別名:

Worm:Win32/Brontok.FFV (Microsoft); W32/Rontokbro.worm (McAfee); W32.SillyFDC (Symantec); Virus.Win32.Virut.ce (Kaspersky); Virus.Win32.Virut.ce (v) (Sunbelt); Win32.Virtob.Gen.12 (FSecure)

 プラットフォーム:

Windows 2000, Windows XP, Windows Server 2003

 危険度:
 ダメージ度:
 感染力:
 感染確認数:

  • マルウェアタイプ:
    トロイの木馬型

  • 破壊活動の有無:
    なし

  • 暗号化:
     

  • 感染報告の有無 :
    はい

  概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 213,504 bytes
タイプ EXE
メモリ常駐 はい
発見日 2012年4月23日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のフォルダを作成します。

  • %System%\dllchache

(註：%System%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\System"、Windows NT および 2000 の場合、"C:\WinNT\System32"、Windows XP および Server 2003 の場合、"C:\Windows\System32" です。)

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Blank AntiViri = "%System Root%\AUT0EXEC.BAT StartUp"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Secure64 = "%System%\dllcache\Regedit32.com StartUp"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Secure32 = "%System%\dllcache\Shell32.com StartUp"

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を変更します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe, %System%\M5VBVM60.EXE StartUp"

(註：変更前の上記レジストリ値は、「%Windows%\system32\userinit.exe,」となります。)

他のシステム変更

マルウェアは、以下のファイルを削除します。

  • %User Temp%\winnyxdb.exe
  • %User Temp%\klihd.exe

(註：%User Temp%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\Temp"、Windows NT の場合、"C:\Profiles\＜ユーザー名＞\TEMP"、Windows 2000、XP、Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\TEMP" です。)

マルウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Wilbert914
W3_33 = "aefaf276"

HKEY_CURRENT_USER\Software\Wilbert914
W4_33 = "aff99437"

HKEY_CURRENT_USER\Software\Wilbert914
W1_34 = "1229dc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_34 = "1265e68"

HKEY_CURRENT_USER\Software\Wilbert914
W3_34 = "13669bcf"

HKEY_CURRENT_USER\Software\Wilbert914
W4_34 = "1265fd8e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_35 = "35a2eebc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_35 = "74d279e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_35 = "75d1a4"

HKEY_CURRENT_USER\Software\Wilbert914
W4_35 = "74d266e5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_36 = "c157f865"

HKEY_CURRENT_USER\Software\Wilbert914
W2_36 = "d73ec977"

HKEY_CURRENT_USER\Software\Wilbert914
W3_36 = "d63db67d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_36 = "d73ed3c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_37 = "fcc41fc5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_37 = "39ab2d3f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_37 = "38a85fd2"

HKEY_CURRENT_USER\Software\Wilbert914
W4_37 = "39ab3993"

HKEY_CURRENT_USER\Software\Wilbert914
W1_38 = "9ff34b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_38 = "9c17bb27"

HKEY_CURRENT_USER\Software\Wilbert914
W3_38 = "9d14c4ab"

HKEY_CURRENT_USER\Software\Wilbert914
W4_38 = "9c17a2ea"

HKEY_CURRENT_USER\Software\Wilbert914
W1_39 = "43e35"

HKEY_CURRENT_USER\Software\Wilbert914
W2_39 = "fe842f69"

HKEY_CURRENT_USER\Software\Wilbert914
W3_39 = "ff876a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_39 = "fe84c41"

HKEY_CURRENT_USER\Software\Wilbert914
W1_40 = "17adab5b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_40 = "6f69a6"

HKEY_CURRENT_USER\Software\Wilbert914
W3_40 = "61f313d9"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CabinetState
FullPathAddress = "1"

HKEY_CURRENT_USER\Software\Wilbert914
W4_40 = "6f7598"

HKEY_CURRENT_USER\Software\Wilbert914
W1_41 = "3f436b6"

HKEY_CURRENT_USER\Software\Wilbert914
W2_41 = "c35ccbd4"

HKEY_CURRENT_USER\Software\Wilbert914
W3_41 = "c25fb8ae"

HKEY_CURRENT_USER\Software\Wilbert914
W4_41 = "c35cdeef"

HKEY_CURRENT_USER\Software\Wilbert914
W1_42 = "787be78"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

HKEY_CURRENT_USER\Software\Wilbert914
W2_42 = "25c951a6"

HKEY_CURRENT_USER\Software\Wilbert914
W3_42 = "24ca2e7"

HKEY_CURRENT_USER\Software\Wilbert914
W4_42 = "25c94846"

HKEY_CURRENT_USER\Software\Wilbert914
W1_43 = "cfed9cb"

HKEY_CURRENT_USER\Software\Wilbert914
W2_43 = "8835a8b5"

HKEY_CURRENT_USER\Software\Wilbert914
W3_43 = "8936d7dc"

HKEY_CURRENT_USER\Software\Wilbert914
W4_43 = "8835b19d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_44 = "af4168a8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_44 = "eaa2ee"

HKEY_CURRENT_USER\Software\Wilbert914
W3_44 = "eba17cb5"

HKEY_CURRENT_USER\Software\Wilbert914
W4_44 = "eaa21af4"

HKEY_CURRENT_USER\Software\Wilbert914
W1_45 = "47b3911"

HKEY_CURRENT_USER\Software\Wilbert914
W2_45 = "4de24b3"

HKEY_CURRENT_USER\Software\Wilbert914
W3_45 = "4cde2a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_45 = "4de844b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_46 = "577e351c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_46 = "af7afc63"

HKEY_CURRENT_USER\Software\Wilbert914
W3_46 = "ae798be3"

HKEY_CURRENT_USER\Software\Wilbert914
W4_46 = "af7aeda2"

HKEY_CURRENT_USER\Software\Wilbert914
W1_47 = "5e252eae"

HKEY_CURRENT_USER\Software\Wilbert914
W2_47 = "11e74b85"

HKEY_CURRENT_USER\Software\Wilbert914
W3_47 = "1e43b8"

HKEY_CURRENT_USER\Software\Wilbert914
W4_47 = "11e756f9"

HKEY_CURRENT_USER\Software\Wilbert914
W1_48 = "cc43981e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_48 = "7453d676"

HKEY_CURRENT_USER\Software\Wilbert914
W3_48 = "755a611"

HKEY_CURRENT_USER\Software\Wilbert914
W4_48 = "7453c5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_49 = "f5955cfc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_49 = "d6c3a3f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_49 = "d7c34fe6"

HKEY_CURRENT_USER\Software\Wilbert914
W4_49 = "d6c29a7"

HKEY_CURRENT_USER\Software\Wilbert914
W1_50 = "ee8be3b1"

HKEY_CURRENT_USER\Software\Wilbert914
W2_50 = "392c8a89"

HKEY_CURRENT_USER\Software\Wilbert914
W3_50 = "382ff4bf"

HKEY_CURRENT_USER\Software\Wilbert914
W4_50 = "392c92fe"

HKEY_CURRENT_USER\Software\Wilbert914
W1_51 = "f167d794"

HKEY_CURRENT_USER\Software\Wilbert914
W2_51 = "9b98e78"

HKEY_CURRENT_USER\Software\Wilbert914
W3_51 = "9a9b9a14"

HKEY_CURRENT_USER\Software\Wilbert914
W4_51 = "9b98fc55"

HKEY_CURRENT_USER\Software\Wilbert914
W1_52 = "6a8ff8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_52 = "fe57c98"

HKEY_CURRENT_USER\Software\Wilbert914
W3_52 = "ff63ed"

HKEY_CURRENT_USER\Software\Wilbert914
W4_52 = "fe565ac"

HKEY_CURRENT_USER\Software\Wilbert914
W1_53 = "64f2eb5a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_53 = "671dbf9"

HKEY_CURRENT_USER\Software\Wilbert914
W3_53 = "6172a942"

HKEY_CURRENT_USER\Software\Wilbert914
W4_53 = "671cf3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_54 = "463259d"

HKEY_CURRENT_USER\Software\Wilbert914
W2_54 = "c2de256e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_54 = "c3dd5e1b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_54 = "c2de385a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_55 = "94cad8fc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_55 = "254ab659"

HKEY_CURRENT_USER\Software\Wilbert914
W3_55 = "2449c7f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_55 = "254aa1b1"

HKEY_CURRENT_USER\Software\Wilbert914
W1_56 = "4dd1f4c7"

HKEY_CURRENT_USER\Software\Wilbert914
W2_56 = "87b71ca8"

HKEY_CURRENT_USER\Software\Wilbert914
W3_56 = "86b46d49"

HKEY_CURRENT_USER\Software\Wilbert914
W4_56 = "87b7b8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_57 = "34c6d1e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_57 = "ea2361c5"

HKEY_CURRENT_USER\Software\Wilbert914
W3_57 = "eb2121e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_57 = "ea23745f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_58 = "3da2a5e3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_58 = "4c8fcd1f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_58 = "4d8cbbf7"

HKEY_CURRENT_USER\Software\Wilbert914
W4_58 = "4c8fddb6"

HKEY_CURRENT_USER\Software\Wilbert914
W1_59 = "3c986e54"

HKEY_CURRENT_USER\Software\Wilbert914
W2_59 = "aefc5465"

HKEY_CURRENT_USER\Software\Wilbert914
W3_59 = "afff214c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_59 = "aefc47d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_60 = "18ff9d2"

HKEY_CURRENT_USER\Software\Wilbert914
W2_60 = "1168a982"

HKEY_CURRENT_USER\Software\Wilbert914
W3_60 = "16bd625"

HKEY_CURRENT_USER\Software\Wilbert914
W4_60 = "1168b64"

HKEY_CURRENT_USER\Software\Wilbert914
W1_61 = "cdc2b79"

HKEY_CURRENT_USER\Software\Wilbert914
W2_61 = "73d53cb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_61 = "72d67ffa"

HKEY_CURRENT_USER\Software\Wilbert914
W4_61 = "73d519bb"

HKEY_CURRENT_USER\Software\Wilbert914
W1_62 = "b296ab4b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_62 = "d641927e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_62 = "d742e553"

HKEY_CURRENT_USER\Software\Wilbert914
W4_62 = "d6418312"

HKEY_CURRENT_USER\Software\Wilbert914
W1_63 = "af6822f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_63 = "38adf872"

HKEY_CURRENT_USER\Software\Wilbert914
W3_63 = "39ae8a28"

HKEY_CURRENT_USER\Software\Wilbert914
W4_63 = "38adec69"

HKEY_CURRENT_USER\Software\Wilbert914
W1_64 = "7ec27499"

HKEY_CURRENT_USER\Software\Wilbert914
W2_64 = "9b1a4d39"

HKEY_CURRENT_USER\Software\Wilbert914
W3_64 = "9a193381"

HKEY_CURRENT_USER\Software\Wilbert914
W4_64 = "9b1a55c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_65 = "a19e924e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_65 = "fd86aeba"

HKEY_CURRENT_USER\Software\Wilbert914
W3_65 = "fc85d956"

HKEY_CURRENT_USER\Software\Wilbert914
W4_65 = "fd86bf17"

HKEY_CURRENT_USER\Software\Wilbert914
W1_66 = "9d3ccc2d"

HKEY_CURRENT_USER\Software\Wilbert914
W2_66 = "5ff33b48"

HKEY_CURRENT_USER\Software\Wilbert914
W3_66 = "5ef4e2f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_66 = "5ff3286e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_67 = "5bf2e397"

HKEY_CURRENT_USER\Software\Wilbert914
W2_67 = "c25f8a55"

HKEY_CURRENT_USER\Software\Wilbert914
W3_67 = "c35cf784"

HKEY_CURRENT_USER\Software\Wilbert914
W4_67 = "c25f91c5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_68 = "c9794a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_68 = "24cbebf6"

HKEY_CURRENT_USER\Software\Wilbert914
W3_68 = "25c89d5d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_68 = "24cbfb1c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_69 = "2a4c12a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_69 = "873875b"

HKEY_CURRENT_USER\Software\Wilbert914
W3_69 = "863b232"

HKEY_CURRENT_USER\Software\Wilbert914
W4_69 = "87386473"

HKEY_CURRENT_USER\Software\Wilbert914
W1_70 = "eabea19e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_70 = "e9a4d8f1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_70 = "e8a7ab8b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_70 = "e9a4cdca"

HKEY_CURRENT_USER\Software\Wilbert914
W1_71 = "2efbdef5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_71 = "4c112c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_71 = "4d12516"

HKEY_CURRENT_USER\Software\Wilbert914
W4_71 = "4c113721"

HKEY_CURRENT_USER\Software\Wilbert914
W1_72 = "5245ee21"

HKEY_CURRENT_USER\Software\Wilbert914
W2_72 = "ae7db28"

HKEY_CURRENT_USER\Software\Wilbert914
W3_72 = "af7ec639"

HKEY_CURRENT_USER\Software\Wilbert914
W4_72 = "ae7da78"

HKEY_CURRENT_USER\Software\Wilbert914
W1_73 = "32a27a8a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_73 = "1ea1213"

HKEY_CURRENT_USER\Software\Wilbert914
W3_73 = "11e96f8e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_73 = "1ea9cf"

HKEY_CURRENT_USER\Software\Wilbert914
W1_74 = "d5ff6d77"

HKEY_CURRENT_USER\Software\Wilbert914
W2_74 = "73566e93"

HKEY_CURRENT_USER\Software\Wilbert914
W3_74 = "72551567"

HKEY_CURRENT_USER\Software\Wilbert914
W4_74 = "73567326"

HKEY_CURRENT_USER\Software\Wilbert914
W1_75 = "1cfe265"

HKEY_CURRENT_USER\Software\Wilbert914
W2_75 = "d5c2cf3"

HKEY_CURRENT_USER\Software\Wilbert914
W3_75 = "d4c1ba3c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_75 = "d5c2dc7d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_76 = "18fabf83"

HKEY_CURRENT_USER\Software\Wilbert914
W2_76 = "382f5cde"

HKEY_CURRENT_USER\Software\Wilbert914
W3_76 = "392c2395"

HKEY_CURRENT_USER\Software\Wilbert914
W4_76 = "382f45d4"

HKEY_CURRENT_USER\Software\Wilbert914
W1_77 = "375d277"

HKEY_CURRENT_USER\Software\Wilbert914
W2_77 = "9a9bbd87"

HKEY_CURRENT_USER\Software\Wilbert914
W3_77 = "9b98c96a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_77 = "9a9baf2b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_78 = "afb4e7d2"

HKEY_CURRENT_USER\Software\Wilbert914
W2_78 = "fd864a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_78 = "fcb7ec3"

HKEY_CURRENT_USER\Software\Wilbert914
W4_78 = "fd81882"

HKEY_CURRENT_USER\Software\Wilbert914
W1_79 = "c4639d8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_79 = "5f7497dd"

HKEY_CURRENT_USER\Software\Wilbert914
W3_79 = "5e77e798"

HKEY_CURRENT_USER\Software\Wilbert914
W4_79 = "5f7481d9"

HKEY_CURRENT_USER\Software\Wilbert914
W1_80 = "25721563"

HKEY_CURRENT_USER\Software\Wilbert914
W2_80 = "c1ef31a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_80 = "ce38d71"

HKEY_CURRENT_USER\Software\Wilbert914
W4_80 = "c1eeb3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_81 = "576e9dc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_81 = "244d46ad"

HKEY_CURRENT_USER\Software\Wilbert914
W3_81 = "254e32c6"

HKEY_CURRENT_USER\Software\Wilbert914
W4_81 = "244d5487"

HKEY_CURRENT_USER\Software\Wilbert914
W1_82 = "f6bb9487"

HKEY_CURRENT_USER\Software\Wilbert914
W2_82 = "86b9a4d4"

HKEY_CURRENT_USER\Software\Wilbert914
W3_82 = "87badb9f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_82 = "86b9bdde"

HKEY_CURRENT_USER\Software\Wilbert914
W1_83 = "185947a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_83 = "e92636e1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_83 = "e8254174"

HKEY_CURRENT_USER\Software\Wilbert914
W4_83 = "e9262735"

HKEY_CURRENT_USER\Software\Wilbert914
W1_84 = "996cc1c1"

HKEY_CURRENT_USER\Software\Wilbert914
W2_84 = "4b928531"

HKEY_CURRENT_USER\Software\Wilbert914
W3_84 = "4a91f6cd"

HKEY_CURRENT_USER\Software\Wilbert914
W4_84 = "4b9298c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_85 = "9bdedcba"

HKEY_CURRENT_USER\Software\Wilbert914
W2_85 = "adfee9b"

HKEY_CURRENT_USER\Software\Wilbert914
W3_85 = "acfd9fa2"

HKEY_CURRENT_USER\Software\Wilbert914
W4_85 = "adfef9e3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_86 = "2ebeab72"

HKEY_CURRENT_USER\Software\Wilbert914
W2_86 = "16b79eb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_86 = "116857b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_86 = "16b633a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_87 = "e1775c3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_87 = "72d7d7d1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_87 = "73d4aad"

HKEY_CURRENT_USER\Software\Wilbert914
W4_87 = "72d7cc91"

HKEY_CURRENT_USER\Software\Wilbert914
W1_88 = "ab6d18ac"

HKEY_CURRENT_USER\Software\Wilbert914
W2_88 = "d54424b6"

HKEY_CURRENT_USER\Software\Wilbert914
W3_88 = "d44753a9"

HKEY_CURRENT_USER\Software\Wilbert914
W4_88 = "d54435e8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_89 = "7ef6e772"

HKEY_CURRENT_USER\Software\Wilbert914
W2_89 = "37b8dac"

HKEY_CURRENT_USER\Software\Wilbert914
W3_89 = "36b3f97e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_89 = "37b9f3f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_90 = "dd6fb9d5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_90 = "9a1d1c6c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_90 = "9b1e6ed7"

HKEY_CURRENT_USER\Software\Wilbert914
W4_90 = "9a1d896"

HKEY_CURRENT_USER\Software\Wilbert914
W1_91 = "bbca52c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_91 = "fc896af9"

HKEY_CURRENT_USER\Software\Wilbert914
W3_91 = "fd8a17ac"

HKEY_CURRENT_USER\Software\Wilbert914
W4_91 = "fc8971ed"

HKEY_CURRENT_USER\Software\Wilbert914
W1_92 = "a373e1d"

HKEY_CURRENT_USER\Software\Wilbert914
W2_92 = "5ef5c87c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_92 = "5ff6bd5"

HKEY_CURRENT_USER\Software\Wilbert914
W4_92 = "5ef5db44"

HKEY_CURRENT_USER\Software\Wilbert914
W1_93 = "c45d1b46"

HKEY_CURRENT_USER\Software\Wilbert914
W2_93 = "c16252dc"

HKEY_CURRENT_USER\Software\Wilbert914
W3_93 = "c6122da"

HKEY_CURRENT_USER\Software\Wilbert914
W4_93 = "c162449b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_94 = "6add18a3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_94 = "23cebf2a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_94 = "22cdcbb3"

HKEY_CURRENT_USER\Software\Wilbert914
W4_94 = "23ceadf2"

HKEY_CURRENT_USER\Software\Wilbert914
W1_95 = "5117b534"

HKEY_CURRENT_USER\Software\Wilbert914
W2_95 = "863bdbf"

HKEY_CURRENT_USER\Software\Wilbert914
W3_95 = "8738718"

HKEY_CURRENT_USER\Software\Wilbert914
W4_95 = "863b1749"

HKEY_CURRENT_USER\Software\Wilbert914
W1_96 = "c97da1f9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_96 = "e8a79419"

HKEY_CURRENT_USER\Software\Wilbert914
W3_96 = "e9a4e6e1"

HKEY_CURRENT_USER\Software\Wilbert914
W4_96 = "e8a78a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_97 = "6d85a449"

HKEY_CURRENT_USER\Software\Wilbert914
W2_97 = "4b13f5f5"

HKEY_CURRENT_USER\Software\Wilbert914
W3_97 = "4a18fb6"

HKEY_CURRENT_USER\Software\Wilbert914
W4_97 = "4b13e9f7"

HKEY_CURRENT_USER\Software\Wilbert914
W1_98 = "4bfc32f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_98 = "ad846d4"

HKEY_CURRENT_USER\Software\Wilbert914
W3_98 = "ac8335f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_98 = "ad8534e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_99 = "caa8d6f3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_99 = "fecad1d"

HKEY_CURRENT_USER\Software\Wilbert914
W3_99 = "eefdae4"

HKEY_CURRENT_USER\Software\Wilbert914
W4_99 = "fecbca5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_100 = "c2ac6b7"

HKEY_CURRENT_USER\Software\Wilbert914
W2_100 = "72593972"

HKEY_CURRENT_USER\Software\Wilbert914
W3_100 = "735a43bd"

HKEY_CURRENT_USER\Software\Wilbert914
W4_100 = "725925fc"

HKEY_CURRENT_USER\Software\Wilbert914
W1_101 = "3ee6fa6"

HKEY_CURRENT_USER\Software\Wilbert914
W2_101 = "d4c594ff"

HKEY_CURRENT_USER\Software\Wilbert914
W3_101 = "d5c6e912"

HKEY_CURRENT_USER\Software\Wilbert914
W4_101 = "d4c58f53"

HKEY_CURRENT_USER\Software\Wilbert914
W1_102 = "635cae4"

HKEY_CURRENT_USER\Software\Wilbert914
W2_102 = "3731e4e2"

HKEY_CURRENT_USER\Software\Wilbert914
W3_102 = "36329eeb"

HKEY_CURRENT_USER\Software\Wilbert914
W4_102 = "3731f8aa"

HKEY_CURRENT_USER\Software\Wilbert914
W1_103 = "935dc5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_103 = "999e73a1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_103 = "989d44"

HKEY_CURRENT_USER\Software\Wilbert914
W4_103 = "999e621"

HKEY_CURRENT_USER\Software\Wilbert914
W1_104 = "35a51e6"

HKEY_CURRENT_USER\Software\Wilbert914
W2_104 = "fcad22"

HKEY_CURRENT_USER\Software\Wilbert914
W3_104 = "fd9ad19"

HKEY_CURRENT_USER\Software\Wilbert914
W4_104 = "fcacb58"

HKEY_CURRENT_USER\Software\Wilbert914
W1_105 = "4dd4191"

HKEY_CURRENT_USER\Software\Wilbert914
W2_105 = "5e772c5f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_105 = "5f7452ee"

HKEY_CURRENT_USER\Software\Wilbert914
W4_105 = "5e7734af"

HKEY_CURRENT_USER\Software\Wilbert914
W1_106 = "d6ff8c5f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_106 = "ce3895e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_106 = "c1ef847"

HKEY_CURRENT_USER\Software\Wilbert914
W4_106 = "ce39e6"

HKEY_CURRENT_USER\Software\Wilbert914
W1_107 = "e73b274"

HKEY_CURRENT_USER\Software\Wilbert914
W2_107 = "23524f7"

HKEY_CURRENT_USER\Software\Wilbert914
W3_107 = "2253611c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_107 = "23575d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_108 = "ab22e8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_108 = "85bc557e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_108 = "84bf16f5"

HKEY_CURRENT_USER\Software\Wilbert914
W4_108 = "85bc7b4"

HKEY_CURRENT_USER\Software\Wilbert914
W1_109 = "b6123b5c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_109 = "e828c949"

HKEY_CURRENT_USER\Software\Wilbert914
W3_109 = "e92bbc4a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_109 = "e828dab"

HKEY_CURRENT_USER\Software\Wilbert914
W1_110 = "86cf43a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_110 = "4a955a4a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_110 = "4b962523"

HKEY_CURRENT_USER\Software\Wilbert914
W4_110 = "4a954362"

HKEY_CURRENT_USER\Software\Wilbert914
W1_111 = "fdc776ea"

HKEY_CURRENT_USER\Software\Wilbert914
W2_111 = "ad1bfb2"

HKEY_CURRENT_USER\Software\Wilbert914
W3_111 = "ac2caf8"

HKEY_CURRENT_USER\Software\Wilbert914
W4_111 = "ad1acb9"

HKEY_CURRENT_USER\Software\Wilbert914
W1_112 = "4d354e5e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_112 = "f6ebf"

HKEY_CURRENT_USER\Software\Wilbert914
W3_112 = "e6d751"

HKEY_CURRENT_USER\Software\Wilbert914
W4_112 = "f6e161"

HKEY_CURRENT_USER\Software\Wilbert914
W1_113 = "66c71431"

HKEY_CURRENT_USER\Software\Wilbert914
W2_113 = "71da6a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_113 = "7d91926"

HKEY_CURRENT_USER\Software\Wilbert914
W4_113 = "71da7f67"

HKEY_CURRENT_USER\Software\Wilbert914
W1_114 = "4f9677b2"

HKEY_CURRENT_USER\Software\Wilbert914
W2_114 = "d446fd4d"

HKEY_CURRENT_USER\Software\Wilbert914
W3_114 = "d5458eff"

HKEY_CURRENT_USER\Software\Wilbert914
W4_114 = "d446e8be"

HKEY_CURRENT_USER\Software\Wilbert914
W1_115 = "b2dae22b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_115 = "36b34663"

HKEY_CURRENT_USER\Software\Wilbert914
W3_115 = "37b3454"

HKEY_CURRENT_USER\Software\Wilbert914
W4_115 = "36b35215"

HKEY_CURRENT_USER\Software\Wilbert914
W1_116 = "d79bd616"

HKEY_CURRENT_USER\Software\Wilbert914
W2_116 = "991fa9b4"

HKEY_CURRENT_USER\Software\Wilbert914
W3_116 = "981cdd2d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_116 = "991fbb6c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_117 = "4f2f9998"

HKEY_CURRENT_USER\Software\Wilbert914
W2_117 = "fb8c3d88"

HKEY_CURRENT_USER\Software\Wilbert914
W3_117 = "fa8f4282"

HKEY_CURRENT_USER\Software\Wilbert914
W4_117 = "fb8c24c3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_118 = "825e24b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_118 = "5df89dc2"

HKEY_CURRENT_USER\Software\Wilbert914
W3_118 = "5cfbe85b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_118 = "5df88e1a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_119 = "328a62c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_119 = "c64ee37"

HKEY_CURRENT_USER\Software\Wilbert914
W3_119 = "c167913"

HKEY_CURRENT_USER\Software\Wilbert914
W4_119 = "c64f771"

HKEY_CURRENT_USER\Software\Wilbert914
W1_120 = "9cba89a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_120 = "22d17595"

HKEY_CURRENT_USER\Software\Wilbert914
W3_120 = "23d2689"

HKEY_CURRENT_USER\Software\Wilbert914
W4_120 = "22d16c8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_121 = "6ecb8fdc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_121 = "853dc584"

HKEY_CURRENT_USER\Software\Wilbert914
W3_121 = "843eac5e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_121 = "853dca1f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_122 = "bec4ae2c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_122 = "e7aa28d8"

HKEY_CURRENT_USER\Software\Wilbert914
W3_122 = "e6a95537"

HKEY_CURRENT_USER\Software\Wilbert914
W4_122 = "e7aa3376"

HKEY_CURRENT_USER\Software\Wilbert914
W1_123 = "327eab19"

HKEY_CURRENT_USER\Software\Wilbert914
W2_123 = "4a168c17"

HKEY_CURRENT_USER\Software\Wilbert914
W3_123 = "4b15fa8c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_123 = "4a169ccd"

HKEY_CURRENT_USER\Software\Wilbert914
W1_124 = "2af77fd"

HKEY_CURRENT_USER\Software\Wilbert914
W2_124 = "ac83123f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_124 = "ad8665"

HKEY_CURRENT_USER\Software\Wilbert914
W4_124 = "ac83624"

HKEY_CURRENT_USER\Software\Wilbert914
W1_125 = "2f59b122"

HKEY_CURRENT_USER\Software\Wilbert914
W2_125 = "eef7211"

HKEY_CURRENT_USER\Software\Wilbert914
W3_125 = "fec93a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_125 = "eef6f7b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_126 = "5426f18b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_126 = "715bc3c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_126 = "758be93"

HKEY_CURRENT_USER\Software\Wilbert914
W4_126 = "715bd8d2"

HKEY_CURRENT_USER\Software\Wilbert914
W1_127 = "bf483eb"

HKEY_CURRENT_USER\Software\Wilbert914
W2_127 = "d3c85794"

HKEY_CURRENT_USER\Software\Wilbert914
W3_127 = "d2cb2468"

HKEY_CURRENT_USER\Software\Wilbert914
W4_127 = "d3c84229"

HKEY_CURRENT_USER\Software\Wilbert914
W1_128 = "6d618d9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_128 = "3634bc45"

HKEY_CURRENT_USER\Software\Wilbert914
W3_128 = "3737cdc1"

HKEY_CURRENT_USER\Software\Wilbert914
W4_128 = "3634ab8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_129 = "a53d9f99"

HKEY_CURRENT_USER\Software\Wilbert914
W2_129 = "98a1cc"

HKEY_CURRENT_USER\Software\Wilbert914
W3_129 = "99a27296"

HKEY_CURRENT_USER\Software\Wilbert914
W4_129 = "98a114d7"

HKEY_CURRENT_USER\Software\Wilbert914
W1_130 = "edd6b36"

HKEY_CURRENT_USER\Software\Wilbert914
W2_130 = "fbd68ae"

HKEY_CURRENT_USER\Software\Wilbert914
W3_130 = "fae186f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_130 = "fbd7e2e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_131 = "2b536d7"

HKEY_CURRENT_USER\Software\Wilbert914
W2_131 = "5d79fe5f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_131 = "5c7a81c4"

HKEY_CURRENT_USER\Software\Wilbert914
W4_131 = "5d79e785"

HKEY_CURRENT_USER\Software\Wilbert914
W1_132 = "2ce21189"

HKEY_CURRENT_USER\Software\Wilbert914
W2_132 = "bfe64734"

HKEY_CURRENT_USER\Software\Wilbert914
W3_132 = "bee5369d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_132 = "bfe65dc"

HKEY_CURRENT_USER\Software\Wilbert914
W1_133 = "6d59ffd"

HKEY_CURRENT_USER\Software\Wilbert914
W2_133 = "2252ac15"

HKEY_CURRENT_USER\Software\Wilbert914
W3_133 = "2351dc72"

HKEY_CURRENT_USER\Software\Wilbert914
W4_133 = "2252ba33"

HKEY_CURRENT_USER\Software\Wilbert914
W1_134 = "7ee7b7d9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_134 = "84bf36b1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_134 = "85bc45cb"

HKEY_CURRENT_USER\Software\Wilbert914
W4_134 = "84bf238a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_135 = "9521a4b8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_135 = "e72b9797"

HKEY_CURRENT_USER\Software\Wilbert914
W3_135 = "e628eaa"

HKEY_CURRENT_USER\Software\Wilbert914
W4_135 = "e72b8ce1"

HKEY_CURRENT_USER\Software\Wilbert914
W1_136 = "fb3a8464"

HKEY_CURRENT_USER\Software\Wilbert914
W2_136 = "4997ead"

HKEY_CURRENT_USER\Software\Wilbert914
W3_136 = "4894979"

HKEY_CURRENT_USER\Software\Wilbert914
W4_136 = "4997f638"

HKEY_CURRENT_USER\Software\Wilbert914
W1_137 = "85c534d9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_137 = "ac445ae"

HKEY_CURRENT_USER\Software\Wilbert914
W3_137 = "ad739ce"

HKEY_CURRENT_USER\Software\Wilbert914
W4_137 = "ac45f8f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_138 = "5537e1ab"

HKEY_CURRENT_USER\Software\Wilbert914
W2_138 = "e7d911"

HKEY_CURRENT_USER\Software\Wilbert914
W3_138 = "f73aea7"

HKEY_CURRENT_USER\Software\Wilbert914
W4_138 = "e7c8e6"

HKEY_CURRENT_USER\Software\Wilbert914
W1_139 = "7cfccae7"

HKEY_CURRENT_USER\Software\Wilbert914
W2_139 = "7dd25aa"

HKEY_CURRENT_USER\Software\Wilbert914
W3_139 = "71de547c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_139 = "7dd323d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_140 = "f511b7cd"

HKEY_CURRENT_USER\Software\Wilbert914
W2_140 = "d34988d6"

HKEY_CURRENT_USER\Software\Wilbert914
W3_140 = "d24afdd5"

HKEY_CURRENT_USER\Software\Wilbert914
W4_140 = "d3499b94"

HKEY_CURRENT_USER\Software\Wilbert914
W1_141 = "6c36fbc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_141 = "35b61ab"

HKEY_CURRENT_USER\Software\Wilbert914
W3_141 = "34b562aa"

HKEY_CURRENT_USER\Software\Wilbert914
W4_141 = "35b64eb"

HKEY_CURRENT_USER\Software\Wilbert914
W1_142 = "899a1fd"

HKEY_CURRENT_USER\Software\Wilbert914
W2_142 = "982275ba"

HKEY_CURRENT_USER\Software\Wilbert914
W3_142 = "992183"

HKEY_CURRENT_USER\Software\Wilbert914
W4_142 = "98226e42"

HKEY_CURRENT_USER\Software\Wilbert914
W1_143 = "2ced62c8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_143 = "fa8ec258"

HKEY_CURRENT_USER\Software\Wilbert914
W3_143 = "fb8db1d8"

HKEY_CURRENT_USER\Software\Wilbert914
W4_143 = "fa8ed799"

HKEY_CURRENT_USER\Software\Wilbert914
W1_144 = "215cc625"

HKEY_CURRENT_USER\Software\Wilbert914
W2_144 = "5cfb537f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_144 = "5df826b1"

HKEY_CURRENT_USER\Software\Wilbert914
W4_144 = "5cfb4f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_145 = "a2c2b715"

HKEY_CURRENT_USER\Software\Wilbert914
W2_145 = "bf67bd"

HKEY_CURRENT_USER\Software\Wilbert914
W3_145 = "be64cc6"

HKEY_CURRENT_USER\Software\Wilbert914
W4_145 = "bf67aa47"

HKEY_CURRENT_USER\Software\Wilbert914
W1_146 = "d8a37eca"

HKEY_CURRENT_USER\Software\Wilbert914
W2_146 = "21d46a5"

HKEY_CURRENT_USER\Software\Wilbert914
W3_146 = "2d775df"

HKEY_CURRENT_USER\Software\Wilbert914
W4_146 = "21d4139e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_147 = "69761abb"

HKEY_CURRENT_USER\Software\Wilbert914
W2_147 = "8446ab2"

HKEY_CURRENT_USER\Software\Wilbert914
W3_147 = "85431ab4"

HKEY_CURRENT_USER\Software\Wilbert914
W4_147 = "8447cf5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_148 = "7ef6818"

HKEY_CURRENT_USER\Software\Wilbert914
W2_148 = "e6acf77"

HKEY_CURRENT_USER\Software\Wilbert914
W3_148 = "e7af8d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_148 = "e6ace64c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_149 = "57abb7f4"

HKEY_CURRENT_USER\Software\Wilbert914
W2_149 = "49195ddb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_149 = "481a29e2"

HKEY_CURRENT_USER\Software\Wilbert914
W4_149 = "49194fa3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_150 = "9217ca1"

HKEY_CURRENT_USER\Software\Wilbert914
W2_150 = "ab85af3f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_150 = "aa86debb"

HKEY_CURRENT_USER\Software\Wilbert914
W4_150 = "ab85b8fa"

HKEY_CURRENT_USER\Software\Wilbert914
W1_151 = "c4381b7"

HKEY_CURRENT_USER\Software\Wilbert914
W2_151 = "df235d"

HKEY_CURRENT_USER\Software\Wilbert914
W3_151 = "cf1441"

HKEY_CURRENT_USER\Software\Wilbert914
W4_151 = "df22251"

HKEY_CURRENT_USER\Software\Wilbert914
W1_152 = "678156a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_152 = "75e9ba"

HKEY_CURRENT_USER\Software\Wilbert914
W3_152 = "715dede9"

HKEY_CURRENT_USER\Software\Wilbert914
W4_152 = "75e8ba8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_153 = "43dd5782"

HKEY_CURRENT_USER\Software\Wilbert914
W2_153 = "d2cad135"

HKEY_CURRENT_USER\Software\Wilbert914
W3_153 = "d3c992be"

HKEY_CURRENT_USER\Software\Wilbert914
W4_153 = "d2caf4ff"

HKEY_CURRENT_USER\Software\Wilbert914
W1_154 = "9294f2"

HKEY_CURRENT_USER\Software\Wilbert914
W2_154 = "35374c4"

HKEY_CURRENT_USER\Software\Wilbert914
W3_154 = "34343817"

HKEY_CURRENT_USER\Software\Wilbert914
W4_154 = "35375e56"

HKEY_CURRENT_USER\Software\Wilbert914
W1_155 = "ca762e79"

HKEY_CURRENT_USER\Software\Wilbert914
W2_155 = "97a3d357"

HKEY_CURRENT_USER\Software\Wilbert914
W3_155 = "96aa1ec"

HKEY_CURRENT_USER\Software\Wilbert914
W4_155 = "97a3c7ad"

HKEY_CURRENT_USER\Software\Wilbert914
W1_156 = "b1d8eb57"

HKEY_CURRENT_USER\Software\Wilbert914
W2_156 = "fa12c86"

HKEY_CURRENT_USER\Software\Wilbert914
W3_156 = "fb135745"

HKEY_CURRENT_USER\Software\Wilbert914
W4_156 = "fa1314"

HKEY_CURRENT_USER\Software\Wilbert914
W1_157 = "b12e1d65"

HKEY_CURRENT_USER\Software\Wilbert914
W2_157 = "5c7c811b"

HKEY_CURRENT_USER\Software\Wilbert914
W3_157 = "5d7ffc1a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_157 = "5c7c9a5b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_158 = "18d76e7"

HKEY_CURRENT_USER\Software\Wilbert914
W2_158 = "bee91d7"

HKEY_CURRENT_USER\Software\Wilbert914
W3_158 = "bfea65f3"

HKEY_CURRENT_USER\Software\Wilbert914
W4_158 = "bee93b2"

HKEY_CURRENT_USER\Software\Wilbert914
W1_159 = "7c9a1444"

HKEY_CURRENT_USER\Software\Wilbert914
W2_159 = "215579a9"

HKEY_CURRENT_USER\Software\Wilbert914
W3_159 = "256b48"

HKEY_CURRENT_USER\Software\Wilbert914
W4_159 = "21556d9"

HKEY_CURRENT_USER\Software\Wilbert914
W1_160 = "f6cf7b35"

HKEY_CURRENT_USER\Software\Wilbert914
W2_160 = "83c1cf48"

HKEY_CURRENT_USER\Software\Wilbert914
W3_160 = "82c2b21"

HKEY_CURRENT_USER\Software\Wilbert914
W4_160 = "83c1d66"

HKEY_CURRENT_USER\Software\Wilbert914
W1_161 = "3e7f4bf8"

HKEY_CURRENT_USER\Software\Wilbert914
W2_161 = "e62e297f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_161 = "e72d59f6"

HKEY_CURRENT_USER\Software\Wilbert914
W4_161 = "e62e3fb7"

HKEY_CURRENT_USER\Software\Wilbert914
W1_162 = "ab7ad941"

HKEY_CURRENT_USER\Software\Wilbert914
W2_162 = "489ab88e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_162 = "4999cf4f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_162 = "489aa9e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_163 = "f8f2bbc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_163 = "ab7b2e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_163 = "aa47424"

HKEY_CURRENT_USER\Software\Wilbert914
W4_163 = "ab71265"

HKEY_CURRENT_USER\Software\Wilbert914
W1_164 = "bd26fdfa"

HKEY_CURRENT_USER\Software\Wilbert914
W2_164 = "d736ceb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_164 = "c71dfd"

HKEY_CURRENT_USER\Software\Wilbert914
W4_164 = "d737bbc"

HKEY_CURRENT_USER\Software\Wilbert914
W1_165 = "b44ab25"

HKEY_CURRENT_USER\Software\Wilbert914
W2_165 = "6fdff335"

HKEY_CURRENT_USER\Software\Wilbert914
W3_165 = "6edc8352"

HKEY_CURRENT_USER\Software\Wilbert914
W4_165 = "6fdfe513"

HKEY_CURRENT_USER\Software\Wilbert914
W1_166 = "2cc7ca9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_166 = "d24c5c96"

HKEY_CURRENT_USER\Software\Wilbert914
W3_166 = "d34f282b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_166 = "d24c4e6a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_167 = "53956b8c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_167 = "34b82c79"

HKEY_CURRENT_USER\Software\Wilbert914
W3_167 = "35bbd18"

HKEY_CURRENT_USER\Software\Wilbert914
W4_167 = "34b8b7c1"

HKEY_CURRENT_USER\Software\Wilbert914
W1_168 = "25ef5757"

HKEY_CURRENT_USER\Software\Wilbert914
W2_168 = "972535a1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_168 = "96264759"

HKEY_CURRENT_USER\Software\Wilbert914
W4_168 = "97252118"

HKEY_CURRENT_USER\Software\Wilbert914
W1_169 = "1c3a473b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_169 = "f991917d"

HKEY_CURRENT_USER\Software\Wilbert914
W3_169 = "f892ec2e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_169 = "f9918a6f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_170 = "1dbb65"

HKEY_CURRENT_USER\Software\Wilbert914
W2_170 = "5bfdfc5d"

HKEY_CURRENT_USER\Software\Wilbert914
W3_170 = "5afe9587"

HKEY_CURRENT_USER\Software\Wilbert914
W4_170 = "5bfdf3c6"

HKEY_CURRENT_USER\Software\Wilbert914
W1_171 = "2d8c364b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_171 = "be6a432"

HKEY_CURRENT_USER\Software\Wilbert914
W3_171 = "bf693b5c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_171 = "be6a5d1d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_172 = "5454dc3a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_172 = "2d6df4a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_172 = "21d5a35"

HKEY_CURRENT_USER\Software\Wilbert914
W4_172 = "2d6c674"

HKEY_CURRENT_USER\Software\Wilbert914
W1_173 = "8e258af5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_173 = "83435d5"

HKEY_CURRENT_USER\Software\Wilbert914
W3_173 = "824498a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_173 = "83432fcb"

HKEY_CURRENT_USER\Software\Wilbert914
W1_174 = "979cb79"

HKEY_CURRENT_USER\Software\Wilbert914
W2_174 = "e5af85a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_174 = "e4acff63"

HKEY_CURRENT_USER\Software\Wilbert914
W4_174 = "e5af9922"

HKEY_CURRENT_USER\Software\Wilbert914
W1_175 = "87867ad"

HKEY_CURRENT_USER\Software\Wilbert914
W2_175 = "481c1cbb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_175 = "491f6438"

HKEY_CURRENT_USER\Software\Wilbert914
W4_175 = "481c279"

HKEY_CURRENT_USER\Software\Wilbert914
W1_176 = "74266183"

HKEY_CURRENT_USER\Software\Wilbert914
W2_176 = "aa8875f8"

HKEY_CURRENT_USER\Software\Wilbert914
W3_176 = "ab8bd91"

HKEY_CURRENT_USER\Software\Wilbert914
W4_176 = "aa886bd"

HKEY_CURRENT_USER\Software\Wilbert914
W1_177 = "aa52a575"

HKEY_CURRENT_USER\Software\Wilbert914
W2_177 = "cf4c76f"

HKEY_CURRENT_USER\Software\Wilbert914
W3_177 = "df7b366"

HKEY_CURRENT_USER\Software\Wilbert914
W4_177 = "cf4d527"

HKEY_CURRENT_USER\Software\Wilbert914
W1_178 = "653d29c3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_178 = "6f611f66"

HKEY_CURRENT_USER\Software\Wilbert914
W3_178 = "6e62583f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_178 = "6f613e7e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_179 = "9bad589"

HKEY_CURRENT_USER\Software\Wilbert914
W2_179 = "d1cdbe31"

HKEY_CURRENT_USER\Software\Wilbert914
W3_179 = "dcec194"

HKEY_CURRENT_USER\Software\Wilbert914
W4_179 = "d1cda7d5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_180 = "9b1c217"

HKEY_CURRENT_USER\Software\Wilbert914
W2_180 = "343a854"

HKEY_CURRENT_USER\Software\Wilbert914
W3_180 = "3539776d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_180 = "343a112c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_181 = "6c87e6db"

HKEY_CURRENT_USER\Software\Wilbert914
W2_181 = "96a66c4e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_181 = "97a51cc2"

HKEY_CURRENT_USER\Software\Wilbert914
W4_181 = "96a67a83"

HKEY_CURRENT_USER\Software\Wilbert914
W1_182 = "9ddf94"

HKEY_CURRENT_USER\Software\Wilbert914
W2_182 = "f912fe38"

HKEY_CURRENT_USER\Software\Wilbert914
W3_182 = "f811859b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_182 = "f912e3da"

HKEY_CURRENT_USER\Software\Wilbert914
W1_183 = "d5f29d74"

HKEY_CURRENT_USER\Software\Wilbert914
W2_183 = "5b7f56e9"

HKEY_CURRENT_USER\Software\Wilbert914
W3_183 = "5a7c2b7"

HKEY_CURRENT_USER\Software\Wilbert914
W4_183 = "5b7f4d31"

HKEY_CURRENT_USER\Software\Wilbert914
W1_184 = "698dbdc"

HKEY_CURRENT_USER\Software\Wilbert914
W2_184 = "bdeba5ca"

HKEY_CURRENT_USER\Software\Wilbert914
W3_184 = "bce8dc9"

HKEY_CURRENT_USER\Software\Wilbert914
W4_184 = "bdebb688"

HKEY_CURRENT_USER\Software\Wilbert914
W1_185 = "167e169b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_185 = "258921"

HKEY_CURRENT_USER\Software\Wilbert914
W3_185 = "215b799e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_185 = "2581fdf"

HKEY_CURRENT_USER\Software\Wilbert914
W1_186 = "41aa616f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_186 = "82c497f8"

HKEY_CURRENT_USER\Software\Wilbert914
W3_186 = "83c7ef77"

HKEY_CURRENT_USER\Software\Wilbert914
W4_186 = "82c48936"

HKEY_CURRENT_USER\Software\Wilbert914
W1_187 = "48eca7d5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_187 = "e53e7f1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_187 = "e43394cc"

HKEY_CURRENT_USER\Software\Wilbert914
W4_187 = "e53f28d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_188 = "5d64aa9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_188 = "479d4de"

HKEY_CURRENT_USER\Software\Wilbert914
W3_188 = "469e3da5"

HKEY_CURRENT_USER\Software\Wilbert914
W4_188 = "479d5be4"

HKEY_CURRENT_USER\Software\Wilbert914
W1_189 = "1a223bfa"

HKEY_CURRENT_USER\Software\Wilbert914
W2_189 = "aa9d8eb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_189 = "abaa37a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_189 = "aa9c53b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_190 = "2c92346"

HKEY_CURRENT_USER\Software\Wilbert914
W2_190 = "c763a2b"

HKEY_CURRENT_USER\Software\Wilbert914
W3_190 = "d7548d3"

HKEY_CURRENT_USER\Software\Wilbert914
W4_190 = "c762e92"

HKEY_CURRENT_USER\Software\Wilbert914
W1_191 = "b54f8d3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_191 = "6ee2b223"

HKEY_CURRENT_USER\Software\Wilbert914
W3_191 = "6fe1f1a8"

HKEY_CURRENT_USER\Software\Wilbert914
W4_191 = "6ee297e9"

HKEY_CURRENT_USER\Software\Wilbert914
W1_192 = "f4bde869"

HKEY_CURRENT_USER\Software\Wilbert914
W2_192 = "d14f1abb"

HKEY_CURRENT_USER\Software\Wilbert914
W3_192 = "d4c671"

HKEY_CURRENT_USER\Software\Wilbert914
W4_192 = "d14f14"

HKEY_CURRENT_USER\Software\Wilbert914
W1_193 = "6b85142"

HKEY_CURRENT_USER\Software\Wilbert914
W2_193 = "33bb7cec"

HKEY_CURRENT_USER\Software\Wilbert914
W3_193 = "32b8cd6"

HKEY_CURRENT_USER\Software\Wilbert914
W4_193 = "33bb6a97"

HKEY_CURRENT_USER\Software\Wilbert914
W1_194 = "8d83c2d3"

HKEY_CURRENT_USER\Software\Wilbert914
W2_194 = "9627c43e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_194 = "9724b5af"

HKEY_CURRENT_USER\Software\Wilbert914
W4_194 = "9627d3ee"

HKEY_CURRENT_USER\Software\Wilbert914
W1_195 = "16715b1c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_195 = "f89426e9"

HKEY_CURRENT_USER\Software\Wilbert914
W3_195 = "f9975b4"

HKEY_CURRENT_USER\Software\Wilbert914
W4_195 = "f8943d45"

HKEY_CURRENT_USER\Software\Wilbert914
W1_196 = "a5463bc6"

HKEY_CURRENT_USER\Software\Wilbert914
W2_196 = "5bb4c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_196 = "5a3cdd"

HKEY_CURRENT_USER\Software\Wilbert914
W4_196 = "5ba69c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_197 = "9bd429aa"

HKEY_CURRENT_USER\Software\Wilbert914
W2_197 = "bd6d1c2b"

HKEY_CURRENT_USER\Software\Wilbert914
W3_197 = "bc6e69b2"

HKEY_CURRENT_USER\Software\Wilbert914
W4_197 = "bd6dff3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_198 = "edf8b811"

HKEY_CURRENT_USER\Software\Wilbert914
W2_198 = "1fd96336"

HKEY_CURRENT_USER\Software\Wilbert914
W3_198 = "1eda1fb"

HKEY_CURRENT_USER\Software\Wilbert914
W4_198 = "1fd9794a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_199 = "638fc51f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_199 = "8245f8ff"

HKEY_CURRENT_USER\Software\Wilbert914
W3_199 = "834684e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_199 = "8245e2a1"

HKEY_CURRENT_USER\Software\Wilbert914
W1_200 = "ddb7b5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_200 = "e4b259d7"

HKEY_CURRENT_USER\Software\Wilbert914
W3_200 = "e5b12db9"

HKEY_CURRENT_USER\Software\Wilbert914
W4_200 = "e4b24bf8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_201 = "d91ce412"

HKEY_CURRENT_USER\Software\Wilbert914
W2_201 = "471eac47"

HKEY_CURRENT_USER\Software\Wilbert914
W3_201 = "461dd3e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_201 = "471eb54f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_202 = "ce994218"

HKEY_CURRENT_USER\Software\Wilbert914
W2_202 = "a98b94"

HKEY_CURRENT_USER\Software\Wilbert914
W3_202 = "a88878e7"

HKEY_CURRENT_USER\Software\Wilbert914
W4_202 = "a98b1ea6"

HKEY_CURRENT_USER\Software\Wilbert914
W1_203 = "a61dd9ad"

HKEY_CURRENT_USER\Software\Wilbert914
W2_203 = "bf72135"

HKEY_CURRENT_USER\Software\Wilbert914
W3_203 = "af4e1bc"

HKEY_CURRENT_USER\Software\Wilbert914
W4_203 = "bf787fd"

HKEY_CURRENT_USER\Software\Wilbert914
W1_204 = "79ad1f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_204 = "6e63fe7c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_204 = "6f69715"

HKEY_CURRENT_USER\Software\Wilbert914
W4_204 = "6e63f154"

HKEY_CURRENT_USER\Software\Wilbert914
W1_205 = "439773f2"

HKEY_CURRENT_USER\Software\Wilbert914
W2_205 = "dd45df"

HKEY_CURRENT_USER\Software\Wilbert914
W3_205 = "d1d33cea"

HKEY_CURRENT_USER\Software\Wilbert914
W4_205 = "dd5aab"

HKEY_CURRENT_USER\Software\Wilbert914
W1_206 = "ce1ce15b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_206 = "333cd678"

HKEY_CURRENT_USER\Software\Wilbert914
W3_206 = "323fa243"

HKEY_CURRENT_USER\Software\Wilbert914
W4_206 = "333cc42"

HKEY_CURRENT_USER\Software\Wilbert914
W1_207 = "91255a16"

HKEY_CURRENT_USER\Software\Wilbert914
W2_207 = "95a93862"

HKEY_CURRENT_USER\Software\Wilbert914
W3_207 = "94aa4b18"

HKEY_CURRENT_USER\Software\Wilbert914
W4_207 = "95a92d59"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:enabled:ipsec"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
1651272023 = "6"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
-992423250 = "0"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
658848773 = "0"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
-1984846500 = "1e"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
-333574477 = "8"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
1317697546 = "{random characters}"

HKEY_CURRENT_USER\Software\Wilbert914\
1926745233
-1325997727 = "{random characters}"

HKEY_CURRENT_USER\Software\Wilbert914
W1_0 = "cc96283a"

HKEY_CURRENT_USER\Software\Wilbert914
W2_0 = "158d"

HKEY_CURRENT_USER\Software\Wilbert914
W3_0 = "136641"

HKEY_CURRENT_USER\Software\Wilbert914
W4_0 = "0"

HKEY_CURRENT_USER\Software\Wilbert914
W1_1 = "2c4a573e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_1 = "626c7cda"

HKEY_CURRENT_USER\Software\Wilbert914
W3_1 = "636ff16"

HKEY_CURRENT_USER\Software\Wilbert914
W4_1 = "626c6957"

HKEY_CURRENT_USER\Software\Wilbert914
W1_2 = "86e968b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_2 = "c4d8c723"

HKEY_CURRENT_USER\Software\Wilbert914
W3_2 = "c5dbb4ef"

HKEY_CURRENT_USER\Software\Wilbert914
W4_2 = "c4d8d2ae"

HKEY_CURRENT_USER\Software\Wilbert914
W1_3 = "3c3c35"

HKEY_CURRENT_USER\Software\Wilbert914
W2_3 = "27452988"

HKEY_CURRENT_USER\Software\Wilbert914
W3_3 = "26465a44"

HKEY_CURRENT_USER\Software\Wilbert914
W4_3 = "27453c5"

HKEY_CURRENT_USER\Software\Wilbert914
W1_4 = "6dcf7a5"

HKEY_CURRENT_USER\Software\Wilbert914
W2_4 = "89b1bd1"

HKEY_CURRENT_USER\Software\Wilbert914
W3_4 = "88b2c31d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_4 = "89b1a55c"

HKEY_CURRENT_USER\Software\Wilbert914
W1_5 = "d227327b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_5 = "ec1e1b3e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_5 = "ed1d68f2"

HKEY_CURRENT_USER\Software\Wilbert914
W4_5 = "ec1eeb3"

HKEY_CURRENT_USER\Software\Wilbert914
W1_6 = "1a3ae15c"

HKEY_CURRENT_USER\Software\Wilbert914
W2_6 = "4e8a6d87"

HKEY_CURRENT_USER\Software\Wilbert914
W3_6 = "4f891e4b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_6 = "4e8a78a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_7 = "cce5b332"

HKEY_CURRENT_USER\Software\Wilbert914
W2_7 = "bf6f4ec"

HKEY_CURRENT_USER\Software\Wilbert914
W3_7 = "b1f5872"

HKEY_CURRENT_USER\Software\Wilbert914
W4_7 = "bf6e161"

HKEY_CURRENT_USER\Software\Wilbert914
W1_8 = "ea64b1d"

HKEY_CURRENT_USER\Software\Wilbert914
W2_8 = "13635f35"

HKEY_CURRENT_USER\Software\Wilbert914
W3_8 = "1262cf9"

HKEY_CURRENT_USER\Software\Wilbert914
W4_8 = "13634ab8"

HKEY_CURRENT_USER\Software\Wilbert914
W1_9 = "de232156"

HKEY_CURRENT_USER\Software\Wilbert914
W2_9 = "75cfa182"

HKEY_CURRENT_USER\Software\Wilbert914
W3_9 = "74ccd24e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_9 = "75cfb4f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_10 = "68659db"

HKEY_CURRENT_USER\Software\Wilbert914
W2_10 = "d83c2e"

HKEY_CURRENT_USER\Software\Wilbert914
W3_10 = "d93f7b27"

HKEY_CURRENT_USER\Software\Wilbert914
W4_10 = "d83c1d66"

HKEY_CURRENT_USER\Software\Wilbert914
W1_11 = "4af638ec"

HKEY_CURRENT_USER\Software\Wilbert914
W2_11 = "3aa89cf9"

HKEY_CURRENT_USER\Software\Wilbert914
W3_11 = "3babefc"

HKEY_CURRENT_USER\Software\Wilbert914
W4_11 = "3aa886bd"

HKEY_CURRENT_USER\Software\Wilbert914
W1_12 = "3418a59"

HKEY_CURRENT_USER\Software\Wilbert914
W2_12 = "9d14e348"

HKEY_CURRENT_USER\Software\Wilbert914
W3_12 = "9c179655"

HKEY_CURRENT_USER\Software\Wilbert914
W4_12 = "9d14f14"

HKEY_CURRENT_USER\Software\Wilbert914
W1_13 = "54e574a2"

HKEY_CURRENT_USER\Software\Wilbert914
W2_13 = "ff8143cf"

HKEY_CURRENT_USER\Software\Wilbert914
W3_13 = "fe823f2a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_13 = "ff81596b"

HKEY_CURRENT_USER\Software\Wilbert914
W1_14 = "ec93841b"

HKEY_CURRENT_USER\Software\Wilbert914
W2_14 = "61edd73c"

HKEY_CURRENT_USER\Software\Wilbert914
W3_14 = "6eea483"

HKEY_CURRENT_USER\Software\Wilbert914
W4_14 = "61edc2c2"

HKEY_CURRENT_USER\Software\Wilbert914
W1_15 = "5e195b4"

HKEY_CURRENT_USER\Software\Wilbert914
W2_15 = "c45a9d3"

HKEY_CURRENT_USER\Software\Wilbert914
W3_15 = "c5594a58"

HKEY_CURRENT_USER\Software\Wilbert914
W4_15 = "c45a2c19"

HKEY_CURRENT_USER\Software\Wilbert914
W1_16 = "bc85e212"

HKEY_CURRENT_USER\Software\Wilbert914
W2_16 = "26c6bba"

HKEY_CURRENT_USER\Software\Wilbert914
W3_16 = "27c5f331"

HKEY_CURRENT_USER\Software\Wilbert914
W4_16 = "26c6957"

HKEY_CURRENT_USER\Software\Wilbert914
W1_17 = "8fe6df9e"

HKEY_CURRENT_USER\Software\Wilbert914
W2_17 = "8932ef13"

HKEY_CURRENT_USER\Software\Wilbert914
W3_17 = "88319886"

HKEY_CURRENT_USER\Software\Wilbert914
W4_17 = "8932fec7"

HKEY_CURRENT_USER\Software\Wilbert914
W1_18 = "fa121851"

HKEY_CURRENT_USER\Software\Wilbert914
W2_18 = "eb9f7c52"

HKEY_CURRENT_USER\Software\Wilbert914
W3_18 = "ea9ce5f"

HKEY_CURRENT_USER\Software\Wilbert914
W4_18 = "eb9f681e"

HKEY_CURRENT_USER\Software\Wilbert914
W1_19 = "ab39838"

HKEY_CURRENT_USER\Software\Wilbert914
W2_19 = "4ebc5cc"

HKEY_CURRENT_USER\Software\Wilbert914
W3_19 = "4f8b734"

HKEY_CURRENT_USER\Software\Wilbert914
W4_19 = "4ebd175"

HKEY_CURRENT_USER\Software\Wilbert914
W1_20 = "7bf7849d"

HKEY_CURRENT_USER\Software\Wilbert914
W2_20 = "b782779"

HKEY_CURRENT_USER\Software\Wilbert914
W3_20 = "b17b5c8d"

HKEY_CURRENT_USER\Software\Wilbert914
W4_20 = "b783acc"

HKEY_CURRENT_USER\Software\Wilbert914
W1_21 = "f42b3c68"

HKEY_CURRENT_USER\Software\Wilbert914
W2_21 = "12e4b774"

HKEY_CURRENT_USER\Software\Wilbert914
W3_21 = "13e7c262"

HKEY_CURRENT_USER\Software\Wilbert914
W4_21 = "12e4a423"

HKEY_CURRENT_USER\Software\Wilbert914
W1_22 = "e59b4223"

HKEY_CURRENT_USER\Software\Wilbert914
W2_22 = "75511a39"

HKEY_CURRENT_USER\Software\Wilbert914
W3_22 = "74526b3b"

HKEY_CURRENT_USER\Software\Wilbert914
W4_22 = "7551d7a"

HKEY_CURRENT_USER\Software\Wilbert914
W1_23 = "1d995388"

HKEY_CURRENT_USER\Software\Wilbert914
W2_23 = "d7bd6268"

HKEY_CURRENT_USER\Software\Wilbert914
W3_23 = "d6be19"

HKEY_CURRENT_USER\Software\Wilbert914
W4_23 = "d7bd76d1"

HKEY_CURRENT_USER\Software\Wilbert914
W1_24 = "56b6971"

HKEY_CURRENT_USER\Software\Wilbert914
W2_24 = "3a29f491"

HKEY_CURRENT_USER\Software\Wilbert914
W3_24 = "3b2a8669"

HKEY_CURRENT_USER\Software\Wilbert914
W4_24 = "3a29e28"

HKEY_CURRENT_USER\Software\Wilbert914
W1_25 = "a7642329"

HKEY_CURRENT_USER\Software\Wilbert914
W2_25 = "9c965edf"

HKEY_CURRENT_USER\Software\Wilbert914
W3_25 = "9d952f3e"

HKEY_CURRENT_USER\Software\Wilbert914
W4_25 = "9c96497f"

HKEY_CURRENT_USER\Software\Wilbert914
W1_26 = "b612ae8f"

HKEY_CURRENT_USER\Software\Wilbert914
W2_26 = "ff2a1a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_26 = "fe1d497"

HKEY_CURRENT_USER\Software\Wilbert914
W4_26 = "ff2b2d6"

HKEY_CURRENT_USER\Software\Wilbert914
W1_27 = "e41a678"

HKEY_CURRENT_USER\Software\Wilbert914
W2_27 = "616f7e6"

HKEY_CURRENT_USER\Software\Wilbert914
W3_27 = "66c7a6c"

HKEY_CURRENT_USER\Software\Wilbert914
W4_27 = "616f1c2d"

HKEY_CURRENT_USER\Software\Wilbert914
W1_28 = "e147eca"

HKEY_CURRENT_USER\Software\Wilbert914
W2_28 = "c3db9a7a"

HKEY_CURRENT_USER\Software\Wilbert914
W3_28 = "c2d8e3c5"

HKEY_CURRENT_USER\Software\Wilbert914
W4_28 = "c3db8584"

HKEY_CURRENT_USER\Software\Wilbert914
W1_29 = "4ce23689"

HKEY_CURRENT_USER\Software\Wilbert914
W2_29 = "2647f243"

HKEY_CURRENT_USER\Software\Wilbert914
W3_29 = "2744889a"

HKEY_CURRENT_USER\Software\Wilbert914
W4_29 = "2647eedb"

HKEY_CURRENT_USER\Software\Wilbert914
W1_30 = "f7eb3164"

HKEY_CURRENT_USER\Software\Wilbert914
W2_30 = "88b47828"

HKEY_CURRENT_USER\Software\Wilbert914
W3_30 = "89b73e73"

HKEY_CURRENT_USER\Software\Wilbert914
W4_30 = "88b45832"

HKEY_CURRENT_USER\Software\Wilbert914
W1_31 = "b6fc93d"

HKEY_CURRENT_USER\Software\Wilbert914
W2_31 = "eb2de41"

HKEY_CURRENT_USER\Software\Wilbert914
W3_31 = "ea23a7c8"

HKEY_CURRENT_USER\Software\Wilbert914
W4_31 = "eb2c189"

HKEY_CURRENT_USER\Software\Wilbert914
W1_32 = "25364b9"

HKEY_CURRENT_USER\Software\Wilbert914
W2_32 = "4d8d33e8"

HKEY_CURRENT_USER\Software\Wilbert914
W3_32 = "4c8e4ca1"

HKEY_CURRENT_USER\Software\Wilbert914
W4_32 = "4d8d2ae"

HKEY_CURRENT_USER\Software\Wilbert914
W1_33 = "6fa5ae79"

HKEY_CURRENT_USER\Software\Wilbert914
W2_33 = "aff98a13"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\Explorer.EXE = "%Windows%\Explorer.EXE:*:Enabled:ipsec"

マルウェアは、以下のレジストリ値を変更します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(註：変更前の上記レジストリ値は、「2」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CabinetState
FullPath = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "1"

(註：変更前の上記レジストリ値は、「2」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot
AlternateShell = "%System Root%\AUT0EXEC.BAT StartUp"

(註：変更前の上記レジストリ値は、「cmd.exe」となります。)

マルウェアは、以下のレジストリキーを削除します。

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
AppMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Base

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot file system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
CryptSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmadmin

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmboot.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmio.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmload.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmserver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
EventLog

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
File system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
HelpSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Netlogon

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PCI Configuration

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PlugPlay

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PNP Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Primary disk

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
RpcSs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SCSI Class

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sermouse.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sr.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SRService

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
System Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vga.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vgasave.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
WinMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{36FC9E60-C465-11CF-8056-444553540000}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E965-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E969-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96A-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96F-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E977-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97D-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E980-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AFD

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AppMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Base

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot file system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Browser

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
CryptSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Dhcp

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmadmin

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmboot.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmio.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmload.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmserver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DnsCache

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
EventLog

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
File system

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
HelpSvc

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ip6fw.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ipnat.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanServer

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanWorkstation

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LmHosts

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Messenger

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS Wrapper

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Ndisuio

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOS

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOSGroup

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBT

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetDDEGroup

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Netlogon

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetMan

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Network

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetworkProvider

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NtLmSsp

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PCI Configuration

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PlugPlay

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP Filter

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP_TDI

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Primary disk

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpcdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpwd.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdsessmgr

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
RpcSs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SCSI Class

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sermouse.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SharedAccess

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sr.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SRService

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Streams Drivers

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
System Bus Extender

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Tcpip

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
TDI

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdpipe.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdtcp.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
termservice

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vga.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vgasave.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WinMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WZCSVC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{36FC9E60-C465-11CF-8056-444553540000}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E965-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E969-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96A-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96F-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E972-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E973-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E974-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E975-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E977-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97B-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97D-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E980-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network

作成活動

マルウェアは、以下のファイルを作成します。

  • %System Root%\(Read Me)Pendekar Blank.txt
  • %System%\drivers\nlpoi.sys
  • B:\136da
  • %System Root%\13c58
  • %System Root%\17d0a
  • D:\1816f
  • E:\18603
  • F:\18b14
  • G:\190d1
  • H:\196ad
  • I:\19ac4
  • J:\19eea
  • K:\1a2f2
  • L:\1a7d4
  • M:\1abdb
  • N:\1b1e6
  • O:\1b6b8
  • P:\1babf
  • Q:\1c05d
  • R:\1c4c2
  • S:\1c946
  • T:\1cd7c
  • U:\1d183
  • V:\1d58b
  • W:\1d992
  • X:\1dde7
  • Y:\1e1ef
  • Z:\1e682
  • VMWARE SHARED FOLDERS\1ffd7
  • MICROSOFT TERMINAL SERVICES\2043c
  • MICROSOFT WINDOWS NETWORK\20a27
  • WORKGROUP\21a16
  • \WILBERT-D7E8189\21e3c
  • WEB CLIENT NETWORK\22a33
  • %System%\dllChache\msvbvm60.dll
  • %System Root%\msvbvm60.dll
  • %System%\dllcache\msvbvm60.dll
  • %System%\dllChache\Empty.jpg
  • %System%\dllChache\Blank.doc
  • %System%\dllChache\Zero.txt
  • %System%\dllChache\Hole.zip
  • %System%\dllChache\Unoccupied.reg
  • %System Root%\AUT0EXEC.BAT
  • %System%\rund1132.exe
  • %System%\dllcache\Regedit32.com
  • %System%\dllcache\Shell32.com
  • %System%\M5VBVM60.EXE
  • %System%.exe
  • %System%\dllchache.exe
  • %User Temp%\winnyxdb.exe
  • %User Temp%\klihd.exe

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

  • http://oceaninfo.{BLOCKED}o.kr/tanga.gif?150ea=345000
  • http://{BLOCKED}k.ru/img/logo4.gif?19f96=425560
  • http://{BLOCKED}_averi_{BLOCKED}.infaa?1e6b1=249186
  • http://{BLOCKED}i3.info/tanga.gif?22234=139828

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.200

手順 1

Windows XP および Windows Server 2003 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

スタートアップディスク、または、回復コンソールを用いて、「PE_VIRUX.S-O」として検出されたファイルを確認し削除します。

[ 詳細 ]

手順 3

このレジストリキーを削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Wilbert914
    • 1926745233

手順 4

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Blank AntiViri = "%System Root%\AUT0EXEC.BAT StartUp"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Secure64 = "%System%\dllcache\Regedit32.com StartUp"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Secure32 = "%System%\dllcache\Shell32.com StartUp"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    • GlobalUserOffline = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    • EnableLUA = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • {malware path and file name} = "{malware path and file name}:*:enabled:ipsec"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • 1651272023 = "6"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • -992423250 = "0"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • 658848773 = "0"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • -1984846500 = "1e"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • -333574477 = "8"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • 1317697546 = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Wilbert914\1926745233
    • -1325997727 = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_0 = "cc96283a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_0 = "158d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_0 = "136641"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_0 = "0"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_1 = "2c4a573e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_1 = "626c7cda"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_1 = "636ff16"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_1 = "626c6957"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_2 = "86e968b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_2 = "c4d8c723"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_2 = "c5dbb4ef"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_2 = "c4d8d2ae"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_3 = "3c3c35"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_3 = "27452988"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_3 = "26465a44"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_3 = "27453c5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_4 = "6dcf7a5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_4 = "89b1bd1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_4 = "88b2c31d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_4 = "89b1a55c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_5 = "d227327b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_5 = "ec1e1b3e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_5 = "ed1d68f2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_5 = "ec1eeb3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_6 = "1a3ae15c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_6 = "4e8a6d87"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_6 = "4f891e4b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_6 = "4e8a78a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_7 = "cce5b332"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_7 = "bf6f4ec"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_7 = "b1f5872"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_7 = "bf6e161"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_8 = "ea64b1d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_8 = "13635f35"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_8 = "1262cf9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_8 = "13634ab8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_9 = "de232156"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_9 = "75cfa182"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_9 = "74ccd24e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_9 = "75cfb4f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_10 = "68659db"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_10 = "d83c2e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_10 = "d93f7b27"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_10 = "d83c1d66"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_11 = "4af638ec"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_11 = "3aa89cf9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_11 = "3babefc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_11 = "3aa886bd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_12 = "3418a59"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_12 = "9d14e348"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_12 = "9c179655"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_12 = "9d14f14"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_13 = "54e574a2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_13 = "ff8143cf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_13 = "fe823f2a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_13 = "ff81596b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_14 = "ec93841b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_14 = "61edd73c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_14 = "6eea483"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_14 = "61edc2c2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_15 = "5e195b4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_15 = "c45a9d3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_15 = "c5594a58"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_15 = "c45a2c19"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_16 = "bc85e212"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_16 = "26c6bba"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_16 = "27c5f331"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_16 = "26c6957"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_17 = "8fe6df9e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_17 = "8932ef13"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_17 = "88319886"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_17 = "8932fec7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_18 = "fa121851"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_18 = "eb9f7c52"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_18 = "ea9ce5f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_18 = "eb9f681e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_19 = "ab39838"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_19 = "4ebc5cc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_19 = "4f8b734"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_19 = "4ebd175"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_20 = "7bf7849d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_20 = "b782779"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_20 = "b17b5c8d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_20 = "b783acc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_21 = "f42b3c68"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_21 = "12e4b774"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_21 = "13e7c262"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_21 = "12e4a423"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_22 = "e59b4223"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_22 = "75511a39"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_22 = "74526b3b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_22 = "7551d7a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_23 = "1d995388"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_23 = "d7bd6268"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_23 = "d6be19"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_23 = "d7bd76d1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_24 = "56b6971"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_24 = "3a29f491"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_24 = "3b2a8669"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_24 = "3a29e28"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_25 = "a7642329"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_25 = "9c965edf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_25 = "9d952f3e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_25 = "9c96497f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_26 = "b612ae8f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_26 = "ff2a1a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_26 = "fe1d497"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_26 = "ff2b2d6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_27 = "e41a678"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_27 = "616f7e6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_27 = "66c7a6c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_27 = "616f1c2d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_28 = "e147eca"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_28 = "c3db9a7a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_28 = "c2d8e3c5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_28 = "c3db8584"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_29 = "4ce23689"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_29 = "2647f243"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_29 = "2744889a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_29 = "2647eedb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_30 = "f7eb3164"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_30 = "88b47828"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_30 = "89b73e73"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_30 = "88b45832"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_31 = "b6fc93d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_31 = "eb2de41"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_31 = "ea23a7c8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_31 = "eb2c189"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_32 = "25364b9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_32 = "4d8d33e8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_32 = "4c8e4ca1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_32 = "4d8d2ae"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_33 = "6fa5ae79"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_33 = "aff98a13"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_33 = "aefaf276"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_33 = "aff99437"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_34 = "1229dc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_34 = "1265e68"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_34 = "13669bcf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_34 = "1265fd8e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_35 = "35a2eebc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_35 = "74d279e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_35 = "75d1a4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_35 = "74d266e5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_36 = "c157f865"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_36 = "d73ec977"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_36 = "d63db67d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_36 = "d73ed3c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_37 = "fcc41fc5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_37 = "39ab2d3f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_37 = "38a85fd2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_37 = "39ab3993"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_38 = "9ff34b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_38 = "9c17bb27"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_38 = "9d14c4ab"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_38 = "9c17a2ea"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_39 = "43e35"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_39 = "fe842f69"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_39 = "ff876a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_39 = "fe84c41"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_40 = "17adab5b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_40 = "6f69a6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_40 = "61f313d9"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
    • FullPathAddress = "1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_40 = "6f7598"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_41 = "3f436b6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_41 = "c35ccbd4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_41 = "c25fb8ae"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_41 = "c35cdeef"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_42 = "787be78"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • ShowSuperHidden = "0"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_42 = "25c951a6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_42 = "24ca2e7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_42 = "25c94846"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_43 = "cfed9cb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_43 = "8835a8b5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_43 = "8936d7dc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_43 = "8835b19d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_44 = "af4168a8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_44 = "eaa2ee"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_44 = "eba17cb5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_44 = "eaa21af4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_45 = "47b3911"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_45 = "4de24b3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_45 = "4cde2a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_45 = "4de844b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_46 = "577e351c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_46 = "af7afc63"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_46 = "ae798be3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_46 = "af7aeda2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_47 = "5e252eae"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_47 = "11e74b85"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_47 = "1e43b8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_47 = "11e756f9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_48 = "cc43981e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_48 = "7453d676"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_48 = "755a611"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_48 = "7453c5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_49 = "f5955cfc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_49 = "d6c3a3f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_49 = "d7c34fe6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_49 = "d6c29a7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_50 = "ee8be3b1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_50 = "392c8a89"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_50 = "382ff4bf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_50 = "392c92fe"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_51 = "f167d794"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_51 = "9b98e78"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_51 = "9a9b9a14"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_51 = "9b98fc55"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_52 = "6a8ff8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_52 = "fe57c98"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_52 = "ff63ed"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_52 = "fe565ac"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_53 = "64f2eb5a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_53 = "671dbf9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_53 = "6172a942"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_53 = "671cf3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_54 = "463259d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_54 = "c2de256e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_54 = "c3dd5e1b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_54 = "c2de385a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_55 = "94cad8fc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_55 = "254ab659"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_55 = "2449c7f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_55 = "254aa1b1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_56 = "4dd1f4c7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_56 = "87b71ca8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_56 = "86b46d49"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_56 = "87b7b8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_57 = "34c6d1e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_57 = "ea2361c5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_57 = "eb2121e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_57 = "ea23745f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_58 = "3da2a5e3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_58 = "4c8fcd1f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_58 = "4d8cbbf7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_58 = "4c8fddb6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_59 = "3c986e54"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_59 = "aefc5465"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_59 = "afff214c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_59 = "aefc47d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_60 = "18ff9d2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_60 = "1168a982"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_60 = "16bd625"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_60 = "1168b64"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_61 = "cdc2b79"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_61 = "73d53cb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_61 = "72d67ffa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_61 = "73d519bb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_62 = "b296ab4b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_62 = "d641927e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_62 = "d742e553"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_62 = "d6418312"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_63 = "af6822f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_63 = "38adf872"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_63 = "39ae8a28"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_63 = "38adec69"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_64 = "7ec27499"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_64 = "9b1a4d39"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_64 = "9a193381"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_64 = "9b1a55c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_65 = "a19e924e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_65 = "fd86aeba"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_65 = "fc85d956"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_65 = "fd86bf17"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_66 = "9d3ccc2d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_66 = "5ff33b48"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_66 = "5ef4e2f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_66 = "5ff3286e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_67 = "5bf2e397"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_67 = "c25f8a55"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_67 = "c35cf784"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_67 = "c25f91c5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_68 = "c9794a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_68 = "24cbebf6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_68 = "25c89d5d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_68 = "24cbfb1c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_69 = "2a4c12a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_69 = "873875b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_69 = "863b232"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_69 = "87386473"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_70 = "eabea19e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_70 = "e9a4d8f1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_70 = "e8a7ab8b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_70 = "e9a4cdca"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_71 = "2efbdef5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_71 = "4c112c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_71 = "4d12516"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_71 = "4c113721"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_72 = "5245ee21"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_72 = "ae7db28"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_72 = "af7ec639"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_72 = "ae7da78"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_73 = "32a27a8a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_73 = "1ea1213"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_73 = "11e96f8e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_73 = "1ea9cf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_74 = "d5ff6d77"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_74 = "73566e93"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_74 = "72551567"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_74 = "73567326"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_75 = "1cfe265"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_75 = "d5c2cf3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_75 = "d4c1ba3c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_75 = "d5c2dc7d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_76 = "18fabf83"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_76 = "382f5cde"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_76 = "392c2395"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_76 = "382f45d4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_77 = "375d277"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_77 = "9a9bbd87"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_77 = "9b98c96a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_77 = "9a9baf2b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_78 = "afb4e7d2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_78 = "fd864a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_78 = "fcb7ec3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_78 = "fd81882"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_79 = "c4639d8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_79 = "5f7497dd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_79 = "5e77e798"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_79 = "5f7481d9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_80 = "25721563"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_80 = "c1ef31a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_80 = "ce38d71"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_80 = "c1eeb3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_81 = "576e9dc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_81 = "244d46ad"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_81 = "254e32c6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_81 = "244d5487"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_82 = "f6bb9487"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_82 = "86b9a4d4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_82 = "87badb9f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_82 = "86b9bdde"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_83 = "185947a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_83 = "e92636e1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_83 = "e8254174"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_83 = "e9262735"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_84 = "996cc1c1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_84 = "4b928531"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_84 = "4a91f6cd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_84 = "4b9298c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_85 = "9bdedcba"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_85 = "adfee9b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_85 = "acfd9fa2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_85 = "adfef9e3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_86 = "2ebeab72"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_86 = "16b79eb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_86 = "116857b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_86 = "16b633a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_87 = "e1775c3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_87 = "72d7d7d1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_87 = "73d4aad"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_87 = "72d7cc91"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_88 = "ab6d18ac"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_88 = "d54424b6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_88 = "d44753a9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_88 = "d54435e8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_89 = "7ef6e772"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_89 = "37b8dac"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_89 = "36b3f97e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_89 = "37b9f3f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_90 = "dd6fb9d5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_90 = "9a1d1c6c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_90 = "9b1e6ed7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_90 = "9a1d896"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_91 = "bbca52c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_91 = "fc896af9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_91 = "fd8a17ac"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_91 = "fc8971ed"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_92 = "a373e1d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_92 = "5ef5c87c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_92 = "5ff6bd5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_92 = "5ef5db44"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_93 = "c45d1b46"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_93 = "c16252dc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_93 = "c6122da"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_93 = "c162449b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_94 = "6add18a3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_94 = "23cebf2a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_94 = "22cdcbb3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_94 = "23ceadf2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_95 = "5117b534"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_95 = "863bdbf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_95 = "8738718"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_95 = "863b1749"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_96 = "c97da1f9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_96 = "e8a79419"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_96 = "e9a4e6e1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_96 = "e8a78a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_97 = "6d85a449"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_97 = "4b13f5f5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_97 = "4a18fb6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_97 = "4b13e9f7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_98 = "4bfc32f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_98 = "ad846d4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_98 = "ac8335f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_98 = "ad8534e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_99 = "caa8d6f3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_99 = "fecad1d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_99 = "eefdae4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_99 = "fecbca5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_100 = "c2ac6b7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_100 = "72593972"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_100 = "735a43bd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_100 = "725925fc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_101 = "3ee6fa6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_101 = "d4c594ff"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_101 = "d5c6e912"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_101 = "d4c58f53"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_102 = "635cae4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_102 = "3731e4e2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_102 = "36329eeb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_102 = "3731f8aa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_103 = "935dc5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_103 = "999e73a1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_103 = "989d44"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_103 = "999e621"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_104 = "35a51e6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_104 = "fcad22"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_104 = "fd9ad19"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_104 = "fcacb58"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_105 = "4dd4191"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_105 = "5e772c5f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_105 = "5f7452ee"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_105 = "5e7734af"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_106 = "d6ff8c5f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_106 = "ce3895e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_106 = "c1ef847"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_106 = "ce39e6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_107 = "e73b274"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_107 = "23524f7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_107 = "2253611c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_107 = "23575d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_108 = "ab22e8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_108 = "85bc557e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_108 = "84bf16f5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_108 = "85bc7b4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_109 = "b6123b5c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_109 = "e828c949"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_109 = "e92bbc4a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_109 = "e828dab"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_110 = "86cf43a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_110 = "4a955a4a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_110 = "4b962523"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_110 = "4a954362"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_111 = "fdc776ea"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_111 = "ad1bfb2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_111 = "ac2caf8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_111 = "ad1acb9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_112 = "4d354e5e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_112 = "f6ebf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_112 = "e6d751"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_112 = "f6e161"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_113 = "66c71431"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_113 = "71da6a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_113 = "7d91926"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_113 = "71da7f67"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_114 = "4f9677b2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_114 = "d446fd4d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_114 = "d5458eff"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_114 = "d446e8be"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_115 = "b2dae22b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_115 = "36b34663"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_115 = "37b3454"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_115 = "36b35215"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_116 = "d79bd616"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_116 = "991fa9b4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_116 = "981cdd2d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_116 = "991fbb6c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_117 = "4f2f9998"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_117 = "fb8c3d88"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_117 = "fa8f4282"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_117 = "fb8c24c3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_118 = "825e24b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_118 = "5df89dc2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_118 = "5cfbe85b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_118 = "5df88e1a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_119 = "328a62c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_119 = "c64ee37"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_119 = "c167913"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_119 = "c64f771"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_120 = "9cba89a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_120 = "22d17595"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_120 = "23d2689"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_120 = "22d16c8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_121 = "6ecb8fdc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_121 = "853dc584"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_121 = "843eac5e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_121 = "853dca1f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_122 = "bec4ae2c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_122 = "e7aa28d8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_122 = "e6a95537"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_122 = "e7aa3376"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_123 = "327eab19"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_123 = "4a168c17"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_123 = "4b15fa8c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_123 = "4a169ccd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_124 = "2af77fd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_124 = "ac83123f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_124 = "ad8665"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_124 = "ac83624"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_125 = "2f59b122"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_125 = "eef7211"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_125 = "fec93a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_125 = "eef6f7b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_126 = "5426f18b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_126 = "715bc3c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_126 = "758be93"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_126 = "715bd8d2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_127 = "bf483eb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_127 = "d3c85794"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_127 = "d2cb2468"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_127 = "d3c84229"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_128 = "6d618d9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_128 = "3634bc45"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_128 = "3737cdc1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_128 = "3634ab8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_129 = "a53d9f99"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_129 = "98a1cc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_129 = "99a27296"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_129 = "98a114d7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_130 = "edd6b36"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_130 = "fbd68ae"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_130 = "fae186f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_130 = "fbd7e2e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_131 = "2b536d7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_131 = "5d79fe5f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_131 = "5c7a81c4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_131 = "5d79e785"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_132 = "2ce21189"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_132 = "bfe64734"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_132 = "bee5369d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_132 = "bfe65dc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_133 = "6d59ffd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_133 = "2252ac15"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_133 = "2351dc72"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_133 = "2252ba33"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_134 = "7ee7b7d9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_134 = "84bf36b1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_134 = "85bc45cb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_134 = "84bf238a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_135 = "9521a4b8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_135 = "e72b9797"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_135 = "e628eaa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_135 = "e72b8ce1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_136 = "fb3a8464"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_136 = "4997ead"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_136 = "4894979"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_136 = "4997f638"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_137 = "85c534d9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_137 = "ac445ae"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_137 = "ad739ce"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_137 = "ac45f8f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_138 = "5537e1ab"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_138 = "e7d911"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_138 = "f73aea7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_138 = "e7c8e6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_139 = "7cfccae7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_139 = "7dd25aa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_139 = "71de547c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_139 = "7dd323d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_140 = "f511b7cd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_140 = "d34988d6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_140 = "d24afdd5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_140 = "d3499b94"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_141 = "6c36fbc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_141 = "35b61ab"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_141 = "34b562aa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_141 = "35b64eb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_142 = "899a1fd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_142 = "982275ba"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_142 = "992183"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_142 = "98226e42"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_143 = "2ced62c8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_143 = "fa8ec258"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_143 = "fb8db1d8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_143 = "fa8ed799"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_144 = "215cc625"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_144 = "5cfb537f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_144 = "5df826b1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_144 = "5cfb4f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_145 = "a2c2b715"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_145 = "bf67bd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_145 = "be64cc6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_145 = "bf67aa47"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_146 = "d8a37eca"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_146 = "21d46a5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_146 = "2d775df"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_146 = "21d4139e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_147 = "69761abb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_147 = "8446ab2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_147 = "85431ab4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_147 = "8447cf5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_148 = "7ef6818"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_148 = "e6acf77"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_148 = "e7af8d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_148 = "e6ace64c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_149 = "57abb7f4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_149 = "49195ddb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_149 = "481a29e2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_149 = "49194fa3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_150 = "9217ca1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_150 = "ab85af3f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_150 = "aa86debb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_150 = "ab85b8fa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_151 = "c4381b7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_151 = "df235d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_151 = "cf1441"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_151 = "df22251"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_152 = "678156a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_152 = "75e9ba"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_152 = "715dede9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_152 = "75e8ba8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_153 = "43dd5782"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_153 = "d2cad135"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_153 = "d3c992be"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_153 = "d2caf4ff"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_154 = "9294f2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_154 = "35374c4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_154 = "34343817"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_154 = "35375e56"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_155 = "ca762e79"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_155 = "97a3d357"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_155 = "96aa1ec"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_155 = "97a3c7ad"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_156 = "b1d8eb57"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_156 = "fa12c86"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_156 = "fb135745"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_156 = "fa1314"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_157 = "b12e1d65"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_157 = "5c7c811b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_157 = "5d7ffc1a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_157 = "5c7c9a5b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_158 = "18d76e7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_158 = "bee91d7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_158 = "bfea65f3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_158 = "bee93b2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_159 = "7c9a1444"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_159 = "215579a9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_159 = "256b48"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_159 = "21556d9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_160 = "f6cf7b35"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_160 = "83c1cf48"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_160 = "82c2b21"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_160 = "83c1d66"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_161 = "3e7f4bf8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_161 = "e62e297f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_161 = "e72d59f6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_161 = "e62e3fb7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_162 = "ab7ad941"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_162 = "489ab88e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_162 = "4999cf4f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_162 = "489aa9e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_163 = "f8f2bbc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_163 = "ab7b2e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_163 = "aa47424"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_163 = "ab71265"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_164 = "bd26fdfa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_164 = "d736ceb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_164 = "c71dfd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_164 = "d737bbc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_165 = "b44ab25"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_165 = "6fdff335"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_165 = "6edc8352"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_165 = "6fdfe513"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_166 = "2cc7ca9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_166 = "d24c5c96"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_166 = "d34f282b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_166 = "d24c4e6a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_167 = "53956b8c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_167 = "34b82c79"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_167 = "35bbd18"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_167 = "34b8b7c1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_168 = "25ef5757"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_168 = "972535a1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_168 = "96264759"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_168 = "97252118"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_169 = "1c3a473b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_169 = "f991917d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_169 = "f892ec2e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_169 = "f9918a6f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_170 = "1dbb65"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_170 = "5bfdfc5d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_170 = "5afe9587"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_170 = "5bfdf3c6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_171 = "2d8c364b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_171 = "be6a432"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_171 = "bf693b5c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_171 = "be6a5d1d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_172 = "5454dc3a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_172 = "2d6df4a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_172 = "21d5a35"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_172 = "2d6c674"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_173 = "8e258af5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_173 = "83435d5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_173 = "824498a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_173 = "83432fcb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_174 = "979cb79"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_174 = "e5af85a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_174 = "e4acff63"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_174 = "e5af9922"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_175 = "87867ad"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_175 = "481c1cbb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_175 = "491f6438"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_175 = "481c279"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_176 = "74266183"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_176 = "aa8875f8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_176 = "ab8bd91"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_176 = "aa886bd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_177 = "aa52a575"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_177 = "cf4c76f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_177 = "df7b366"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_177 = "cf4d527"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_178 = "653d29c3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_178 = "6f611f66"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_178 = "6e62583f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_178 = "6f613e7e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_179 = "9bad589"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_179 = "d1cdbe31"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_179 = "dcec194"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_179 = "d1cda7d5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_180 = "9b1c217"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_180 = "343a854"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_180 = "3539776d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_180 = "343a112c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_181 = "6c87e6db"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_181 = "96a66c4e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_181 = "97a51cc2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_181 = "96a67a83"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_182 = "9ddf94"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_182 = "f912fe38"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_182 = "f811859b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_182 = "f912e3da"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_183 = "d5f29d74"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_183 = "5b7f56e9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_183 = "5a7c2b7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_183 = "5b7f4d31"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_184 = "698dbdc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_184 = "bdeba5ca"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_184 = "bce8dc9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_184 = "bdebb688"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_185 = "167e169b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_185 = "258921"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_185 = "215b799e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_185 = "2581fdf"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_186 = "41aa616f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_186 = "82c497f8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_186 = "83c7ef77"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_186 = "82c48936"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_187 = "48eca7d5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_187 = "e53e7f1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_187 = "e43394cc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_187 = "e53f28d"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_188 = "5d64aa9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_188 = "479d4de"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_188 = "469e3da5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_188 = "479d5be4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_189 = "1a223bfa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_189 = "aa9d8eb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_189 = "abaa37a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_189 = "aa9c53b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_190 = "2c92346"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_190 = "c763a2b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_190 = "d7548d3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_190 = "c762e92"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_191 = "b54f8d3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_191 = "6ee2b223"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_191 = "6fe1f1a8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_191 = "6ee297e9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_192 = "f4bde869"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_192 = "d14f1abb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_192 = "d4c671"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_192 = "d14f14"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_193 = "6b85142"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_193 = "33bb7cec"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_193 = "32b8cd6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_193 = "33bb6a97"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_194 = "8d83c2d3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_194 = "9627c43e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_194 = "9724b5af"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_194 = "9627d3ee"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_195 = "16715b1c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_195 = "f89426e9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_195 = "f9975b4"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_195 = "f8943d45"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_196 = "a5463bc6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_196 = "5bb4c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_196 = "5a3cdd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_196 = "5ba69c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_197 = "9bd429aa"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_197 = "bd6d1c2b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_197 = "bc6e69b2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_197 = "bd6dff3"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_198 = "edf8b811"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_198 = "1fd96336"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_198 = "1eda1fb"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_198 = "1fd9794a"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_199 = "638fc51f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_199 = "8245f8ff"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_199 = "834684e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_199 = "8245e2a1"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_200 = "ddb7b5"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_200 = "e4b259d7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_200 = "e5b12db9"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_200 = "e4b24bf8"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_201 = "d91ce412"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_201 = "471eac47"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_201 = "461dd3e"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_201 = "471eb54f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_202 = "ce994218"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_202 = "a98b94"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_202 = "a88878e7"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_202 = "a98b1ea6"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_203 = "a61dd9ad"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_203 = "bf72135"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_203 = "af4e1bc"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_203 = "bf787fd"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_204 = "79ad1f"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_204 = "6e63fe7c"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_204 = "6f69715"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_204 = "6e63f154"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_205 = "439773f2"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_205 = "dd45df"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_205 = "d1d33cea"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_205 = "dd5aab"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_206 = "ce1ce15b"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_206 = "333cd678"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_206 = "323fa243"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_206 = "333cc42"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W1_207 = "91255a16"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W2_207 = "95a93862"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W3_207 = "94aa4b18"
  • In HKEY_CURRENT_USER\Software\Wilbert914
    • W4_207 = "95a92d59"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • EnableFirewall = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DoNotAllowExceptions = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • %Windows%\Explorer.EXE = "%Windows%\Explorer.EXE:*:Enabled:ipsec"

手順 5

変更されたレジストリ値を修正します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: Hidden = "2"
      To: Hidden = ""2""
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
    • FullPath = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: Hidden = "1"
      To: Hidden = ""2""
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: HideFileExt = "1"
      To: HideFileExt = ""1""
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
    • From: AlternateShell = "%System Root%\AUT0EXEC.BAT StartUp"
      To: AlternateShell = ""cmd.exe""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • From: Userinit = "%System%\userinit.exe, %System%\M5VBVM60.EXE StartUp"
      To: Userinit = ""%Windows%\system32\userinit.exe,""

手順 6

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %System Root%\(Read Me)Pendekar Blank.txt
  • %System%\drivers\nlpoi.sys
  • B:\136da
  • %System Root%\13c58
  • %System Root%\17d0a
  • D:\1816f
  • E:\18603
  • F:\18b14
  • G:\190d1
  • H:\196ad
  • I:\19ac4
  • J:\19eea
  • K:\1a2f2
  • L:\1a7d4
  • M:\1abdb
  • N:\1b1e6
  • O:\1b6b8
  • P:\1babf
  • Q:\1c05d
  • R:\1c4c2
  • S:\1c946
  • T:\1cd7c
  • U:\1d183
  • V:\1d58b
  • W:\1d992
  • X:\1dde7
  • Y:\1e1ef
  • Z:\1e682
  • VMWARE SHARED FOLDERS\1ffd7
  • MICROSOFT TERMINAL SERVICES\2043c
  • MICROSOFT WINDOWS NETWORK\20a27
  • WORKGROUP\21a16
  • \WILBERT-D7E8189\21e3c
  • WEB CLIENT NETWORK\22a33
  • %System%\dllChache\msvbvm60.dll
  • %System Root%\msvbvm60.dll
  • %System%\dllcache\msvbvm60.dll
  • %System%\dllChache\Empty.jpg
  • %System%\dllChache\Blank.doc
  • %System%\dllChache\Zero.txt
  • %System%\dllChache\Hole.zip
  • %System%\dllChache\Unoccupied.reg
  • %System Root%\AUT0EXEC.BAT
  • %System%\rund1132.exe
  • %System%\dllcache\Regedit32.com
  • %System%\dllcache\Shell32.com
  • %System%\M5VBVM60.EXE
  • %System%.exe
  • %System%\dllchache.exe
  • %User Temp%\winnyxdb.exe
  • %User Temp%\klihd.exe

手順 7

以下のフォルダを検索し削除します。

[ 詳細 ]
註：このフォルダは、隠しフォルダとして設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %System%\dllchache

手順 8

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「PE_VIRUX.S-O」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 9

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %User Temp%\winnyxdb.exe
  • %User Temp%\klihd.exe

手順 10

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • AppMgmt
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • Base
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • Boot Bus Extender
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • Boot file system
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • CryptSvc
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • DcomLaunch
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • dmadmin
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • dmboot.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • dmio.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • dmload.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • dmserver
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • EventLog
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • File system
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • Filter
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • HelpSvc
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • Netlogon
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • PCI Configuration
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • PlugPlay
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • PNP Filter
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • Primary disk
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • RpcSs
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • SCSI Class
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • sermouse.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • sr.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • SRService
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • System Bus Extender
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • vga.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • vgasave.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • WinMgmt
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {36FC9E60-C465-11CF-8056-444553540000}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E965-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E967-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E969-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E96A-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E96B-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E96F-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E977-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E97B-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E97D-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {4D36E980-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {71A27CDD-812A-11D0-BEC7-08002BE2092F}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
    • {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
    • Minimal
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • AFD
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • AppMgmt
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Base
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Boot Bus Extender
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Boot file system
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Browser
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • CryptSvc
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • DcomLaunch
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Dhcp
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • dmadmin
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • dmboot.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • dmio.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • dmload.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • dmserver
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • DnsCache
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • EventLog
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • File system
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Filter
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • HelpSvc
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • ip6fw.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • ipnat.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • LanmanServer
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • LanmanWorkstation
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • LmHosts
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Messenger
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NDIS
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NDIS Wrapper
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Ndisuio
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NetBIOS
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NetBIOSGroup
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NetBT
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NetDDEGroup
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Netlogon
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NetMan
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
    • Network
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NetworkProvider
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • NtLmSsp
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • PCI Configuration
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • PlugPlay
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • PNP Filter
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • PNP_TDI
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Primary disk
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • rdpcdd.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • rdpdd.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • rdpwd.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • rdsessmgr
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • RpcSs
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • SCSI Class
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • sermouse.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • SharedAccess
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • sr.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • SRService
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Streams Drivers
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • System Bus Extender
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • Tcpip
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • TDI
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • tdpipe.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • tdtcp.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • termservice
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • vga.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • vgasave.sys
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • WinMgmt
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • WZCSVC
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {36FC9E60-C465-11CF-8056-444553540000}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E965-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E967-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E969-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E96A-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E96B-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E96F-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E972-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E973-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E974-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E975-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E977-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E97B-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E97D-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {4D36E980-E325-11CE-BFC1-08002BE10318}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {71A27CDD-812A-11D0-BEC7-08002BE2092F}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
    • {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
    • Network


ご利用はいかがでしたか？　アンケートにご協力ください