a1257"

HKEY_CURRENT_USER\Software\Administrator914
A4_254 = "9a89787e"

HKEY_CURRENT_USER\Software\Administrator914
A1_255 = "cfe8f4"

HKEY_CURRENT_USER\Software\Administrator914
A2_255 = "3f6cc77"

HKEY_CURRENT_USER\Software\Administrator914
A3_255 = "2f5b696"

HKEY_CURRENT_USER\Software\Administrator914
A4_255 = "3f6dcbf"

HKEY_CURRENT_USER\Software\Administrator914
A1_256 = "2f9a6b59"

HKEY_CURRENT_USER\Software\Administrator914
A2_256 = "6d6459a2"

HKEY_CURRENT_USER\Software\Administrator914
A3_256 = "6c672b29"

HKEY_CURRENT_USER\Software\Administrator914
A4_256 = "6d6441"

HKEY_CURRENT_USER\Software\Administrator914
A1_257 = "bc3c53ff"

HKEY_CURRENT_USER\Software\Administrator914
A2_257 = "d6d1bd6"

HKEY_CURRENT_USER\Software\Administrator914
A3_257 = "d7d2cf68"

HKEY_CURRENT_USER\Software\Administrator914
A4_257 = "d6d1a541"

HKEY_CURRENT_USER\Software\Administrator914
A1_258 = "4b7668cc"

HKEY_CURRENT_USER\Software\Administrator914
A2_258 = "43f11dd"

HKEY_CURRENT_USER\Software\Administrator914
A3_258 = "413c63ab"

HKEY_CURRENT_USER\Software\Administrator914
A4_258 = "43f982"

HKEY_CURRENT_USER\Software\Administrator914
A1_259 = "c2d31e9e"

HKEY_CURRENT_USER\Software\Administrator914
A2_259 = "a9ac7d6a"

HKEY_CURRENT_USER\Software\Administrator914
A3_259 = "a8af7ea"

HKEY_CURRENT_USER\Software\Administrator914
A4_259 = "a9ac6dc3"

HKEY_CURRENT_USER\Software\Administrator914
A1_260 = "fd8bc73"

HKEY_CURRENT_USER\Software\Administrator914
A2_260 = "1319cbf5"

HKEY_CURRENT_USER\Software\Administrator914
A3_260 = "121ab82d"

HKEY_CURRENT_USER\Software\Administrator914
A4_260 = "1319d24"

HKEY_CURRENT_USER\Software\Administrator914
A1_261 = "2c4c7f9"

HKEY_CURRENT_USER\Software\Administrator914
A2_261 = "7c8727fd"

HKEY_CURRENT_USER\Software\Administrator914
A3_261 = "7d845c6c"

HKEY_CURRENT_USER\Software\Administrator914
A4_261 = "7c873645"

HKEY_CURRENT_USER\Software\Administrator914
A1_262 = "4a25b38"

HKEY_CURRENT_USER\Software\Administrator914
A2_262 = "e5f48fee"

HKEY_CURRENT_USER\Software\Administrator914
A3_262 = "e4f7faf"

HKEY_CURRENT_USER\Software\Administrator914
A4_262 = "e5f49a86"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Program Files%\Messenger\msmsgs.exe = "%Program Files%\Messenger\msmsgs.exe:*:Enabled:ipsec"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
1768776769 = "f7"

HKEY_CURRENT_USER\Software\Administrator914\
-993627007
253949253 = "13b"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\winluncp.exe = "%User Temp%\winluncp.exe:*:Enabled:ipsec"

HKEY_CURRENT_USER\Software\Administrator914
A3_0 = "136641"

HKEY_CURRENT_USER\Software\Administrator914
A4_0 = "82"

HKEY_CURRENT_USER\Software\Administrator914
A3_1 = "686e2"

HKEY_CURRENT_USER\Software\Administrator914
A4_1 = "696d64c3"

HKEY_CURRENT_USER\Software\Administrator914
A1_2 = "c84dc"

HKEY_CURRENT_USER\Software\Administrator914
A2_2 = "d2dace4d"

HKEY_CURRENT_USER\Software\Administrator914
A3_2 = "d3d9aec3"

HKEY_CURRENT_USER\Software\Administrator914
A4_2 = "d2dac8"

HKEY_CURRENT_USER\Software\Administrator914
A1_3 = "e48669d"

HKEY_CURRENT_USER\Software\Administrator914
A2_3 = "3c482ac"

HKEY_CURRENT_USER\Software\Administrator914
A3_3 = "3d4b4a82"

HKEY_CURRENT_USER\Software\Administrator914
A4_3 = "3c482c41"

HKEY_CURRENT_USER\Software\Administrator914
A1_4 = "b76fdd5a"

HKEY_CURRENT_USER\Software\Administrator914
A2_4 = "a5b597cb"

HKEY_CURRENT_USER\Software\Administrator914
A3_4 = "a4b6f745"

HKEY_CURRENT_USER\Software\Administrator914
A4_4 = "a5b59186"

HKEY_CURRENT_USER\Software\Administrator914
A1_5 = "d7ecb91b"

HKEY_CURRENT_USER\Software\Administrator914
A2_5 = "f22f38a"

HKEY_CURRENT_USER\Software\Administrator914
A3_5 = "e21934"

HKEY_CURRENT_USER\Software\Administrator914
A4_5 = "f22f5c7"

HKEY_CURRENT_USER\Software\Administrator914
A1_6 = "6a4a15d8"

HKEY_CURRENT_USER\Software\Administrator914
A2_6 = "7895f49"

HKEY_CURRENT_USER\Software\Administrator914
A3_6 = "79933fc7"

HKEY_CURRENT_USER\Software\Administrator914
A4_6 = "789594"

HKEY_CURRENT_USER\Software\Administrator914
A1_7 = "3933f199"

HKEY_CURRENT_USER\Software\Administrator914
A2_7 = "e1fdbb8"

HKEY_CURRENT_USER\Software\Administrator914
A3_7 = "efedb86"

HKEY_CURRENT_USER\Software\Administrator914
A4_7 = "e1fdbd45"

HKEY_CURRENT_USER\Software\Administrator914
A1_8 = "59b16e56"

HKEY_CURRENT_USER\Software\Administrator914
A2_8 = "4b6b24c7"

HKEY_CURRENT_USER\Software\Administrator914
A3_8 = "4a684449"

HKEY_CURRENT_USER\Software\Administrator914
A4_8 = "4b6b228a"

HKEY_CURRENT_USER\Software\Administrator914
A1_9 = "6c16ca17"

HKEY_CURRENT_USER\Software\Administrator914
A2_9 = "b4d8886"

HKEY_CURRENT_USER\Software\Administrator914
A3_9 = "b5dbe8"

HKEY_CURRENT_USER\Software\Administrator914
A4_9 = "b4d886cb"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\winpdchp.exe = "%User Temp%\winpdchp.exe:*:Enabled:ipsec"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
system
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
system
DisableRegistryTools = "1"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
AppMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Base

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot file system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
CryptSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmadmin

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmboot.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmio.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmload.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmserver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
EventLog

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
File system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
HelpSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Netlogon

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PCI Configuration

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PlugPlay

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PNP Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Primary disk

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
RpcSs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SCSI Class

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sermouse.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sr.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SRService

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
System Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vga.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vgasave.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
WinMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{36FC9E60-C465-11CF-8056-444553540000}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E965-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E969-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96A-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96F-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E977-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97D-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E980-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AFD

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AppMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Base

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot file system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Browser

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
CryptSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Dhcp

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmadmin

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmboot.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmio.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmload.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmserver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DnsCache

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
EventLog

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
File system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
HelpSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ip6fw.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ipnat.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanServer

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanWorkstation

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LmHosts

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Messenger

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS Wrapper

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Ndisuio

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOS

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOSGroup

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBT

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetDDEGroup

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Netlogon

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetMan

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Network

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetworkProvider

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NtLmSsp

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PCI Configuration

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PlugPlay

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP_TDI

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Primary disk

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpcdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpwd.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdsessmgr

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
RpcSs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SCSI Class

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sermouse.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SharedAccess

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sr.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SRService

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Streams Drivers

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
System Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Tcpip

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
TDI

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdpipe.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdtcp.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
termservice

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vga.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vgasave.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WinMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WZCSVC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{36FC9E60-C465-11CF-8056-444553540000}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E965-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E969-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96A-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96F-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E972-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E973-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E974-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E975-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E977-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97D-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E980-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network

Dropping Routine

This file infector drops the following files:

• %System%\drivers\kephq.sys
• %User Temp%\winfwppl.exe
• %User Temp%\winluncp.exe
• %System Root%\10d68
• %User Temp%\khdvr.exe
• D:\111cd
• %User Temp%\winpdchp.exe
• E:\11603
• F:\11a2a
• G:\11e50
• H:\12296
• I:\1269d
• J:\12aa5
• K:\12eea
• L:\132f2
• M:\13718
• N:\13b2f
• O:\13f46
• P:\1435d
• Q:\14800
• R:\14c08
• S:\1506d
• T:\15474
• U:\1587b
• V:\15c92
• %User Temp%\jlfa.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other Details

This file infector connects to the following possibly malicious URL:

• http://{BLOCKED}ra.com/images/logof.gif?e697=295155
• http://{BLOCKED}oydogus.com/images/logo.gif?101fe=198138
• http://bagcilarziyagokalp.{BLOCKED}2.tr/images/logo.gif?103a4=664680
• http://{BLOCKED}p.com/images/logo.gif?10f5c=416808
• http://{BLOCKED}m.com/images/logo.gif?11018=557248

This report is generated via an automated analysis system.