TROJ_BREDOZP.A

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

マルウェアは、ファイルを改変します。これにより、該当プログラムおよびアプリケーションが正しく実行されなくなります。 マルウェアは、タスクマネージャやレジストリエディタ、フォルダオプションを無効にします。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

• %User Profile%\Application Data\csrss.exe

(註：%User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

マルウェアは、以下のフォルダを作成します。

• %User Profile%\Microsoft\Protect

(註：%User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
uxdi = "rundll32 %User Profile%\Protect\sjla.m, kpgw"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
djiax = "rundll32 %User Profile%\Protect\ldbeig.hf, byta"

他のシステム変更

マルウェアは、以下のファイルを改変します。

• %Application Data%\GDIPFONTCACHEV1.DAT

(註：%Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。)

マルウェアは、以下のファイルを削除します。

• %User Profile%\Application Data\csrss.exe
• %User Profile%\Application Data\csrss.exe:Zone.Identifier
• %User Temp%\1.tmp
• %User Temp%\2.tmp
• %User Temp%\3.tmp
• %User Temp%\4.tmp
• %Application Data%\aeu.exe
• %Application Data%\shj.exe
• %Application Data%\duk.exe
• %Application Data%\jmq.exe
• %Application Data%\yth.exe
• %User Profile%\Application Data\fte.exe
• %User Profile%\Application Data\rvk.exe
• %User Profile%\Application Data\brx.exe
• %User Profile%\Application Data\rnw.exe
• %User Profile%\Application Data\dbf.exe
• %User Temp%\hti.exe
• %User Temp%\qyd.exe
• %User Temp%\gnq.exe
• %User Temp%\aym.exe
• %User Temp%\uct.exe
• %User Profile%\Templates\mii.exe
• %User Profile%\Templates\yrd.exe
• %User Profile%\Templates\qwg.exe
• %User Profile%\Templates\msa.exe
• %User Profile%\Templates\tgd.exe
• %User Profile%\Protect\gs32.txt

(註：%User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。. %User Temp%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\Temp"、Windows NT の場合、"C:\Profiles\＜ユーザー名＞\TEMP"、Windows 2000、XP、Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\TEMP" です。. %Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。)

マルウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\Mb4\shell\
runas\command

HKEY_CURRENT_USER\6r0

HKEY_CURRENT_USER\6r0\DefaultIcon

HKEY_CURRENT_USER\6r0\shell

HKEY_CURRENT_USER\6r0\shell\
open

HKEY_CURRENT_USER\6r0\shell\
open\command

HKEY_CURRENT_USER\6r0\shell\
runas

HKEY_CURRENT_USER\6r0\shell\
runas\command

HKEY_CURRENT_USER\E56

HKEY_CURRENT_USER\E56\DefaultIcon

HKEY_CURRENT_USER\E56\shell

HKEY_CURRENT_USER\E56\shell\
open

HKEY_CURRENT_USER\E56\shell\
open\command

HKEY_CURRENT_USER\E56\shell\
runas

HKEY_CURRENT_USER\E56\shell\
runas\command

HKEY_CURRENT_USER\01e

HKEY_CURRENT_USER\01e\DefaultIcon

HKEY_CURRENT_USER\01e\shell

HKEY_CURRENT_USER\01e\shell\
open

HKEY_CURRENT_USER\01e\shell\
open\command

HKEY_CURRENT_USER\01e\shell\
runas

HKEY_CURRENT_USER\01e\shell\
runas\command

HKEY_CURRENT_USER\V44

HKEY_CURRENT_USER\V44\DefaultIcon

HKEY_CURRENT_USER\V44\shell

HKEY_CURRENT_USER\V44\shell\
open

HKEY_CURRENT_USER\V44\shell\
open\command

HKEY_CURRENT_USER\V44\shell\
runas

HKEY_CURRENT_USER\V44\shell\
runas\command

HKEY_CURRENT_USER\uB8

HKEY_CURRENT_USER\uB8\DefaultIcon

HKEY_CURRENT_USER\uB8\shell

HKEY_CURRENT_USER\uB8\shell\
open

HKEY_CURRENT_USER\uB8\shell\
open\command

HKEY_CURRENT_USER\uB8\shell\
runas

HKEY_CURRENT_USER\uB8\shell\
runas\command

HKEY_CURRENT_USER\BI

HKEY_CURRENT_USER\BI\DefaultIcon

HKEY_CURRENT_USER\BI\shell

HKEY_CURRENT_USER\BI\shell\
open

HKEY_CURRENT_USER\BI\shell\
open\command

HKEY_CURRENT_USER\BI\shell\
runas

HKEY_CURRENT_USER\BI\shell\
runas\command

HKEY_CURRENT_USER\wg

HKEY_CURRENT_USER\wg\DefaultIcon

HKEY_CURRENT_USER\wg\shell

HKEY_CURRENT_USER\wg\shell\
open

HKEY_CURRENT_USER\wg\shell\
open\command

HKEY_CURRENT_USER\wg\shell\
runas

HKEY_CURRENT_USER\wg\shell\
runas\command

HKEY_CURRENT_USER\Yq8

HKEY_CURRENT_USER\Yq8\DefaultIcon

HKEY_CURRENT_USER\Yq8\shell

HKEY_CURRENT_USER\Yq8\shell\
open

HKEY_CURRENT_USER\Yq8\shell\
open\command

HKEY_CURRENT_USER\Yq8\shell\
runas

HKEY_CURRENT_USER\Yq8\shell\
runas\command

HKEY_CURRENT_USER\Jv

HKEY_CURRENT_USER\Jv\DefaultIcon

HKEY_CURRENT_USER\Jv\shell

HKEY_CURRENT_USER\Jv\shell\
open

HKEY_CURRENT_USER\Jv\shell\
open\command

HKEY_CURRENT_USER\Jv\shell\
runas

HKEY_CURRENT_USER\Jv\shell\
runas\command

HKEY_CURRENT_USER\6R

HKEY_CURRENT_USER\6R\DefaultIcon

HKEY_CURRENT_USER\6R\shell

HKEY_CURRENT_USER\6R\shell\
open

HKEY_CURRENT_USER\6R\shell\
open\command

HKEY_CURRENT_USER\6R\shell\
runas

HKEY_CURRENT_USER\6R\shell\
runas\command

HKEY_CURRENT_USER\HlB

HKEY_CURRENT_USER\HlB\DefaultIcon

HKEY_CURRENT_USER\HlB\shell

HKEY_CURRENT_USER\HlB\shell\
open

HKEY_CURRENT_USER\HlB\shell\
open\command

HKEY_CURRENT_USER\HlB\shell\
runas

HKEY_CURRENT_USER\HlB\shell\
runas\command

HKEY_CURRENT_USER\0a

HKEY_CURRENT_USER\0a\DefaultIcon

HKEY_CURRENT_USER\0a\shell

HKEY_CURRENT_USER\0a\shell\
open

HKEY_CURRENT_USER\0a\shell\
open\command

HKEY_CURRENT_USER\0a\shell\
runas

HKEY_CURRENT_USER\0a\shell\
runas\command

HKEY_CURRENT_USER\Qn

HKEY_CURRENT_USER\Qn\DefaultIcon

HKEY_CURRENT_USER\Qn\shell

HKEY_CURRENT_USER\Qn\shell\
open

HKEY_CURRENT_USER\Qn\shell\
open\command

HKEY_CURRENT_USER\Qn\shell\
runas

HKEY_CURRENT_USER\Qn\shell\
runas\command

HKEY_CURRENT_USER\Glr

HKEY_CURRENT_USER\Glr\DefaultIcon

HKEY_CURRENT_USER\Glr\shell

HKEY_CURRENT_USER\Glr\shell\
open

HKEY_CURRENT_USER\Glr\shell\
open\command

HKEY_CURRENT_USER\Glr\shell\
runas

HKEY_CURRENT_USER\Glr\shell\
runas\command

HKEY_CURRENT_USER\OW

HKEY_CURRENT_USER\OW\DefaultIcon

HKEY_CURRENT_USER\OW\shell

HKEY_CURRENT_USER\OW\shell\
open

HKEY_CURRENT_USER\OW\shell\
open\command

HKEY_CURRENT_USER\OW\shell\
runas

HKEY_CURRENT_USER\OW\shell\
runas\command

HKEY_CURRENT_USER\GH

HKEY_CURRENT_USER\GH\DefaultIcon

HKEY_CURRENT_USER\GH\shell

HKEY_CURRENT_USER\GH\shell\
open

HKEY_CURRENT_USER\GH\shell\
open\command

HKEY_CURRENT_USER\GH\shell\
runas

HKEY_CURRENT_USER\GH\shell\
runas\command

HKEY_CURRENT_USER\5Tv

HKEY_CURRENT_USER\5Tv\DefaultIcon

HKEY_CURRENT_USER\5Tv\shell

HKEY_CURRENT_USER\5Tv\shell\
open

HKEY_CURRENT_USER\5Tv\shell\
open\command

HKEY_CURRENT_USER\5Tv\shell\
runas

HKEY_CURRENT_USER\5Tv\shell\
runas\command

HKEY_CURRENT_USER\R4

HKEY_CURRENT_USER\R4\DefaultIcon

HKEY_CURRENT_USER\R4\shell

HKEY_CURRENT_USER\R4\shell\
open

HKEY_CURRENT_USER\R4\shell\
open\command

HKEY_CURRENT_USER\R4\shell\
runas

HKEY_CURRENT_USER\R4\shell\
runas\command

HKEY_CURRENT_USER\c5

HKEY_CURRENT_USER\c5\DefaultIcon

HKEY_CURRENT_USER\c5\shell

HKEY_CURRENT_USER\c5\shell\
open

HKEY_CURRENT_USER\c5\shell\
open\command

HKEY_CURRENT_USER\c5\shell\
runas

HKEY_CURRENT_USER\c5\shell\
runas\command

HKEY_CURRENT_USER\OaO

HKEY_CURRENT_USER\OaO\DefaultIcon

HKEY_CURRENT_USER\OaO\shell

HKEY_CURRENT_USER\OaO\shell\
open

HKEY_CURRENT_USER\OaO\shell\
open\command

HKEY_CURRENT_USER\OaO\shell\
runas

HKEY_CURRENT_USER\OaO\shell\
runas\command

HKEY_CURRENT_USER\3u

HKEY_CURRENT_USER\3u\DefaultIcon

HKEY_CURRENT_USER\3u\shell

HKEY_CURRENT_USER\3u\shell\
open

HKEY_CURRENT_USER\3u\shell\
open\command

HKEY_CURRENT_USER\3u\shell\
runas

HKEY_CURRENT_USER\3u\shell\
runas\command

HKEY_CURRENT_USER\L34

HKEY_CURRENT_USER\L34\DefaultIcon

HKEY_CURRENT_USER\L34\shell

HKEY_CURRENT_USER\L34\shell\
open

HKEY_CURRENT_USER\L34\shell\
open\command

HKEY_CURRENT_USER\L34\shell\
runas

HKEY_CURRENT_USER\L34\shell\
runas\command

HKEY_CURRENT_USER\bUO

HKEY_CURRENT_USER\bUO\DefaultIcon

HKEY_CURRENT_USER\bUO\shell

HKEY_CURRENT_USER\bUO\shell\
open

HKEY_CURRENT_USER\bUO\shell\
open\command

HKEY_CURRENT_USER\bUO\shell\
runas

HKEY_CURRENT_USER\bUO\shell\
runas\command

HKEY_CURRENT_USER\1Q1

HKEY_CURRENT_USER\1Q1\DefaultIcon

HKEY_CURRENT_USER\1Q1\shell

HKEY_CURRENT_USER\1Q1\shell\
open

HKEY_CURRENT_USER\1Q1\shell\
open\command

HKEY_CURRENT_USER\1Q1\shell\
runas

HKEY_CURRENT_USER\1Q1\shell\
runas\command

HKEY_CURRENT_USER\q8r

HKEY_CURRENT_USER\q8r\DefaultIcon

HKEY_CURRENT_USER\q8r\shell

HKEY_CURRENT_USER\q8r\shell\
open

HKEY_CURRENT_USER\q8r\shell\
open\command

HKEY_CURRENT_USER\q8r\shell\
runas

HKEY_CURRENT_USER\q8r\shell\
runas\command

HKEY_CURRENT_USER\1aI

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_CURRENT_USER\.exe

HKEY_CURRENT_USER\.exe\DefaultIcon

HKEY_CURRENT_USER\.exe\shell

HKEY_CURRENT_USER\.exe\shell\
open

HKEY_CURRENT_USER\.exe\shell\
open\command

HKEY_CURRENT_USER\.exe\shell\
runas

HKEY_CURRENT_USER\.exe\shell\
runas\command

HKEY_CURRENT_USER\P82

HKEY_CURRENT_USER\P82\DefaultIcon

HKEY_CURRENT_USER\P82\shell

HKEY_CURRENT_USER\P82\shell\
open

HKEY_CURRENT_USER\P82\shell\
open\command

HKEY_CURRENT_USER\P82\shell\
runas

HKEY_CURRENT_USER\P82\shell\
runas\command

HKEY_CURRENT_USER\Y8

HKEY_CURRENT_USER\Y8\DefaultIcon

HKEY_CURRENT_USER\Y8\shell

HKEY_CURRENT_USER\Y8\shell\
open

HKEY_CURRENT_USER\Y8\shell\
open\command

HKEY_CURRENT_USER\Y8\shell\
runas

HKEY_CURRENT_USER\Y8\shell\
runas\command

HKEY_CURRENT_USER\c7

HKEY_CURRENT_USER\c7\DefaultIcon

HKEY_CURRENT_USER\c7\shell

HKEY_CURRENT_USER\c7\shell\
open

HKEY_CURRENT_USER\c7\shell\
open\command

HKEY_CURRENT_USER\c7\shell\
runas

HKEY_CURRENT_USER\c7\shell\
runas\command

HKEY_CURRENT_USER\34

HKEY_CURRENT_USER\34\DefaultIcon

HKEY_CURRENT_USER\34\shell

HKEY_CURRENT_USER\34\shell\
open

HKEY_CURRENT_USER\34\shell\
open\command

HKEY_CURRENT_USER\34\shell\
runas

HKEY_CURRENT_USER\34\shell\
runas\command

HKEY_CURRENT_USER\T5

HKEY_CURRENT_USER\T5\DefaultIcon

HKEY_CURRENT_USER\T5\shell

HKEY_CURRENT_USER\T5\shell\
open

HKEY_CURRENT_USER\T5\shell\
open\command

HKEY_CURRENT_USER\T5\shell\
runas

HKEY_CURRENT_USER\T5\shell\
runas\command

HKEY_CURRENT_USER\jG

HKEY_CURRENT_USER\jG\DefaultIcon

HKEY_CURRENT_USER\jG\shell

HKEY_CURRENT_USER\jG\shell\
open

HKEY_CURRENT_USER\jG\shell\
open\command

HKEY_CURRENT_USER\jG\shell\
runas

HKEY_CURRENT_USER\jG\shell\
runas\command

HKEY_CURRENT_USER\LRO

HKEY_CURRENT_USER\LRO\DefaultIcon

HKEY_CURRENT_USER\LRO\shell

HKEY_CURRENT_USER\LRO\shell\
open

HKEY_CURRENT_USER\LRO\shell\
open\command

HKEY_CURRENT_USER\LRO\shell\
runas

HKEY_CURRENT_USER\LRO\shell\
runas\command

HKEY_CURRENT_USER\3Q

HKEY_CURRENT_USER\3Q\DefaultIcon

HKEY_CURRENT_USER\1aI\DefaultIcon

HKEY_CURRENT_USER\1aI\shell

HKEY_CURRENT_USER\1aI\shell\
open

HKEY_CURRENT_USER\1aI\shell\
open\command

HKEY_CURRENT_USER\1aI\shell\
runas

HKEY_CURRENT_USER\1aI\shell\
runas\command

HKEY_CURRENT_USER\IS

HKEY_CURRENT_USER\IS\DefaultIcon

HKEY_CURRENT_USER\IS\shell

HKEY_CURRENT_USER\IS\shell\
open

HKEY_CURRENT_USER\IS\shell\
open\command

HKEY_CURRENT_USER\IS\shell\
runas

HKEY_CURRENT_USER\IS\shell\
runas\command

HKEY_CURRENT_USER\Nn0

HKEY_CURRENT_USER\Nn0\DefaultIcon

HKEY_CURRENT_USER\Nn0\shell

HKEY_CURRENT_USER\Nn0\shell\
open

HKEY_CURRENT_USER\Nn0\shell\
open\command

HKEY_CURRENT_USER\Nn0\shell\
runas

HKEY_CURRENT_USER\Nn0\shell\
runas\command

HKEY_CURRENT_USER\17i

HKEY_CURRENT_USER\17i\DefaultIcon

HKEY_CURRENT_USER\17i\shell

HKEY_CURRENT_USER\17i\shell\
open

HKEY_CURRENT_USER\17i\shell\
open\command

HKEY_CURRENT_USER\17i\shell\
runas

HKEY_CURRENT_USER\17i\shell\
runas\command

HKEY_CURRENT_USER\wt6

HKEY_CURRENT_USER\wt6\DefaultIcon

HKEY_CURRENT_USER\wt6\shell

HKEY_CURRENT_USER\wt6\shell\
open

HKEY_CURRENT_USER\wt6\shell\
open\command

HKEY_CURRENT_USER\wt6\shell\
runas

HKEY_CURRENT_USER\wt6\shell\
runas\command

HKEY_CURRENT_USER\Nm1

HKEY_CURRENT_USER\Nm1\DefaultIcon

HKEY_CURRENT_USER\Nm1\shell

HKEY_CURRENT_USER\Nm1\shell\
open

HKEY_CURRENT_USER\Nm1\shell\
open\command

HKEY_CURRENT_USER\Nm1\shell\
runas

HKEY_CURRENT_USER\Nm1\shell\
runas\command

HKEY_CURRENT_USER\16S

HKEY_CURRENT_USER\16S\DefaultIcon

HKEY_CURRENT_USER\16S\shell

HKEY_CURRENT_USER\16S\shell\
open

HKEY_CURRENT_USER\16S\shell\
open\command

HKEY_CURRENT_USER\16S\shell\
runas

HKEY_CURRENT_USER\16S\shell\
runas\command

HKEY_CURRENT_USER\H0o

HKEY_CURRENT_USER\H0o\DefaultIcon

HKEY_CURRENT_USER\H0o\shell

HKEY_CURRENT_USER\H0o\shell\
open

HKEY_CURRENT_USER\H0o\shell\
open\command

HKEY_CURRENT_USER\H0o\shell\
runas

HKEY_CURRENT_USER\H0o\shell\
runas\command

HKEY_CURRENT_USER\BY

HKEY_CURRENT_USER\BY\DefaultIcon

HKEY_CURRENT_USER\BY\shell

HKEY_CURRENT_USER\BY\shell\
open

HKEY_CURRENT_USER\3Q\shell

HKEY_CURRENT_USER\3Q\shell\
open

HKEY_CURRENT_USER\3Q\shell\
open\command

HKEY_CURRENT_USER\3Q\shell\
runas

HKEY_CURRENT_USER\3Q\shell\
runas\command

HKEY_CURRENT_USER\xk

HKEY_CURRENT_USER\xk\DefaultIcon

HKEY_CURRENT_USER\xk\shell

HKEY_CURRENT_USER\xk\shell\
open

HKEY_CURRENT_USER\xk\shell\
open\command

HKEY_CURRENT_USER\xk\shell\
runas

HKEY_CURRENT_USER\xk\shell\
runas\command

HKEY_CURRENT_USER\13

HKEY_CURRENT_USER\13\DefaultIcon

HKEY_CURRENT_USER\13\shell

HKEY_CURRENT_USER\13\shell\
open

HKEY_CURRENT_USER\13\shell\
open\command

HKEY_CURRENT_USER\13\shell\
runas

HKEY_CURRENT_USER\13\shell\
runas\command

HKEY_CURRENT_USER\81

HKEY_CURRENT_USER\81\DefaultIcon

HKEY_CURRENT_USER\81\shell

HKEY_CURRENT_USER\81\shell\
open

HKEY_CURRENT_USER\81\shell\
open\command

HKEY_CURRENT_USER\81\shell\
runas

HKEY_CURRENT_USER\81\shell\
runas\command

HKEY_CURRENT_USER\1a

HKEY_CURRENT_USER\1a\DefaultIcon

HKEY_CURRENT_USER\1a\shell

HKEY_CURRENT_USER\1a\shell\
open

HKEY_CURRENT_USER\1a\shell\
open\command

HKEY_CURRENT_USER\1a\shell\
runas

HKEY_CURRENT_USER\1a\shell\
runas\command

HKEY_CURRENT_USER\46T

HKEY_CURRENT_USER\46T\DefaultIcon

HKEY_CURRENT_USER\46T\shell

HKEY_CURRENT_USER\46T\shell\
open

HKEY_CURRENT_USER\46T\shell\
open\command

HKEY_CURRENT_USER\46T\shell\
runas

HKEY_CURRENT_USER\46T\shell\
runas\command

HKEY_CURRENT_USER\3m

HKEY_CURRENT_USER\3m\DefaultIcon

HKEY_CURRENT_USER\3m\shell

HKEY_CURRENT_USER\3m\shell\
open

HKEY_CURRENT_USER\3m\shell\
open\command

HKEY_CURRENT_USER\3m\shell\
runas

HKEY_CURRENT_USER\3m\shell\
runas\command

HKEY_CURRENT_USER\C1

HKEY_CURRENT_USER\C1\DefaultIcon

HKEY_CURRENT_USER\C1\shell

HKEY_CURRENT_USER\C1\shell\
open

HKEY_CURRENT_USER\C1\shell\
open\command

HKEY_CURRENT_USER\C1\shell\
runas

HKEY_CURRENT_USER\C1\shell\
runas\command

HKEY_CURRENT_USER\wQ5

HKEY_CURRENT_USER\wQ5\DefaultIcon

HKEY_CURRENT_USER\wQ5\shell

HKEY_CURRENT_USER\wQ5\shell\
open

HKEY_CURRENT_USER\wQ5\shell\
open\command

HKEY_CURRENT_USER\wQ5\shell\
runas

HKEY_CURRENT_USER\BY\shell\
open\command

HKEY_CURRENT_USER\BY\shell\
runas

HKEY_CURRENT_USER\BY\shell\
runas\command

HKEY_CURRENT_USER\2Pm

HKEY_CURRENT_USER\2Pm\DefaultIcon

HKEY_CURRENT_USER\2Pm\shell

HKEY_CURRENT_USER\2Pm\shell\
open

HKEY_CURRENT_USER\2Pm\shell\
open\command

HKEY_CURRENT_USER\2Pm\shell\
runas

HKEY_CURRENT_USER\2Pm\shell\
runas\command

HKEY_CURRENT_USER\0u1

HKEY_CURRENT_USER\0u1\DefaultIcon

HKEY_CURRENT_USER\0u1\shell

HKEY_CURRENT_USER\0u1\shell\
open

HKEY_CURRENT_USER\0u1\shell\
open\command

HKEY_CURRENT_USER\0u1\shell\
runas

HKEY_CURRENT_USER\0u1\shell\
runas\command

HKEY_CURRENT_USER\74n

HKEY_CURRENT_USER\74n\DefaultIcon

HKEY_CURRENT_USER\74n\shell

HKEY_CURRENT_USER\74n\shell\
open

HKEY_CURRENT_USER\74n\shell\
open\command

HKEY_CURRENT_USER\74n\shell\
runas

HKEY_CURRENT_USER\74n\shell\
runas\command

HKEY_CURRENT_USER\py

HKEY_CURRENT_USER\py\DefaultIcon

HKEY_CURRENT_USER\py\shell

HKEY_CURRENT_USER\py\shell\
open

HKEY_CURRENT_USER\py\shell\
open\command

HKEY_CURRENT_USER\py\shell\
runas

HKEY_CURRENT_USER\py\shell\
runas\command

HKEY_CURRENT_USER\f15

HKEY_CURRENT_USER\f15\DefaultIcon

HKEY_CURRENT_USER\f15\shell

HKEY_CURRENT_USER\f15\shell\
open

HKEY_CURRENT_USER\f15\shell\
open\command

HKEY_CURRENT_USER\f15\shell\
runas

HKEY_CURRENT_USER\f15\shell\
runas\command

HKEY_CURRENT_USER\Qo

HKEY_CURRENT_USER\Qo\DefaultIcon

HKEY_CURRENT_USER\Qo\shell

HKEY_CURRENT_USER\Qo\shell\
open

HKEY_CURRENT_USER\Qo\shell\
open\command

HKEY_CURRENT_USER\Qo\shell\
runas

HKEY_CURRENT_USER\Qo\shell\
runas\command

HKEY_CURRENT_USER\l0A

HKEY_CURRENT_USER\l0A\DefaultIcon

HKEY_CURRENT_USER\l0A\shell

HKEY_CURRENT_USER\l0A\shell\
open

HKEY_CURRENT_USER\l0A\shell\
open\command

HKEY_CURRENT_USER\l0A\shell\
runas

HKEY_CURRENT_USER\l0A\shell\
runas\command

HKEY_CURRENT_USER\U52

HKEY_CURRENT_USER\U52\DefaultIcon

HKEY_CURRENT_USER\U52\shell

HKEY_CURRENT_USER\U52\shell\
open

HKEY_CURRENT_USER\U52\shell\
open\command

HKEY_CURRENT_USER\U52\shell\
runas

HKEY_CURRENT_USER\U52\shell\
runas\command

HKEY_CURRENT_USER\wQ5\shell\
runas\command

HKEY_CURRENT_USER\23

HKEY_CURRENT_USER\23\DefaultIcon

HKEY_CURRENT_USER\23\shell

HKEY_CURRENT_USER\23\shell\
open

HKEY_CURRENT_USER\23\shell\
open\command

HKEY_CURRENT_USER\23\shell\
runas

HKEY_CURRENT_USER\23\shell\
runas\command

HKEY_CURRENT_USER\D20

HKEY_CURRENT_USER\D20\DefaultIcon

HKEY_CURRENT_USER\D20\shell

HKEY_CURRENT_USER\D20\shell\
open

HKEY_CURRENT_USER\D20\shell\
open\command

HKEY_CURRENT_USER\D20\shell\
runas

HKEY_CURRENT_USER\D20\shell\
runas\command

HKEY_CURRENT_USER\1u

HKEY_CURRENT_USER\1u\DefaultIcon

HKEY_CURRENT_USER\1u\shell

HKEY_CURRENT_USER\1u\shell\
open

HKEY_CURRENT_USER\1u\shell\
open\command

HKEY_CURRENT_USER\1u\shell\
runas

HKEY_CURRENT_USER\1u\shell\
runas\command

HKEY_CURRENT_USER\OF

HKEY_CURRENT_USER\OF\DefaultIcon

HKEY_CURRENT_USER\OF\shell

HKEY_CURRENT_USER\OF\shell\
open

HKEY_CURRENT_USER\OF\shell\
open\command

HKEY_CURRENT_USER\OF\shell\
runas

HKEY_CURRENT_USER\OF\shell\
runas\command

HKEY_CURRENT_USER\Y6

HKEY_CURRENT_USER\Y6\DefaultIcon

HKEY_CURRENT_USER\Y6\shell

HKEY_CURRENT_USER\Y6\shell\
open

HKEY_CURRENT_USER\Y6\shell\
open\command

HKEY_CURRENT_USER\Y6\shell\
runas

HKEY_CURRENT_USER\Y6\shell\
runas\command

HKEY_CURRENT_USER\k7l

HKEY_CURRENT_USER\k7l\DefaultIcon

HKEY_CURRENT_USER\k7l\shell

HKEY_CURRENT_USER\k7l\shell\
open

HKEY_CURRENT_USER\k7l\shell\
open\command

HKEY_CURRENT_USER\k7l\shell\
runas

HKEY_CURRENT_USER\k7l\shell\
runas\command

HKEY_CURRENT_USER\17

HKEY_CURRENT_USER\17\DefaultIcon

HKEY_CURRENT_USER\17\shell

HKEY_CURRENT_USER\17\shell\
open

HKEY_CURRENT_USER\17\shell\
open\command

HKEY_CURRENT_USER\17\shell\
runas

HKEY_CURRENT_USER\17\shell\
runas\command

HKEY_CURRENT_USER\X51

HKEY_CURRENT_USER\X51\DefaultIcon

HKEY_CURRENT_USER\X51\shell

HKEY_CURRENT_USER\X51\shell\
open

HKEY_CURRENT_USER\X51\shell\
open\command

HKEY_CURRENT_USER\X51\shell\
runas

HKEY_CURRENT_USER\X51\shell\
runas\command

HKEY_CURRENT_USER\rk5

HKEY_CURRENT_USER\rk5\DefaultIcon

HKEY_CURRENT_USER\8UU

HKEY_CURRENT_USER\8UU\DefaultIcon

HKEY_CURRENT_USER\8UU\shell

HKEY_CURRENT_USER\8UU\shell\
open

HKEY_CURRENT_USER\8UU\shell\
open\command

HKEY_CURRENT_USER\8UU\shell\
runas

HKEY_CURRENT_USER\8UU\shell\
runas\command

HKEY_CURRENT_USER\YAY

HKEY_CURRENT_USER\YAY\DefaultIcon

HKEY_CURRENT_USER\YAY\shell

HKEY_CURRENT_USER\YAY\shell\
open

HKEY_CURRENT_USER\YAY\shell\
open\command

HKEY_CURRENT_USER\YAY\shell\
runas

HKEY_CURRENT_USER\YAY\shell\
runas\command

HKEY_CURRENT_USER\mO

HKEY_CURRENT_USER\mO\DefaultIcon

HKEY_CURRENT_USER\mO\shell

HKEY_CURRENT_USER\mO\shell\
open

HKEY_CURRENT_USER\mO\shell\
open\command

HKEY_CURRENT_USER\mO\shell\
runas

HKEY_CURRENT_USER\mO\shell\
runas\command

HKEY_CURRENT_USER\1g

HKEY_CURRENT_USER\1g\DefaultIcon

HKEY_CURRENT_USER\1g\shell

HKEY_CURRENT_USER\1g\shell\
open

HKEY_CURRENT_USER\1g\shell\
open\command

HKEY_CURRENT_USER\1g\shell\
runas

HKEY_CURRENT_USER\1g\shell\
runas\command

HKEY_CURRENT_USER\JO

HKEY_CURRENT_USER\JO\DefaultIcon

HKEY_CURRENT_USER\JO\shell

HKEY_CURRENT_USER\JO\shell\
open

HKEY_CURRENT_USER\JO\shell\
open\command

HKEY_CURRENT_USER\JO\shell\
runas

HKEY_CURRENT_USER\JO\shell\
runas\command

HKEY_CURRENT_USER\D75

HKEY_CURRENT_USER\D75\DefaultIcon

HKEY_CURRENT_USER\D75\shell

HKEY_CURRENT_USER\D75\shell\
open

HKEY_CURRENT_USER\D75\shell\
open\command

HKEY_CURRENT_USER\D75\shell\
runas

HKEY_CURRENT_USER\D75\shell\
runas\command

HKEY_CURRENT_USER\yWK

HKEY_CURRENT_USER\yWK\DefaultIcon

HKEY_CURRENT_USER\yWK\shell

HKEY_CURRENT_USER\yWK\shell\
open

HKEY_CURRENT_USER\yWK\shell\
open\command

HKEY_CURRENT_USER\yWK\shell\
runas

HKEY_CURRENT_USER\yWK\shell\
runas\command

HKEY_CURRENT_USER\FX

HKEY_CURRENT_USER\FX\DefaultIcon

HKEY_CURRENT_USER\FX\shell

HKEY_CURRENT_USER\FX\shell\
open

HKEY_CURRENT_USER\FX\shell\
open\command

HKEY_CURRENT_USER\FX\shell\
runas

HKEY_CURRENT_USER\FX\shell\
runas\command

HKEY_CURRENT_USER\t1s

HKEY_CURRENT_USER\t1s\DefaultIcon

HKEY_CURRENT_USER\t1s\shell

HKEY_CURRENT_USER\rk5\shell

HKEY_CURRENT_USER\rk5\shell\
open

HKEY_CURRENT_USER\rk5\shell\
open\command

HKEY_CURRENT_USER\rk5\shell\
runas

HKEY_CURRENT_USER\rk5\shell\
runas\command

HKEY_CURRENT_USER\eT

HKEY_CURRENT_USER\eT\DefaultIcon

HKEY_CURRENT_USER\eT\shell

HKEY_CURRENT_USER\eT\shell\
open

HKEY_CURRENT_USER\eT\shell\
open\command

HKEY_CURRENT_USER\eT\shell\
runas

HKEY_CURRENT_USER\eT\shell\
runas\command

HKEY_CURRENT_USER\7P3

HKEY_CURRENT_USER\7P3\DefaultIcon

HKEY_CURRENT_USER\7P3\shell

HKEY_CURRENT_USER\7P3\shell\
open

HKEY_CURRENT_USER\7P3\shell\
open\command

HKEY_CURRENT_USER\7P3\shell\
runas

HKEY_CURRENT_USER\7P3\shell\
runas\command

HKEY_CURRENT_USER\74Q

HKEY_CURRENT_USER\74Q\DefaultIcon

HKEY_CURRENT_USER\74Q\shell

HKEY_CURRENT_USER\74Q\shell\
open

HKEY_CURRENT_USER\74Q\shell\
open\command

HKEY_CURRENT_USER\74Q\shell\
runas

HKEY_CURRENT_USER\74Q\shell\
runas\command

HKEY_CURRENT_USER\71

HKEY_CURRENT_USER\71\DefaultIcon

HKEY_CURRENT_USER\71\shell

HKEY_CURRENT_USER\71\shell\
open

HKEY_CURRENT_USER\71\shell\
open\command

HKEY_CURRENT_USER\71\shell\
runas

HKEY_CURRENT_USER\71\shell\
runas\command

HKEY_CURRENT_USER\h1

HKEY_CURRENT_USER\h1\DefaultIcon

HKEY_CURRENT_USER\h1\shell

HKEY_CURRENT_USER\h1\shell\
open

HKEY_CURRENT_USER\h1\shell\
open\command

HKEY_CURRENT_USER\h1\shell\
runas

HKEY_CURRENT_USER\h1\shell\
runas\command

HKEY_CURRENT_USER\Gl

HKEY_CURRENT_USER\Gl\DefaultIcon

HKEY_CURRENT_USER\Gl\shell

HKEY_CURRENT_USER\Gl\shell\
open

HKEY_CURRENT_USER\Gl\shell\
open\command

HKEY_CURRENT_USER\Gl\shell\
runas

HKEY_CURRENT_USER\Gl\shell\
runas\command

HKEY_CURRENT_USER\678

HKEY_CURRENT_USER\678\DefaultIcon

HKEY_CURRENT_USER\678\shell

HKEY_CURRENT_USER\678\shell\
open

HKEY_CURRENT_USER\678\shell\
open\command

HKEY_CURRENT_USER\678\shell\
runas

HKEY_CURRENT_USER\678\shell\
runas\command

HKEY_CURRENT_USER\lGj

HKEY_CURRENT_USER\lGj\DefaultIcon

HKEY_CURRENT_USER\lGj\shell

HKEY_CURRENT_USER\lGj\shell\
open

HKEY_CURRENT_USER\lGj\shell\
open\command

HKEY_CURRENT_USER\t1s\shell\
open

HKEY_CURRENT_USER\t1s\shell\
open\command

HKEY_CURRENT_USER\t1s\shell\
runas

HKEY_CURRENT_USER\t1s\shell\
runas\command

HKEY_CURRENT_USER\acv

HKEY_CURRENT_USER\acv\DefaultIcon

HKEY_CURRENT_USER\acv\shell

HKEY_CURRENT_USER\acv\shell\
open

HKEY_CURRENT_USER\acv\shell\
open\command

HKEY_CURRENT_USER\acv\shell\
runas

HKEY_CURRENT_USER\acv\shell\
runas\command

HKEY_CURRENT_USER\DJ2

HKEY_CURRENT_USER\DJ2\DefaultIcon

HKEY_CURRENT_USER\DJ2\shell

HKEY_CURRENT_USER\DJ2\shell\
open

HKEY_CURRENT_USER\DJ2\shell\
open\command

HKEY_CURRENT_USER\DJ2\shell\
runas

HKEY_CURRENT_USER\DJ2\shell\
runas\command

HKEY_CURRENT_USER\wF

HKEY_CURRENT_USER\wF\DefaultIcon

HKEY_CURRENT_USER\wF\shell

HKEY_CURRENT_USER\wF\shell\
open

HKEY_CURRENT_USER\wF\shell\
open\command

HKEY_CURRENT_USER\wF\shell\
runas

HKEY_CURRENT_USER\wF\shell\
runas\command

HKEY_CURRENT_USER\id1

HKEY_CURRENT_USER\id1\DefaultIcon

HKEY_CURRENT_USER\id1\shell

HKEY_CURRENT_USER\id1\shell\
open

HKEY_CURRENT_USER\id1\shell\
open\command

HKEY_CURRENT_USER\id1\shell\
runas

HKEY_CURRENT_USER\id1\shell\
runas\command

HKEY_CURRENT_USER\t7q

HKEY_CURRENT_USER\t7q\DefaultIcon

HKEY_CURRENT_USER\t7q\shell

HKEY_CURRENT_USER\t7q\shell\
open

HKEY_CURRENT_USER\t7q\shell\
open\command

HKEY_CURRENT_USER\t7q\shell\
runas

HKEY_CURRENT_USER\t7q\shell\
runas\command

HKEY_CURRENT_USER\NW

HKEY_CURRENT_USER\NW\DefaultIcon

HKEY_CURRENT_USER\NW\shell

HKEY_CURRENT_USER\NW\shell\
open

HKEY_CURRENT_USER\NW\shell\
open\command

HKEY_CURRENT_USER\NW\shell\
runas

HKEY_CURRENT_USER\NW\shell\
runas\command

HKEY_CURRENT_USER\114

HKEY_CURRENT_USER\114\DefaultIcon

HKEY_CURRENT_USER\114\shell

HKEY_CURRENT_USER\114\shell\
open

HKEY_CURRENT_USER\114\shell\
open\command

HKEY_CURRENT_USER\114\shell\
runas

HKEY_CURRENT_USER\114\shell\
runas\command

HKEY_CURRENT_USER\nJ

HKEY_CURRENT_USER\nJ\DefaultIcon

HKEY_CURRENT_USER\nJ\shell

HKEY_CURRENT_USER\nJ\shell\
open

HKEY_CURRENT_USER\nJ\shell\
open\command

HKEY_CURRENT_USER\nJ\shell\
runas

HKEY_CURRENT_USER\lGj\shell\
runas

HKEY_CURRENT_USER\lGj\shell\
runas\command

HKEY_CURRENT_USER\pj

HKEY_CURRENT_USER\pj\DefaultIcon

HKEY_CURRENT_USER\pj\shell

HKEY_CURRENT_USER\pj\shell\
open

HKEY_CURRENT_USER\pj\shell\
open\command

HKEY_CURRENT_USER\pj\shell\
runas

HKEY_CURRENT_USER\pj\shell\
runas\command

HKEY_CURRENT_USER\kY

HKEY_CURRENT_USER\kY\DefaultIcon

HKEY_CURRENT_USER\kY\shell

HKEY_CURRENT_USER\kY\shell\
open

HKEY_CURRENT_USER\kY\shell\
open\command

HKEY_CURRENT_USER\kY\shell\
runas

HKEY_CURRENT_USER\kY\shell\
runas\command

HKEY_CURRENT_USER\8C

HKEY_CURRENT_USER\8C\DefaultIcon

HKEY_CURRENT_USER\8C\shell

HKEY_CURRENT_USER\8C\shell\
open

HKEY_CURRENT_USER\8C\shell\
open\command

HKEY_CURRENT_USER\8C\shell\
runas

HKEY_CURRENT_USER\8C\shell\
runas\command

HKEY_CURRENT_USER\e3

HKEY_CURRENT_USER\e3\DefaultIcon

HKEY_CURRENT_USER\e3\shell

HKEY_CURRENT_USER\e3\shell\
open

HKEY_CURRENT_USER\e3\shell\
open\command

HKEY_CURRENT_USER\e3\shell\
runas

HKEY_CURRENT_USER\e3\shell\
runas\command

HKEY_CURRENT_USER\2w

HKEY_CURRENT_USER\2w\DefaultIcon

HKEY_CURRENT_USER\2w\shell

HKEY_CURRENT_USER\2w\shell\
open

HKEY_CURRENT_USER\2w\shell\
open\command

HKEY_CURRENT_USER\2w\shell\
runas

HKEY_CURRENT_USER\2w\shell\
runas\command

HKEY_CURRENT_USER\208

HKEY_CURRENT_USER\208\DefaultIcon

HKEY_CURRENT_USER\208\shell

HKEY_CURRENT_USER\208\shell\
open

HKEY_CURRENT_USER\208\shell\
open\command

HKEY_CURRENT_USER\208\shell\
runas

HKEY_CURRENT_USER\208\shell\
runas\command

HKEY_CURRENT_USER\UEH

HKEY_CURRENT_USER\UEH\DefaultIcon

HKEY_CURRENT_USER\UEH\shell

HKEY_CURRENT_USER\UEH\shell\
open

HKEY_CURRENT_USER\UEH\shell\
open\command

HKEY_CURRENT_USER\UEH\shell\
runas

HKEY_CURRENT_USER\UEH\shell\
runas\command

HKEY_CURRENT_USER\1o

HKEY_CURRENT_USER\1o\DefaultIcon

HKEY_CURRENT_USER\1o\shell

HKEY_CURRENT_USER\1o\shell\
open

HKEY_CURRENT_USER\1o\shell\
open\command

HKEY_CURRENT_USER\1o\shell\
runas

HKEY_CURRENT_USER\1o\shell\
runas\command

HKEY_CURRENT_USER\2Ka

HKEY_CURRENT_USER\2Ka\DefaultIcon

HKEY_CURRENT_USER\nJ\shell\
runas\command

HKEY_CURRENT_USER\qd

HKEY_CURRENT_USER\qd\DefaultIcon

HKEY_CURRENT_USER\qd\shell

HKEY_CURRENT_USER\qd\shell\
open

HKEY_CURRENT_USER\qd\shell\
open\command

HKEY_CURRENT_USER\qd\shell\
runas

HKEY_CURRENT_USER\qd\shell\
runas\command

HKEY_CURRENT_USER\SWf

HKEY_CURRENT_USER\SWf\DefaultIcon

HKEY_CURRENT_USER\SWf\shell

HKEY_CURRENT_USER\SWf\shell\
open

HKEY_CURRENT_USER\SWf\shell\
open\command

HKEY_CURRENT_USER\SWf\shell\
runas

HKEY_CURRENT_USER\SWf\shell\
runas\command

HKEY_CURRENT_USER\RDt

HKEY_CURRENT_USER\RDt\DefaultIcon

HKEY_CURRENT_USER\RDt\shell

HKEY_CURRENT_USER\RDt\shell\
open

HKEY_CURRENT_USER\RDt\shell\
open\command

HKEY_CURRENT_USER\RDt\shell\
runas

HKEY_CURRENT_USER\RDt\shell\
runas\command

HKEY_CURRENT_USER\1B

HKEY_CURRENT_USER\1B\DefaultIcon

HKEY_CURRENT_USER\1B\shell

HKEY_CURRENT_USER\1B\shell\
open

HKEY_CURRENT_USER\1B\shell\
open\command

HKEY_CURRENT_USER\1B\shell\
runas

HKEY_CURRENT_USER\1B\shell\
runas\command

HKEY_CURRENT_USER\88

HKEY_CURRENT_USER\88\DefaultIcon

HKEY_CURRENT_USER\88\shell

HKEY_CURRENT_USER\88\shell\
open

HKEY_CURRENT_USER\88\shell\
open\command

HKEY_CURRENT_USER\88\shell\
runas

HKEY_CURRENT_USER\88\shell\
runas\command

HKEY_CURRENT_USER\8J8

HKEY_CURRENT_USER\8J8\DefaultIcon

HKEY_CURRENT_USER\8J8\shell

HKEY_CURRENT_USER\8J8\shell\
open

HKEY_CURRENT_USER\8J8\shell\
open\command

HKEY_CURRENT_USER\8J8\shell\
runas

HKEY_CURRENT_USER\8J8\shell\
runas\command

HKEY_CURRENT_USER\0w6

HKEY_CURRENT_USER\0w6\DefaultIcon

HKEY_CURRENT_USER\0w6\shell

HKEY_CURRENT_USER\0w6\shell\
open

HKEY_CURRENT_USER\0w6\shell\
open\command

HKEY_CURRENT_USER\0w6\shell\
runas

HKEY_CURRENT_USER\0w6\shell\
runas\command

HKEY_CURRENT_USER\SEp

HKEY_CURRENT_USER\SEp\DefaultIcon

HKEY_CURRENT_USER\SEp\shell

HKEY_CURRENT_USER\SEp\shell\
open

HKEY_CURRENT_USER\SEp\shell\
open\command

HKEY_CURRENT_USER\SEp\shell\
runas

HKEY_CURRENT_USER\SEp\shell\
runas\command

HKEY_CURRENT_USER\yJ1

HKEY_CURRENT_USER\yJ1\DefaultIcon

HKEY_CURRENT_USER\2Ka\shell

HKEY_CURRENT_USER\2Ka\shell\
open

HKEY_CURRENT_USER\2Ka\shell\
open\command

HKEY_CURRENT_USER\2Ka\shell\
runas

HKEY_CURRENT_USER\2Ka\shell\
runas\command

HKEY_CURRENT_USER\e2

HKEY_CURRENT_USER\e2\DefaultIcon

HKEY_CURRENT_USER\e2\shell

HKEY_CURRENT_USER\e2\shell\
open

HKEY_CURRENT_USER\e2\shell\
open\command

HKEY_CURRENT_USER\e2\shell\
runas

HKEY_CURRENT_USER\e2\shell\
runas\command

HKEY_CURRENT_USER\3pO

HKEY_CURRENT_USER\3pO\DefaultIcon

HKEY_CURRENT_USER\3pO\shell

HKEY_CURRENT_USER\3pO\shell\
open

HKEY_CURRENT_USER\3pO\shell\
open\command

HKEY_CURRENT_USER\3pO\shell\
runas

HKEY_CURRENT_USER\3pO\shell\
runas\command

HKEY_CURRENT_USER\uUe

HKEY_CURRENT_USER\uUe\DefaultIcon

HKEY_CURRENT_USER\uUe\shell

HKEY_CURRENT_USER\uUe\shell\
open

HKEY_CURRENT_USER\uUe\shell\
open\command

HKEY_CURRENT_USER\uUe\shell\
runas

HKEY_CURRENT_USER\uUe\shell\
runas\command

HKEY_CURRENT_USER\G3Y

HKEY_CURRENT_USER\G3Y\DefaultIcon

HKEY_CURRENT_USER\G3Y\shell

HKEY_CURRENT_USER\G3Y\shell\
open

HKEY_CURRENT_USER\G3Y\shell\
open\command

HKEY_CURRENT_USER\G3Y\shell\
runas

HKEY_CURRENT_USER\G3Y\shell\
runas\command

HKEY_CURRENT_USER\2Ey

HKEY_CURRENT_USER\2Ey\DefaultIcon

HKEY_CURRENT_USER\2Ey\shell

HKEY_CURRENT_USER\2Ey\shell\
open

HKEY_CURRENT_USER\2Ey\shell\
open\command

HKEY_CURRENT_USER\2Ey\shell\
runas

HKEY_CURRENT_USER\2Ey\shell\
runas\command

HKEY_CURRENT_USER\gE

HKEY_CURRENT_USER\gE\DefaultIcon

HKEY_CURRENT_USER\gE\shell

HKEY_CURRENT_USER\gE\shell\
open

HKEY_CURRENT_USER\gE\shell\
open\command

HKEY_CURRENT_USER\gE\shell\
runas

HKEY_CURRENT_USER\gE\shell\
runas\command

HKEY_CURRENT_USER\Up

HKEY_CURRENT_USER\Up\DefaultIcon

HKEY_CURRENT_USER\Up\shell

HKEY_CURRENT_USER\Up\shell\
open

HKEY_CURRENT_USER\Up\shell\
open\command

HKEY_CURRENT_USER\Up\shell\
runas

HKEY_CURRENT_USER\Up\shell\
runas\command

HKEY_CURRENT_USER\3O7

HKEY_CURRENT_USER\3O7\DefaultIcon

HKEY_CURRENT_USER\3O7\shell

HKEY_CURRENT_USER\3O7\shell\
open

HKEY_CURRENT_USER\3O7\shell\
open\command

HKEY_CURRENT_USER\yJ1\shell

HKEY_CURRENT_USER\yJ1\shell\
open

HKEY_CURRENT_USER\yJ1\shell\
open\command

HKEY_CURRENT_USER\yJ1\shell\
runas

HKEY_CURRENT_USER\yJ1\shell\
runas\command

HKEY_CURRENT_USER\Pl8

HKEY_CURRENT_USER\Pl8\DefaultIcon

HKEY_CURRENT_USER\Pl8\shell

HKEY_CURRENT_USER\Pl8\shell\
open

HKEY_CURRENT_USER\Pl8\shell\
open\command

HKEY_CURRENT_USER\Pl8\shell\
runas

HKEY_CURRENT_USER\Pl8\shell\
runas\command

HKEY_CURRENT_USER\5Y

HKEY_CURRENT_USER\5Y\DefaultIcon

HKEY_CURRENT_USER\5Y\shell

HKEY_CURRENT_USER\5Y\shell\
open

HKEY_CURRENT_USER\5Y\shell\
open\command

HKEY_CURRENT_USER\5Y\shell\
runas

HKEY_CURRENT_USER\5Y\shell\
runas\command

HKEY_CURRENT_USER\Eu

HKEY_CURRENT_USER\Eu\DefaultIcon

HKEY_CURRENT_USER\Eu\shell

HKEY_CURRENT_USER\Eu\shell\
open

HKEY_CURRENT_USER\Eu\shell\
open\command

HKEY_CURRENT_USER\Eu\shell\
runas

HKEY_CURRENT_USER\Eu\shell\
runas\command

HKEY_CURRENT_USER\5x

HKEY_CURRENT_USER\5x\DefaultIcon

HKEY_CURRENT_USER\5x\shell

HKEY_CURRENT_USER\5x\shell\
open

HKEY_CURRENT_USER\5x\shell\
open\command

HKEY_CURRENT_USER\5x\shell\
runas

HKEY_CURRENT_USER\5x\shell\
runas\command

HKEY_CURRENT_USER\L5

HKEY_CURRENT_USER\L5\DefaultIcon

HKEY_CURRENT_USER\L5\shell

HKEY_CURRENT_USER\L5\shell\
open

HKEY_CURRENT_USER\L5\shell\
open\command

HKEY_CURRENT_USER\L5\shell\
runas

HKEY_CURRENT_USER\L5\shell\
runas\command

HKEY_CURRENT_USER\apC

HKEY_CURRENT_USER\apC\DefaultIcon

HKEY_CURRENT_USER\apC\shell

HKEY_CURRENT_USER\apC\shell\
open

HKEY_CURRENT_USER\apC\shell\
open\command

HKEY_CURRENT_USER\apC\shell\
runas

HKEY_CURRENT_USER\apC\shell\
runas\command

HKEY_CURRENT_USER\sU1

HKEY_CURRENT_USER\sU1\DefaultIcon

HKEY_CURRENT_USER\sU1\shell

HKEY_CURRENT_USER\sU1\shell\
open

HKEY_CURRENT_USER\sU1\shell\
open\command

HKEY_CURRENT_USER\sU1\shell\
runas

HKEY_CURRENT_USER\sU1\shell\
runas\command

HKEY_CURRENT_USER\0H5

HKEY_CURRENT_USER\0H5\DefaultIcon

HKEY_CURRENT_USER\0H5\shell

HKEY_CURRENT_USER\0H5\shell\
open

HKEY_CURRENT_USER\0H5\shell\
open\command

HKEY_CURRENT_USER\3O7\shell\
runas

HKEY_CURRENT_USER\3O7\shell\
runas\command

HKEY_CURRENT_USER\4D

HKEY_CURRENT_USER\4D\DefaultIcon

HKEY_CURRENT_USER\4D\shell

HKEY_CURRENT_USER\4D\shell\
open

HKEY_CURRENT_USER\4D\shell\
open\command

HKEY_CURRENT_USER\4D\shell\
runas

HKEY_CURRENT_USER\4D\shell\
runas\command

HKEY_CURRENT_USER\fW3

HKEY_CURRENT_USER\fW3\DefaultIcon

HKEY_CURRENT_USER\fW3\shell

HKEY_CURRENT_USER\fW3\shell\
open

HKEY_CURRENT_USER\fW3\shell\
open\command

HKEY_CURRENT_USER\fW3\shell\
runas

HKEY_CURRENT_USER\fW3\shell\
runas\command

HKEY_CURRENT_USER\12y

HKEY_CURRENT_USER\12y\DefaultIcon

HKEY_CURRENT_USER\12y\shell

HKEY_CURRENT_USER\12y\shell\
open

HKEY_CURRENT_USER\12y\shell\
open\command

HKEY_CURRENT_USER\12y\shell\
runas

HKEY_CURRENT_USER\12y\shell\
runas\command

HKEY_CURRENT_USER\7D

HKEY_CURRENT_USER\7D\DefaultIcon

HKEY_CURRENT_USER\7D\shell

HKEY_CURRENT_USER\7D\shell\
open

HKEY_CURRENT_USER\7D\shell\
open\command

HKEY_CURRENT_USER\7D\shell\
runas

HKEY_CURRENT_USER\7D\shell\
runas\command

HKEY_CURRENT_USER\165

HKEY_CURRENT_USER\165\DefaultIcon

HKEY_CURRENT_USER\165\shell

HKEY_CURRENT_USER\165\shell\
open

HKEY_CURRENT_USER\165\shell\
open\command

HKEY_CURRENT_USER\165\shell\
runas

HKEY_CURRENT_USER\165\shell\
runas\command

HKEY_CURRENT_USER\00e

HKEY_CURRENT_USER\00e\DefaultIcon

HKEY_CURRENT_USER\00e\shell

HKEY_CURRENT_USER\00e\shell\
open

HKEY_CURRENT_USER\00e\shell\
open\command

HKEY_CURRENT_USER\00e\shell\
runas

HKEY_CURRENT_USER\00e\shell\
runas\command

HKEY_CURRENT_USER\e3E

HKEY_CURRENT_USER\e3E\DefaultIcon

HKEY_CURRENT_USER\e3E\shell

HKEY_CURRENT_USER\e3E\shell\
open

HKEY_CURRENT_USER\e3E\shell\
open\command

HKEY_CURRENT_USER\e3E\shell\
runas

HKEY_CURRENT_USER\e3E\shell\
runas\command

HKEY_CURRENT_USER\nE

HKEY_CURRENT_USER\nE\DefaultIcon

HKEY_CURRENT_USER\nE\shell

HKEY_CURRENT_USER\nE\shell\
open

HKEY_CURRENT_USER\nE\shell\
open\command

HKEY_CURRENT_USER\nE\shell\
runas

HKEY_CURRENT_USER\nE\shell\
runas\command

HKEY_CURRENT_USER\6Fn

HKEY_CURRENT_USER\0H5\shell\
runas

HKEY_CURRENT_USER\0H5\shell\
runas\command

HKEY_CURRENT_USER\6s

HKEY_CURRENT_USER\6s\DefaultIcon

HKEY_CURRENT_USER\6s\shell

HKEY_CURRENT_USER\6s\shell\
open

HKEY_CURRENT_USER\6s\shell\
open\command

HKEY_CURRENT_USER\6s\shell\
runas

HKEY_CURRENT_USER\6s\shell\
runas\command

HKEY_CURRENT_USER\2YG

HKEY_CURRENT_USER\2YG\DefaultIcon

HKEY_CURRENT_USER\2YG\shell

HKEY_CURRENT_USER\2YG\shell\
open

HKEY_CURRENT_USER\2YG\shell\
open\command

HKEY_CURRENT_USER\2YG\shell\
runas

HKEY_CURRENT_USER\2YG\shell\
runas\command

HKEY_CURRENT_USER\45g

HKEY_CURRENT_USER\45g\DefaultIcon

HKEY_CURRENT_USER\45g\shell

HKEY_CURRENT_USER\45g\shell\
open

HKEY_CURRENT_USER\45g\shell\
open\command

HKEY_CURRENT_USER\45g\shell\
runas

HKEY_CURRENT_USER\45g\shell\
runas\command

HKEY_CURRENT_USER\fj

HKEY_CURRENT_USER\fj\DefaultIcon

HKEY_CURRENT_USER\fj\shell

HKEY_CURRENT_USER\fj\shell\
open

HKEY_CURRENT_USER\fj\shell\
open\command

HKEY_CURRENT_USER\fj\shell\
runas

HKEY_CURRENT_USER\fj\shell\
runas\command

HKEY_CURRENT_USER\75

HKEY_CURRENT_USER\75\DefaultIcon

HKEY_CURRENT_USER\75\shell

HKEY_CURRENT_USER\75\shell\
open

HKEY_CURRENT_USER\75\shell\
open\command

HKEY_CURRENT_USER\75\shell\
runas

HKEY_CURRENT_USER\75\shell\
runas\command

HKEY_CURRENT_USER\8W

HKEY_CURRENT_USER\8W\DefaultIcon

HKEY_CURRENT_USER\8W\shell

HKEY_CURRENT_USER\8W\shell\
open

HKEY_CURRENT_USER\8W\shell\
open\command

HKEY_CURRENT_USER\8W\shell\
runas

HKEY_CURRENT_USER\8W\shell\
runas\command

HKEY_CURRENT_USER\87F

HKEY_CURRENT_USER\87F\DefaultIcon

HKEY_CURRENT_USER\87F\shell

HKEY_CURRENT_USER\87F\shell\
open

HKEY_CURRENT_USER\87F\shell\
open\command

HKEY_CURRENT_USER\87F\shell\
runas

HKEY_CURRENT_USER\87F\shell\
runas\command

HKEY_CURRENT_USER\cpA

HKEY_CURRENT_USER\cpA\DefaultIcon

HKEY_CURRENT_USER\cpA\shell

HKEY_CURRENT_USER\cpA\shell\
open

HKEY_CURRENT_USER\cpA\shell\
open\command

HKEY_CURRENT_USER\cpA\shell\
runas

HKEY_CURRENT_USER\cpA\shell\
runas\command

HKEY_CURRENT_USER\J28

HKEY_CURRENT_USER\6Fn\DefaultIcon

HKEY_CURRENT_USER\6Fn\shell

HKEY_CURRENT_USER\6Fn\shell\
open

HKEY_CURRENT_USER\6Fn\shell\
open\command

HKEY_CURRENT_USER\6Fn\shell\
runas

HKEY_CURRENT_USER\6Fn\shell\
runas\command

HKEY_CURRENT_USER\WB

HKEY_CURRENT_USER\WB\DefaultIcon

HKEY_CURRENT_USER\WB\shell

HKEY_CURRENT_USER\WB\shell\
open

HKEY_CURRENT_USER\WB\shell\
open\command

HKEY_CURRENT_USER\WB\shell\
runas

HKEY_CURRENT_USER\WB\shell\
runas\command

HKEY_CURRENT_USER\3yJ

HKEY_CURRENT_USER\3yJ\DefaultIcon

HKEY_CURRENT_USER\3yJ\shell

HKEY_CURRENT_USER\3yJ\shell\
open

HKEY_CURRENT_USER\3yJ\shell\
open\command

HKEY_CURRENT_USER\3yJ\shell\
runas

HKEY_CURRENT_USER\3yJ\shell\
runas\command

HKEY_CURRENT_USER\1R

HKEY_CURRENT_USER\1R\DefaultIcon

HKEY_CURRENT_USER\1R\shell

HKEY_CURRENT_USER\1R\shell\
open

HKEY_CURRENT_USER\1R\shell\
open\command

HKEY_CURRENT_USER\1R\shell\
runas

HKEY_CURRENT_USER\1R\shell\
runas\command

HKEY_CURRENT_USER\1i

HKEY_CURRENT_USER\1i\DefaultIcon

HKEY_CURRENT_USER\1i\shell

HKEY_CURRENT_USER\1i\shell\
open

HKEY_CURRENT_USER\1i\shell\
open\command

HKEY_CURRENT_USER\1i\shell\
runas

HKEY_CURRENT_USER\1i\shell\
runas\command

HKEY_CURRENT_USER\y2c

HKEY_CURRENT_USER\y2c\DefaultIcon

HKEY_CURRENT_USER\y2c\shell

HKEY_CURRENT_USER\y2c\shell\
open

HKEY_CURRENT_USER\y2c\shell\
open\command

HKEY_CURRENT_USER\y2c\shell\
runas

HKEY_CURRENT_USER\y2c\shell\
runas\command

HKEY_CURRENT_USER\r0

HKEY_CURRENT_USER\r0\DefaultIcon

HKEY_CURRENT_USER\r0\shell

HKEY_CURRENT_USER\r0\shell\
open

HKEY_CURRENT_USER\r0\shell\
open\command

HKEY_CURRENT_USER\r0\shell\
runas

HKEY_CURRENT_USER\r0\shell\
runas\command

HKEY_CURRENT_USER\wQ

HKEY_CURRENT_USER\wQ\DefaultIcon

HKEY_CURRENT_USER\wQ\shell

HKEY_CURRENT_USER\wQ\shell\
open

HKEY_CURRENT_USER\wQ\shell\
open\command

HKEY_CURRENT_USER\wQ\shell\
runas

HKEY_CURRENT_USER\wQ\shell\
runas\command

HKEY_CURRENT_USER\Tu

HKEY_CURRENT_USER\Tu\DefaultIcon

HKEY_CURRENT_USER\Tu\shell

HKEY_CURRENT_USER\Tu\shell\
open

HKEY_CURRENT_USER\Tu\shell\
open\command

HKEY_CURRENT_USER\J28\DefaultIcon

HKEY_CURRENT_USER\J28\shell

HKEY_CURRENT_USER\J28\shell\
open

HKEY_CURRENT_USER\J28\shell\
open\command

HKEY_CURRENT_USER\J28\shell\
runas

HKEY_CURRENT_USER\J28\shell\
runas\command

HKEY_CURRENT_USER\8D0

HKEY_CURRENT_USER\8D0\DefaultIcon

HKEY_CURRENT_USER\8D0\shell

HKEY_CURRENT_USER\8D0\shell\
open

HKEY_CURRENT_USER\8D0\shell\
open\command

HKEY_CURRENT_USER\8D0\shell\
runas

HKEY_CURRENT_USER\8D0\shell\
runas\command

HKEY_CURRENT_USER\5f

HKEY_CURRENT_USER\5f\DefaultIcon

HKEY_CURRENT_USER\5f\shell

HKEY_CURRENT_USER\5f\shell\
open

HKEY_CURRENT_USER\5f\shell\
open\command

HKEY_CURRENT_USER\5f\shell\
runas

HKEY_CURRENT_USER\5f\shell\
runas\command

HKEY_CURRENT_USER\Us

HKEY_CURRENT_USER\Us\DefaultIcon

HKEY_CURRENT_USER\Us\shell

HKEY_CURRENT_USER\Us\shell\
open

HKEY_CURRENT_USER\Us\shell\
open\command

HKEY_CURRENT_USER\Us\shell\
runas

HKEY_CURRENT_USER\Us\shell\
runas\command

HKEY_CURRENT_USER\5e

HKEY_CURRENT_USER\5e\DefaultIcon

HKEY_CURRENT_USER\5e\shell

HKEY_CURRENT_USER\5e\shell\
open

HKEY_CURRENT_USER\5e\shell\
open\command

HKEY_CURRENT_USER\5e\shell\
runas

HKEY_CURRENT_USER\5e\shell\
runas\command

HKEY_CURRENT_USER\15

HKEY_CURRENT_USER\15\DefaultIcon

HKEY_CURRENT_USER\15\shell

HKEY_CURRENT_USER\15\shell\
open

HKEY_CURRENT_USER\15\shell\
open\command

HKEY_CURRENT_USER\15\shell\
runas

HKEY_CURRENT_USER\15\shell\
runas\command

HKEY_CURRENT_USER\m2c

HKEY_CURRENT_USER\m2c\DefaultIcon

HKEY_CURRENT_USER\m2c\shell

HKEY_CURRENT_USER\m2c\shell\
open

HKEY_CURRENT_USER\m2c\shell\
open\command

HKEY_CURRENT_USER\m2c\shell\
runas

HKEY_CURRENT_USER\m2c\shell\
runas\command

HKEY_CURRENT_USER\55n

HKEY_CURRENT_USER\55n\DefaultIcon

HKEY_CURRENT_USER\55n\shell

HKEY_CURRENT_USER\55n\shell\
open

HKEY_CURRENT_USER\55n\shell\
open\command

HKEY_CURRENT_USER\55n\shell\
runas

HKEY_CURRENT_USER\55n\shell\
runas\command

HKEY_CURRENT_USER\eg

HKEY_CURRENT_USER\eg\DefaultIcon

HKEY_CURRENT_USER\eg\shell

HKEY_CURRENT_USER\eg\shell\
open

HKEY_CURRENT_USER\Tu\shell\
runas

HKEY_CURRENT_USER\Tu\shell\
runas\command

HKEY_CURRENT_USER\STy

HKEY_CURRENT_USER\STy\DefaultIcon

HKEY_CURRENT_USER\STy\shell

HKEY_CURRENT_USER\STy\shell\
open

HKEY_CURRENT_USER\STy\shell\
open\command

HKEY_CURRENT_USER\STy\shell\
runas

HKEY_CURRENT_USER\STy\shell\
runas\command

HKEY_CURRENT_USER\m0u

HKEY_CURRENT_USER\m0u\DefaultIcon

HKEY_CURRENT_USER\m0u\shell

HKEY_CURRENT_USER\m0u\shell\
open

HKEY_CURRENT_USER\m0u\shell\
open\command

HKEY_CURRENT_USER\m0u\shell\
runas

HKEY_CURRENT_USER\m0u\shell\
runas\command

HKEY_CURRENT_USER\38

HKEY_CURRENT_USER\38\DefaultIcon

HKEY_CURRENT_USER\38\shell

HKEY_CURRENT_USER\38\shell\
open

HKEY_CURRENT_USER\38\shell\
open\command

HKEY_CURRENT_USER\38\shell\
runas

HKEY_CURRENT_USER\38\shell\
runas\command

HKEY_CURRENT_USER\dG1

HKEY_CURRENT_USER\dG1\DefaultIcon

HKEY_CURRENT_USER\dG1\shell

HKEY_CURRENT_USER\dG1\shell\
open

HKEY_CURRENT_USER\dG1\shell\
open\command

HKEY_CURRENT_USER\dG1\shell\
runas

HKEY_CURRENT_USER\dG1\shell\
runas\command

HKEY_CURRENT_USER\1in

HKEY_CURRENT_USER\1in\DefaultIcon

HKEY_CURRENT_USER\1in\shell

HKEY_CURRENT_USER\1in\shell\
open

HKEY_CURRENT_USER\1in\shell\
open\command

HKEY_CURRENT_USER\1in\shell\
runas

HKEY_CURRENT_USER\1in\shell\
runas\command

HKEY_CURRENT_USER\8l

HKEY_CURRENT_USER\8l\DefaultIcon

HKEY_CURRENT_USER\8l\shell

HKEY_CURRENT_USER\8l\shell\
open

HKEY_CURRENT_USER\8l\shell\
open\command

HKEY_CURRENT_USER\8l\shell\
runas

HKEY_CURRENT_USER\8l\shell\
runas\command

HKEY_CURRENT_USER\F8

HKEY_CURRENT_USER\F8\DefaultIcon

HKEY_CURRENT_USER\F8\shell

HKEY_CURRENT_USER\F8\shell\
open

HKEY_CURRENT_USER\F8\shell\
open\command

HKEY_CURRENT_USER\F8\shell\
runas

HKEY_CURRENT_USER\F8\shell\
runas\command

HKEY_CURRENT_USER\juB

HKEY_CURRENT_USER\juB\DefaultIcon

HKEY_CURRENT_USER\juB\shell

HKEY_CURRENT_USER\juB\shell\
open

HKEY_CURRENT_USER\juB\shell\
open\command

HKEY_CURRENT_USER\juB\shell\
runas

HKEY_CURRENT_USER\juB\shell\
runas\command

HKEY_CURRENT_USER\ejJ

HKEY_CURRENT_USER\ejJ\DefaultIcon

HKEY_CURRENT_USER\ejJ\shell

HKEY_CURRENT_USER\ejJ\shell\
open

HKEY_CURRENT_USER\ejJ\shell\
open\command

HKEY_CURRENT_USER\ejJ\shell\
runas

HKEY_CURRENT_USER\ejJ\shell\
runas\command

HKEY_CURRENT_USER\p1

HKEY_CURRENT_USER\p1\DefaultIcon

HKEY_CURRENT_USER\p1\shell

HKEY_CURRENT_USER\p1\shell\
open

HKEY_CURRENT_USER\p1\shell\
open\command

HKEY_CURRENT_USER\p1\shell\
runas

HKEY_CURRENT_USER\p1\shell\
runas\command

HKEY_CURRENT_USER\rfY

HKEY_CURRENT_USER\rfY\DefaultIcon

HKEY_CURRENT_USER\rfY\shell

HKEY_CURRENT_USER\rfY\shell\
open

HKEY_CURRENT_USER\rfY\shell\
open\command

HKEY_CURRENT_USER\rfY\shell\
runas

HKEY_CURRENT_USER\rfY\shell\
runas\command

HKEY_CURRENT_USER\TH

HKEY_CURRENT_USER\TH\DefaultIcon

HKEY_CURRENT_USER\TH\shell

HKEY_CURRENT_USER\TH\shell\
open

HKEY_CURRENT_USER\TH\shell\
open\command

HKEY_CURRENT_USER\TH\shell\
runas

HKEY_CURRENT_USER\TH\shell\
runas\command

HKEY_CURRENT_USER\JQX

HKEY_CURRENT_USER\JQX\DefaultIcon

HKEY_CURRENT_USER\JQX\shell

HKEY_CURRENT_USER\JQX\shell\
open

HKEY_CURRENT_USER\JQX\shell\
open\command

HKEY_CURRENT_USER\JQX\shell\
runas

HKEY_CURRENT_USER\JQX\shell\
runas\command

HKEY_CURRENT_USER\nyP

HKEY_CURRENT_USER\nyP\DefaultIcon

HKEY_CURRENT_USER\nyP\shell

HKEY_CURRENT_USER\nyP\shell\
open

HKEY_CURRENT_USER\nyP\shell\
open\command

HKEY_CURRENT_USER\nyP\shell\
runas

HKEY_CURRENT_USER\nyP\shell\
runas\command

HKEY_CURRENT_USER\8V

HKEY_CURRENT_USER\8V\DefaultIcon

HKEY_CURRENT_USER\8V\shell

HKEY_CURRENT_USER\8V\shell\
open

HKEY_CURRENT_USER\8V\shell\
open\command

HKEY_CURRENT_USER\8V\shell\
runas

HKEY_CURRENT_USER\8V\shell\
runas\command

HKEY_CURRENT_USER\keR

HKEY_CURRENT_USER\keR\DefaultIcon

HKEY_CURRENT_USER\keR\shell

HKEY_CURRENT_USER\keR\shell\
open

HKEY_CURRENT_USER\keR\shell\
open\command

HKEY_CURRENT_USER\keR\shell\
runas

HKEY_CURRENT_USER\keR\shell\
runas\command

HKEY_CURRENT_USER\Vs

HKEY_CURRENT_USER\Vs\DefaultIcon

HKEY_CURRENT_USER\Vs\shell

HKEY_CURRENT_USER\Vs\shell\
open

HKEY_CURRENT_USER\Vs\shell\
open\command

HKEY_CURRENT_USER\Vs\shell\
runas

HKEY_CURRENT_USER\Vs\shell\
runas\command

HKEY_CURRENT_USER\6w

HKEY_CURRENT_USER\6w\DefaultIcon

HKEY_CURRENT_USER\6w\shell

HKEY_CURRENT_USER\6w\shell\
open

HKEY_CURRENT_USER\6w\shell\
open\command

HKEY_CURRENT_USER\6w\shell\
runas

HKEY_CURRENT_USER\6w\shell\
runas\command

HKEY_CURRENT_USER\vx

HKEY_CURRENT_USER\vx\DefaultIcon

HKEY_CURRENT_USER\vx\shell

HKEY_CURRENT_USER\vx\shell\
open

HKEY_CURRENT_USER\vx\shell\
open\command

HKEY_CURRENT_USER\vx\shell\
runas

HKEY_CURRENT_USER\vx\shell\
runas\command

HKEY_CURRENT_USER\M0f

HKEY_CURRENT_USER\M0f\DefaultIcon

HKEY_CURRENT_USER\M0f\shell

HKEY_CURRENT_USER\M0f\shell\
open

HKEY_CURRENT_USER\M0f\shell\
open\command

HKEY_CURRENT_USER\M0f\shell\
runas

HKEY_CURRENT_USER\M0f\shell\
runas\command

HKEY_CURRENT_USER\Y5u

HKEY_CURRENT_USER\Y5u\DefaultIcon

HKEY_CURRENT_USER\Y5u\shell

HKEY_CURRENT_USER\Y5u\shell\
open

HKEY_CURRENT_USER\Y5u\shell\
open\command

HKEY_CURRENT_USER\Y5u\shell\
runas

HKEY_CURRENT_USER\Y5u\shell\
runas\command

HKEY_CURRENT_USER\M6

HKEY_CURRENT_USER\M6\DefaultIcon

HKEY_CURRENT_USER\M6\shell

HKEY_CURRENT_USER\M6\shell\
open

HKEY_CURRENT_USER\M6\shell\
open\command

HKEY_CURRENT_USER\M6\shell\
runas

HKEY_CURRENT_USER\M6\shell\
runas\command

HKEY_CURRENT_USER\563

HKEY_CURRENT_USER\563\DefaultIcon

HKEY_CURRENT_USER\563\shell

HKEY_CURRENT_USER\563\shell\
open

HKEY_CURRENT_USER\563\shell\
open\command

HKEY_CURRENT_USER\563\shell\
runas

HKEY_CURRENT_USER\563\shell\
runas\command

HKEY_CURRENT_USER\53

HKEY_CURRENT_USER\53\DefaultIcon

HKEY_CURRENT_USER\53\shell

HKEY_CURRENT_USER\53\shell\
open

HKEY_CURRENT_USER\53\shell\
open\command

HKEY_CURRENT_USER\53\shell\
runas

HKEY_CURRENT_USER\53\shell\
runas\command

HKEY_CURRENT_USER\ca

HKEY_CURRENT_USER\ca\DefaultIcon

HKEY_CURRENT_USER\ca\shell

HKEY_CURRENT_USER\ca\shell\
open

HKEY_CURRENT_USER\ca\shell\
open\command

HKEY_CURRENT_USER\ca\shell\
runas

HKEY_CURRENT_USER\ca\shell\
runas\command

HKEY_CURRENT_USER\AD

HKEY_CURRENT_USER\AD\DefaultIcon

HKEY_CURRENT_USER\AD\shell

HKEY_CURRENT_USER\AD\shell\
open

HKEY_CURRENT_USER\AD\shell\
open\command

HKEY_CURRENT_USER\AD\shell\
runas

HKEY_CURRENT_USER\AD\shell\
runas\command

HKEY_CURRENT_USER\Vt

HKEY_CURRENT_USER\Vt\DefaultIcon

HKEY_CURRENT_USER\Vt\shell

HKEY_CURRENT_USER\Vt\shell\
open

HKEY_CURRENT_USER\Vt\shell\
open\command

HKEY_CURRENT_USER\Vt\shell\
runas

HKEY_CURRENT_USER\Vt\shell\
runas\command

HKEY_CURRENT_USER\Glw

HKEY_CURRENT_USER\Glw\DefaultIcon

HKEY_CURRENT_USER\Glw\shell

HKEY_CURRENT_USER\Glw\shell\
open

HKEY_CURRENT_USER\Glw\shell\
open\command

HKEY_CURRENT_USER\Glw\shell\
runas

HKEY_CURRENT_USER\Glw\shell\
runas\command

HKEY_CURRENT_USER\7t

HKEY_CURRENT_USER\7t\DefaultIcon

HKEY_CURRENT_USER\7t\shell

HKEY_CURRENT_USER\7t\shell\
open

HKEY_CURRENT_USER\7t\shell\
open\command

HKEY_CURRENT_USER\7t\shell\
runas

HKEY_CURRENT_USER\7t\shell\
runas\command

HKEY_CURRENT_USER\Jgt

HKEY_CURRENT_USER\Jgt\DefaultIcon

HKEY_CURRENT_USER\Jgt\shell

HKEY_CURRENT_USER\Jgt\shell\
open

HKEY_CURRENT_USER\Jgt\shell\
open\command

HKEY_CURRENT_USER\Jgt\shell\
runas

HKEY_CURRENT_USER\Jgt\shell\
runas\command

HKEY_CURRENT_USER\WUq

HKEY_CURRENT_USER\WUq\DefaultIcon

HKEY_CURRENT_USER\WUq\shell

HKEY_CURRENT_USER\WUq\shell\
open

HKEY_CURRENT_USER\WUq\shell\
open\command

HKEY_CURRENT_USER\WUq\shell\
runas

HKEY_CURRENT_USER\WUq\shell\
runas\command

HKEY_CURRENT_USER\dXH

HKEY_CURRENT_USER\dXH\DefaultIcon

HKEY_CURRENT_USER\dXH\shell

HKEY_CURRENT_USER\dXH\shell\
open

HKEY_CURRENT_USER\dXH\shell\
open\command

HKEY_CURRENT_USER\dXH\shell\
runas

HKEY_CURRENT_USER\dXH\shell\
runas\command

HKEY_CURRENT_USER\8M

HKEY_CURRENT_USER\8M\DefaultIcon

HKEY_CURRENT_USER\8M\shell

HKEY_CURRENT_USER\8M\shell\
open

HKEY_CURRENT_USER\8M\shell\
open\command

HKEY_CURRENT_USER\8M\shell\
runas

HKEY_CURRENT_USER\8M\shell\
runas\command

HKEY_CURRENT_USER\7V

HKEY_CURRENT_USER\7V\DefaultIcon

HKEY_CURRENT_USER\7V\shell

HKEY_CURRENT_USER\7V\shell\
open

HKEY_CURRENT_USER\7V\shell\
open\command

HKEY_CURRENT_USER\7V\shell\
runas

HKEY_CURRENT_USER\7V\shell\
runas\command

HKEY_CURRENT_USER\Tg

HKEY_CURRENT_USER\Tg\DefaultIcon

HKEY_CURRENT_USER\Tg\shell

HKEY_CURRENT_USER\Tg\shell\
open

HKEY_CURRENT_USER\Tg\shell\
open\command

HKEY_CURRENT_USER\Tg\shell\
runas

HKEY_CURRENT_USER\Tg\shell\
runas\command

HKEY_CURRENT_USER\o1w

HKEY_CURRENT_USER\o1w\DefaultIcon

HKEY_CURRENT_USER\o1w\shell

HKEY_CURRENT_USER\o1w\shell\
open

HKEY_CURRENT_USER\o1w\shell\
open\command

HKEY_CURRENT_USER\o1w\shell\
runas

HKEY_CURRENT_USER\o1w\shell\
runas\command

HKEY_CURRENT_USER\Ty4

HKEY_CURRENT_USER\Ty4\DefaultIcon

HKEY_CURRENT_USER\Ty4\shell

HKEY_CURRENT_USER\Ty4\shell\
open

HKEY_CURRENT_USER\Ty4\shell\
open\command

HKEY_CURRENT_USER\Ty4\shell\
runas

HKEY_CURRENT_USER\Ty4\shell\
runas\command

HKEY_CURRENT_USER\lG

HKEY_CURRENT_USER\lG\DefaultIcon

HKEY_CURRENT_USER\lG\shell

HKEY_CURRENT_USER\lG\shell\
open

HKEY_CURRENT_USER\lG\shell\
open\command

HKEY_CURRENT_USER\lG\shell\
runas

HKEY_CURRENT_USER\lG\shell\
runas\command

HKEY_CURRENT_USER\Yh

HKEY_CURRENT_USER\Yh\DefaultIcon

HKEY_CURRENT_USER\Yh\shell

HKEY_CURRENT_USER\Yh\shell\
open

HKEY_CURRENT_USER\Yh\shell\
open\command

HKEY_CURRENT_USER\Yh\shell\
runas

HKEY_CURRENT_USER\Yh\shell\
runas\command

HKEY_CURRENT_USER\h7

HKEY_CURRENT_USER\h7\DefaultIcon

HKEY_CURRENT_USER\h7\shell

HKEY_CURRENT_USER\h7\shell\
open

HKEY_CURRENT_USER\h7\shell\
open\command

HKEY_CURRENT_USER\h7\shell\
runas

HKEY_CURRENT_USER\h7\shell\
runas\command

HKEY_CURRENT_USER\Mb4

HKEY_CURRENT_USER\Mb4\DefaultIcon

HKEY_CURRENT_USER\Mb4\shell

HKEY_CURRENT_USER\Mb4\shell\
open

HKEY_CURRENT_USER\Mb4\shell\
open\command

HKEY_CURRENT_USER\Mb4\shell\
runas

HKEY_CURRENT_USER\eg\shell\
open\command

HKEY_CURRENT_USER\eg\shell\
runas

HKEY_CURRENT_USER\eg\shell\
runas\command

HKEY_CURRENT_USER\28B

HKEY_CURRENT_USER\28B\DefaultIcon

HKEY_CURRENT_USER\28B\shell

HKEY_CURRENT_USER\28B\shell\
open

HKEY_CURRENT_USER\28B\shell\
open\command

HKEY_CURRENT_USER\28B\shell\
runas

HKEY_CURRENT_USER\28B\shell\
runas\command

HKEY_CURRENT_USER\BF5

HKEY_CURRENT_USER\BF5\DefaultIcon

HKEY_CURRENT_USER\BF5\shell

HKEY_CURRENT_USER\BF5\shell\
open

HKEY_CURRENT_USER\BF5\shell\
open\command

HKEY_CURRENT_USER\BF5\shell\
runas

HKEY_CURRENT_USER\BF5\shell\
runas\command

HKEY_LOCAL_MACHINE\Software\Microsoft\
Sft

マルウェアは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

HKEY_CURRENT_USER\.exe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\.exe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\.exe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\P82
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\P82\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\P82\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Software\Microsoft\
Windows
Local = "2bb5abe9"

HKEY_CURRENT_USER\Y8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\c7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\34
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\34\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\34\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\T5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LRO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\LRO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LRO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3Q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xk
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xk\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xk\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\13
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\13\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\13\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\81
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\81\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\81\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1a
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1a\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1a\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\46T
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\46T\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\46T\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3m
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3m\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3m\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\C1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\C1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\C1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wQ5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\23
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\23\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\23\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D20
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\D20\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D20\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\OF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k7l
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\k7l\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k7l\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\17\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X51
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\X51\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X51\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rk5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rk5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rk5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\eT\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eT\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7P3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7P3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7P3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\74Q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74Q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\71
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\71\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\71\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Gl
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Gl\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Gl\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\678
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\678\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\678\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lGj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lGj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lGj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\kY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\kY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\kY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8C
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8C\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8C\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\e3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\208
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\208\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\208\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\UEH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\UEH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\UEH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1o
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1o\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1o\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ka
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Ka\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ka\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\e2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3pO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3pO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3pO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uUe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uUe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uUe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G3Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\G3Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G3Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ey
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Ey\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ey\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gE\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gE\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Up
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Up\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Up\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3O7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3O7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3O7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4D
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4D\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4D\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fW3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\fW3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fW3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\12y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\12y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\12y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7D
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7D\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7D\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\165
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\165\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\165\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\00e
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\00e\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\00e\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3E
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\e3E\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3E\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nE\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nE\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Fn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6Fn\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Fn\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\WB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3yJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3yJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3yJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1i
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1i\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1i\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\y2c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y2c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\y2c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\r0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\r0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\r0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wQ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\STy
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\STy\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\STy\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m0u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\m0u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m0u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\38\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dG1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\dG1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dG1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1in
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1in\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1in\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8l
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8l\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8l\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\F8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\F8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\juB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\juB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\juB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ejJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ejJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ejJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\p1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rfY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rfY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rfY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\TH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JQX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JQX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JQX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nyP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nyP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nyP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8V
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8V\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8V\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\keR
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\keR\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\keR\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vs\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vs\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vx
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\vx\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vx\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M0f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\M0f\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M0f\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y5u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y5u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y5u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\M6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\563
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\563\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\563\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\53
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\53\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\53\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ca
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ca\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ca\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AD
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\AD\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AD\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vt
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vt\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vt\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glw
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Glw\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glw\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7t\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7t\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jgt
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jgt\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jgt\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WUq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\WUq\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WUq\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dXH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\dXH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dXH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8M
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8M\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8M\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7V
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7V\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7V\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\o1w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\o1w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\o1w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Ty4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Ty4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Ty4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yh
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Yh\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yh\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Mb4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Mb4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Mb4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6r0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6r0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6r0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\E56
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\E56\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\E56\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\01e
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\01e\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\01e\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V44
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V44\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V44\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uB8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uB8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uB8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yq8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Yq8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yq8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HlB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\HlB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HlB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0a
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0a\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0a\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Qn\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qn\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Glr\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glr\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\OW\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OW\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\GH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\GH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Tv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5Tv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Tv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\R4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\R4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\R4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\c5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OaO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\OaO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OaO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L34
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L34\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L34\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bUO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bUO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bUO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1Q1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1Q1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1Q1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\q8r
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\q8r\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\q8r\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1aI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1aI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1aI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\IS\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IS\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nn0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Nn0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nn0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17i
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\17i\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17i\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wt6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wt6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wt6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nm1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Nm1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nm1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\16S
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\16S\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\16S\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\H0o
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\H0o\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\H0o\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Pm
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Pm\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Pm\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0u1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0u1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0u1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\74n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\py
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\py\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\py\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\f15
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\f15\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\f15\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Qo\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qo\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l0A
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\l0A\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l0A\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U52
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\U52\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U52\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8UU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8UU\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8UU\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YAY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YAY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YAY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\mO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\mO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1g
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1g\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1g\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D75
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\D75\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D75\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yWK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yWK\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yWK\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\FX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\FX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\FX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t1s
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\t1s\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t1s\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\acv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\acv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\acv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\DJ2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\DJ2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\DJ2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\id1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\id1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\id1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t7q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\t7q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t7q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\NW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\NW\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\NW\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\114
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\114\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\114\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qd
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\qd\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qd\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SWf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SWf\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SWf\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RDt
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\RDt\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RDt\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1B\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1B\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\88
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\88\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\88\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8J8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8J8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8J8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0w6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0w6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0w6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SEp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SEp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SEp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yJ1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yJ1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yJ1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pl8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pl8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pl8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Eu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Eu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Eu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5x\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5x\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\apC
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\apC\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\apC\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sU1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sU1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sU1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0H5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0H5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0H5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6s
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6s\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6s\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2YG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2YG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2YG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\45g
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\45g\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\45g\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\fj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\75
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\75\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\75\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8W
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8W\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8W\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87F
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\87F\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87F\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cpA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cpA\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cpA\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\J28
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\J28\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\J28\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8D0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8D0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8D0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5f\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5f\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Us
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Us\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Us\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5e
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5e\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5e\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\15\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m2c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\m2c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m2c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\55n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\eg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\28B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\28B\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\28B\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BF5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BF5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BF5\shell\
runas\command
IsolatedCommand = "%1 %*"

マルウェアは、以下のレジストリ値を変更します。

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = "4"

(註：変更前の上記レジストリ値は、「2」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

(註：変更前の上記レジストリ値は、「%User Profile%\Local Settings\Application Data」となります。)

マルウェアは、以下のレジストリ値を追加し、タスクマネージャやレジストリエディタ、フォルダオプションを無効にします。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Policies = "%User Profile%\Application Data\csrss.exe"

作成活動

マルウェアは、以下のファイルを作成します。

• %Application Data%\uvu.exe
• %User Profile%\Protect\sjla.m
• %User Profile%\Protect\s32.txt
• %User Profile%\Protect\ldbeig.hf

(註：%Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。. %User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}or2011.ru/aaa/index.php?{random characters}

このウイルス情報は、自動解析システムにより作成されました。