PE_SALITY.EM-O
Virus:Win32/Sality.AM (Microsoft); W32/Sality.gen.z (McAfee); W32.Sality.AE (Symantec); Virus.Win32.Sality.aa (Kaspersky); Virus.Win32.Sality.ah.dam (v) (Sunbelt); Win32.Sality.OG (FSecure)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It disables Task Manager, Registry Editor, and Folder Options.
TECHNICAL DETAILS
168,447 bytes
EXE
No
26 Apr 2012
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other System Modifications
This Trojan deletes the following files:
- %User Temp%\xgjebh.exe
(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It adds the following registry keys:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\policies\
system
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
It adds the following registry entries:
HKEY_CURRENT_USER\Software\Administrator914
A3_230 = "b94b7427"
HKEY_CURRENT_USER\Software\Administrator914
A4_230 = "b8481266"
HKEY_CURRENT_USER\Software\Administrator914
A1_231 = "386d71c"
HKEY_CURRENT_USER\Software\Administrator914
A2_231 = "21b562df"
HKEY_CURRENT_USER\Software\Administrator914
A3_231 = "2b61e6"
HKEY_CURRENT_USER\Software\Administrator914
A4_231 = "21b576a7"
HKEY_CURRENT_USER\Software\Administrator914
A1_232 = "9516882"
HKEY_CURRENT_USER\Software\Administrator914
A2_232 = "8b22c7c7"
HKEY_CURRENT_USER\Software\Administrator914
A3_232 = "8a21bca9"
HKEY_CURRENT_USER\Software\Administrator914
A4_232 = "8b22dae8"
HKEY_CURRENT_USER\Software\Administrator914
A1_233 = "ca5f477"
HKEY_CURRENT_USER\Software\Administrator914
A2_233 = "f492ce7"
HKEY_CURRENT_USER\Software\Administrator914
A3_233 = "f5935968"
HKEY_CURRENT_USER\Software\Administrator914
A4_233 = "f493f29"
HKEY_CURRENT_USER\Software\Administrator914
A1_234 = "23b8d33"
HKEY_CURRENT_USER\Software\Administrator914
A2_234 = "5dfdbbaa"
HKEY_CURRENT_USER\Software\Administrator914
A3_234 = "5cfec52b"
HKEY_CURRENT_USER\Software\Administrator914
A4_234 = "5dfda36a"
HKEY_CURRENT_USER\Software\Administrator914
A1_235 = "2cdccb9a"
HKEY_CURRENT_USER\Software\Administrator914
A2_235 = "c76b26b8"
HKEY_CURRENT_USER\Software\Administrator914
A3_235 = "c66861ea"
HKEY_CURRENT_USER\Software\Administrator914
A4_235 = "c76b7ab"
HKEY_CURRENT_USER\Software\Administrator914
A1_236 = "e5c1839a"
HKEY_CURRENT_USER\Software\Administrator914
A2_236 = "3d87c7"
HKEY_CURRENT_USER\Software\Administrator914
A3_236 = "31dbdad"
HKEY_CURRENT_USER\Software\Administrator914
A4_236 = "3d86bec"
HKEY_CURRENT_USER\Software\Administrator914
A1_237 = "aafdf9"
HKEY_CURRENT_USER\Software\Administrator914
A2_237 = "9a45c565"
HKEY_CURRENT_USER\Software\Administrator914
A3_237 = "9b46b66c"
HKEY_CURRENT_USER\Software\Administrator914
A4_237 = "9a45d2d"
HKEY_CURRENT_USER\Software\Administrator914
A1_238 = "336dd13"
HKEY_CURRENT_USER\Software\Administrator914
A2_238 = "3b3237e"
HKEY_CURRENT_USER\Software\Administrator914
A3_238 = "2b522f"
HKEY_CURRENT_USER\Software\Administrator914
A4_238 = "3b3346e"
HKEY_CURRENT_USER\Software\Administrator914
A1_239 = "6a8c54df"
HKEY_CURRENT_USER\Software\Administrator914
A2_239 = "6d287dd"
HKEY_CURRENT_USER\Software\Administrator914
A3_239 = "6c23feee"
HKEY_CURRENT_USER\Software\Administrator914
A4_239 = "6d298af"
HKEY_CURRENT_USER\Software\Administrator914
A1_240 = "c285dde"
HKEY_CURRENT_USER\Software\Administrator914
A2_240 = "d68de85c"
HKEY_CURRENT_USER\Software\Administrator914
A3_240 = "d78e9ab1"
HKEY_CURRENT_USER\Software\Administrator914
A4_240 = "d68dfcf"
HKEY_CURRENT_USER\Software\Administrator914
A1_241 = "941d338"
HKEY_CURRENT_USER\Software\Administrator914
A2_241 = "3ffb7e43"
HKEY_CURRENT_USER\Software\Administrator914
A3_241 = "3ef877"
HKEY_CURRENT_USER\Software\Administrator914
A4_241 = "3ffb6131"
HKEY_CURRENT_USER\Software\Administrator914
A1_242 = "c16adcce"
HKEY_CURRENT_USER\Software\Administrator914
A2_242 = "a968d662"
HKEY_CURRENT_USER\Software\Administrator914
A3_242 = "a86ba333"
HKEY_CURRENT_USER\Software\Administrator914
A4_242 = "a968c572"
HKEY_CURRENT_USER\Software\Administrator914
A1_243 = "a61a4889"
HKEY_CURRENT_USER\Software\Administrator914
A2_243 = "12d63e3d"
HKEY_CURRENT_USER\Software\Administrator914
A3_243 = "13d54ff2"
HKEY_CURRENT_USER\Software\Administrator914
A4_243 = "12d629b3"
HKEY_CURRENT_USER\Software\Administrator914
A1_244 = "92d19f83"
HKEY_CURRENT_USER\Software\Administrator914
A2_244 = "7c43945"
HKEY_CURRENT_USER\Software\Administrator914
A3_244 = "7d4ebb5"
HKEY_CURRENT_USER\Software\Administrator914
A4_244 = "7c438df4"
HKEY_CURRENT_USER\Software\Administrator914
A1_245 = "aba5389"
HKEY_CURRENT_USER\Software\Administrator914
A2_245 = "e5be648"
HKEY_CURRENT_USER\Software\Administrator914
A3_245 = "e4b39474"
HKEY_CURRENT_USER\Software\Administrator914
A4_245 = "e5bf235"
HKEY_CURRENT_USER\Software\Administrator914
A1_246 = "5c7e354c"
HKEY_CURRENT_USER\Software\Administrator914
A2_246 = "4f1e4ccc"
HKEY_CURRENT_USER\Software\Administrator914
A3_246 = "4e1d337"
HKEY_CURRENT_USER\Software\Administrator914
A4_246 = "4f1e5676"
HKEY_CURRENT_USER\Software\Administrator914
A1_247 = "93b346e3"
HKEY_CURRENT_USER\Software\Administrator914
A2_247 = "b88ba997"
HKEY_CURRENT_USER\Software\Administrator914
A3_247 = "b988dcf6"
HKEY_CURRENT_USER\Software\Administrator914
A4_247 = "b88bbab7"
HKEY_CURRENT_USER\Software\Administrator914
A1_248 = "1dc8d346"
HKEY_CURRENT_USER\Software\Administrator914
A2_248 = "21f9b39"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\Explorer.EXE = "%Windows%\Explorer.EXE:*:Enabled:ipsec"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
1768776769 = "f7"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
253949253 = "13b"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\winbawdh.exe = "%User Temp%\winbawdh.exe:*:Enabled:ipsec"
HKEY_CURRENT_USER\Software\Administrator914
A4_0 = "82"
HKEY_CURRENT_USER\Software\Administrator914
A4_1 = "696d64c3"
HKEY_CURRENT_USER\Software\Administrator914
A1_2 = "c84dc"
HKEY_CURRENT_USER\Software\Administrator914
A2_2 = "d2dace4d"
HKEY_CURRENT_USER\Software\Administrator914
A4_2 = "d2dac8"
HKEY_CURRENT_USER\Software\Administrator914
A1_3 = "e48669d"
HKEY_CURRENT_USER\Software\Administrator914
A2_3 = "3c482ac"
HKEY_CURRENT_USER\Software\Administrator914
A4_3 = "3c482c41"
HKEY_CURRENT_USER\Software\Administrator914
A1_4 = "b76fdd5a"
HKEY_CURRENT_USER\Software\Administrator914
A2_4 = "a5b597cb"
HKEY_CURRENT_USER\Software\Administrator914
A4_4 = "a5b59186"
HKEY_CURRENT_USER\Software\Administrator914
A1_5 = "d7ecb91b"
HKEY_CURRENT_USER\Software\Administrator914
A2_5 = "f22f38a"
HKEY_CURRENT_USER\Software\Administrator914
A4_5 = "f22f5c7"
HKEY_CURRENT_USER\Software\Administrator914
A1_6 = "6a4a15d8"
HKEY_CURRENT_USER\Software\Administrator914
A2_6 = "7895f49"
HKEY_CURRENT_USER\Software\Administrator914
A4_6 = "789594"
HKEY_CURRENT_USER\Software\Administrator914
A1_7 = "3933f199"
HKEY_CURRENT_USER\Software\Administrator914
A2_7 = "e1fdbb8"
HKEY_CURRENT_USER\Software\Administrator914
A4_7 = "e1fdbd45"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:enabled:ipsec"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
1768776769 = "f6"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
-757413758 = "0"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
1011363011 = "0"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
-1514827516 = "23"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
253949253 = "11"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
2022726022 = "{random characters}"
HKEY_CURRENT_USER\Software\Administrator914\
-993627007
-503464505 = "{random characters}"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\userinit.exe = "%System%\userinit.exe:*:Enabled:ipsec"
HKEY_CURRENT_USER\Software\Administrator914
A1_0 = "12da4c5e"
HKEY_CURRENT_USER\Software\Administrator914
A2_0 = "6cf"
HKEY_CURRENT_USER\Software\Administrator914
A3_0 = "136641"
HKEY_CURRENT_USER\Software\Administrator914
A4_0 = "0"
HKEY_CURRENT_USER\Software\Administrator914
A1_1 = "b1a3281f"
HKEY_CURRENT_USER\Software\Administrator914
A2_1 = "696d628e"
HKEY_CURRENT_USER\Software\Administrator914
A3_1 = "686e2"
HKEY_CURRENT_USER\Software\Administrator914
A4_1 = "696d6441"
HKEY_CURRENT_USER\Software\Administrator914
A1_2 = "8f2eef"
HKEY_CURRENT_USER\Software\Administrator914
A2_2 = "d2daddea"
HKEY_CURRENT_USER\Software\Administrator914
A3_2 = "d3d9aec3"
HKEY_CURRENT_USER\Software\Administrator914
A4_2 = "d2dac882"
HKEY_CURRENT_USER\Software\Administrator914
A1_3 = "e669fb9a"
HKEY_CURRENT_USER\Software\Administrator914
A2_3 = "3c483ec"
HKEY_CURRENT_USER\Software\Administrator914
A3_3 = "3d4b4a82"
HKEY_CURRENT_USER\Software\Administrator914
A4_3 = "3c482cc3"
HKEY_CURRENT_USER\Software\Administrator914
A1_4 = "d4843cd"
HKEY_CURRENT_USER\Software\Administrator914
A2_4 = "a5b58918"
HKEY_CURRENT_USER\Software\Administrator914
A3_4 = "a4b6f745"
HKEY_CURRENT_USER\Software\Administrator914
A4_4 = "a5b5914"
HKEY_CURRENT_USER\Software\Administrator914
A1_5 = "2fb71c91"
HKEY_CURRENT_USER\Software\Administrator914
A2_5 = "f22e5ec"
HKEY_CURRENT_USER\Software\Administrator914
A3_5 = "e21934"
HKEY_CURRENT_USER\Software\Administrator914
A4_5 = "f22f545"
HKEY_CURRENT_USER\Software\Administrator914
A1_6 = "c8cb73df"
HKEY_CURRENT_USER\Software\Administrator914
A2_6 = "7894ad3"
HKEY_CURRENT_USER\Software\Administrator914
A3_6 = "79933fc7"
HKEY_CURRENT_USER\Software\Administrator914
A4_6 = "7895986"
HKEY_CURRENT_USER\Software\Administrator914
A1_7 = "1a46349e"
HKEY_CURRENT_USER\Software\Administrator914
A2_7 = "e1fdaf3"
HKEY_CURRENT_USER\Software\Administrator914
A3_7 = "efedb86"
HKEY_CURRENT_USER\Software\Administrator914
A4_7 = "e1fdbdc7"
HKEY_CURRENT_USER\Software\Administrator914
A1_8 = "d5dbaab2"
HKEY_CURRENT_USER\Software\Administrator914
A2_8 = "4b6b3c7b"
HKEY_CURRENT_USER\Software\Administrator914
A3_8 = "4a684449"
HKEY_CURRENT_USER\Software\Administrator914
A4_8 = "4b6b228"
HKEY_CURRENT_USER\Software\Administrator914
A1_9 = "8e15bd8"
HKEY_CURRENT_USER\Software\Administrator914
A2_9 = "b4d89463"
HKEY_CURRENT_USER\Software\Administrator914
A3_9 = "b5dbe8"
HKEY_CURRENT_USER\Software\Administrator914
A4_9 = "b4d88649"
HKEY_CURRENT_USER\Software\Administrator914
A1_10 = "39fe16dd"
HKEY_CURRENT_USER\Software\Administrator914
A2_10 = "1e45fec6"
HKEY_CURRENT_USER\Software\Administrator914
A3_10 = "1f468ccb"
HKEY_CURRENT_USER\Software\Administrator914
A4_10 = "1e45ea8a"
HKEY_CURRENT_USER\Software\Administrator914
A1_11 = "7f68249"
HKEY_CURRENT_USER\Software\Administrator914
A2_11 = "87b3531e"
HKEY_CURRENT_USER\Software\Administrator914
A3_11 = "86b288a"
HKEY_CURRENT_USER\Software\Administrator914
A4_11 = "87b34ecb"
HKEY_CURRENT_USER\Software\Administrator914
A1_12 = "338d242"
HKEY_CURRENT_USER\Software\Administrator914
A2_12 = "f12a191"
HKEY_CURRENT_USER\Software\Administrator914
A3_12 = "f23d54d"
HKEY_CURRENT_USER\Software\Administrator914
A4_12 = "f12b3c"
HKEY_CURRENT_USER\Software\Administrator914
A1_13 = "6b83f48c"
HKEY_CURRENT_USER\Software\Administrator914
A2_13 = "5a8ed9c"
HKEY_CURRENT_USER\Software\Administrator914
A3_13 = "5b8d71c"
HKEY_CURRENT_USER\Software\Administrator914
A4_13 = "5a8e174d"
HKEY_CURRENT_USER\Software\Administrator914
A1_14 = "4cbf3adb"
HKEY_CURRENT_USER\Software\Administrator914
A2_14 = "c3fb6d4f"
HKEY_CURRENT_USER\Software\Administrator914
A3_14 = "c2f81dcf"
HKEY_CURRENT_USER\Software\Administrator914
A4_14 = "c3fb7b8e"
HKEY_CURRENT_USER\Software\Administrator914
A1_15 = "48f88d78"
HKEY_CURRENT_USER\Software\Administrator914
A2_15 = "2d68cf25"
HKEY_CURRENT_USER\Software\Administrator914
A3_15 = "2c6bb98e"
HKEY_CURRENT_USER\Software\Administrator914
A4_15 = "2d68dfcf"
HKEY_CURRENT_USER\Software\Administrator914
A1_16 = "422c2d7d"
HKEY_CURRENT_USER\Software\Administrator914
A2_16 = "96d65478"
HKEY_CURRENT_USER\Software\Administrator914
A3_16 = "97d52251"
HKEY_CURRENT_USER\Software\Administrator914
A4_16 = "96d6441"
HKEY_CURRENT_USER\Software\Administrator914
A1_17 = "b7ec37"
HKEY_CURRENT_USER\Software\Administrator914
A2_17 = "43bf9"
HKEY_CURRENT_USER\Software\Administrator914
A3_17 = "14ce1"
HKEY_CURRENT_USER\Software\Administrator914
A4_17 = "43a851"
HKEY_CURRENT_USER\Software\Administrator914
A1_18 = "727b72f"
HKEY_CURRENT_USER\Software\Administrator914
A2_18 = "69b11d12"
HKEY_CURRENT_USER\Software\Administrator914
A3_18 = "68b26ad3"
HKEY_CURRENT_USER\Software\Administrator914
A4_18 = "69b1c92"
HKEY_CURRENT_USER\Software\Administrator914
A1_19 = "f79d278f"
HKEY_CURRENT_USER\Software\Administrator914
A2_19 = "d31e66d7"
HKEY_CURRENT_USER\Software\Administrator914
A3_19 = "d21d1692"
HKEY_CURRENT_USER\Software\Administrator914
A4_19 = "d31e7d3"
HKEY_CURRENT_USER\Software\Administrator914
A1_20 = "ca6fa349"
HKEY_CURRENT_USER\Software\Administrator914
A2_20 = "3c8bc41f"
HKEY_CURRENT_USER\Software\Administrator914
A3_20 = "3d88b355"
HKEY_CURRENT_USER\Software\Administrator914
A4_20 = "3c8bd514"
HKEY_CURRENT_USER\Software\Administrator914
A1_21 = "e51b57"
HKEY_CURRENT_USER\Software\Administrator914
A2_21 = "a5f922a5"
HKEY_CURRENT_USER\Software\Administrator914
A3_21 = "a4fa5f14"
HKEY_CURRENT_USER\Software\Administrator914
A4_21 = "a5f93955"
HKEY_CURRENT_USER\Software\Administrator914
A1_22 = "fd4de3c"
HKEY_CURRENT_USER\Software\Administrator914
A2_22 = "f66bfee"
HKEY_CURRENT_USER\Software\Administrator914
A3_22 = "e65fbd7"
HKEY_CURRENT_USER\Software\Administrator914
A4_22 = "f669d96"
HKEY_CURRENT_USER\Software\Administrator914
A1_23 = "229e7d98"
HKEY_CURRENT_USER\Software\Administrator914
A2_23 = "78d417da"
HKEY_CURRENT_USER\Software\Administrator914
A3_23 = "79d76796"
HKEY_CURRENT_USER\Software\Administrator914
A4_23 = "78d41d7"
HKEY_CURRENT_USER\Software\Administrator914
A1_24 = "724b441"
HKEY_CURRENT_USER\Software\Administrator914
A2_24 = "e24175c"
HKEY_CURRENT_USER\Software\Administrator914
A3_24 = "e34259"
HKEY_CURRENT_USER\Software\Administrator914
A4_24 = "e2416618"
HKEY_CURRENT_USER\Software\Administrator914
A1_25 = "1de4412"
HKEY_CURRENT_USER\Software\Administrator914
A2_25 = "4baed8ac"
HKEY_CURRENT_USER\Software\Administrator914
A3_25 = "4aadac18"
HKEY_CURRENT_USER\Software\Administrator914
A4_25 = "4baeca59"
HKEY_CURRENT_USER\Software\Administrator914
A1_26 = "69f6cdf7"
HKEY_CURRENT_USER\Software\Administrator914
A2_26 = "b51c398c"
HKEY_CURRENT_USER\Software\Administrator914
A3_26 = "b41f48db"
HKEY_CURRENT_USER\Software\Administrator914
A4_26 = "b51c2e9a"
HKEY_CURRENT_USER\Software\Administrator914
A1_27 = "a134ea8e"
HKEY_CURRENT_USER\Software\Administrator914
A2_27 = "1e8987e9"
HKEY_CURRENT_USER\Software\Administrator914
A3_27 = "1f8af49a"
HKEY_CURRENT_USER\Software\Administrator914
A4_27 = "1e8992db"
HKEY_CURRENT_USER\Software\Administrator914
A1_28 = "155db8a2"
HKEY_CURRENT_USER\Software\Administrator914
A2_28 = "87f6ec21"
HKEY_CURRENT_USER\Software\Administrator914
A3_28 = "86f5915d"
HKEY_CURRENT_USER\Software\Administrator914
A4_28 = "87f6f71c"
HKEY_CURRENT_USER\Software\Administrator914
A1_29 = "2d714"
HKEY_CURRENT_USER\Software\Administrator914
A2_29 = "f164484d"
HKEY_CURRENT_USER\Software\Administrator914
A3_29 = "f673d1c"
HKEY_CURRENT_USER\Software\Administrator914
A4_29 = "f1645b5d"
HKEY_CURRENT_USER\Software\Administrator914
A1_30 = "65b782"
HKEY_CURRENT_USER\Software\Administrator914
A2_30 = "5ad1a465"
HKEY_CURRENT_USER\Software\Administrator914
A3_30 = "5bd2d9df"
HKEY_CURRENT_USER\Software\Administrator914
A4_30 = "5ad1bf9e"
HKEY_CURRENT_USER\Software\Administrator914
A1_31 = "52a83b2"
HKEY_CURRENT_USER\Software\Administrator914
A2_31 = "c43f3a2e"
HKEY_CURRENT_USER\Software\Administrator914
A3_31 = "c53c459e"
HKEY_CURRENT_USER\Software\Administrator914
A4_31 = "c43f23df"
HKEY_CURRENT_USER\Software\Administrator914
A1_32 = "c51b4d5"
HKEY_CURRENT_USER\Software\Administrator914
A2_32 = "2dac9f73"
HKEY_CURRENT_USER\Software\Administrator914
A3_32 = "2cafee61"
HKEY_CURRENT_USER\Software\Administrator914
A4_32 = "2dac882"
HKEY_CURRENT_USER\Software\Administrator914
A1_33 = "b71ac8d1"
HKEY_CURRENT_USER\Software\Administrator914
A2_33 = "9719f848"
HKEY_CURRENT_USER\Software\Administrator914
A3_33 = "961a8a2"
HKEY_CURRENT_USER\Software\Administrator914
A4_33 = "9719ec61"
HKEY_CURRENT_USER\Software\Administrator914
A1_34 = "9b79a86b"
HKEY_CURRENT_USER\Software\Administrator914
A2_34 = "874953"
HKEY_CURRENT_USER\Software\Administrator914
A3_34 = "18436e3"
HKEY_CURRENT_USER\Software\Administrator914
A4_34 = "875a2"
HKEY_CURRENT_USER\Software\Administrator914
A1_35 = "af2ec2be"
HKEY_CURRENT_USER\Software\Administrator914
A2_35 = "69f4a2a4"
HKEY_CURRENT_USER\Software\Administrator914
A3_35 = "68f7d2a2"
HKEY_CURRENT_USER\Software\Administrator914
A4_35 = "69f4b4e3"
HKEY_CURRENT_USER\Software\Administrator914
A1_36 = "1475656b"
HKEY_CURRENT_USER\Software\Administrator914
A2_36 = "d362d52"
HKEY_CURRENT_USER\Software\Administrator914
A3_36 = "d2617f65"
HKEY_CURRENT_USER\Software\Administrator914
A4_36 = "d3621924"
HKEY_CURRENT_USER\Software\Administrator914
A1_37 = "48af2d9"
HKEY_CURRENT_USER\Software\Administrator914
A2_37 = "3ccf66f5"
HKEY_CURRENT_USER\Software\Administrator914
A3_37 = "3dcc1b24"
HKEY_CURRENT_USER\Software\Administrator914
A4_37 = "3ccf7d65"
HKEY_CURRENT_USER\Software\Administrator914
A1_38 = "7c25c9ff"
HKEY_CURRENT_USER\Software\Administrator914
A2_38 = "a63cf643"
HKEY_CURRENT_USER\Software\Administrator914
A3_38 = "a73f87e7"
HKEY_CURRENT_USER\Software\Administrator914
A4_38 = "a63ce1a6"
HKEY_CURRENT_USER\Software\Administrator914
A1_39 = "4c131ab"
HKEY_CURRENT_USER\Software\Administrator914
A2_39 = "faa5c2a"
HKEY_CURRENT_USER\Software\Administrator914
A3_39 = "ea923a6"
HKEY_CURRENT_USER\Software\Administrator914
A4_39 = "faa45e7"
HKEY_CURRENT_USER\Software\Administrator914
A1_40 = "326c86"
HKEY_CURRENT_USER\Software\Administrator914
A2_40 = "7917bffe"
HKEY_CURRENT_USER\Software\Administrator914
A3_40 = "7814cc69"
HKEY_CURRENT_USER\Software\Administrator914
A4_40 = "7917aa28"
HKEY_CURRENT_USER\Software\Administrator914
A1_41 = "f4297d34"
HKEY_CURRENT_USER\Software\Administrator914
A2_41 = "e28517e5"
HKEY_CURRENT_USER\Software\Administrator914
A3_41 = "e3866828"
HKEY_CURRENT_USER\Software\Administrator914
A4_41 = "e285e69"
HKEY_CURRENT_USER\Software\Administrator914
A1_42 = "1abbe6f2"
HKEY_CURRENT_USER\Software\Administrator914
A2_42 = "4bf261b"
HKEY_CURRENT_USER\Software\Administrator914
A3_42 = "4af114eb"
HKEY_CURRENT_USER\Software\Administrator914
A4_42 = "4bf272aa"
HKEY_CURRENT_USER\Software\Administrator914
A1_43 = "2b44eab5"
HKEY_CURRENT_USER\Software\Administrator914
A2_43 = "b55fc76b"
HKEY_CURRENT_USER\Software\Administrator914
A3_43 = "b45cbaa"
HKEY_CURRENT_USER\Software\Administrator914
A4_43 = "b55fd6eb"
HKEY_CURRENT_USER\Software\Administrator914
A1_44 = "17f9f334"
HKEY_CURRENT_USER\Software\Administrator914
A2_44 = "1ecd2f95"
HKEY_CURRENT_USER\Software\Administrator914
A3_44 = "1fce5d6d"
HKEY_CURRENT_USER\Software\Administrator914
A4_44 = "1ecd3b2c"
HKEY_CURRENT_USER\Software\Administrator914
A1_45 = "9ffba34"
HKEY_CURRENT_USER\Software\Administrator914
A2_45 = "883a8b2d"
HKEY_CURRENT_USER\Software\Administrator914
A3_45 = "8939f92c"
HKEY_CURRENT_USER\Software\Administrator914
A4_45 = "883a9f6d"
HKEY_CURRENT_USER\Software\Administrator914
A1_46 = "ebb578f3"
HKEY_CURRENT_USER\Software\Administrator914
A2_46 = "f1a81ae5"
HKEY_CURRENT_USER\Software\Administrator914
A3_46 = "fab65ef"
HKEY_CURRENT_USER\Software\Administrator914
A4_46 = "f1a83ae"
HKEY_CURRENT_USER\Software\Administrator914
A1_47 = "8fc42d5d"
HKEY_CURRENT_USER\Software\Administrator914
A2_47 = "5b1573af"
HKEY_CURRENT_USER\Software\Administrator914
A3_47 = "5a161ae"
HKEY_CURRENT_USER\Software\Administrator914
A4_47 = "5b1567ef"
HKEY_CURRENT_USER\Software\Administrator914
A1_48 = "8e3524"
HKEY_CURRENT_USER\Software\Administrator914
A2_48 = "c482d42c"
HKEY_CURRENT_USER\Software\Administrator914
A3_48 = "c581aa71"
HKEY_CURRENT_USER\Software\Administrator914
A4_48 = "c482cc3"
HKEY_CURRENT_USER\Software\Administrator914
A1_49 = "57287cb8"
HKEY_CURRENT_USER\Software\Administrator914
A2_49 = "2df25b"
HKEY_CURRENT_USER\Software\Administrator914
A3_49 = "2cf3563"
HKEY_CURRENT_USER\Software\Administrator914
A4_49 = "2df371"
HKEY_CURRENT_USER\Software\Administrator914
A1_50 = "7c5662e5"
HKEY_CURRENT_USER\Software\Administrator914
A2_50 = "975d8fa2"
HKEY_CURRENT_USER\Software\Administrator914
A3_50 = "965ef2f3"
HKEY_CURRENT_USER\Software\Administrator914
A4_50 = "975d94b2"
HKEY_CURRENT_USER\Software\Administrator914
A1_51 = "77c9b5ae"
HKEY_CURRENT_USER\Software\Administrator914
A2_51 = "caecda"
HKEY_CURRENT_USER\Software\Administrator914
A3_51 = "1c99eb2"
HKEY_CURRENT_USER\Software\Administrator914
A4_51 = "caf8f3"
HKEY_CURRENT_USER\Software\Administrator914
A1_52 = "7f9de81a"
HKEY_CURRENT_USER\Software\Administrator914
A2_52 = "6a384af1"
HKEY_CURRENT_USER\Software\Administrator914
A3_52 = "6b3b3b75"
HKEY_CURRENT_USER\Software\Administrator914
A4_52 = "6a385d34"
HKEY_CURRENT_USER\Software\Administrator914
A1_53 = "fe8e42c"
HKEY_CURRENT_USER\Software\Administrator914
A2_53 = "d3a5d87f"
HKEY_CURRENT_USER\Software\Administrator914
A3_53 = "d2a6a734"
HKEY_CURRENT_USER\Software\Administrator914
A4_53 = "d3a5c175"
HKEY_CURRENT_USER\Software\Administrator914
A1_54 = "1717d9c5"
HKEY_CURRENT_USER\Software\Administrator914
A2_54 = "3d13366"
HKEY_CURRENT_USER\Software\Administrator914
A3_54 = "3c143f7"
HKEY_CURRENT_USER\Software\Administrator914
A4_54 = "3d1325b6"
HKEY_CURRENT_USER\Software\Administrator914
A1_55 = "d921adae"
HKEY_CURRENT_USER\Software\Administrator914
A2_55 = "a689ad7"
HKEY_CURRENT_USER\Software\Administrator914
A3_55 = "a783efb6"
HKEY_CURRENT_USER\Software\Administrator914
A4_55 = "a6889f7"
HKEY_CURRENT_USER\Software\Administrator914
A1_56 = "1892a61"
HKEY_CURRENT_USER\Software\Administrator914
A2_56 = "fedf197"
HKEY_CURRENT_USER\Software\Administrator914
A3_56 = "eee8879"
HKEY_CURRENT_USER\Software\Administrator914
A4_56 = "fedee38"
HKEY_CURRENT_USER\Software\Administrator914
A1_57 = "cdfc8ba"
HKEY_CURRENT_USER\Software\Administrator914
A2_57 = "795b41f1"
HKEY_CURRENT_USER\Software\Administrator914
A3_57 = "78583438"
HKEY_CURRENT_USER\Software\Administrator914
A4_57 = "795b5279"
HKEY_CURRENT_USER\Software\Administrator914
A1_58 = "f7693df4"
HKEY_CURRENT_USER\Software\Administrator914
A2_58 = "e2c8a17f"
HKEY_CURRENT_USER\Software\Administrator914
A3_58 = "e3cbdfb"
HKEY_CURRENT_USER\Software\Administrator914
A4_58 = "e2c8b6ba"
HKEY_CURRENT_USER\Software\Administrator914
A1_59 = "4ade25b1"
HKEY_CURRENT_USER\Software\Administrator914
A2_59 = "4c36993"
HKEY_CURRENT_USER\Software\Administrator914
A3_59 = "4d357cba"
HKEY_CURRENT_USER\Software\Administrator914
A4_59 = "4c361afb"
HKEY_CURRENT_USER\Software\Administrator914
A1_60 = "63e176a"
HKEY_CURRENT_USER\Software\Administrator914
A2_60 = "b5a3653c"
HKEY_CURRENT_USER\Software\Administrator914
A3_60 = "b4a197d"
HKEY_CURRENT_USER\Software\Administrator914
A4_60 = "b5a37f3c"
HKEY_CURRENT_USER\Software\Administrator914
A1_61 = "4212442e"
HKEY_CURRENT_USER\Software\Administrator914
A2_61 = "1f1fa3b"
HKEY_CURRENT_USER\Software\Administrator914
A3_61 = "1e13853c"
HKEY_CURRENT_USER\Software\Administrator914
A4_61 = "1f1e37d"
HKEY_CURRENT_USER\Software\Administrator914
A1_62 = "dcdf6e7"
HKEY_CURRENT_USER\Software\Administrator914
A2_62 = "887e51e"
HKEY_CURRENT_USER\Software\Administrator914
A3_62 = "897d21ff"
HKEY_CURRENT_USER\Software\Administrator914
A4_62 = "887e47be"
HKEY_CURRENT_USER\Software\Administrator914
A1_63 = "48fbecb2"
HKEY_CURRENT_USER\Software\Administrator914
A2_63 = "f1ebb2f5"
HKEY_CURRENT_USER\Software\Administrator914
A3_63 = "fe8cdbe"
HKEY_CURRENT_USER\Software\Administrator914
A4_63 = "f1ebabff"
HKEY_CURRENT_USER\Software\Administrator914
A1_64 = "431162fe"
HKEY_CURRENT_USER\Software\Administrator914
A2_64 = "5b599b1"
HKEY_CURRENT_USER\Software\Administrator914
A3_64 = "5a5a761"
HKEY_CURRENT_USER\Software\Administrator914
A4_64 = "5b5914"
HKEY_CURRENT_USER\Software\Administrator914
A1_65 = "1e981dd4"
HKEY_CURRENT_USER\Software\Administrator914
A2_65 = "c4c669a"
HKEY_CURRENT_USER\Software\Administrator914
A3_65 = "c5c512c"
HKEY_CURRENT_USER\Software\Administrator914
A4_65 = "c4c67481"
HKEY_CURRENT_USER\Software\Administrator914
A1_66 = "64bbc9b"
HKEY_CURRENT_USER\Software\Administrator914
A2_66 = "2e33cdbe"
HKEY_CURRENT_USER\Software\Administrator914
A3_66 = "2f3be83"
HKEY_CURRENT_USER\Software\Administrator914
A4_66 = "2e33d8c2"
HKEY_CURRENT_USER\Software\Administrator914
A1_67 = "ee4eb2d"
HKEY_CURRENT_USER\Software\Administrator914
A2_67 = "97a12c8"
HKEY_CURRENT_USER\Software\Administrator914
A3_67 = "96a25b42"
HKEY_CURRENT_USER\Software\Administrator914
A4_67 = "97a13d3"
HKEY_CURRENT_USER\Software\Administrator914
A1_68 = "bfa7f9fe"
HKEY_CURRENT_USER\Software\Administrator914
A2_68 = "1eba98"
HKEY_CURRENT_USER\Software\Administrator914
A3_68 = "dc75"
HKEY_CURRENT_USER\Software\Administrator914
A4_68 = "1ea144"
HKEY_CURRENT_USER\Software\Administrator914
A1_69 = "3efefa3"
HKEY_CURRENT_USER\Software\Administrator914
A2_69 = "6a7c1c1b"
HKEY_CURRENT_USER\Software\Administrator914
A3_69 = "6b7f63c4"
HKEY_CURRENT_USER\Software\Administrator914
A4_69 = "6a7c585"
HKEY_CURRENT_USER\Software\Administrator914
A1_70 = "8261617d"
HKEY_CURRENT_USER\Software\Administrator914
A2_70 = "d3e971b2"
HKEY_CURRENT_USER\Software\Administrator914
A3_70 = "d2eaf87"
HKEY_CURRENT_USER\Software\Administrator914
A4_70 = "d3e969c6"
HKEY_CURRENT_USER\Software\Administrator914
A1_71 = "cba7f5a"
HKEY_CURRENT_USER\Software\Administrator914
A2_71 = "3d56d2ef"
HKEY_CURRENT_USER\Software\Administrator914
A3_71 = "3c55a846"
HKEY_CURRENT_USER\Software\Administrator914
A4_71 = "3d56ce7"
HKEY_CURRENT_USER\Software\Administrator914
A1_72 = "fb3d7f5"
HKEY_CURRENT_USER\Software\Administrator914
A2_72 = "a6c42773"
HKEY_CURRENT_USER\Software\Administrator914
A3_72 = "a7c7549"
HKEY_CURRENT_USER\Software\Administrator914
A4_72 = "a6c43248"
HKEY_CURRENT_USER\Software\Administrator914
A1_73 = "55866735"
HKEY_CURRENT_USER\Software\Administrator914
A2_73 = "131841"
HKEY_CURRENT_USER\Software\Administrator914
A3_73 = "1132fc8"
HKEY_CURRENT_USER\Software\Administrator914
A4_73 = "1319689"
HKEY_CURRENT_USER\Software\Administrator914
A1_74 = "1c9287"
HKEY_CURRENT_USER\Software\Administrator914
A2_74 = "799ee82"
HKEY_CURRENT_USER\Software\Administrator914
A3_74 = "789d9c8b"
HKEY_CURRENT_USER\Software\Administrator914
A4_74 = "799efaca"
HKEY_CURRENT_USER\Software\Administrator914
A1_75 = "fe8e222"
HKEY_CURRENT_USER\Software\Administrator914
A2_75 = "e3c45e1"
HKEY_CURRENT_USER\Software\Administrator914
A3_75 = "e2f394a"
HKEY_CURRENT_USER\Software\Administrator914
A4_75 = "e3c5fb"
HKEY_CURRENT_USER\Software\Administrator914
A1_76 = "aaaf54fe"
HKEY_CURRENT_USER\Software\Administrator914
A2_76 = "4c79dc3"
HKEY_CURRENT_USER\Software\Administrator914
A3_76 = "4d7aa5d"
HKEY_CURRENT_USER\Software\Administrator914
A4_76 = "4c79c34c"
HKEY_CURRENT_USER\Software\Administrator914
A1_77 = "668dd4"
HKEY_CURRENT_USER\Software\Administrator914
A2_77 = "b5e73686"
HKEY_CURRENT_USER\Software\Administrator914
A3_77 = "b4e441cc"
HKEY_CURRENT_USER\Software\Administrator914
A4_77 = "b5e7278d"
HKEY_CURRENT_USER\Software\Administrator914
A1_78 = "51b68db2"
HKEY_CURRENT_USER\Software\Administrator914
A2_78 = "1f5495"
HKEY_CURRENT_USER\Software\Administrator914
A3_78 = "1e57ed8f"
HKEY_CURRENT_USER\Software\Administrator914
A4_78 = "1f548bce"
HKEY_CURRENT_USER\Software\Administrator914
A1_79 = "e332f15c"
HKEY_CURRENT_USER\Software\Administrator914
A2_79 = "88c1e887"
HKEY_CURRENT_USER\Software\Administrator914
A3_79 = "89c2964e"
HKEY_CURRENT_USER\Software\Administrator914
A4_79 = "88c1ff"
HKEY_CURRENT_USER\Software\Administrator914
A1_80 = "c984db9a"
HKEY_CURRENT_USER\Software\Administrator914
A2_80 = "f22f4a28"
HKEY_CURRENT_USER\Software\Administrator914
A3_80 = "f32c3211"
HKEY_CURRENT_USER\Software\Administrator914
A4_80 = "f22f545"
HKEY_CURRENT_USER\Software\Administrator914
A1_81 = "55e4e259"
HKEY_CURRENT_USER\Software\Administrator914
A2_81 = "5b9ca6b5"
HKEY_CURRENT_USER\Software\Administrator914
A3_81 = "5a9fded"
HKEY_CURRENT_USER\Software\Administrator914
A4_81 = "5b9cb891"
HKEY_CURRENT_USER\Software\Administrator914
A1_82 = "8558d8a"
HKEY_CURRENT_USER\Software\Administrator914
A2_82 = "c5aada"
HKEY_CURRENT_USER\Software\Administrator914
A3_82 = "c497a93"
HKEY_CURRENT_USER\Software\Administrator914
A4_82 = "c5a1cd2"
HKEY_CURRENT_USER\Software\Administrator914
A1_83 = "c7ac8a3"
HKEY_CURRENT_USER\Software\Administrator914
A2_83 = "2e77965"
HKEY_CURRENT_USER\Software\Administrator914
A3_83 = "2f74e752"
HKEY_CURRENT_USER\Software\Administrator914
A4_83 = "2e778113"
HKEY_CURRENT_USER\Software\Administrator914
A1_84 = "ceb62eee"
HKEY_CURRENT_USER\Software\Administrator914
A2_84 = "97e4f59c"
HKEY_CURRENT_USER\Software\Administrator914
A3_84 = "96e78315"
HKEY_CURRENT_USER\Software\Administrator914
A4_84 = "97e4e554"
HKEY_CURRENT_USER\Software\Administrator914
A1_85 = "383d6c7"
HKEY_CURRENT_USER\Software\Administrator914
A2_85 = "1525bcf"
HKEY_CURRENT_USER\Software\Administrator914
A3_85 = "512fd4"
HKEY_CURRENT_USER\Software\Administrator914
A4_85 = "1524995"
HKEY_CURRENT_USER\Software\Administrator914
A1_86 = "1498d6c"
HKEY_CURRENT_USER\Software\Administrator914
A2_86 = "6abfbef6"
HKEY_CURRENT_USER\Software\Administrator914
A3_86 = "6bbccb97"
HKEY_CURRENT_USER\Software\Administrator914
A4_86 = "6abfadd6"
HKEY_CURRENT_USER\Software\Administrator914
A1_87 = "f624c3de"
HKEY_CURRENT_USER\Software\Administrator914
A2_87 = "d42dd65"
HKEY_CURRENT_USER\Software\Administrator914
A3_87 = "d52e7456"
HKEY_CURRENT_USER\Software\Administrator914
A4_87 = "d42d1217"
HKEY_CURRENT_USER\Software\Administrator914
A1_88 = "fe81a17"
HKEY_CURRENT_USER\Software\Administrator914
A2_88 = "3d9a67e"
HKEY_CURRENT_USER\Software\Administrator914
A3_88 = "3c99119"
HKEY_CURRENT_USER\Software\Administrator914
A4_88 = "3d9a7658"
HKEY_CURRENT_USER\Software\Administrator914
A1_89 = "8921a6d6"
HKEY_CURRENT_USER\Software\Administrator914
A2_89 = "a77c536"
HKEY_CURRENT_USER\Software\Administrator914
A3_89 = "a64bcd8"
HKEY_CURRENT_USER\Software\Administrator914
A4_89 = "a77da99"
HKEY_CURRENT_USER\Software\Administrator914
A1_90 = "1ffde8f4"
HKEY_CURRENT_USER\Software\Administrator914
A2_90 = "1752cf5"
HKEY_CURRENT_USER\Software\Administrator914
A3_90 = "1176589b"
HKEY_CURRENT_USER\Software\Administrator914
A4_90 = "1753eda"
HKEY_CURRENT_USER\Software\Administrator914
A1_91 = "bf1a96b5"
HKEY_CURRENT_USER\Software\Administrator914
A2_91 = "79e2bb44"
HKEY_CURRENT_USER\Software\Administrator914
A3_91 = "78e1c55a"
HKEY_CURRENT_USER\Software\Administrator914
A4_91 = "79e2a31b"
HKEY_CURRENT_USER\Software\Administrator914
A1_92 = "febe4b3"
HKEY_CURRENT_USER\Software\Administrator914
A2_92 = "e351e56"
HKEY_CURRENT_USER\Software\Administrator914
A3_92 = "e253611d"
HKEY_CURRENT_USER\Software\Administrator914
A4_92 = "e3575c"
HKEY_CURRENT_USER\Software\Administrator914
A1_93 = "279bd2c"
HKEY_CURRENT_USER\Software\Administrator914
A2_93 = "4cbd789"
HKEY_CURRENT_USER\Software\Administrator914
A3_93 = "4dbeddc"
HKEY_CURRENT_USER\Software\Administrator914
A4_93 = "4cbd6b9d"
HKEY_CURRENT_USER\Software\Administrator914
A1_94 = "7b76e78a"
HKEY_CURRENT_USER\Software\Administrator914
A2_94 = "b62ad52"
HKEY_CURRENT_USER\Software\Administrator914
A3_94 = "b729a99f"
HKEY_CURRENT_USER\Software\Administrator914
A4_94 = "b62acfde"
HKEY_CURRENT_USER\Software\Administrator914
A1_95 = "98ac4542"
HKEY_CURRENT_USER\Software\Administrator914
A2_95 = "1f982cb3"
HKEY_CURRENT_USER\Software\Administrator914
A3_95 = "1e9b525e"
HKEY_CURRENT_USER\Software\Administrator914
A4_95 = "1f98341f"
HKEY_CURRENT_USER\Software\Administrator914
A1_96 = "c8fade27"
HKEY_CURRENT_USER\Software\Administrator914
A2_96 = "8958b2"
HKEY_CURRENT_USER\Software\Administrator914
A3_96 = "886fe21"
HKEY_CURRENT_USER\Software\Administrator914
A4_96 = "895986"
HKEY_CURRENT_USER\Software\Administrator914
A1_97 = "984ee3ef"
HKEY_CURRENT_USER\Software\Administrator914
A2_97 = "f272e9c9"
HKEY_CURRENT_USER\Software\Administrator914
A3_97 = "f3719ae"
HKEY_CURRENT_USER\Software\Administrator914
A4_97 = "f272fca1"
HKEY_CURRENT_USER\Software\Administrator914
A1_98 = "a84158"
HKEY_CURRENT_USER\Software\Administrator914
A2_98 = "5be7a75"
HKEY_CURRENT_USER\Software\Administrator914
A3_98 = "5ae36a3"
HKEY_CURRENT_USER\Software\Administrator914
A4_98 = "5be6e2"
HKEY_CURRENT_USER\Software\Administrator914
A1_99 = "d2496b76"
HKEY_CURRENT_USER\Software\Administrator914
A2_99 = "c54ddcee"
HKEY_CURRENT_USER\Software\Administrator914
A3_99 = "c44ea362"
HKEY_CURRENT_USER\Software\Administrator914
A4_99 = "c54dc523"
HKEY_CURRENT_USER\Software\Administrator914
A1_100 = "6a6b482a"
HKEY_CURRENT_USER\Software\Administrator914
A2_100 = "2ebb3e3f"
HKEY_CURRENT_USER\Software\Administrator914
A3_100 = "2fb84f25"
HKEY_CURRENT_USER\Software\Administrator914
A4_100 = "2ebb2964"
HKEY_CURRENT_USER\Software\Administrator914
A1_101 = "b4a8a79"
HKEY_CURRENT_USER\Software\Administrator914
A2_101 = "98289fd"
HKEY_CURRENT_USER\Software\Administrator914
A3_101 = "992bebe4"
HKEY_CURRENT_USER\Software\Administrator914
A4_101 = "98288da5"
HKEY_CURRENT_USER\Software\Administrator914
A1_102 = "f496debf"
HKEY_CURRENT_USER\Software\Administrator914
A2_102 = "195e45c"
HKEY_CURRENT_USER\Software\Administrator914
A3_102 = "9697a7"
HKEY_CURRENT_USER\Software\Administrator914
A4_102 = "195f1e6"
HKEY_CURRENT_USER\Software\Administrator914
A1_103 = "ba479199"
HKEY_CURRENT_USER\Software\Administrator914
A2_103 = "6b34359"
HKEY_CURRENT_USER\Software\Administrator914
A3_103 = "6a366"
HKEY_CURRENT_USER\Software\Administrator914
A4_103 = "6b35627"
HKEY_CURRENT_USER\Software\Administrator914
A1_104 = "4a9d9631"
HKEY_CURRENT_USER\Software\Administrator914
A2_104 = "d47a9e"
HKEY_CURRENT_USER\Software\Administrator914
A3_104 = "d573dc29"
HKEY_CURRENT_USER\Software\Administrator914
A4_104 = "d47ba68"
HKEY_CURRENT_USER\Software\Administrator914
A1_105 = "aa75c887"
HKEY_CURRENT_USER\Software\Administrator914
A2_105 = "3dde829"
HKEY_CURRENT_USER\Software\Administrator914
A3_105 = "3cdd78e8"
HKEY_CURRENT_USER\Software\Administrator914
A4_105 = "3dde1ea9"
HKEY_CURRENT_USER\Software\Administrator914
A1_106 = "8f496da7"
HKEY_CURRENT_USER\Software\Administrator914
A2_106 = "a74b9bde"
HKEY_CURRENT_USER\Software\Administrator914
A3_106 = "a648e4ab"
HKEY_CURRENT_USER\Software\Administrator914
A4_106 = "a74b82ea"
HKEY_CURRENT_USER\Software\Administrator914
A1_107 = "3b45aa66"
HKEY_CURRENT_USER\Software\Administrator914
A2_107 = "1b8fee"
HKEY_CURRENT_USER\Software\Administrator914
A3_107 = "11bb816a"
HKEY_CURRENT_USER\Software\Administrator914
A4_107 = "1b8e72b"
HKEY_CURRENT_USER\Software\Administrator914
A1_108 = "372f97d1"
HKEY_CURRENT_USER\Software\Administrator914
A2_108 = "7a265214"
HKEY_CURRENT_USER\Software\Administrator914
A3_108 = "7b252d2d"
HKEY_CURRENT_USER\Software\Administrator914
A4_108 = "7a264b6c"
HKEY_CURRENT_USER\Software\Administrator914
A1_109 = "d4ac8f4"
HKEY_CURRENT_USER\Software\Administrator914
A2_109 = "e393bf4"
HKEY_CURRENT_USER\Software\Administrator914
A3_109 = "e29c9ec"
HKEY_CURRENT_USER\Software\Administrator914
A4_109 = "e393afad"
HKEY_CURRENT_USER\Software\Administrator914
A1_110 = "6bd9a3b"
HKEY_CURRENT_USER\Software\Administrator914
A2_110 = "4d1f6"
HKEY_CURRENT_USER\Software\Administrator914
A3_110 = "4c275af"
HKEY_CURRENT_USER\Software\Administrator914
A4_110 = "4d113ee"
HKEY_CURRENT_USER\Software\Administrator914
A1_111 = "7437bc7e"
HKEY_CURRENT_USER\Software\Administrator914
A2_111 = "b66e6886"
HKEY_CURRENT_USER\Software\Administrator914
A3_111 = "b76d1e6e"
HKEY_CURRENT_USER\Software\Administrator914
A4_111 = "b66e782f"
HKEY_CURRENT_USER\Software\Administrator914
A1_112 = "e6bfcb9"
HKEY_CURRENT_USER\Software\Administrator914
A2_112 = "1fdbc58"
HKEY_CURRENT_USER\Software\Administrator914
A3_112 = "1ed8ba31"
HKEY_CURRENT_USER\Software\Administrator914
A4_112 = "1fdbdc7"
HKEY_CURRENT_USER\Software\Administrator914
A1_113 = "9b78d1f"
HKEY_CURRENT_USER\Software\Administrator914
A2_113 = "8949519a"
HKEY_CURRENT_USER\Software\Administrator914
A3_113 = "884a26f"
HKEY_CURRENT_USER\Software\Administrator914
A4_113 = "89494b1"
HKEY_CURRENT_USER\Software\Administrator914
A1_114 = "e2554e"
HKEY_CURRENT_USER\Software\Administrator914
A2_114 = "f2b6b2f"
HKEY_CURRENT_USER\Software\Administrator914
A3_114 = "f3b5c2b3"
HKEY_CURRENT_USER\Software\Administrator914
A4_114 = "f2b6a4f2"
HKEY_CURRENT_USER\Software\Administrator914
A1_115 = "d83f6ed"
HKEY_CURRENT_USER\Software\Administrator914
A2_115 = "5c2414f3"
HKEY_CURRENT_USER\Software\Administrator914
A3_115 = "5d276f72"
HKEY_CURRENT_USER\Software\Administrator914
A4_115 = "5c24933"
HKEY_CURRENT_USER\Software\Administrator914
A1_116 = "5ee14c8"
HKEY_CURRENT_USER\Software\Administrator914
A2_116 = "c591753"
HKEY_CURRENT_USER\Software\Administrator914
A3_116 = "c492b35"
HKEY_CURRENT_USER\Software\Administrator914
A4_116 = "c5916d74"
HKEY_CURRENT_USER\Software\Administrator914
A1_117 = "17f156cc"
HKEY_CURRENT_USER\Software\Administrator914
A2_117 = "2efec355"
HKEY_CURRENT_USER\Software\Administrator914
A3_117 = "2ffdb7f4"
HKEY_CURRENT_USER\Software\Administrator914
A4_117 = "2efed1b5"
HKEY_CURRENT_USER\Software\Administrator914
A1_118 = "9a4a49b9"
HKEY_CURRENT_USER\Software\Administrator914
A2_118 = "986c21f1"
HKEY_CURRENT_USER\Software\Administrator914
A3_118 = "996f53b7"
HKEY_CURRENT_USER\Software\Administrator914
A4_118 = "986c35f6"
HKEY_CURRENT_USER\Software\Administrator914
A1_119 = "abc94e2f"
HKEY_CURRENT_USER\Software\Administrator914
A2_119 = "1d98e59"
HKEY_CURRENT_USER\Software\Administrator914
A3_119 = "dafc76"
HKEY_CURRENT_USER\Software\Administrator914
A4_119 = "1d99a37"
HKEY_CURRENT_USER\Software\Administrator914
A1_120 = "16f321"
HKEY_CURRENT_USER\Software\Administrator914
A2_120 = "6b46eac1"
HKEY_CURRENT_USER\Software\Administrator914
A3_120 = "6a459839"
HKEY_CURRENT_USER\Software\Administrator914
A4_120 = "6b46fe78"
HKEY_CURRENT_USER\Software\Administrator914
A1_121 = "cfbc3f7"
HKEY_CURRENT_USER\Software\Administrator914
A2_121 = "d4b473d5"
HKEY_CURRENT_USER\Software\Administrator914
A3_121 = "d5b74f8"
HKEY_CURRENT_USER\Software\Administrator914
A4_121 = "d4b462b9"
HKEY_CURRENT_USER\Software\Administrator914
A1_122 = "1d6488a"
HKEY_CURRENT_USER\Software\Administrator914
A2_122 = "3e21de92"
HKEY_CURRENT_USER\Software\Administrator914
A3_122 = "3f22abb"
HKEY_CURRENT_USER\Software\Administrator914
A4_122 = "3e21c6fa"
HKEY_CURRENT_USER\Software\Administrator914
A1_123 = "25dfd87"
HKEY_CURRENT_USER\Software\Administrator914
A2_123 = "a78f3bd1"
HKEY_CURRENT_USER\Software\Administrator914
A3_123 = "a68c4d7a"
HKEY_CURRENT_USER\Software\Administrator914
A4_123 = "a78f2b3b"
HKEY_CURRENT_USER\Software\Administrator914
A1_124 = "65b88463"
HKEY_CURRENT_USER\Software\Administrator914
A2_124 = "1fc993b"
HKEY_CURRENT_USER\Software\Administrator914
A3_124 = "11ffe93d"
HKEY_CURRENT_USER\Software\Administrator914
A4_124 = "1fc8f7c"
HKEY_CURRENT_USER\Software\Administrator914
A1_125 = "9e87a2f3"
HKEY_CURRENT_USER\Software\Administrator914
A2_125 = "7a69ebaf"
HKEY_CURRENT_USER\Software\Administrator914
A3_125 = "7b6a95fc"
HKEY_CURRENT_USER\Software\Administrator914
A4_125 = "7a69f3bd"
HKEY_CURRENT_USER\Software\Administrator914
A1_126 = "2b1d63a"
HKEY_CURRENT_USER\Software\Administrator914
A2_126 = "e3d74646"
HKEY_CURRENT_USER\Software\Administrator914
A3_126 = "e2d431bf"
HKEY_CURRENT_USER\Software\Administrator914
A4_126 = "e3d757fe"
HKEY_CURRENT_USER\Software\Administrator914
A1_127 = "3f56b26a"
HKEY_CURRENT_USER\Software\Administrator914
A2_127 = "4d44a8f"
HKEY_CURRENT_USER\Software\Administrator914
A3_127 = "4c47da7e"
HKEY_CURRENT_USER\Software\Administrator914
A4_127 = "4d44bc3f"
HKEY_CURRENT_USER\Software\Administrator914
A1_128 = "7b5e5fd6"
HKEY_CURRENT_USER\Software\Administrator914
A2_128 = "b6b2326"
HKEY_CURRENT_USER\Software\Administrator914
A3_128 = "b7b146c1"
HKEY_CURRENT_USER\Software\Administrator914
A4_128 = "b6b228"
HKEY_CURRENT_USER\Software\Administrator914
A1_129 = "fbeafe97"
HKEY_CURRENT_USER\Software\Administrator914
A2_129 = "21f9541"
HKEY_CURRENT_USER\Software\Administrator914
A3_129 = "211ce28"
HKEY_CURRENT_USER\Software\Administrator914
A4_129 = "21f84c1"
HKEY_CURRENT_USER\Software\Administrator914
A1_130 = "9786a75f"
HKEY_CURRENT_USER\Software\Administrator914
A2_130 = "898cf2fa"
HKEY_CURRENT_USER\Software\Administrator914
A3_130 = "888f8f43"
HKEY_CURRENT_USER\Software\Administrator914
A4_130 = "898ce92"
HKEY_CURRENT_USER\Software\Administrator914
A1_131 = "7f39eff"
HKEY_CURRENT_USER\Software\Administrator914
A2_131 = "f2fa5d2b"
HKEY_CURRENT_USER\Software\Administrator914
A3_131 = "f3f92b2"
HKEY_CURRENT_USER\Software\Administrator914
A4_131 = "f2fa4d43"
HKEY_CURRENT_USER\Software\Administrator914
A1_132 = "3d6e6638"
HKEY_CURRENT_USER\Software\Administrator914
A2_132 = "5c67a78"
HKEY_CURRENT_USER\Software\Administrator914
A3_132 = "5d64d7c5"
HKEY_CURRENT_USER\Software\Administrator914
A4_132 = "5c67b184"
HKEY_CURRENT_USER\Software\Administrator914
A1_133 = "8582e977"
HKEY_CURRENT_USER\Software\Administrator914
A2_133 = "c5d551f"
HKEY_CURRENT_USER\Software\Administrator914
A3_133 = "c4d67384"
HKEY_CURRENT_USER\Software\Administrator914
A4_133 = "c5d515c5"
HKEY_CURRENT_USER\Software\Administrator914
A1_134 = "42eec55f"
HKEY_CURRENT_USER\Software\Administrator914
A2_134 = "2f426da6"
HKEY_CURRENT_USER\Software\Administrator914
A3_134 = "2e411c47"
HKEY_CURRENT_USER\Software\Administrator914
A4_134 = "2f427a6"
HKEY_CURRENT_USER\Software\Administrator914
A1_135 = "6c3a1fb"
HKEY_CURRENT_USER\Software\Administrator914
A2_135 = "98affb8d"
HKEY_CURRENT_USER\Software\Administrator914
A3_135 = "99acb86"
HKEY_CURRENT_USER\Software\Administrator914
A4_135 = "98afde47"
HKEY_CURRENT_USER\Software\Administrator914
A1_136 = "4fd3acc5"
HKEY_CURRENT_USER\Software\Administrator914
A2_136 = "21d57f4"
HKEY_CURRENT_USER\Software\Administrator914
A3_136 = "31e24c9"
HKEY_CURRENT_USER\Software\Administrator914
A4_136 = "21d4288"
HKEY_CURRENT_USER\Software\Administrator914
A1_137 = "86846eb9"
HKEY_CURRENT_USER\Software\Administrator914
A2_137 = "6b8abc5"
HKEY_CURRENT_USER\Software\Administrator914
A3_137 = "6a89c88"
HKEY_CURRENT_USER\Software\Administrator914
A4_137 = "6b8aa6c9"
HKEY_CURRENT_USER\Software\Administrator914
A1_138 = "3123c1b4"
HKEY_CURRENT_USER\Software\Administrator914
A2_138 = "d4f815c4"
HKEY_CURRENT_USER\Software\Administrator914
A3_138 = "d5fb6d4b"
HKEY_CURRENT_USER\Software\Administrator914
A4_138 = "d4f8ba"
HKEY_CURRENT_USER\Software\Administrator914
A1_139 = "2a43b91"
HKEY_CURRENT_USER\Software\Administrator914
A2_139 = "3e657cf4"
HKEY_CURRENT_USER\Software\Administrator914
A3_139 = "3f669a"
HKEY_CURRENT_USER\Software\Administrator914
A4_139 = "3e656f4b"
HKEY_CURRENT_USER\Software\Administrator914
A1_140 = "be97fd3"
HKEY_CURRENT_USER\Software\Administrator914
A2_140 = "a7d2c6c4"
HKEY_CURRENT_USER\Software\Administrator914
A3_140 = "a6d1b5cd"
HKEY_CURRENT_USER\Software\Administrator914
A4_140 = "a7d2d38c"
HKEY_CURRENT_USER\Software\Administrator914
A1_141 = "1b865486"
HKEY_CURRENT_USER\Software\Administrator914
A2_141 = "11422b1"
HKEY_CURRENT_USER\Software\Administrator914
A3_141 = "143518c"
HKEY_CURRENT_USER\Software\Administrator914
A4_141 = "11437cd"
HKEY_CURRENT_USER\Software\Administrator914
A1_142 = "598be41"
HKEY_CURRENT_USER\Software\Administrator914
A2_142 = "7aad8466"
HKEY_CURRENT_USER\Software\Administrator914
A3_142 = "7baefa4f"
HKEY_CURRENT_USER\Software\Administrator914
A4_142 = "7aad9ce"
HKEY_CURRENT_USER\Software\Administrator914
A1_143 = "ac67649a"
HKEY_CURRENT_USER\Software\Administrator914
A2_143 = "e41b1ebf"
HKEY_CURRENT_USER\Software\Administrator914
A3_143 = "e51866e"
HKEY_CURRENT_USER\Software\Administrator914
A4_143 = "e41b4f"
HKEY_CURRENT_USER\Software\Administrator914
A1_144 = "bef7aae"
HKEY_CURRENT_USER\Software\Administrator914
A2_144 = "4d887298"
HKEY_CURRENT_USER\Software\Administrator914
A3_144 = "4c8b2d1"
HKEY_CURRENT_USER\Software\Administrator914
A4_144 = "4d88649"
HKEY_CURRENT_USER\Software\Administrator914
A1_145 = "6ac761a8"
HKEY_CURRENT_USER\Software\Administrator914
A2_145 = "b6f5df55"
HKEY_CURRENT_USER\Software\Administrator914
A3_145 = "b7f6ae9"
HKEY_CURRENT_USER\Software\Administrator914
A4_145 = "b6f5c8d1"
HKEY_CURRENT_USER\Software\Administrator914
A1_146 = "ddc6ebac"
HKEY_CURRENT_USER\Software\Administrator914
A2_146 = "2633491"
HKEY_CURRENT_USER\Software\Administrator914
A3_146 = "2164b53"
HKEY_CURRENT_USER\Software\Administrator914
A4_146 = "2632d12"
HKEY_CURRENT_USER\Software\Administrator914
A1_147 = "6921d5c"
HKEY_CURRENT_USER\Software\Administrator914
A2_147 = "89d887b"
HKEY_CURRENT_USER\Software\Administrator914
A3_147 = "88d3f712"
HKEY_CURRENT_USER\Software\Administrator914
A4_147 = "89d9153"
HKEY_CURRENT_USER\Software\Administrator914
A1_148 = "9d2689db"
HKEY_CURRENT_USER\Software\Administrator914
A2_148 = "f33de6c8"
HKEY_CURRENT_USER\Software\Administrator914
A3_148 = "f23e93d5"
HKEY_CURRENT_USER\Software\Administrator914
A4_148 = "f33df594"
HKEY_CURRENT_USER\Software\Administrator914
A1_149 = "3848a28b"
HKEY_CURRENT_USER\Software\Administrator914
A2_149 = "5cab4125"
HKEY_CURRENT_USER\Software\Administrator914
A3_149 = "5da83f94"
HKEY_CURRENT_USER\Software\Administrator914
A4_149 = "5cab59d5"
HKEY_CURRENT_USER\Software\Administrator914
A1_150 = "c6aade58"
HKEY_CURRENT_USER\Software\Administrator914
A2_150 = "c618a728"
HKEY_CURRENT_USER\Software\Administrator914
A3_150 = "c71bd857"
HKEY_CURRENT_USER\Software\Administrator914
A4_150 = "c618be16"
HKEY_CURRENT_USER\Software\Administrator914
A1_151 = "ed243e95"
HKEY_CURRENT_USER\Software\Administrator914
A2_151 = "2f863a2"
HKEY_CURRENT_USER\Software\Administrator914
A3_151 = "2e854416"
HKEY_CURRENT_USER\Software\Administrator914
A4_151 = "2f862257"
HKEY_CURRENT_USER\Software\Administrator914
A1_152 = "85ea5ad5"
HKEY_CURRENT_USER\Software\Administrator914
A2_152 = "98f391c3"
HKEY_CURRENT_USER\Software\Administrator914
A3_152 = "99fed9"
HKEY_CURRENT_USER\Software\Administrator914
A4_152 = "98f38698"
HKEY_CURRENT_USER\Software\Administrator914
A1_153 = "ddfb5171"
HKEY_CURRENT_USER\Software\Administrator914
A2_153 = "26ffb1"
HKEY_CURRENT_USER\Software\Administrator914
A3_153 = "3638c98"
HKEY_CURRENT_USER\Software\Administrator914
A4_153 = "26ead9"
HKEY_CURRENT_USER\Software\Administrator914
A1_154 = "352cf"
HKEY_CURRENT_USER\Software\Administrator914
A2_154 = "6bce5b33"
HKEY_CURRENT_USER\Software\Administrator914
A3_154 = "6acd295b"
HKEY_CURRENT_USER\Software\Administrator914
A4_154 = "6bce4f1a"
HKEY_CURRENT_USER\Software\Administrator914
A1_155 = "1bdc827"
HKEY_CURRENT_USER\Software\Administrator914
A2_155 = "d53ba9b1"
HKEY_CURRENT_USER\Software\Administrator914
A3_155 = "d438d51a"
HKEY_CURRENT_USER\Software\Administrator914
A4_155 = "d53bb35b"
HKEY_CURRENT_USER\Software\Administrator914
A1_156 = "2e496ce"
HKEY_CURRENT_USER\Software\Administrator914
A2_156 = "3ea9735"
HKEY_CURRENT_USER\Software\Administrator914
A3_156 = "3faa71dd"
HKEY_CURRENT_USER\Software\Administrator914
A4_156 = "3ea9179c"
HKEY_CURRENT_USER\Software\Administrator914
A1_157 = "49375a1c"
HKEY_CURRENT_USER\Software\Administrator914
A2_157 = "a81668fe"
HKEY_CURRENT_USER\Software\Administrator914
A3_157 = "a9151d9c"
HKEY_CURRENT_USER\Software\Administrator914
A4_157 = "a8167bdd"
HKEY_CURRENT_USER\Software\Administrator914
A1_158 = "a51beb4b"
HKEY_CURRENT_USER\Software\Administrator914
A2_158 = "1183fa5a"
HKEY_CURRENT_USER\Software\Administrator914
A3_158 = "18865f"
HKEY_CURRENT_USER\Software\Administrator914
A4_158 = "1183e1e"
HKEY_CURRENT_USER\Software\Administrator914
A1_159 = "bef3ce1"
HKEY_CURRENT_USER\Software\Administrator914
A2_159 = "7af158"
HKEY_CURRENT_USER\Software\Administrator914
A3_159 = "7bf2221e"
HKEY_CURRENT_USER\Software\Administrator914
A4_159 = "7af1445f"
HKEY_CURRENT_USER\Software\Administrator914
A1_160 = "88cc1cd"
HKEY_CURRENT_USER\Software\Administrator914
A2_160 = "e45eb9fe"
HKEY_CURRENT_USER\Software\Administrator914
A3_160 = "e55dcee1"
HKEY_CURRENT_USER\Software\Administrator914
A4_160 = "e45ea8a"
HKEY_CURRENT_USER\Software\Administrator914
A1_161 = "da24b45a"
HKEY_CURRENT_USER\Software\Administrator914
A2_161 = "4dcc1b41"
HKEY_CURRENT_USER\Software\Administrator914
A3_161 = "4ccf6aa"
HKEY_CURRENT_USER\Software\Administrator914
A4_161 = "4dccce1"
HKEY_CURRENT_USER\Software\Administrator914
A1_162 = "9212251c"
HKEY_CURRENT_USER\Software\Administrator914
A2_162 = "b7396e5"
HKEY_CURRENT_USER\Software\Administrator914
A3_162 = "b63a1763"
HKEY_CURRENT_USER\Software\Administrator914
A4_162 = "b7397122"
HKEY_CURRENT_USER\Software\Administrator914
A1_163 = "65c91813"
HKEY_CURRENT_USER\Software\Administrator914
A2_163 = "2a6c197"
HKEY_CURRENT_USER\Software\Administrator914
A3_163 = "21a5b322"
HKEY_CURRENT_USER\Software\Administrator914
A4_163 = "2a6d563"
HKEY_CURRENT_USER\Software\Administrator914
A1_164 = "2fa59ea"
HKEY_CURRENT_USER\Software\Administrator914
A2_164 = "8a142ae6"
HKEY_CURRENT_USER\Software\Administrator914
A3_164 = "8b175fe5"
HKEY_CURRENT_USER\Software\Administrator914
A4_164 = "8a1439a4"
HKEY_CURRENT_USER\Software\Administrator914
A1_165 = "3ec7285b"
HKEY_CURRENT_USER\Software\Administrator914
A2_165 = "f3818824"
HKEY_CURRENT_USER\Software\Administrator914
A3_165 = "f282fba4"
HKEY_CURRENT_USER\Software\Administrator914
A4_165 = "f3819de5"
HKEY_CURRENT_USER\Software\Administrator914
A1_166 = "847ed777"
HKEY_CURRENT_USER\Software\Administrator914
A2_166 = "5cef21a4"
HKEY_CURRENT_USER\Software\Administrator914
A3_166 = "5dec6467"
HKEY_CURRENT_USER\Software\Administrator914
A4_166 = "5cef226"
HKEY_CURRENT_USER\Software\Administrator914
A1_167 = "63eb2b38"
HKEY_CURRENT_USER\Software\Administrator914
A2_167 = "c65c735c"
HKEY_CURRENT_USER\Software\Administrator914
A3_167 = "c75f26"
HKEY_CURRENT_USER\Software\Administrator914
A4_167 = "c65c6667"
HKEY_CURRENT_USER\Software\Administrator914
A1_168 = "83cfc4b7"
HKEY_CURRENT_USER\Software\Administrator914
A2_168 = "2fc9d36"
HKEY_CURRENT_USER\Software\Administrator914
A3_168 = "2ecaace9"
HKEY_CURRENT_USER\Software\Administrator914
A4_168 = "2fc9caa8"
HKEY_CURRENT_USER\Software\Administrator914
A1_169 = "3425155"
HKEY_CURRENT_USER\Software\Administrator914
A2_169 = "9937392c"
HKEY_CURRENT_USER\Software\Administrator914
A3_169 = "983448a8"
HKEY_CURRENT_USER\Software\Administrator914
A4_169 = "99372ee9"
HKEY_CURRENT_USER\Software\Administrator914
A1_170 = "1d24f97c"
HKEY_CURRENT_USER\Software\Administrator914
A2_170 = "2a483a"
HKEY_CURRENT_USER\Software\Administrator914
A3_170 = "3a7f56b"
HKEY_CURRENT_USER\Software\Administrator914
A4_170 = "2a4932a"
HKEY_CURRENT_USER\Software\Administrator914
A1_171 = "42538736"
HKEY_CURRENT_USER\Software\Administrator914
A2_171 = "6c11ec93"
HKEY_CURRENT_USER\Software\Administrator914
A3_171 = "6d12912a"
HKEY_CURRENT_USER\Software\Administrator914
A4_171 = "6c11f76b"
HKEY_CURRENT_USER\Software\Administrator914
A1_172 = "356827e3"
HKEY_CURRENT_USER\Software\Administrator914
A2_172 = "d57f4d2a"
HKEY_CURRENT_USER\Software\Administrator914
A3_172 = "d47c3ded"
HKEY_CURRENT_USER\Software\Administrator914
A4_172 = "d57f5bac"
HKEY_CURRENT_USER\Software\Administrator914
A1_173 = "166b24b"
HKEY_CURRENT_USER\Software\Administrator914
A2_173 = "3eeca925"
HKEY_CURRENT_USER\Software\Administrator914
A3_173 = "3fefd9ac"
HKEY_CURRENT_USER\Software\Administrator914
A4_173 = "3eecbfed"
HKEY_CURRENT_USER\Software\Administrator914
A1_174 = "f71ff9"
HKEY_CURRENT_USER\Software\Administrator914
A2_174 = "a85a3543"
HKEY_CURRENT_USER\Software\Administrator914
A3_174 = "a959426f"
HKEY_CURRENT_USER\Software\Administrator914
A4_174 = "a85a242e"
HKEY_CURRENT_USER\Software\Administrator914
A1_175 = "9a1a536"
HKEY_CURRENT_USER\Software\Administrator914
A2_175 = "11c7996"
HKEY_CURRENT_USER\Software\Administrator914
A3_175 = "1c4ee2e"
HKEY_CURRENT_USER\Software\Administrator914
A4_175 = "11c7886f"
HKEY_CURRENT_USER\Software\Administrator914
A1_176 = "b5cfbe9"
HKEY_CURRENT_USER\Software\Administrator914
A2_176 = "7b34fff2"
HKEY_CURRENT_USER\Software\Administrator914
A3_176 = "7a378af1"
HKEY_CURRENT_USER\Software\Administrator914
A4_176 = "7b34ecb"
HKEY_CURRENT_USER\Software\Administrator914
A1_177 = "9945839"
HKEY_CURRENT_USER\Software\Administrator914
A2_177 = "e4a24c19"
HKEY_CURRENT_USER\Software\Administrator914
A3_177 = "e5a136b"
HKEY_CURRENT_USER\Software\Administrator914
A4_177 = "e4a25f1"
HKEY_CURRENT_USER\Software\Administrator914
A1_178 = "cc3dfa8"
HKEY_CURRENT_USER\Software\Administrator914
A2_178 = "4efa15"
HKEY_CURRENT_USER\Software\Administrator914
A3_178 = "4fcd373"
HKEY_CURRENT_USER\Software\Administrator914
A4_178 = "4efb532"
HKEY_CURRENT_USER\Software\Administrator914
A1_179 = "42ff9c1"
HKEY_CURRENT_USER\Software\Administrator914
A2_179 = "b77d783"
HKEY_CURRENT_USER\Software\Administrator914
A3_179 = "b67e7f32"
HKEY_CURRENT_USER\Software\Administrator914
A4_179 = "b77d1973"
HKEY_CURRENT_USER\Software\Administrator914
A1_180 = "cba99a"
HKEY_CURRENT_USER\Software\Administrator914
A2_180 = "2ea66a4"
HKEY_CURRENT_USER\Software\Administrator914
A3_180 = "21e91bf5"
HKEY_CURRENT_USER\Software\Administrator914
A4_180 = "2ea7db4"
HKEY_CURRENT_USER\Software\Administrator914
A1_181 = "477461bb"
HKEY_CURRENT_USER\Software\Administrator914
A2_181 = "8a57f4ce"
HKEY_CURRENT_USER\Software\Administrator914
A3_181 = "8b5487b4"
HKEY_CURRENT_USER\Software\Administrator914
A4_181 = "8a57e1f5"
HKEY_CURRENT_USER\Software\Administrator914
A1_182 = "da5a117b"
HKEY_CURRENT_USER\Software\Administrator914
A2_182 = "f3c55f7"
HKEY_CURRENT_USER\Software\Administrator914
A3_182 = "f2c6277"
HKEY_CURRENT_USER\Software\Administrator914
A4_182 = "f3c54636"
HKEY_CURRENT_USER\Software\Administrator914
A1_183 = "8647d1b"
HKEY_CURRENT_USER\Software\Administrator914
A2_183 = "5d32bd92"
HKEY_CURRENT_USER\Software\Administrator914
A3_183 = "5c31cc36"
HKEY_CURRENT_USER\Software\Administrator914
A4_183 = "5d32aa77"
HKEY_CURRENT_USER\Software\Administrator914
A1_184 = "731926e1"
HKEY_CURRENT_USER\Software\Administrator914
A2_184 = "c6a1a1"
HKEY_CURRENT_USER\Software\Administrator914
A3_184 = "c7a368f9"
HKEY_CURRENT_USER\Software\Administrator914
A4_184 = "c6aeb8"
HKEY_CURRENT_USER\Software\Administrator914
A1_185 = "2e2d14d7"
HKEY_CURRENT_USER\Software\Administrator914
A2_185 = "3d66d"
HKEY_CURRENT_USER\Software\Administrator914
A3_185 = "31e14b8"
HKEY_CURRENT_USER\Software\Administrator914
A4_185 = "3d72f9"
HKEY_CURRENT_USER\Software\Administrator914
A1_186 = "27c41184"
HKEY_CURRENT_USER\Software\Administrator914
A2_186 = "997ac51e"
HKEY_CURRENT_USER\Software\Administrator914
A3_186 = "9879b17b"
HKEY_CURRENT_USER\Software\Administrator914
A4_186 = "997ad73a"
HKEY_CURRENT_USER\Software\Administrator914
A1_187 = "7e9c1127"
HKEY_CURRENT_USER\Software\Administrator914
A2_187 = "2e82f2e"
HKEY_CURRENT_USER\Software\Administrator914
A3_187 = "3eb5d3a"
HKEY_CURRENT_USER\Software\Administrator914
A4_187 = "2e83b7b"
HKEY_CURRENT_USER\Software\Administrator914
A1_188 = "1f1ba8ec"
HKEY_CURRENT_USER\Software\Administrator914
A2_188 = "6c558adb"
HKEY_CURRENT_USER\Software\Administrator914
A3_188 = "6d56f9fd"
HKEY_CURRENT_USER\Software\Administrator914
A4_188 = "6c559fbc"
HKEY_CURRENT_USER\Software\Administrator914
A1_189 = "5da321a4"
HKEY_CURRENT_USER\Software\Administrator914
A2_189 = "d5c31ba2"
HKEY_CURRENT_USER\Software\Administrator914
A3_189 = "d4c65bc"
HKEY_CURRENT_USER\Software\Administrator914
A4_189 = "d5c33fd"
HKEY_CURRENT_USER\Software\Administrator914
A1_190 = "5811f26"
HKEY_CURRENT_USER\Software\Administrator914
A2_190 = "3f37cfd"
HKEY_CURRENT_USER\Software\Administrator914
A3_190 = "3e33e7f"
HKEY_CURRENT_USER\Software\Administrator914
A4_190 = "3f3683e"
HKEY_CURRENT_USER\Software\Administrator914
A1_191 = "bd244f6"
HKEY_CURRENT_USER\Software\Administrator914
A2_191 = "a89dc34f"
HKEY_CURRENT_USER\Software\Administrator914
A3_191 = "a99eaa3e"
HKEY_CURRENT_USER\Software\Administrator914
A4_191 = "a89dcc7f"
HKEY_CURRENT_USER\Software\Administrator914
A1_192 = "e4b326c1"
HKEY_CURRENT_USER\Software\Administrator914
A2_192 = "12b261"
HKEY_CURRENT_USER\Software\Administrator914
A3_192 = "1385681"
HKEY_CURRENT_USER\Software\Administrator914
A4_192 = "12b3c"
HKEY_CURRENT_USER\Software\Administrator914
A1_193 = "ec632c2f"
HKEY_CURRENT_USER\Software\Administrator914
A2_193 = "7b78811"
HKEY_CURRENT_USER\Software\Administrator914
A3_193 = "7a7bf34"
HKEY_CURRENT_USER\Software\Administrator914
A4_193 = "7b78951"
HKEY_CURRENT_USER\Software\Administrator914
A1_194 = "6a2bb51d"
HKEY_CURRENT_USER\Software\Administrator914
A2_194 = "e4e5ef8f"
HKEY_CURRENT_USER\Software\Administrator914
A3_194 = "e5e69f3"
HKEY_CURRENT_USER\Software\Administrator914
A4_194 = "e4e5f942"
HKEY_CURRENT_USER\Software\Administrator914
A1_195 = "e63f893f"
HKEY_CURRENT_USER\Software\Administrator914
A2_195 = "4e534fd9"
HKEY_CURRENT_USER\Software\Administrator914
A3_195 = "4f53bc2"
HKEY_CURRENT_USER\Software\Administrator914
A4_195 = "4e535d83"
HKEY_CURRENT_USER\Software\Administrator914
A1_196 = "75f4ab92"
HKEY_CURRENT_USER\Software\Administrator914
A2_196 = "b7cd69c"
HKEY_CURRENT_USER\Software\Administrator914
A3_196 = "b6c3a785"
HKEY_CURRENT_USER\Software\Administrator914
A4_196 = "b7cc1c4"
HKEY_CURRENT_USER\Software\Administrator914
A1_197 = "65a1e367"
HKEY_CURRENT_USER\Software\Administrator914
A2_197 = "212e385"
HKEY_CURRENT_USER\Software\Administrator914
A3_197 = "22d444"
HKEY_CURRENT_USER\Software\Administrator914
A4_197 = "212e265"
HKEY_CURRENT_USER\Software\Administrator914
A1_198 = "bfd5d1fc"
HKEY_CURRENT_USER\Software\Administrator914
A2_198 = "8a9b9268"
HKEY_CURRENT_USER\Software\Administrator914
A3_198 = "8b98ec7"
HKEY_CURRENT_USER\Software\Administrator914
A4_198 = "8a9b8a46"
HKEY_CURRENT_USER\Software\Administrator914
A1_199 = "f61e739"
HKEY_CURRENT_USER\Software\Administrator914
A2_199 = "f48f776"
HKEY_CURRENT_USER\Software\Administrator914
A3_199 = "f5b88c6"
HKEY_CURRENT_USER\Software\Administrator914
A4_199 = "f48ee87"
HKEY_CURRENT_USER\Software\Administrator914
A1_200 = "2e781b95"
HKEY_CURRENT_USER\Software\Administrator914
A2_200 = "5d764b56"
HKEY_CURRENT_USER\Software\Administrator914
A3_200 = "5c753489"
HKEY_CURRENT_USER\Software\Administrator914
A4_200 = "5d7652c8"
HKEY_CURRENT_USER\Software\Administrator914
A1_201 = "436474c1"
HKEY_CURRENT_USER\Software\Administrator914
A2_201 = "c6e3a312"
HKEY_CURRENT_USER\Software\Administrator914
A3_201 = "c7ed148"
HKEY_CURRENT_USER\Software\Administrator914
A4_201 = "c6e3b79"
HKEY_CURRENT_USER\Software\Administrator914
A1_202 = "9a8254"
HKEY_CURRENT_USER\Software\Administrator914
A2_202 = "35117e"
HKEY_CURRENT_USER\Software\Administrator914
A3_202 = "31527db"
HKEY_CURRENT_USER\Software\Administrator914
A4_202 = "3511b4a"
HKEY_CURRENT_USER\Software\Administrator914
A1_203 = "8c72d3c"
HKEY_CURRENT_USER\Software\Administrator914
A2_203 = "99be6ea"
HKEY_CURRENT_USER\Software\Administrator914
A3_203 = "98bd19ca"
HKEY_CURRENT_USER\Software\Administrator914
A4_203 = "99be7f8b"
HKEY_CURRENT_USER\Software\Administrator914
A1_204 = "ca23fa13"
HKEY_CURRENT_USER\Software\Administrator914
A2_204 = "32bf46c"
HKEY_CURRENT_USER\Software\Administrator914
A3_204 = "228858d"
HKEY_CURRENT_USER\Software\Administrator914
A4_204 = "32be3cc"
HKEY_CURRENT_USER\Software\Administrator914
A1_205 = "91bba56"
HKEY_CURRENT_USER\Software\Administrator914
A2_205 = "6c995225"
HKEY_CURRENT_USER\Software\Administrator914
A3_205 = "6d9a2e4c"
HKEY_CURRENT_USER\Software\Administrator914
A4_205 = "6c9948d"
HKEY_CURRENT_USER\Software\Administrator914
A1_206 = "24b9a61a"
HKEY_CURRENT_USER\Software\Administrator914
A2_206 = "d66b4b7"
HKEY_CURRENT_USER\Software\Administrator914
A3_206 = "d75caf"
HKEY_CURRENT_USER\Software\Administrator914
A4_206 = "d66ac4e"
HKEY_CURRENT_USER\Software\Administrator914
A1_207 = "39d6c3dd"
HKEY_CURRENT_USER\Software\Administrator914
A2_207 = "3f74921"
HKEY_CURRENT_USER\Software\Administrator914
A3_207 = "3e7776ce"
HKEY_CURRENT_USER\Software\Administrator914
A4_207 = "3f7418f"
HKEY_CURRENT_USER\Software\Administrator914
A1_208 = "a7c1686d"
HKEY_CURRENT_USER\Software\Administrator914
A2_208 = "a8e1615d"
HKEY_CURRENT_USER\Software\Administrator914
A3_208 = "a9e21291"
HKEY_CURRENT_USER\Software\Administrator914
A4_208 = "a8e174d"
HKEY_CURRENT_USER\Software\Administrator914
A1_209 = "ae8fda"
HKEY_CURRENT_USER\Software\Administrator914
A2_209 = "124ec2ea"
HKEY_CURRENT_USER\Software\Administrator914
A3_209 = "134dbf5"
HKEY_CURRENT_USER\Software\Administrator914
A4_209 = "124ed911"
HKEY_CURRENT_USER\Software\Administrator914
A1_210 = "35e913b"
HKEY_CURRENT_USER\Software\Administrator914
A2_210 = "7bbc2cc3"
HKEY_CURRENT_USER\Software\Administrator914
A3_210 = "7abf5b13"
HKEY_CURRENT_USER\Software\Administrator914
A4_210 = "7bbc3d52"
HKEY_CURRENT_USER\Software\Administrator914
A1_211 = "241825b"
HKEY_CURRENT_USER\Software\Administrator914
A2_211 = "e529bdbf"
HKEY_CURRENT_USER\Software\Administrator914
A3_211 = "e42ac7d2"
HKEY_CURRENT_USER\Software\Administrator914
A4_211 = "e529a193"
HKEY_CURRENT_USER\Software\Administrator914
A1_212 = "27f468"
HKEY_CURRENT_USER\Software\Administrator914
A2_212 = "4e97131c"
HKEY_CURRENT_USER\Software\Administrator914
A3_212 = "4f946395"
HKEY_CURRENT_USER\Software\Administrator914
A4_212 = "4e975d4"
HKEY_CURRENT_USER\Software\Administrator914
A1_213 = "259a68a9"
HKEY_CURRENT_USER\Software\Administrator914
A2_213 = "b847793"
HKEY_CURRENT_USER\Software\Administrator914
A3_213 = "b97c54"
HKEY_CURRENT_USER\Software\Administrator914
A4_213 = "b846a15"
HKEY_CURRENT_USER\Software\Administrator914
A1_214 = "82586be4"
HKEY_CURRENT_USER\Software\Administrator914
A2_214 = "2171c33e"
HKEY_CURRENT_USER\Software\Administrator914
A3_214 = "272a817"
HKEY_CURRENT_USER\Software\Administrator914
A4_214 = "2171ce56"
HKEY_CURRENT_USER\Software\Administrator914
A1_215 = "19123de"
HKEY_CURRENT_USER\Software\Administrator914
A2_215 = "8adf293b"
HKEY_CURRENT_USER\Software\Administrator914
A3_215 = "8bdc54d6"
HKEY_CURRENT_USER\Software\Administrator914
A4_215 = "8adf3297"
HKEY_CURRENT_USER\Software\Administrator914
A1_216 = "4c1ca4c"
HKEY_CURRENT_USER\Software\Administrator914
A2_216 = "f44c83e3"
HKEY_CURRENT_USER\Software\Administrator914
A3_216 = "f54ff99"
HKEY_CURRENT_USER\Software\Administrator914
A4_216 = "f44c96d8"
HKEY_CURRENT_USER\Software\Administrator914
A1_217 = "69bfd75d"
HKEY_CURRENT_USER\Software\Administrator914
A2_217 = "5db9e5d7"
HKEY_CURRENT_USER\Software\Administrator914
A3_217 = "5cba9d58"
HKEY_CURRENT_USER\Software\Administrator914
A4_217 = "5db9fb19"
HKEY_CURRENT_USER\Software\Administrator914
A1_218 = "625f51e"
HKEY_CURRENT_USER\Software\Administrator914
A2_218 = "c72746ab"
HKEY_CURRENT_USER\Software\Administrator914
A3_218 = "c624391b"
HKEY_CURRENT_USER\Software\Administrator914
A4_218 = "c7275f5a"
HKEY_CURRENT_USER\Software\Administrator914
A1_219 = "1d2a526"
HKEY_CURRENT_USER\Software\Administrator914
A2_219 = "394d11a"
HKEY_CURRENT_USER\Software\Administrator914
A3_219 = "3197a5da"
HKEY_CURRENT_USER\Software\Administrator914
A4_219 = "394c39b"
HKEY_CURRENT_USER\Software\Administrator914
A1_220 = "245d41f2"
HKEY_CURRENT_USER\Software\Administrator914
A2_220 = "9a2315"
HKEY_CURRENT_USER\Software\Administrator914
A3_220 = "9b1419d"
HKEY_CURRENT_USER\Software\Administrator914
A4_220 = "9a227dc"
HKEY_CURRENT_USER\Software\Administrator914
A1_221 = "a8b8f49"
HKEY_CURRENT_USER\Software\Administrator914
A2_221 = "36f9961"
HKEY_CURRENT_USER\Software\Administrator914
A3_221 = "26cea5c"
HKEY_CURRENT_USER\Software\Administrator914
A4_221 = "36f8c1d"
HKEY_CURRENT_USER\Software\Administrator914
A1_222 = "f565bc95"
HKEY_CURRENT_USER\Software\Administrator914
A2_222 = "6cdcd594"
HKEY_CURRENT_USER\Software\Administrator914
A3_222 = "6ddf961f"
HKEY_CURRENT_USER\Software\Administrator914
A4_222 = "6cdcf5e"
HKEY_CURRENT_USER\Software\Administrator914
A1_223 = "36fff4e8"
HKEY_CURRENT_USER\Software\Administrator914
A2_223 = "d64a45b4"
HKEY_CURRENT_USER\Software\Administrator914
A3_223 = "d74932de"
HKEY_CURRENT_USER\Software\Administrator914
A4_223 = "d64a549f"
HKEY_CURRENT_USER\Software\Administrator914
A1_224 = "1f4ba35c"
HKEY_CURRENT_USER\Software\Administrator914
A2_224 = "3fb7aaa8"
HKEY_CURRENT_USER\Software\Administrator914
A3_224 = "3eb4dea1"
HKEY_CURRENT_USER\Software\Administrator914
A4_224 = "3fb7b8e"
HKEY_CURRENT_USER\Software\Administrator914
A1_225 = "7f877d2f"
HKEY_CURRENT_USER\Software\Administrator914
A2_225 = "a925c93"
HKEY_CURRENT_USER\Software\Administrator914
A3_225 = "a8267b6"
HKEY_CURRENT_USER\Software\Administrator914
A4_225 = "a9251d21"
HKEY_CURRENT_USER\Software\Administrator914
A1_226 = "5817fb2f"
HKEY_CURRENT_USER\Software\Administrator914
A2_226 = "12929ce4"
HKEY_CURRENT_USER\Software\Administrator914
A3_226 = "1391e723"
HKEY_CURRENT_USER\Software\Administrator914
A4_226 = "12928162"
HKEY_CURRENT_USER\Software\Administrator914
A1_227 = "14399edf"
HKEY_CURRENT_USER\Software\Administrator914
A2_227 = "7bffffd5"
HKEY_CURRENT_USER\Software\Administrator914
A3_227 = "7afc83e2"
HKEY_CURRENT_USER\Software\Administrator914
A4_227 = "7bffe5a3"
HKEY_CURRENT_USER\Software\Administrator914
A1_228 = "bf7564bd"
HKEY_CURRENT_USER\Software\Administrator914
A2_228 = "e56d5ef4"
HKEY_CURRENT_USER\Software\Administrator914
A3_228 = "e46e2fa5"
HKEY_CURRENT_USER\Software\Administrator914
A4_228 = "e56d49e4"
HKEY_CURRENT_USER\Software\Administrator914
A1_229 = "d9c8cf6b"
HKEY_CURRENT_USER\Software\Administrator914
A2_229 = "4edab8a9"
HKEY_CURRENT_USER\Software\Administrator914
A3_229 = "4fd9c864"
HKEY_CURRENT_USER\Software\Administrator914
A4_229 = "4edaae25"
HKEY_CURRENT_USER\Software\Administrator914
A1_230 = "ba1f4fd"
HKEY_CURRENT_USER\Software\Administrator914
A2_230 = "b8489e2"
HKEY_CURRENT_USER\Software\Administrator914
A1_8 = "59b16e56"
HKEY_CURRENT_USER\Software\Administrator914
A2_8 = "4b6b24c7"
HKEY_CURRENT_USER\Software\Administrator914
A4_8 = "4b6b228a"
HKEY_CURRENT_USER\Software\Administrator914
A1_9 = "6c16ca17"
HKEY_CURRENT_USER\Software\Administrator914
A2_9 = "b4d8886"
HKEY_CURRENT_USER\Software\Administrator914
A4_9 = "b4d886cb"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\winqfnmit.exe = "%User Temp%\winqfnmit.exe:*:Enabled:ipsec"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\winudqc.exe = "%User Temp%\winudqc.exe:*:Enabled:ipsec"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is 2.)
It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
system
DisableTaskMgr = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
system
DisableRegistryTools = "1"
It deletes the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Base
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmboot.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmio.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmload.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmserver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
EventLog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
File system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sr.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SRService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AFD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Base
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Browser
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmboot.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmio.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmload.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmserver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DnsCache
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
EventLog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
File system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ip6fw.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ipnat.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanServer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanWorkstation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LmHosts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Messenger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS Wrapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Ndisuio
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOSGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetDDEGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetMan
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Network
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NtLmSsp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpcdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpwd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdsessmgr
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sr.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SRService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Streams Drivers
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
TDI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdpipe.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdtcp.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
termservice
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WZCSVC
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E972-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E973-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E974-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E975-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network
Dropping Routine
This Trojan drops the following files:
- %User Temp%\winunjjcc.exe
- %System%\drivers\mlhdj.sys
- %User Temp%\xnytl.exe
- %User Temp%\winxswub.exe
- %User Temp%\winbawdh.exe
- B:\10356
- %System Root%\1075d
- D:\10b74
- %User Temp%\winqfnmit.exe
- E:\10faa
- F:\113c1
- G:\117e8
- %User Temp%\winmsyb.exe
- H:\11bff
- %User Temp%\winudqc.exe
- J:\12006
- J:\1241d
- K:\12834
- L:\12c3b
- %User Temp%\cmkrfg.exe
- %User Temp%\winbsfbx.exe
- M:\13061
- N:\13478
- O:\13880
- P:\13ce5
- Q:\140ec
- R:\14503
- S:\14987
- T:\14d9e
- U:\151a5
- W:\155bc
- W:\159b4
- Y:\15dbb
- Z:\161c2
- %User Temp%\xgjebh.exe
(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)
Other Details
This Trojan connects to the following possibly malicious URL:
- http://besiktastevfikfikret.{BLOCKED}2.tr/images/logo.gif?b6fb=374744
- http://besiktastevfikfikret.{BLOCKED}2.tr/images/logo.gif?e639=589370
- http://bht.{BLOCKED}c.th/images/logo/logo.gif?e985=478248
- http://{BLOCKED}medicamarquez.com/images/logo.gif?f2bc=248560
- http://{BLOCKED}hali.com/images/logo.gif?f78f=570375
- http://kapuaskab.{BLOCKED}s.go.id/images/logo.gif?fbf4=516000
- http://{BLOCKED}koncuankara.com/logo.gif?10b17=205125
- http://{BLOCKED}h.net/images/logo.gif?117f7=430026
- http://{BLOCKED}sang.com/images/logo.gif?11b62=290184
- http://chacarabonanza.{BLOCKED}m.br/imagens/logo.gif?12ad4=306000
- http://{BLOCKED}apara.com/images/logo.gif?12cd7=693135
This report is generated via an automated analysis system.
SOLUTION
9.200
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Enable Registry Editor, Task Manager, and Folder options
Step 3
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\policies
- system
- In HKEY_CURRENT_USER\Software\Administrator914
- -993627007
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- GlobalUserOffline = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- {malware path and file name} = "{malware path and file name}:*:enabled:ipsec"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- 1768776769 = "f6"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- -757413758 = "0"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- 1011363011 = "0"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- -1514827516 = "23"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- 253949253 = "11"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- 2022726022 = "{random characters}"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- -503464505 = "{random characters}"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %System%\userinit.exe = "%System%\userinit.exe:*:Enabled:ipsec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_0 = "12da4c5e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_0 = "6cf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_0 = "136641"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_0 = "0"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_1 = "b1a3281f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_1 = "696d628e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_1 = "686e2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_1 = "696d6441"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_2 = "8f2eef"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_2 = "d2daddea"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_2 = "d3d9aec3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_2 = "d2dac882"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_3 = "e669fb9a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_3 = "3c483ec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_3 = "3d4b4a82"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_3 = "3c482cc3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_4 = "d4843cd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_4 = "a5b58918"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_4 = "a4b6f745"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_4 = "a5b5914"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_5 = "2fb71c91"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_5 = "f22e5ec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_5 = "e21934"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_5 = "f22f545"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_6 = "c8cb73df"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_6 = "7894ad3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_6 = "79933fc7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_6 = "7895986"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_7 = "1a46349e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_7 = "e1fdaf3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_7 = "efedb86"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_7 = "e1fdbdc7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_8 = "d5dbaab2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_8 = "4b6b3c7b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_8 = "4a684449"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_8 = "4b6b228"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_9 = "8e15bd8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_9 = "b4d89463"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_9 = "b5dbe8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_9 = "b4d88649"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_10 = "39fe16dd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_10 = "1e45fec6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_10 = "1f468ccb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_10 = "1e45ea8a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_11 = "7f68249"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_11 = "87b3531e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_11 = "86b288a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_11 = "87b34ecb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_12 = "338d242"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_12 = "f12a191"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_12 = "f23d54d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_12 = "f12b3c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_13 = "6b83f48c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_13 = "5a8ed9c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_13 = "5b8d71c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_13 = "5a8e174d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_14 = "4cbf3adb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_14 = "c3fb6d4f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_14 = "c2f81dcf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_14 = "c3fb7b8e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_15 = "48f88d78"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_15 = "2d68cf25"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_15 = "2c6bb98e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_15 = "2d68dfcf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_16 = "422c2d7d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_16 = "96d65478"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_16 = "97d52251"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_16 = "96d6441"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_17 = "b7ec37"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_17 = "43bf9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_17 = "14ce1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_17 = "43a851"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_18 = "727b72f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_18 = "69b11d12"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_18 = "68b26ad3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_18 = "69b1c92"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_19 = "f79d278f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_19 = "d31e66d7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_19 = "d21d1692"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_19 = "d31e7d3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_20 = "ca6fa349"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_20 = "3c8bc41f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_20 = "3d88b355"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_20 = "3c8bd514"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_21 = "e51b57"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_21 = "a5f922a5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_21 = "a4fa5f14"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_21 = "a5f93955"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_22 = "fd4de3c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_22 = "f66bfee"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_22 = "e65fbd7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_22 = "f669d96"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_23 = "229e7d98"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_23 = "78d417da"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_23 = "79d76796"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_23 = "78d41d7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_24 = "724b441"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_24 = "e24175c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_24 = "e34259"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_24 = "e2416618"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_25 = "1de4412"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_25 = "4baed8ac"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_25 = "4aadac18"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_25 = "4baeca59"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_26 = "69f6cdf7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_26 = "b51c398c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_26 = "b41f48db"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_26 = "b51c2e9a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_27 = "a134ea8e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_27 = "1e8987e9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_27 = "1f8af49a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_27 = "1e8992db"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_28 = "155db8a2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_28 = "87f6ec21"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_28 = "86f5915d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_28 = "87f6f71c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_29 = "2d714"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_29 = "f164484d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_29 = "f673d1c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_29 = "f1645b5d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_30 = "65b782"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_30 = "5ad1a465"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_30 = "5bd2d9df"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_30 = "5ad1bf9e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_31 = "52a83b2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_31 = "c43f3a2e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_31 = "c53c459e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_31 = "c43f23df"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_32 = "c51b4d5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_32 = "2dac9f73"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_32 = "2cafee61"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_32 = "2dac882"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_33 = "b71ac8d1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_33 = "9719f848"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_33 = "961a8a2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_33 = "9719ec61"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_34 = "9b79a86b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_34 = "874953"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_34 = "18436e3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_34 = "875a2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_35 = "af2ec2be"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_35 = "69f4a2a4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_35 = "68f7d2a2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_35 = "69f4b4e3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_36 = "1475656b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_36 = "d362d52"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_36 = "d2617f65"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_36 = "d3621924"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_37 = "48af2d9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_37 = "3ccf66f5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_37 = "3dcc1b24"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_37 = "3ccf7d65"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_38 = "7c25c9ff"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_38 = "a63cf643"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_38 = "a73f87e7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_38 = "a63ce1a6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_39 = "4c131ab"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_39 = "faa5c2a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_39 = "ea923a6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_39 = "faa45e7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_40 = "326c86"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_40 = "7917bffe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_40 = "7814cc69"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_40 = "7917aa28"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_41 = "f4297d34"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_41 = "e28517e5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_41 = "e3866828"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_41 = "e285e69"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_42 = "1abbe6f2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_42 = "4bf261b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_42 = "4af114eb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_42 = "4bf272aa"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_43 = "2b44eab5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_43 = "b55fc76b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_43 = "b45cbaa"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_43 = "b55fd6eb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_44 = "17f9f334"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_44 = "1ecd2f95"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_44 = "1fce5d6d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_44 = "1ecd3b2c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_45 = "9ffba34"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_45 = "883a8b2d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_45 = "8939f92c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_45 = "883a9f6d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_46 = "ebb578f3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_46 = "f1a81ae5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_46 = "fab65ef"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_46 = "f1a83ae"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_47 = "8fc42d5d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_47 = "5b1573af"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_47 = "5a161ae"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_47 = "5b1567ef"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_48 = "8e3524"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_48 = "c482d42c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_48 = "c581aa71"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_48 = "c482cc3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_49 = "57287cb8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_49 = "2df25b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_49 = "2cf3563"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_49 = "2df371"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_50 = "7c5662e5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_50 = "975d8fa2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_50 = "965ef2f3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_50 = "975d94b2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_51 = "77c9b5ae"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_51 = "caecda"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_51 = "1c99eb2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_51 = "caf8f3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_52 = "7f9de81a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_52 = "6a384af1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_52 = "6b3b3b75"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_52 = "6a385d34"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_53 = "fe8e42c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_53 = "d3a5d87f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_53 = "d2a6a734"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_53 = "d3a5c175"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_54 = "1717d9c5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_54 = "3d13366"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_54 = "3c143f7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_54 = "3d1325b6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_55 = "d921adae"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_55 = "a689ad7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_55 = "a783efb6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_55 = "a6889f7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_56 = "1892a61"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_56 = "fedf197"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_56 = "eee8879"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_56 = "fedee38"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_57 = "cdfc8ba"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_57 = "795b41f1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_57 = "78583438"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_57 = "795b5279"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_58 = "f7693df4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_58 = "e2c8a17f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_58 = "e3cbdfb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_58 = "e2c8b6ba"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_59 = "4ade25b1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_59 = "4c36993"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_59 = "4d357cba"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_59 = "4c361afb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_60 = "63e176a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_60 = "b5a3653c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_60 = "b4a197d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_60 = "b5a37f3c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_61 = "4212442e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_61 = "1f1fa3b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_61 = "1e13853c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_61 = "1f1e37d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_62 = "dcdf6e7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_62 = "887e51e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_62 = "897d21ff"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_62 = "887e47be"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_63 = "48fbecb2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_63 = "f1ebb2f5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_63 = "fe8cdbe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_63 = "f1ebabff"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_64 = "431162fe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_64 = "5b599b1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_64 = "5a5a761"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_64 = "5b5914"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_65 = "1e981dd4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_65 = "c4c669a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_65 = "c5c512c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_65 = "c4c67481"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_66 = "64bbc9b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_66 = "2e33cdbe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_66 = "2f3be83"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_66 = "2e33d8c2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_67 = "ee4eb2d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_67 = "97a12c8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_67 = "96a25b42"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_67 = "97a13d3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_68 = "bfa7f9fe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_68 = "1eba98"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_68 = "dc75"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_68 = "1ea144"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_69 = "3efefa3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_69 = "6a7c1c1b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_69 = "6b7f63c4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_69 = "6a7c585"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_70 = "8261617d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_70 = "d3e971b2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_70 = "d2eaf87"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_70 = "d3e969c6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_71 = "cba7f5a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_71 = "3d56d2ef"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_71 = "3c55a846"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_71 = "3d56ce7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_72 = "fb3d7f5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_72 = "a6c42773"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_72 = "a7c7549"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_72 = "a6c43248"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_73 = "55866735"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_73 = "131841"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_73 = "1132fc8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_73 = "1319689"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_74 = "1c9287"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_74 = "799ee82"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_74 = "789d9c8b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_74 = "799efaca"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_75 = "fe8e222"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_75 = "e3c45e1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_75 = "e2f394a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_75 = "e3c5fb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_76 = "aaaf54fe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_76 = "4c79dc3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_76 = "4d7aa5d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_76 = "4c79c34c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_77 = "668dd4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_77 = "b5e73686"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_77 = "b4e441cc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_77 = "b5e7278d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_78 = "51b68db2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_78 = "1f5495"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_78 = "1e57ed8f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_78 = "1f548bce"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_79 = "e332f15c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_79 = "88c1e887"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_79 = "89c2964e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_79 = "88c1ff"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_80 = "c984db9a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_80 = "f22f4a28"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_80 = "f32c3211"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_80 = "f22f545"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_81 = "55e4e259"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_81 = "5b9ca6b5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_81 = "5a9fded"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_81 = "5b9cb891"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_82 = "8558d8a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_82 = "c5aada"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_82 = "c497a93"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_82 = "c5a1cd2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_83 = "c7ac8a3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_83 = "2e77965"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_83 = "2f74e752"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_83 = "2e778113"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_84 = "ceb62eee"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_84 = "97e4f59c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_84 = "96e78315"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_84 = "97e4e554"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_85 = "383d6c7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_85 = "1525bcf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_85 = "512fd4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_85 = "1524995"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_86 = "1498d6c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_86 = "6abfbef6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_86 = "6bbccb97"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_86 = "6abfadd6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_87 = "f624c3de"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_87 = "d42dd65"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_87 = "d52e7456"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_87 = "d42d1217"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_88 = "fe81a17"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_88 = "3d9a67e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_88 = "3c99119"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_88 = "3d9a7658"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_89 = "8921a6d6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_89 = "a77c536"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_89 = "a64bcd8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_89 = "a77da99"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_90 = "1ffde8f4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_90 = "1752cf5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_90 = "1176589b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_90 = "1753eda"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_91 = "bf1a96b5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_91 = "79e2bb44"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_91 = "78e1c55a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_91 = "79e2a31b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_92 = "febe4b3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_92 = "e351e56"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_92 = "e253611d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_92 = "e3575c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_93 = "279bd2c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_93 = "4cbd789"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_93 = "4dbeddc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_93 = "4cbd6b9d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_94 = "7b76e78a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_94 = "b62ad52"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_94 = "b729a99f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_94 = "b62acfde"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_95 = "98ac4542"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_95 = "1f982cb3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_95 = "1e9b525e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_95 = "1f98341f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_96 = "c8fade27"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_96 = "8958b2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_96 = "886fe21"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_96 = "895986"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_97 = "984ee3ef"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_97 = "f272e9c9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_97 = "f3719ae"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_97 = "f272fca1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_98 = "a84158"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_98 = "5be7a75"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_98 = "5ae36a3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_98 = "5be6e2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_99 = "d2496b76"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_99 = "c54ddcee"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_99 = "c44ea362"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_99 = "c54dc523"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_100 = "6a6b482a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_100 = "2ebb3e3f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_100 = "2fb84f25"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_100 = "2ebb2964"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_101 = "b4a8a79"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_101 = "98289fd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_101 = "992bebe4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_101 = "98288da5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_102 = "f496debf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_102 = "195e45c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_102 = "9697a7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_102 = "195f1e6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_103 = "ba479199"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_103 = "6b34359"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_103 = "6a366"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_103 = "6b35627"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_104 = "4a9d9631"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_104 = "d47a9e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_104 = "d573dc29"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_104 = "d47ba68"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_105 = "aa75c887"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_105 = "3dde829"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_105 = "3cdd78e8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_105 = "3dde1ea9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_106 = "8f496da7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_106 = "a74b9bde"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_106 = "a648e4ab"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_106 = "a74b82ea"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_107 = "3b45aa66"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_107 = "1b8fee"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_107 = "11bb816a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_107 = "1b8e72b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_108 = "372f97d1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_108 = "7a265214"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_108 = "7b252d2d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_108 = "7a264b6c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_109 = "d4ac8f4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_109 = "e393bf4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_109 = "e29c9ec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_109 = "e393afad"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_110 = "6bd9a3b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_110 = "4d1f6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_110 = "4c275af"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_110 = "4d113ee"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_111 = "7437bc7e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_111 = "b66e6886"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_111 = "b76d1e6e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_111 = "b66e782f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_112 = "e6bfcb9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_112 = "1fdbc58"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_112 = "1ed8ba31"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_112 = "1fdbdc7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_113 = "9b78d1f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_113 = "8949519a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_113 = "884a26f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_113 = "89494b1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_114 = "e2554e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_114 = "f2b6b2f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_114 = "f3b5c2b3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_114 = "f2b6a4f2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_115 = "d83f6ed"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_115 = "5c2414f3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_115 = "5d276f72"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_115 = "5c24933"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_116 = "5ee14c8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_116 = "c591753"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_116 = "c492b35"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_116 = "c5916d74"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_117 = "17f156cc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_117 = "2efec355"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_117 = "2ffdb7f4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_117 = "2efed1b5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_118 = "9a4a49b9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_118 = "986c21f1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_118 = "996f53b7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_118 = "986c35f6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_119 = "abc94e2f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_119 = "1d98e59"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_119 = "dafc76"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_119 = "1d99a37"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_120 = "16f321"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_120 = "6b46eac1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_120 = "6a459839"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_120 = "6b46fe78"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_121 = "cfbc3f7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_121 = "d4b473d5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_121 = "d5b74f8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_121 = "d4b462b9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_122 = "1d6488a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_122 = "3e21de92"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_122 = "3f22abb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_122 = "3e21c6fa"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_123 = "25dfd87"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_123 = "a78f3bd1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_123 = "a68c4d7a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_123 = "a78f2b3b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_124 = "65b88463"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_124 = "1fc993b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_124 = "11ffe93d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_124 = "1fc8f7c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_125 = "9e87a2f3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_125 = "7a69ebaf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_125 = "7b6a95fc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_125 = "7a69f3bd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_126 = "2b1d63a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_126 = "e3d74646"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_126 = "e2d431bf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_126 = "e3d757fe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_127 = "3f56b26a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_127 = "4d44a8f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_127 = "4c47da7e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_127 = "4d44bc3f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_128 = "7b5e5fd6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_128 = "b6b2326"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_128 = "b7b146c1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_128 = "b6b228"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_129 = "fbeafe97"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_129 = "21f9541"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_129 = "211ce28"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_129 = "21f84c1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_130 = "9786a75f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_130 = "898cf2fa"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_130 = "888f8f43"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_130 = "898ce92"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_131 = "7f39eff"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_131 = "f2fa5d2b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_131 = "f3f92b2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_131 = "f2fa4d43"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_132 = "3d6e6638"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_132 = "5c67a78"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_132 = "5d64d7c5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_132 = "5c67b184"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_133 = "8582e977"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_133 = "c5d551f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_133 = "c4d67384"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_133 = "c5d515c5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_134 = "42eec55f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_134 = "2f426da6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_134 = "2e411c47"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_134 = "2f427a6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_135 = "6c3a1fb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_135 = "98affb8d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_135 = "99acb86"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_135 = "98afde47"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_136 = "4fd3acc5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_136 = "21d57f4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_136 = "31e24c9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_136 = "21d4288"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_137 = "86846eb9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_137 = "6b8abc5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_137 = "6a89c88"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_137 = "6b8aa6c9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_138 = "3123c1b4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_138 = "d4f815c4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_138 = "d5fb6d4b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_138 = "d4f8ba"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_139 = "2a43b91"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_139 = "3e657cf4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_139 = "3f669a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_139 = "3e656f4b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_140 = "be97fd3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_140 = "a7d2c6c4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_140 = "a6d1b5cd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_140 = "a7d2d38c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_141 = "1b865486"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_141 = "11422b1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_141 = "143518c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_141 = "11437cd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_142 = "598be41"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_142 = "7aad8466"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_142 = "7baefa4f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_142 = "7aad9ce"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_143 = "ac67649a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_143 = "e41b1ebf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_143 = "e51866e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_143 = "e41b4f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_144 = "bef7aae"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_144 = "4d887298"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_144 = "4c8b2d1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_144 = "4d88649"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_145 = "6ac761a8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_145 = "b6f5df55"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_145 = "b7f6ae9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_145 = "b6f5c8d1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_146 = "ddc6ebac"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_146 = "2633491"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_146 = "2164b53"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_146 = "2632d12"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_147 = "6921d5c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_147 = "89d887b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_147 = "88d3f712"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_147 = "89d9153"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_148 = "9d2689db"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_148 = "f33de6c8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_148 = "f23e93d5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_148 = "f33df594"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_149 = "3848a28b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_149 = "5cab4125"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_149 = "5da83f94"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_149 = "5cab59d5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_150 = "c6aade58"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_150 = "c618a728"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_150 = "c71bd857"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_150 = "c618be16"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_151 = "ed243e95"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_151 = "2f863a2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_151 = "2e854416"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_151 = "2f862257"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_152 = "85ea5ad5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_152 = "98f391c3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_152 = "99fed9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_152 = "98f38698"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_153 = "ddfb5171"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_153 = "26ffb1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_153 = "3638c98"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_153 = "26ead9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_154 = "352cf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_154 = "6bce5b33"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_154 = "6acd295b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_154 = "6bce4f1a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_155 = "1bdc827"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_155 = "d53ba9b1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_155 = "d438d51a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_155 = "d53bb35b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_156 = "2e496ce"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_156 = "3ea9735"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_156 = "3faa71dd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_156 = "3ea9179c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_157 = "49375a1c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_157 = "a81668fe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_157 = "a9151d9c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_157 = "a8167bdd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_158 = "a51beb4b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_158 = "1183fa5a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_158 = "18865f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_158 = "1183e1e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_159 = "bef3ce1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_159 = "7af158"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_159 = "7bf2221e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_159 = "7af1445f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_160 = "88cc1cd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_160 = "e45eb9fe"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_160 = "e55dcee1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_160 = "e45ea8a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_161 = "da24b45a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_161 = "4dcc1b41"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_161 = "4ccf6aa"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_161 = "4dccce1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_162 = "9212251c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_162 = "b7396e5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_162 = "b63a1763"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_162 = "b7397122"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_163 = "65c91813"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_163 = "2a6c197"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_163 = "21a5b322"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_163 = "2a6d563"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_164 = "2fa59ea"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_164 = "8a142ae6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_164 = "8b175fe5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_164 = "8a1439a4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_165 = "3ec7285b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_165 = "f3818824"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_165 = "f282fba4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_165 = "f3819de5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_166 = "847ed777"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_166 = "5cef21a4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_166 = "5dec6467"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_166 = "5cef226"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_167 = "63eb2b38"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_167 = "c65c735c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_167 = "c75f26"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_167 = "c65c6667"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_168 = "83cfc4b7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_168 = "2fc9d36"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_168 = "2ecaace9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_168 = "2fc9caa8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_169 = "3425155"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_169 = "9937392c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_169 = "983448a8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_169 = "99372ee9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_170 = "1d24f97c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_170 = "2a483a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_170 = "3a7f56b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_170 = "2a4932a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_171 = "42538736"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_171 = "6c11ec93"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_171 = "6d12912a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_171 = "6c11f76b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_172 = "356827e3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_172 = "d57f4d2a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_172 = "d47c3ded"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_172 = "d57f5bac"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_173 = "166b24b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_173 = "3eeca925"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_173 = "3fefd9ac"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_173 = "3eecbfed"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_174 = "f71ff9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_174 = "a85a3543"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_174 = "a959426f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_174 = "a85a242e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_175 = "9a1a536"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_175 = "11c7996"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_175 = "1c4ee2e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_175 = "11c7886f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_176 = "b5cfbe9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_176 = "7b34fff2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_176 = "7a378af1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_176 = "7b34ecb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_177 = "9945839"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_177 = "e4a24c19"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_177 = "e5a136b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_177 = "e4a25f1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_178 = "cc3dfa8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_178 = "4efa15"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_178 = "4fcd373"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_178 = "4efb532"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_179 = "42ff9c1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_179 = "b77d783"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_179 = "b67e7f32"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_179 = "b77d1973"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_180 = "cba99a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_180 = "2ea66a4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_180 = "21e91bf5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_180 = "2ea7db4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_181 = "477461bb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_181 = "8a57f4ce"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_181 = "8b5487b4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_181 = "8a57e1f5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_182 = "da5a117b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_182 = "f3c55f7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_182 = "f2c6277"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_182 = "f3c54636"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_183 = "8647d1b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_183 = "5d32bd92"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_183 = "5c31cc36"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_183 = "5d32aa77"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_184 = "731926e1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_184 = "c6a1a1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_184 = "c7a368f9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_184 = "c6aeb8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_185 = "2e2d14d7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_185 = "3d66d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_185 = "31e14b8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_185 = "3d72f9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_186 = "27c41184"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_186 = "997ac51e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_186 = "9879b17b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_186 = "997ad73a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_187 = "7e9c1127"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_187 = "2e82f2e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_187 = "3eb5d3a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_187 = "2e83b7b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_188 = "1f1ba8ec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_188 = "6c558adb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_188 = "6d56f9fd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_188 = "6c559fbc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_189 = "5da321a4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_189 = "d5c31ba2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_189 = "d4c65bc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_189 = "d5c33fd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_190 = "5811f26"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_190 = "3f37cfd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_190 = "3e33e7f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_190 = "3f3683e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_191 = "bd244f6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_191 = "a89dc34f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_191 = "a99eaa3e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_191 = "a89dcc7f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_192 = "e4b326c1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_192 = "12b261"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_192 = "1385681"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_192 = "12b3c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_193 = "ec632c2f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_193 = "7b78811"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_193 = "7a7bf34"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_193 = "7b78951"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_194 = "6a2bb51d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_194 = "e4e5ef8f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_194 = "e5e69f3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_194 = "e4e5f942"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_195 = "e63f893f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_195 = "4e534fd9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_195 = "4f53bc2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_195 = "4e535d83"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_196 = "75f4ab92"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_196 = "b7cd69c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_196 = "b6c3a785"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_196 = "b7cc1c4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_197 = "65a1e367"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_197 = "212e385"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_197 = "22d444"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_197 = "212e265"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_198 = "bfd5d1fc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_198 = "8a9b9268"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_198 = "8b98ec7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_198 = "8a9b8a46"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_199 = "f61e739"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_199 = "f48f776"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_199 = "f5b88c6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_199 = "f48ee87"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_200 = "2e781b95"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_200 = "5d764b56"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_200 = "5c753489"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_200 = "5d7652c8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_201 = "436474c1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_201 = "c6e3a312"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_201 = "c7ed148"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_201 = "c6e3b79"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_202 = "9a8254"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_202 = "35117e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_202 = "31527db"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_202 = "3511b4a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_203 = "8c72d3c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_203 = "99be6ea"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_203 = "98bd19ca"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_203 = "99be7f8b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_204 = "ca23fa13"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_204 = "32bf46c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_204 = "228858d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_204 = "32be3cc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_205 = "91bba56"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_205 = "6c995225"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_205 = "6d9a2e4c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_205 = "6c9948d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_206 = "24b9a61a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_206 = "d66b4b7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_206 = "d75caf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_206 = "d66ac4e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_207 = "39d6c3dd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_207 = "3f74921"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_207 = "3e7776ce"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_207 = "3f7418f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_208 = "a7c1686d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_208 = "a8e1615d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_208 = "a9e21291"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_208 = "a8e174d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_209 = "ae8fda"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_209 = "124ec2ea"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_209 = "134dbf5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_209 = "124ed911"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_210 = "35e913b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_210 = "7bbc2cc3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_210 = "7abf5b13"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_210 = "7bbc3d52"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_211 = "241825b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_211 = "e529bdbf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_211 = "e42ac7d2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_211 = "e529a193"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_212 = "27f468"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_212 = "4e97131c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_212 = "4f946395"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_212 = "4e975d4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_213 = "259a68a9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_213 = "b847793"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_213 = "b97c54"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_213 = "b846a15"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_214 = "82586be4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_214 = "2171c33e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_214 = "272a817"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_214 = "2171ce56"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_215 = "19123de"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_215 = "8adf293b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_215 = "8bdc54d6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_215 = "8adf3297"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_216 = "4c1ca4c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_216 = "f44c83e3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_216 = "f54ff99"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_216 = "f44c96d8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_217 = "69bfd75d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_217 = "5db9e5d7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_217 = "5cba9d58"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_217 = "5db9fb19"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_218 = "625f51e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_218 = "c72746ab"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_218 = "c624391b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_218 = "c7275f5a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_219 = "1d2a526"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_219 = "394d11a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_219 = "3197a5da"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_219 = "394c39b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_220 = "245d41f2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_220 = "9a2315"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_220 = "9b1419d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_220 = "9a227dc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_221 = "a8b8f49"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_221 = "36f9961"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_221 = "26cea5c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_221 = "36f8c1d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_222 = "f565bc95"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_222 = "6cdcd594"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_222 = "6ddf961f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_222 = "6cdcf5e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_223 = "36fff4e8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_223 = "d64a45b4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_223 = "d74932de"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_223 = "d64a549f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_224 = "1f4ba35c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_224 = "3fb7aaa8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_224 = "3eb4dea1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_224 = "3fb7b8e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_225 = "7f877d2f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_225 = "a925c93"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_225 = "a8267b6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_225 = "a9251d21"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_226 = "5817fb2f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_226 = "12929ce4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_226 = "1391e723"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_226 = "12928162"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_227 = "14399edf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_227 = "7bffffd5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_227 = "7afc83e2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_227 = "7bffe5a3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_228 = "bf7564bd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_228 = "e56d5ef4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_228 = "e46e2fa5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_228 = "e56d49e4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_229 = "d9c8cf6b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_229 = "4edab8a9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_229 = "4fd9c864"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_229 = "4edaae25"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_230 = "ba1f4fd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_230 = "b8489e2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_230 = "b94b7427"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_230 = "b8481266"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_231 = "386d71c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_231 = "21b562df"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_231 = "2b61e6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_231 = "21b576a7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_232 = "9516882"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_232 = "8b22c7c7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_232 = "8a21bca9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_232 = "8b22dae8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_233 = "ca5f477"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_233 = "f492ce7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_233 = "f5935968"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_233 = "f493f29"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_234 = "23b8d33"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_234 = "5dfdbbaa"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_234 = "5cfec52b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_234 = "5dfda36a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_235 = "2cdccb9a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_235 = "c76b26b8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_235 = "c66861ea"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_235 = "c76b7ab"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_236 = "e5c1839a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_236 = "3d87c7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_236 = "31dbdad"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_236 = "3d86bec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_237 = "aafdf9"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_237 = "9a45c565"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_237 = "9b46b66c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_237 = "9a45d2d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_238 = "336dd13"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_238 = "3b3237e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_238 = "2b522f"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_238 = "3b3346e"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_239 = "6a8c54df"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_239 = "6d287dd"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_239 = "6c23feee"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_239 = "6d298af"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_240 = "c285dde"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_240 = "d68de85c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_240 = "d78e9ab1"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_240 = "d68dfcf"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_241 = "941d338"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_241 = "3ffb7e43"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_241 = "3ef877"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_241 = "3ffb6131"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_242 = "c16adcce"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_242 = "a968d662"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_242 = "a86ba333"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_242 = "a968c572"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_243 = "a61a4889"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_243 = "12d63e3d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_243 = "13d54ff2"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_243 = "12d629b3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_244 = "92d19f83"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_244 = "7c43945"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_244 = "7d4ebb5"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_244 = "7c438df4"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_245 = "aba5389"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_245 = "e5be648"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_245 = "e4b39474"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_245 = "e5bf235"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_246 = "5c7e354c"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_246 = "4f1e4ccc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_246 = "4e1d337"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_246 = "4f1e5676"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_247 = "93b346e3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_247 = "b88ba997"
- In HKEY_CURRENT_USER\Software\Administrator914
- A3_247 = "b988dcf6"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_247 = "b88bbab7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_248 = "1dc8d346"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_248 = "21f9b39"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %Windows%\Explorer.EXE = "%Windows%\Explorer.EXE:*:Enabled:ipsec"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- 1768776769 = "f7"
- In HKEY_CURRENT_USER\Software\Administrator914\-993627007
- 253949253 = "13b"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- EnableFirewall = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DoNotAllowExceptions = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %User Temp%\winbawdh.exe = "%User Temp%\winbawdh.exe:*:Enabled:ipsec"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_0 = "82"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_1 = "696d64c3"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_2 = "c84dc"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_2 = "d2dace4d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_2 = "d2dac8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_3 = "e48669d"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_3 = "3c482ac"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_3 = "3c482c41"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_4 = "b76fdd5a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_4 = "a5b597cb"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_4 = "a5b59186"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_5 = "d7ecb91b"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_5 = "f22f38a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_5 = "f22f5c7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_6 = "6a4a15d8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_6 = "7895f49"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_6 = "789594"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_7 = "3933f199"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_7 = "e1fdbb8"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_7 = "e1fdbd45"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_8 = "59b16e56"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_8 = "4b6b24c7"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_8 = "4b6b228a"
- In HKEY_CURRENT_USER\Software\Administrator914
- A1_9 = "6c16ca17"
- In HKEY_CURRENT_USER\Software\Administrator914
- A2_9 = "b4d8886"
- In HKEY_CURRENT_USER\Software\Administrator914
- A4_9 = "b4d886cb"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %User Temp%\winqfnmit.exe = "%User Temp%\winqfnmit.exe:*:Enabled:ipsec"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %User Temp%\winudqc.exe = "%User Temp%\winudqc.exe:*:Enabled:ipsec"
Step 5
Restore these modified registry values
Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = "2"
To: Hidden = ""2""
- From: Hidden = "2"
Step 6
Search and delete these components
- %User Temp%\winunjjcc.exe
- %System%\drivers\mlhdj.sys
- %User Temp%\xnytl.exe
- %User Temp%\winxswub.exe
- %User Temp%\winbawdh.exe
- B:\10356
- %System Root%\1075d
- D:\10b74
- %User Temp%\winqfnmit.exe
- E:\10faa
- F:\113c1
- G:\117e8
- %User Temp%\winmsyb.exe
- H:\11bff
- %User Temp%\winudqc.exe
- J:\12006
- J:\1241d
- K:\12834
- L:\12c3b
- %User Temp%\cmkrfg.exe
- %User Temp%\winbsfbx.exe
- M:\13061
- N:\13478
- O:\13880
- P:\13ce5
- Q:\140ec
- R:\14503
- S:\14987
- T:\14d9e
- U:\151a5
- W:\155bc
- W:\159b4
- Y:\15dbb
- Z:\161c2
- %User Temp%\xgjebh.exe
Step 7
Scan your computer with your Trend Micro product to delete files detected as PE_SALITY.EM-O. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 8
Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.
- %User Temp%\xgjebh.exe
Step 9
Restore these deleted registry keys/values from backup
*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- AppMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Base
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Boot Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Boot file system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- CryptSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- DcomLaunch
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmadmin
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmboot.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmio.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmload.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmserver
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- EventLog
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- File system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- HelpSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Netlogon
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- PCI Configuration
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- PlugPlay
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- PNP Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Primary disk
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- RpcSs
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- SCSI Class
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- sermouse.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- sr.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- SRService
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- System Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- vga.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- vgasave.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- WinMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {36FC9E60-C465-11CF-8056-444553540000}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E965-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E967-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E969-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E96A-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E96B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E96F-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E977-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E97B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E97D-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E980-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {71A27CDD-812A-11D0-BEC7-08002BE2092F}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- Minimal
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- AFD
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- AppMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Base
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Boot Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Boot file system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Browser
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- CryptSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- DcomLaunch
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Dhcp
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmadmin
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmboot.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmio.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmload.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmserver
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- DnsCache
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- EventLog
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- File system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- HelpSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- ip6fw.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- ipnat.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- LanmanServer
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- LanmanWorkstation
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- LmHosts
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Messenger
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NDIS
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NDIS Wrapper
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Ndisuio
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetBIOS
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetBIOSGroup
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetBT
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetDDEGroup
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Netlogon
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetMan
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- Network
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetworkProvider
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NtLmSsp
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PCI Configuration
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PlugPlay
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PNP Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PNP_TDI
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Primary disk
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdpcdd.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdpdd.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdpwd.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdsessmgr
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- RpcSs
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- SCSI Class
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- sermouse.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- SharedAccess
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- sr.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- SRService
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Streams Drivers
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- System Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Tcpip
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- TDI
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- tdpipe.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- tdtcp.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- termservice
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- vga.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- vgasave.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- WinMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- WZCSVC
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {36FC9E60-C465-11CF-8056-444553540000}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E965-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E967-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E969-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E96A-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E96B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E96F-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E972-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E973-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E974-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E975-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E977-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E97B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E97D-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E980-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {71A27CDD-812A-11D0-BEC7-08002BE2092F}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- Network
Did this description help? Tell us how we did.