TROJ_FAKEAV.LLV

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan modifies the following file(s):

• %Application Data%\GDIPFONTCACHEV1.DAT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following registry keys:

HKEY_CURRENT_USER\.exe

HKEY_CURRENT_USER\.exe\DefaultIcon

HKEY_CURRENT_USER\.exe\shell

HKEY_CURRENT_USER\.exe\shell\
open

HKEY_CURRENT_USER\.exe\shell\
open\command

HKEY_CURRENT_USER\.exe\shell\
runas

HKEY_CURRENT_USER\.exe\shell\
runas\command

HKEY_CURRENT_USER\hb

HKEY_CURRENT_USER\hb\DefaultIcon

HKEY_CURRENT_USER\hb\shell

HKEY_CURRENT_USER\hb\shell\
open

HKEY_CURRENT_USER\hb\shell\
open\command

HKEY_CURRENT_USER\hb\shell\
runas

HKEY_CURRENT_USER\hb\shell\
runas\command

HKEY_CURRENT_USER\b8

HKEY_CURRENT_USER\b8\DefaultIcon

HKEY_CURRENT_USER\b8\shell

HKEY_CURRENT_USER\b8\shell\
open

HKEY_CURRENT_USER\b8\shell\
open\command

HKEY_CURRENT_USER\b8\shell\
runas

HKEY_CURRENT_USER\b8\shell\
runas\command

HKEY_CURRENT_USER\701

HKEY_CURRENT_USER\701\DefaultIcon

HKEY_CURRENT_USER\701\shell

HKEY_CURRENT_USER\701\shell\
open

HKEY_CURRENT_USER\701\shell\
open\command

HKEY_CURRENT_USER\701\shell\
runas

HKEY_CURRENT_USER\701\shell\
runas\command

HKEY_CURRENT_USER\3cU

HKEY_CURRENT_USER\3cU\DefaultIcon

HKEY_CURRENT_USER\3cU\shell

HKEY_CURRENT_USER\3cU\shell\
open

HKEY_CURRENT_USER\3cU\shell\
open\command

HKEY_CURRENT_USER\3cU\shell\
runas

HKEY_CURRENT_USER\3cU\shell\
runas\command

HKEY_CURRENT_USER\48

HKEY_CURRENT_USER\48\DefaultIcon

HKEY_CURRENT_USER\48\shell

HKEY_CURRENT_USER\48\shell\
open

HKEY_CURRENT_USER\48\shell\
open\command

HKEY_CURRENT_USER\48\shell\
runas

HKEY_CURRENT_USER\48\shell\
runas\command

HKEY_CURRENT_USER\c7

HKEY_CURRENT_USER\c7\DefaultIcon

HKEY_CURRENT_USER\c7\shell

HKEY_CURRENT_USER\c7\shell\
open

HKEY_CURRENT_USER\c7\shell\
open\command

HKEY_CURRENT_USER\c7\shell\
runas

HKEY_CURRENT_USER\c7\shell\
runas\command

HKEY_CURRENT_USER\Qu

HKEY_CURRENT_USER\Qu\DefaultIcon

HKEY_CURRENT_USER\Qu\shell

HKEY_CURRENT_USER\Qu\shell\
open

HKEY_CURRENT_USER\Qu\shell\
open\command

HKEY_CURRENT_USER\Qu\shell\
runas

HKEY_CURRENT_USER\Qu\shell\
runas\command

HKEY_CURRENT_USER\k6n

HKEY_CURRENT_USER\k6n\DefaultIcon

HKEY_CURRENT_USER\k6n\shell

HKEY_CURRENT_USER\k6n\shell\
open

HKEY_CURRENT_USER\k6n\shell\
open\command

HKEY_CURRENT_USER\k6n\shell\
runas

HKEY_CURRENT_USER\k6n\shell\
runas\command

HKEY_CURRENT_USER\3rs

HKEY_CURRENT_USER\3rs\DefaultIcon

HKEY_CURRENT_USER\3rs\shell

HKEY_CURRENT_USER\3rs\shell\
open

HKEY_CURRENT_USER\3rs\shell\
open\command

HKEY_CURRENT_USER\3rs\shell\
runas

HKEY_CURRENT_USER\3rs\shell\
runas\command

HKEY_CURRENT_USER\Vp

HKEY_CURRENT_USER\Vp\DefaultIcon

HKEY_CURRENT_USER\Vp\shell

HKEY_CURRENT_USER\Vp\shell\
open

HKEY_CURRENT_USER\Vp\shell\
open\command

HKEY_CURRENT_USER\Vp\shell\
runas

HKEY_CURRENT_USER\Vp\shell\
runas\command

HKEY_CURRENT_USER\nF

HKEY_CURRENT_USER\nF\DefaultIcon

HKEY_CURRENT_USER\nF\shell

HKEY_CURRENT_USER\nF\shell\
open

HKEY_CURRENT_USER\nF\shell\
open\command

HKEY_CURRENT_USER\nF\shell\
runas

HKEY_CURRENT_USER\nF\shell\
runas\command

HKEY_CURRENT_USER\enF

HKEY_CURRENT_USER\enF\DefaultIcon

HKEY_CURRENT_USER\enF\shell

HKEY_CURRENT_USER\enF\shell\
open

HKEY_CURRENT_USER\enF\shell\
open\command

HKEY_CURRENT_USER\enF\shell\
runas

HKEY_CURRENT_USER\enF\shell\
runas\command

HKEY_CURRENT_USER\gUm

HKEY_CURRENT_USER\gUm\DefaultIcon

HKEY_CURRENT_USER\gUm\shell

HKEY_CURRENT_USER\gUm\shell\
open

HKEY_CURRENT_USER\gUm\shell\
open\command

HKEY_CURRENT_USER\gUm\shell\
runas

HKEY_CURRENT_USER\gUm\shell\
runas\command

HKEY_CURRENT_USER\xti

HKEY_CURRENT_USER\xti\DefaultIcon

HKEY_CURRENT_USER\xti\shell

HKEY_CURRENT_USER\xti\shell\
open

HKEY_CURRENT_USER\xti\shell\
open\command

HKEY_CURRENT_USER\xti\shell\
runas

HKEY_CURRENT_USER\xti\shell\
runas\command

HKEY_CURRENT_USER\8E2

HKEY_CURRENT_USER\8E2\DefaultIcon

HKEY_CURRENT_USER\8E2\shell

HKEY_CURRENT_USER\8E2\shell\
open

HKEY_CURRENT_USER\8E2\shell\
open\command

HKEY_CURRENT_USER\8E2\shell\
runas

HKEY_CURRENT_USER\8E2\shell\
runas\command

HKEY_CURRENT_USER\EW3

HKEY_CURRENT_USER\EW3\DefaultIcon

HKEY_CURRENT_USER\EW3\shell

HKEY_CURRENT_USER\EW3\shell\
open

HKEY_CURRENT_USER\EW3\shell\
open\command

HKEY_CURRENT_USER\EW3\shell\
runas

HKEY_CURRENT_USER\EW3\shell\
runas\command

HKEY_CURRENT_USER\h6v

HKEY_CURRENT_USER\h6v\DefaultIcon

HKEY_CURRENT_USER\h6v\shell

HKEY_CURRENT_USER\h6v\shell\
open

HKEY_CURRENT_USER\h6v\shell\
open\command

HKEY_CURRENT_USER\h6v\shell\
runas

HKEY_CURRENT_USER\h6v\shell\
runas\command

HKEY_CURRENT_USER\6x6

HKEY_CURRENT_USER\6x6\DefaultIcon

HKEY_CURRENT_USER\6x6\shell

HKEY_CURRENT_USER\6x6\shell\
open

HKEY_CURRENT_USER\6x6\shell\
open\command

HKEY_CURRENT_USER\6x6\shell\
runas

HKEY_CURRENT_USER\6x6\shell\
runas\command

HKEY_CURRENT_USER\gdI

HKEY_CURRENT_USER\gdI\DefaultIcon

HKEY_CURRENT_USER\gdI\shell

HKEY_CURRENT_USER\gdI\shell\
open

HKEY_CURRENT_USER\gdI\shell\
open\command

HKEY_CURRENT_USER\gdI\shell\
runas

HKEY_CURRENT_USER\gdI\shell\
runas\command

HKEY_CURRENT_USER\84

HKEY_CURRENT_USER\84\DefaultIcon

HKEY_CURRENT_USER\84\shell

HKEY_CURRENT_USER\84\shell\
open

HKEY_CURRENT_USER\84\shell\
open\command

HKEY_CURRENT_USER\84\shell\
runas

HKEY_CURRENT_USER\84\shell\
runas\command

HKEY_CURRENT_USER\tdG

HKEY_CURRENT_USER\tdG\DefaultIcon

HKEY_CURRENT_USER\tdG\shell

HKEY_CURRENT_USER\tdG\shell\
open

HKEY_CURRENT_USER\tdG\shell\
open\command

HKEY_CURRENT_USER\tdG\shell\
runas

HKEY_CURRENT_USER\tdG\shell\
runas\command

HKEY_CURRENT_USER\M6X

HKEY_CURRENT_USER\M6X\DefaultIcon

HKEY_CURRENT_USER\M6X\shell

HKEY_CURRENT_USER\M6X\shell\
open

HKEY_CURRENT_USER\M6X\shell\
open\command

HKEY_CURRENT_USER\M6X\shell\
runas

HKEY_CURRENT_USER\M6X\shell\
runas\command

HKEY_CURRENT_USER\atn

HKEY_CURRENT_USER\atn\DefaultIcon

HKEY_CURRENT_USER\atn\shell

HKEY_CURRENT_USER\atn\shell\
open

HKEY_CURRENT_USER\atn\shell\
open\command

HKEY_CURRENT_USER\atn\shell\
runas

HKEY_CURRENT_USER\atn\shell\
runas\command

HKEY_CURRENT_USER\lWb

HKEY_CURRENT_USER\lWb\DefaultIcon

HKEY_CURRENT_USER\lWb\shell

HKEY_CURRENT_USER\lWb\shell\
open

HKEY_CURRENT_USER\lWb\shell\
open\command

HKEY_CURRENT_USER\lWb\shell\
runas

HKEY_CURRENT_USER\lWb\shell\
runas\command

HKEY_CURRENT_USER\QP

HKEY_CURRENT_USER\QP\DefaultIcon

HKEY_CURRENT_USER\QP\shell

HKEY_CURRENT_USER\QP\shell\
open

HKEY_CURRENT_USER\QP\shell\
open\command

HKEY_CURRENT_USER\QP\shell\
runas

HKEY_CURRENT_USER\QP\shell\
runas\command

HKEY_CURRENT_USER\le

HKEY_CURRENT_USER\le\DefaultIcon

HKEY_CURRENT_USER\le\shell

HKEY_CURRENT_USER\le\shell\
open

HKEY_CURRENT_USER\le\shell\
open\command

HKEY_CURRENT_USER\le\shell\
runas

HKEY_CURRENT_USER\le\shell\
runas\command

HKEY_CURRENT_USER\35

HKEY_CURRENT_USER\35\DefaultIcon

HKEY_CURRENT_USER\35\shell

HKEY_CURRENT_USER\35\shell\
open

HKEY_CURRENT_USER\35\shell\
open\command

HKEY_CURRENT_USER\35\shell\
runas

HKEY_CURRENT_USER\35\shell\
runas\command

HKEY_CURRENT_USER\36

HKEY_CURRENT_USER\36\DefaultIcon

HKEY_CURRENT_USER\36\shell

HKEY_CURRENT_USER\36\shell\
open

HKEY_CURRENT_USER\36\shell\
open\command

HKEY_CURRENT_USER\36\shell\
runas

HKEY_CURRENT_USER\36\shell\
runas\command

HKEY_CURRENT_USER\ja

HKEY_CURRENT_USER\ja\DefaultIcon

HKEY_CURRENT_USER\ja\shell

HKEY_CURRENT_USER\ja\shell\
open

HKEY_CURRENT_USER\ja\shell\
open\command

HKEY_CURRENT_USER\ja\shell\
runas

HKEY_CURRENT_USER\ja\shell\
runas\command

HKEY_CURRENT_USER\1T1

HKEY_CURRENT_USER\1T1\DefaultIcon

HKEY_CURRENT_USER\1T1\shell

HKEY_CURRENT_USER\1T1\shell\
open

HKEY_CURRENT_USER\1T1\shell\
open\command

HKEY_CURRENT_USER\1T1\shell\
runas

HKEY_CURRENT_USER\1T1\shell\
runas\command

HKEY_CURRENT_USER\l6

HKEY_CURRENT_USER\l6\DefaultIcon

HKEY_CURRENT_USER\l6\shell

HKEY_CURRENT_USER\l6\shell\
open

HKEY_CURRENT_USER\l6\shell\
open\command

HKEY_CURRENT_USER\l6\shell\
runas

HKEY_CURRENT_USER\l6\shell\
runas\command

HKEY_CURRENT_USER\WEd

HKEY_CURRENT_USER\WEd\DefaultIcon

HKEY_CURRENT_USER\WEd\shell

HKEY_CURRENT_USER\WEd\shell\
open

HKEY_CURRENT_USER\WEd\shell\
open\command

HKEY_CURRENT_USER\WEd\shell\
runas

HKEY_CURRENT_USER\WEd\shell\
runas\command

HKEY_CURRENT_USER\86Q

HKEY_CURRENT_USER\86Q\DefaultIcon

HKEY_CURRENT_USER\86Q\shell

HKEY_CURRENT_USER\86Q\shell\
open

HKEY_CURRENT_USER\86Q\shell\
open\command

HKEY_CURRENT_USER\86Q\shell\
runas

HKEY_CURRENT_USER\86Q\shell\
runas\command

HKEY_CURRENT_USER\TM

HKEY_CURRENT_USER\TM\DefaultIcon

HKEY_CURRENT_USER\TM\shell

HKEY_CURRENT_USER\TM\shell\
open

HKEY_CURRENT_USER\TM\shell\
open\command

HKEY_CURRENT_USER\TM\shell\
runas

HKEY_CURRENT_USER\TM\shell\
runas\command

HKEY_CURRENT_USER\rI

HKEY_CURRENT_USER\rI\DefaultIcon

HKEY_CURRENT_USER\rI\shell

HKEY_CURRENT_USER\rI\shell\
open

HKEY_CURRENT_USER\rI\shell\
open\command

HKEY_CURRENT_USER\rI\shell\
runas

HKEY_CURRENT_USER\rI\shell\
runas\command

HKEY_CURRENT_USER\gss

HKEY_CURRENT_USER\gss\DefaultIcon

HKEY_CURRENT_USER\gss\shell

HKEY_CURRENT_USER\gss\shell\
open

HKEY_CURRENT_USER\gss\shell\
open\command

HKEY_CURRENT_USER\gss\shell\
runas

HKEY_CURRENT_USER\gss\shell\
runas\command

HKEY_CURRENT_USER\wf

HKEY_CURRENT_USER\wf\DefaultIcon

HKEY_CURRENT_USER\wf\shell

HKEY_CURRENT_USER\wf\shell\
open

HKEY_CURRENT_USER\wf\shell\
open\command

HKEY_CURRENT_USER\wf\shell\
runas

HKEY_CURRENT_USER\wf\shell\
runas\command

HKEY_CURRENT_USER\1V

HKEY_CURRENT_USER\1V\DefaultIcon

HKEY_CURRENT_USER\1V\shell

HKEY_CURRENT_USER\1V\shell\
open

HKEY_CURRENT_USER\1V\shell\
open\command

HKEY_CURRENT_USER\1V\shell\
runas

HKEY_CURRENT_USER\1V\shell\
runas\command

HKEY_CURRENT_USER\6G5

HKEY_CURRENT_USER\6G5\DefaultIcon

HKEY_CURRENT_USER\6G5\shell

HKEY_CURRENT_USER\6G5\shell\
open

HKEY_CURRENT_USER\6G5\shell\
open\command

HKEY_CURRENT_USER\6G5\shell\
runas

HKEY_CURRENT_USER\6G5\shell\
runas\command

HKEY_CURRENT_USER\15c

HKEY_CURRENT_USER\15c\DefaultIcon

HKEY_CURRENT_USER\15c\shell

HKEY_CURRENT_USER\15c\shell\
open

HKEY_CURRENT_USER\15c\shell\
open\command

HKEY_CURRENT_USER\15c\shell\
runas

HKEY_CURRENT_USER\15c\shell\
runas\command

HKEY_CURRENT_USER\I28

HKEY_CURRENT_USER\I28\DefaultIcon

HKEY_CURRENT_USER\I28\shell

HKEY_CURRENT_USER\I28\shell\
open

HKEY_CURRENT_USER\I28\shell\
open\command

HKEY_CURRENT_USER\I28\shell\
runas

HKEY_CURRENT_USER\I28\shell\
runas\command

HKEY_CURRENT_USER\LH

HKEY_CURRENT_USER\LH\DefaultIcon

HKEY_CURRENT_USER\LH\shell

HKEY_CURRENT_USER\LH\shell\
open

HKEY_CURRENT_USER\LH\shell\
open\command

HKEY_CURRENT_USER\LH\shell\
runas

HKEY_CURRENT_USER\LH\shell\
runas\command

HKEY_CURRENT_USER\Kf5

HKEY_CURRENT_USER\Kf5\DefaultIcon

HKEY_CURRENT_USER\Kf5\shell

HKEY_CURRENT_USER\Kf5\shell\
open

HKEY_CURRENT_USER\Kf5\shell\
open\command

HKEY_CURRENT_USER\Kf5\shell\
runas

HKEY_CURRENT_USER\Kf5\shell\
runas\command

HKEY_CURRENT_USER\Wy

HKEY_CURRENT_USER\Wy\DefaultIcon

HKEY_CURRENT_USER\Wy\shell

HKEY_CURRENT_USER\Wy\shell\
open

HKEY_CURRENT_USER\Wy\shell\
open\command

HKEY_CURRENT_USER\Wy\shell\
runas

HKEY_CURRENT_USER\Wy\shell\
runas\command

HKEY_CURRENT_USER\72

HKEY_CURRENT_USER\72\DefaultIcon

HKEY_CURRENT_USER\72\shell

HKEY_CURRENT_USER\72\shell\
open

HKEY_CURRENT_USER\72\shell\
open\command

HKEY_CURRENT_USER\72\shell\
runas

HKEY_CURRENT_USER\72\shell\
runas\command

HKEY_CURRENT_USER\Y1c

HKEY_CURRENT_USER\Y1c\DefaultIcon

HKEY_CURRENT_USER\Y1c\shell

HKEY_CURRENT_USER\Y1c\shell\
open

HKEY_CURRENT_USER\Y1c\shell\
open\command

HKEY_CURRENT_USER\Y1c\shell\
runas

HKEY_CURRENT_USER\Y1c\shell\
runas\command

HKEY_CURRENT_USER\ct

HKEY_CURRENT_USER\ct\DefaultIcon

HKEY_CURRENT_USER\ct\shell

HKEY_CURRENT_USER\ct\shell\
open

HKEY_CURRENT_USER\ct\shell\
open\command

HKEY_CURRENT_USER\ct\shell\
runas

HKEY_CURRENT_USER\ct\shell\
runas\command

HKEY_CURRENT_USER\rxa

HKEY_CURRENT_USER\rxa\DefaultIcon

HKEY_CURRENT_USER\rxa\shell

HKEY_CURRENT_USER\rxa\shell\
open

HKEY_CURRENT_USER\rxa\shell\
open\command

HKEY_CURRENT_USER\rxa\shell\
runas

HKEY_CURRENT_USER\rxa\shell\
runas\command

HKEY_CURRENT_USER\U88

HKEY_CURRENT_USER\U88\DefaultIcon

HKEY_CURRENT_USER\U88\shell

HKEY_CURRENT_USER\U88\shell\
open

HKEY_CURRENT_USER\U88\shell\
open\command

HKEY_CURRENT_USER\U88\shell\
runas

HKEY_CURRENT_USER\U88\shell\
runas\command

HKEY_CURRENT_USER\jY

HKEY_CURRENT_USER\jY\DefaultIcon

HKEY_CURRENT_USER\jY\shell

HKEY_CURRENT_USER\jY\shell\
open

HKEY_CURRENT_USER\jY\shell\
open\command

HKEY_CURRENT_USER\jY\shell\
runas

HKEY_CURRENT_USER\jY\shell\
runas\command

HKEY_CURRENT_USER\1x

HKEY_CURRENT_USER\1x\DefaultIcon

HKEY_CURRENT_USER\1x\shell

HKEY_CURRENT_USER\1x\shell\
open

HKEY_CURRENT_USER\1x\shell\
open\command

HKEY_CURRENT_USER\1x\shell\
runas

HKEY_CURRENT_USER\1x\shell\
runas\command

HKEY_CURRENT_USER\gg

HKEY_CURRENT_USER\gg\DefaultIcon

HKEY_CURRENT_USER\gg\shell

HKEY_CURRENT_USER\gg\shell\
open

HKEY_CURRENT_USER\gg\shell\
open\command

HKEY_CURRENT_USER\gg\shell\
runas

HKEY_CURRENT_USER\gg\shell\
runas\command

HKEY_CURRENT_USER\gx

HKEY_CURRENT_USER\gx\DefaultIcon

HKEY_CURRENT_USER\gx\shell

HKEY_CURRENT_USER\gx\shell\
open

HKEY_CURRENT_USER\gx\shell\
open\command

HKEY_CURRENT_USER\gx\shell\
runas

HKEY_CURRENT_USER\gx\shell\
runas\command

HKEY_CURRENT_USER\lh5

HKEY_CURRENT_USER\lh5\DefaultIcon

HKEY_CURRENT_USER\lh5\shell

HKEY_CURRENT_USER\lh5\shell\
open

HKEY_CURRENT_USER\lh5\shell\
open\command

HKEY_CURRENT_USER\lh5\shell\
runas

HKEY_CURRENT_USER\lh5\shell\
runas\command

HKEY_CURRENT_USER\Rp

HKEY_CURRENT_USER\Rp\DefaultIcon

HKEY_CURRENT_USER\Rp\shell

HKEY_CURRENT_USER\Rp\shell\
open

HKEY_CURRENT_USER\Rp\shell\
open\command

HKEY_CURRENT_USER\Rp\shell\
runas

HKEY_CURRENT_USER\Rp\shell\
runas\command

HKEY_CURRENT_USER\3b

HKEY_CURRENT_USER\3b\DefaultIcon

HKEY_CURRENT_USER\3b\shell

HKEY_CURRENT_USER\3b\shell\
open

HKEY_CURRENT_USER\3b\shell\
open\command

HKEY_CURRENT_USER\3b\shell\
runas

HKEY_CURRENT_USER\3b\shell\
runas\command

HKEY_CURRENT_USER\wyp

HKEY_CURRENT_USER\wyp\DefaultIcon

HKEY_CURRENT_USER\wyp\shell

HKEY_CURRENT_USER\wyp\shell\
open

HKEY_CURRENT_USER\wyp\shell\
open\command

HKEY_CURRENT_USER\wyp\shell\
runas

HKEY_CURRENT_USER\wyp\shell\
runas\command

HKEY_CURRENT_USER\Pv

HKEY_CURRENT_USER\Pv\DefaultIcon

HKEY_CURRENT_USER\Pv\shell

HKEY_CURRENT_USER\Pv\shell\
open

HKEY_CURRENT_USER\Pv\shell\
open\command

HKEY_CURRENT_USER\Pv\shell\
runas

HKEY_CURRENT_USER\Pv\shell\
runas\command

HKEY_CURRENT_USER\JEy

HKEY_CURRENT_USER\JEy\DefaultIcon

HKEY_CURRENT_USER\JEy\shell

HKEY_CURRENT_USER\JEy\shell\
open

HKEY_CURRENT_USER\JEy\shell\
open\command

HKEY_CURRENT_USER\JEy\shell\
runas

HKEY_CURRENT_USER\JEy\shell\
runas\command

HKEY_CURRENT_USER\6oX

HKEY_CURRENT_USER\6oX\DefaultIcon

HKEY_CURRENT_USER\6oX\shell

HKEY_CURRENT_USER\6oX\shell\
open

HKEY_CURRENT_USER\6oX\shell\
open\command

HKEY_CURRENT_USER\6oX\shell\
runas

HKEY_CURRENT_USER\6oX\shell\
runas\command

HKEY_CURRENT_USER\QO1

HKEY_CURRENT_USER\QO1\DefaultIcon

HKEY_CURRENT_USER\QO1\shell

HKEY_CURRENT_USER\QO1\shell\
open

HKEY_CURRENT_USER\QO1\shell\
open\command

HKEY_CURRENT_USER\QO1\shell\
runas

HKEY_CURRENT_USER\QO1\shell\
runas\command

HKEY_CURRENT_USER\chF

HKEY_CURRENT_USER\chF\DefaultIcon

HKEY_CURRENT_USER\chF\shell

HKEY_CURRENT_USER\chF\shell\
open

HKEY_CURRENT_USER\chF\shell\
open\command

HKEY_CURRENT_USER\chF\shell\
runas

HKEY_CURRENT_USER\chF\shell\
runas\command

HKEY_CURRENT_USER\6R

HKEY_CURRENT_USER\6R\DefaultIcon

HKEY_CURRENT_USER\6R\shell

HKEY_CURRENT_USER\6R\shell\
open

HKEY_CURRENT_USER\6R\shell\
open\command

HKEY_CURRENT_USER\6R\shell\
runas

HKEY_CURRENT_USER\6R\shell\
runas\command

HKEY_CURRENT_USER\6w

HKEY_CURRENT_USER\6w\DefaultIcon

HKEY_CURRENT_USER\6w\shell

HKEY_CURRENT_USER\6w\shell\
open

HKEY_CURRENT_USER\6w\shell\
open\command

HKEY_CURRENT_USER\6w\shell\
runas

HKEY_CURRENT_USER\6w\shell\
runas\command

HKEY_CURRENT_USER\cl

HKEY_CURRENT_USER\cl\DefaultIcon

HKEY_CURRENT_USER\cl\shell

HKEY_CURRENT_USER\cl\shell\
open

HKEY_CURRENT_USER\cl\shell\
open\command

HKEY_CURRENT_USER\cl\shell\
runas

HKEY_CURRENT_USER\cl\shell\
runas\command

HKEY_CURRENT_USER\38

HKEY_CURRENT_USER\38\DefaultIcon

HKEY_CURRENT_USER\38\shell

HKEY_CURRENT_USER\38\shell\
open

HKEY_CURRENT_USER\38\shell\
open\command

HKEY_CURRENT_USER\38\shell\
runas

HKEY_CURRENT_USER\38\shell\
runas\command

HKEY_CURRENT_USER\55L

HKEY_CURRENT_USER\55L\DefaultIcon

HKEY_CURRENT_USER\55L\shell

HKEY_CURRENT_USER\55L\shell\
open

HKEY_CURRENT_USER\55L\shell\
open\command

HKEY_CURRENT_USER\55L\shell\
runas

HKEY_CURRENT_USER\55L\shell\
runas\command

HKEY_CURRENT_USER\08

HKEY_CURRENT_USER\08\DefaultIcon

HKEY_CURRENT_USER\08\shell

HKEY_CURRENT_USER\08\shell\
open

HKEY_CURRENT_USER\08\shell\
open\command

HKEY_CURRENT_USER\08\shell\
runas

HKEY_CURRENT_USER\08\shell\
runas\command

HKEY_CURRENT_USER\70

HKEY_CURRENT_USER\70\DefaultIcon

HKEY_CURRENT_USER\70\shell

HKEY_CURRENT_USER\70\shell\
open

HKEY_CURRENT_USER\70\shell\
open\command

HKEY_CURRENT_USER\70\shell\
runas

HKEY_CURRENT_USER\70\shell\
runas\command

HKEY_CURRENT_USER\624

HKEY_CURRENT_USER\624\DefaultIcon

HKEY_CURRENT_USER\624\shell

HKEY_CURRENT_USER\624\shell\
open

HKEY_CURRENT_USER\624\shell\
open\command

HKEY_CURRENT_USER\624\shell\
runas

HKEY_CURRENT_USER\624\shell\
runas\command

HKEY_CURRENT_USER\Cbd

HKEY_CURRENT_USER\Cbd\DefaultIcon

HKEY_CURRENT_USER\Cbd\shell

HKEY_CURRENT_USER\Cbd\shell\
open

HKEY_CURRENT_USER\Cbd\shell\
open\command

HKEY_CURRENT_USER\Cbd\shell\
runas

HKEY_CURRENT_USER\Cbd\shell\
runas\command

HKEY_CURRENT_USER\O1

HKEY_CURRENT_USER\O1\DefaultIcon

HKEY_CURRENT_USER\O1\shell

HKEY_CURRENT_USER\O1\shell\
open

HKEY_CURRENT_USER\O1\shell\
open\command

HKEY_CURRENT_USER\O1\shell\
runas

HKEY_CURRENT_USER\O1\shell\
runas\command

HKEY_CURRENT_USER\IA

HKEY_CURRENT_USER\IA\DefaultIcon

HKEY_CURRENT_USER\IA\shell

HKEY_CURRENT_USER\IA\shell\
open

HKEY_CURRENT_USER\IA\shell\
open\command

HKEY_CURRENT_USER\IA\shell\
runas

HKEY_CURRENT_USER\IA\shell\
runas\command

HKEY_CURRENT_USER\0At

HKEY_CURRENT_USER\0At\DefaultIcon

HKEY_CURRENT_USER\0At\shell

HKEY_CURRENT_USER\0At\shell\
open

HKEY_CURRENT_USER\0At\shell\
open\command

HKEY_CURRENT_USER\0At\shell\
runas

HKEY_CURRENT_USER\0At\shell\
runas\command

HKEY_CURRENT_USER\b4W

HKEY_CURRENT_USER\b4W\DefaultIcon

HKEY_CURRENT_USER\b4W\shell

HKEY_CURRENT_USER\b4W\shell\
open

HKEY_CURRENT_USER\b4W\shell\
open\command

HKEY_CURRENT_USER\b4W\shell\
runas

HKEY_CURRENT_USER\b4W\shell\
runas\command

HKEY_CURRENT_USER\5BF

HKEY_CURRENT_USER\5BF\DefaultIcon

HKEY_CURRENT_USER\5BF\shell

HKEY_CURRENT_USER\5BF\shell\
open

HKEY_CURRENT_USER\5BF\shell\
open\command

HKEY_CURRENT_USER\5BF\shell\
runas

HKEY_CURRENT_USER\5BF\shell\
runas\command

HKEY_CURRENT_USER\pK

HKEY_CURRENT_USER\pK\DefaultIcon

HKEY_CURRENT_USER\pK\shell

HKEY_CURRENT_USER\pK\shell\
open

HKEY_CURRENT_USER\pK\shell\
open\command

HKEY_CURRENT_USER\pK\shell\
runas

HKEY_CURRENT_USER\pK\shell\
runas\command

HKEY_CURRENT_USER\50g

HKEY_CURRENT_USER\50g\DefaultIcon

HKEY_CURRENT_USER\50g\shell

HKEY_CURRENT_USER\50g\shell\
open

HKEY_CURRENT_USER\50g\shell\
open\command

HKEY_CURRENT_USER\50g\shell\
runas

HKEY_CURRENT_USER\50g\shell\
runas\command

HKEY_CURRENT_USER\JG

HKEY_CURRENT_USER\JG\DefaultIcon

HKEY_CURRENT_USER\JG\shell

HKEY_CURRENT_USER\JG\shell\
open

HKEY_CURRENT_USER\JG\shell\
open\command

HKEY_CURRENT_USER\JG\shell\
runas

HKEY_CURRENT_USER\JG\shell\
runas\command

HKEY_CURRENT_USER\bg

HKEY_CURRENT_USER\bg\DefaultIcon

HKEY_CURRENT_USER\bg\shell

HKEY_CURRENT_USER\bg\shell\
open

HKEY_CURRENT_USER\bg\shell\
open\command

HKEY_CURRENT_USER\bg\shell\
runas

HKEY_CURRENT_USER\bg\shell\
runas\command

HKEY_CURRENT_USER\6Tb

HKEY_CURRENT_USER\6Tb\DefaultIcon

HKEY_CURRENT_USER\6Tb\shell

HKEY_CURRENT_USER\6Tb\shell\
open

HKEY_CURRENT_USER\6Tb\shell\
open\command

HKEY_CURRENT_USER\6Tb\shell\
runas

HKEY_CURRENT_USER\6Tb\shell\
runas\command

HKEY_CURRENT_USER\RP2

HKEY_CURRENT_USER\RP2\DefaultIcon

HKEY_CURRENT_USER\RP2\shell

HKEY_CURRENT_USER\RP2\shell\
open

HKEY_CURRENT_USER\RP2\shell\
open\command

HKEY_CURRENT_USER\RP2\shell\
runas

HKEY_CURRENT_USER\RP2\shell\
runas\command

HKEY_CURRENT_USER\V4w

HKEY_CURRENT_USER\V4w\DefaultIcon

HKEY_CURRENT_USER\V4w\shell

HKEY_CURRENT_USER\V4w\shell\
open

HKEY_CURRENT_USER\V4w\shell\
open\command

HKEY_CURRENT_USER\V4w\shell\
runas

HKEY_CURRENT_USER\V4w\shell\
runas\command

HKEY_CURRENT_USER\52Y

HKEY_CURRENT_USER\52Y\DefaultIcon

HKEY_CURRENT_USER\52Y\shell

HKEY_CURRENT_USER\52Y\shell\
open

HKEY_CURRENT_USER\52Y\shell\
open\command

HKEY_CURRENT_USER\52Y\shell\
runas

HKEY_CURRENT_USER\52Y\shell\
runas\command

HKEY_CURRENT_USER\8R

HKEY_CURRENT_USER\8R\DefaultIcon

HKEY_CURRENT_USER\8R\shell

HKEY_CURRENT_USER\8R\shell\
open

HKEY_CURRENT_USER\8R\shell\
open\command

HKEY_CURRENT_USER\8R\shell\
runas

HKEY_CURRENT_USER\8R\shell\
runas\command

HKEY_CURRENT_USER\Kgx

HKEY_CURRENT_USER\Kgx\DefaultIcon

HKEY_CURRENT_USER\Kgx\shell

HKEY_CURRENT_USER\Kgx\shell\
open

HKEY_CURRENT_USER\Kgx\shell\
open\command

HKEY_CURRENT_USER\Kgx\shell\
runas

HKEY_CURRENT_USER\Kgx\shell\
runas\command

HKEY_CURRENT_USER\HFB

HKEY_CURRENT_USER\HFB\DefaultIcon

HKEY_CURRENT_USER\HFB\shell

HKEY_CURRENT_USER\HFB\shell\
open

HKEY_CURRENT_USER\HFB\shell\
open\command

HKEY_CURRENT_USER\HFB\shell\
runas

HKEY_CURRENT_USER\HFB\shell\
runas\command

HKEY_CURRENT_USER\EX

HKEY_CURRENT_USER\EX\DefaultIcon

HKEY_CURRENT_USER\EX\shell

HKEY_CURRENT_USER\EX\shell\
open

HKEY_CURRENT_USER\EX\shell\
open\command

HKEY_CURRENT_USER\EX\shell\
runas

HKEY_CURRENT_USER\EX\shell\
runas\command

HKEY_CURRENT_USER\7vF

HKEY_CURRENT_USER\7vF\DefaultIcon

HKEY_CURRENT_USER\7vF\shell

HKEY_CURRENT_USER\7vF\shell\
open

HKEY_CURRENT_USER\7vF\shell\
open\command

HKEY_CURRENT_USER\7vF\shell\
runas

HKEY_CURRENT_USER\7vF\shell\
runas\command

HKEY_CURRENT_USER\Jvg

HKEY_CURRENT_USER\Jvg\DefaultIcon

HKEY_CURRENT_USER\Jvg\shell

HKEY_CURRENT_USER\Jvg\shell\
open

HKEY_CURRENT_USER\Jvg\shell\
open\command

HKEY_CURRENT_USER\Jvg\shell\
runas

HKEY_CURRENT_USER\Jvg\shell\
runas\command

HKEY_CURRENT_USER\0W

HKEY_CURRENT_USER\0W\DefaultIcon

HKEY_CURRENT_USER\0W\shell

HKEY_CURRENT_USER\0W\shell\
open

HKEY_CURRENT_USER\0W\shell\
open\command

HKEY_CURRENT_USER\0W\shell\
runas

HKEY_CURRENT_USER\0W\shell\
runas\command

HKEY_CURRENT_USER\V5

HKEY_CURRENT_USER\V5\DefaultIcon

HKEY_CURRENT_USER\V5\shell

HKEY_CURRENT_USER\V5\shell\
open

HKEY_CURRENT_USER\V5\shell\
open\command

HKEY_CURRENT_USER\V5\shell\
runas

HKEY_CURRENT_USER\V5\shell\
runas\command

HKEY_CURRENT_USER\vK4

HKEY_CURRENT_USER\vK4\DefaultIcon

HKEY_CURRENT_USER\vK4\shell

HKEY_CURRENT_USER\vK4\shell\
open

HKEY_CURRENT_USER\vK4\shell\
open\command

HKEY_CURRENT_USER\vK4\shell\
runas

HKEY_CURRENT_USER\vK4\shell\
runas\command

HKEY_CURRENT_USER\dJ

HKEY_CURRENT_USER\dJ\DefaultIcon

HKEY_CURRENT_USER\dJ\shell

HKEY_CURRENT_USER\dJ\shell\
open

HKEY_CURRENT_USER\dJ\shell\
open\command

HKEY_CURRENT_USER\dJ\shell\
runas

HKEY_CURRENT_USER\dJ\shell\
runas\command

HKEY_CURRENT_USER\558

HKEY_CURRENT_USER\558\DefaultIcon

HKEY_CURRENT_USER\558\shell

HKEY_CURRENT_USER\558\shell\
open

HKEY_CURRENT_USER\558\shell\
open\command

HKEY_CURRENT_USER\558\shell\
runas

HKEY_CURRENT_USER\558\shell\
runas\command

HKEY_CURRENT_USER\tq1

HKEY_CURRENT_USER\tq1\DefaultIcon

HKEY_CURRENT_USER\tq1\shell

HKEY_CURRENT_USER\tq1\shell\
open

HKEY_CURRENT_USER\tq1\shell\
open\command

HKEY_CURRENT_USER\tq1\shell\
runas

HKEY_CURRENT_USER\tq1\shell\
runas\command

HKEY_CURRENT_USER\tC8

HKEY_CURRENT_USER\tC8\DefaultIcon

HKEY_CURRENT_USER\tC8\shell

HKEY_CURRENT_USER\tC8\shell\
open

HKEY_CURRENT_USER\tC8\shell\
open\command

HKEY_CURRENT_USER\tC8\shell\
runas

HKEY_CURRENT_USER\tC8\shell\
runas\command

HKEY_CURRENT_USER\SIr

HKEY_CURRENT_USER\SIr\DefaultIcon

HKEY_CURRENT_USER\SIr\shell

HKEY_CURRENT_USER\SIr\shell\
open

HKEY_CURRENT_USER\SIr\shell\
open\command

HKEY_CURRENT_USER\SIr\shell\
runas

HKEY_CURRENT_USER\SIr\shell\
runas\command

HKEY_CURRENT_USER\rj6

HKEY_CURRENT_USER\rj6\DefaultIcon

HKEY_CURRENT_USER\rj6\shell

HKEY_CURRENT_USER\rj6\shell\
open

HKEY_CURRENT_USER\rj6\shell\
open\command

HKEY_CURRENT_USER\rj6\shell\
runas

HKEY_CURRENT_USER\rj6\shell\
runas\command

HKEY_CURRENT_USER\uhs

HKEY_CURRENT_USER\uhs\DefaultIcon

HKEY_CURRENT_USER\uhs\shell

HKEY_CURRENT_USER\uhs\shell\
open

HKEY_CURRENT_USER\uhs\shell\
open\command

HKEY_CURRENT_USER\uhs\shell\
runas

HKEY_CURRENT_USER\uhs\shell\
runas\command

HKEY_CURRENT_USER\11

HKEY_CURRENT_USER\11\DefaultIcon

HKEY_CURRENT_USER\11\shell

HKEY_CURRENT_USER\11\shell\
open

HKEY_CURRENT_USER\11\shell\
open\command

HKEY_CURRENT_USER\11\shell\
runas

HKEY_CURRENT_USER\11\shell\
runas\command

HKEY_CURRENT_USER\4TD

HKEY_CURRENT_USER\4TD\DefaultIcon

HKEY_CURRENT_USER\4TD\shell

HKEY_CURRENT_USER\4TD\shell\
open

HKEY_CURRENT_USER\4TD\shell\
open\command

HKEY_CURRENT_USER\4TD\shell\
runas

HKEY_CURRENT_USER\4TD\shell\
runas\command

HKEY_CURRENT_USER\T8

HKEY_CURRENT_USER\T8\DefaultIcon

HKEY_CURRENT_USER\T8\shell

HKEY_CURRENT_USER\T8\shell\
open

HKEY_CURRENT_USER\T8\shell\
open\command

HKEY_CURRENT_USER\T8\shell\
runas

HKEY_CURRENT_USER\T8\shell\
runas\command

HKEY_CURRENT_USER\oeP

HKEY_CURRENT_USER\oeP\DefaultIcon

HKEY_CURRENT_USER\oeP\shell

HKEY_CURRENT_USER\oeP\shell\
open

HKEY_CURRENT_USER\oeP\shell\
open\command

HKEY_CURRENT_USER\oeP\shell\
runas

HKEY_CURRENT_USER\oeP\shell\
runas\command

HKEY_CURRENT_USER\Xtj

HKEY_CURRENT_USER\Xtj\DefaultIcon

HKEY_CURRENT_USER\Xtj\shell

HKEY_CURRENT_USER\Xtj\shell\
open

HKEY_CURRENT_USER\Xtj\shell\
open\command

HKEY_CURRENT_USER\Xtj\shell\
runas

HKEY_CURRENT_USER\Xtj\shell\
runas\command

HKEY_CURRENT_USER\s1

HKEY_CURRENT_USER\s1\DefaultIcon

HKEY_CURRENT_USER\s1\shell

HKEY_CURRENT_USER\s1\shell\
open

HKEY_CURRENT_USER\s1\shell\
open\command

HKEY_CURRENT_USER\s1\shell\
runas

HKEY_CURRENT_USER\s1\shell\
runas\command

HKEY_CURRENT_USER\42R

HKEY_CURRENT_USER\42R\DefaultIcon

HKEY_CURRENT_USER\42R\shell

HKEY_CURRENT_USER\42R\shell\
open

HKEY_CURRENT_USER\42R\shell\
open\command

HKEY_CURRENT_USER\42R\shell\
runas

HKEY_CURRENT_USER\42R\shell\
runas\command

HKEY_CURRENT_USER\L1p

HKEY_CURRENT_USER\L1p\DefaultIcon

HKEY_CURRENT_USER\L1p\shell

HKEY_CURRENT_USER\L1p\shell\
open

HKEY_CURRENT_USER\L1p\shell\
open\command

HKEY_CURRENT_USER\L1p\shell\
runas

HKEY_CURRENT_USER\L1p\shell\
runas\command

HKEY_CURRENT_USER\t3

HKEY_CURRENT_USER\t3\DefaultIcon

HKEY_CURRENT_USER\t3\shell

HKEY_CURRENT_USER\t3\shell\
open

HKEY_CURRENT_USER\t3\shell\
open\command

HKEY_CURRENT_USER\t3\shell\
runas

HKEY_CURRENT_USER\t3\shell\
runas\command

HKEY_CURRENT_USER\85L

HKEY_CURRENT_USER\85L\DefaultIcon

HKEY_CURRENT_USER\85L\shell

HKEY_CURRENT_USER\85L\shell\
open

HKEY_CURRENT_USER\85L\shell\
open\command

HKEY_CURRENT_USER\85L\shell\
runas

HKEY_CURRENT_USER\85L\shell\
runas\command

HKEY_CURRENT_USER\jk

HKEY_CURRENT_USER\jk\DefaultIcon

HKEY_CURRENT_USER\jk\shell

HKEY_CURRENT_USER\jk\shell\
open

HKEY_CURRENT_USER\jk\shell\
open\command

HKEY_CURRENT_USER\jk\shell\
runas

HKEY_CURRENT_USER\jk\shell\
runas\command

HKEY_CURRENT_USER\1oX

HKEY_CURRENT_USER\1oX\DefaultIcon

HKEY_CURRENT_USER\1oX\shell

HKEY_CURRENT_USER\1oX\shell\
open

HKEY_CURRENT_USER\1oX\shell\
open\command

HKEY_CURRENT_USER\1oX\shell\
runas

HKEY_CURRENT_USER\1oX\shell\
runas\command

HKEY_CURRENT_USER\547

HKEY_CURRENT_USER\547\DefaultIcon

HKEY_CURRENT_USER\547\shell

HKEY_CURRENT_USER\547\shell\
open

HKEY_CURRENT_USER\547\shell\
open\command

HKEY_CURRENT_USER\547\shell\
runas

HKEY_CURRENT_USER\547\shell\
runas\command

HKEY_CURRENT_USER\18Y

HKEY_CURRENT_USER\18Y\DefaultIcon

HKEY_CURRENT_USER\18Y\shell

HKEY_CURRENT_USER\18Y\shell\
open

HKEY_CURRENT_USER\18Y\shell\
open\command

HKEY_CURRENT_USER\18Y\shell\
runas

HKEY_CURRENT_USER\18Y\shell\
runas\command

HKEY_CURRENT_USER\AiX

HKEY_CURRENT_USER\AiX\DefaultIcon

HKEY_CURRENT_USER\AiX\shell

HKEY_CURRENT_USER\AiX\shell\
open

HKEY_CURRENT_USER\AiX\shell\
open\command

HKEY_CURRENT_USER\AiX\shell\
runas

HKEY_CURRENT_USER\AiX\shell\
runas\command

HKEY_CURRENT_USER\7C3

HKEY_CURRENT_USER\7C3\DefaultIcon

HKEY_CURRENT_USER\7C3\shell

HKEY_CURRENT_USER\7C3\shell\
open

HKEY_CURRENT_USER\7C3\shell\
open\command

HKEY_CURRENT_USER\7C3\shell\
runas

HKEY_CURRENT_USER\7C3\shell\
runas\command

HKEY_CURRENT_USER\V3G

HKEY_CURRENT_USER\V3G\DefaultIcon

HKEY_CURRENT_USER\V3G\shell

HKEY_CURRENT_USER\V3G\shell\
open

HKEY_CURRENT_USER\V3G\shell\
open\command

HKEY_CURRENT_USER\V3G\shell\
runas

HKEY_CURRENT_USER\V3G\shell\
runas\command

HKEY_CURRENT_USER\b63

HKEY_CURRENT_USER\b63\DefaultIcon

HKEY_CURRENT_USER\b63\shell

HKEY_CURRENT_USER\b63\shell\
open

HKEY_CURRENT_USER\b63\shell\
open\command

HKEY_CURRENT_USER\b63\shell\
runas

HKEY_CURRENT_USER\b63\shell\
runas\command

HKEY_CURRENT_USER\TY5

HKEY_CURRENT_USER\TY5\DefaultIcon

HKEY_CURRENT_USER\TY5\shell

HKEY_CURRENT_USER\TY5\shell\
open

HKEY_CURRENT_USER\TY5\shell\
open\command

HKEY_CURRENT_USER\TY5\shell\
runas

HKEY_CURRENT_USER\TY5\shell\
runas\command

HKEY_CURRENT_USER\48q

HKEY_CURRENT_USER\48q\DefaultIcon

HKEY_CURRENT_USER\48q\shell

HKEY_CURRENT_USER\48q\shell\
open

HKEY_CURRENT_USER\48q\shell\
open\command

HKEY_CURRENT_USER\48q\shell\
runas

HKEY_CURRENT_USER\48q\shell\
runas\command

HKEY_CURRENT_USER\Xe

HKEY_CURRENT_USER\Xe\DefaultIcon

HKEY_CURRENT_USER\Xe\shell

HKEY_CURRENT_USER\Xe\shell\
open

HKEY_CURRENT_USER\Xe\shell\
open\command

HKEY_CURRENT_USER\Xe\shell\
runas

HKEY_CURRENT_USER\Xe\shell\
runas\command

HKEY_CURRENT_USER\Wc

HKEY_CURRENT_USER\Wc\DefaultIcon

HKEY_CURRENT_USER\Wc\shell

HKEY_CURRENT_USER\Wc\shell\
open

HKEY_CURRENT_USER\Wc\shell\
open\command

HKEY_CURRENT_USER\Wc\shell\
runas

HKEY_CURRENT_USER\Wc\shell\
runas\command

HKEY_CURRENT_USER\7n

HKEY_CURRENT_USER\7n\DefaultIcon

HKEY_CURRENT_USER\7n\shell

HKEY_CURRENT_USER\7n\shell\
open

HKEY_CURRENT_USER\7n\shell\
open\command

HKEY_CURRENT_USER\7n\shell\
runas

HKEY_CURRENT_USER\7n\shell\
runas\command

HKEY_CURRENT_USER\I2

HKEY_CURRENT_USER\I2\DefaultIcon

HKEY_CURRENT_USER\I2\shell

HKEY_CURRENT_USER\I2\shell\
open

HKEY_CURRENT_USER\I2\shell\
open\command

HKEY_CURRENT_USER\I2\shell\
runas

HKEY_CURRENT_USER\I2\shell\
runas\command

HKEY_CURRENT_USER\G0

HKEY_CURRENT_USER\G0\DefaultIcon

HKEY_CURRENT_USER\G0\shell

HKEY_CURRENT_USER\G0\shell\
open

HKEY_CURRENT_USER\G0\shell\
open\command

HKEY_CURRENT_USER\G0\shell\
runas

HKEY_CURRENT_USER\G0\shell\
runas\command

HKEY_CURRENT_USER\87

HKEY_CURRENT_USER\87\DefaultIcon

HKEY_CURRENT_USER\87\shell

HKEY_CURRENT_USER\87\shell\
open

HKEY_CURRENT_USER\87\shell\
open\command

HKEY_CURRENT_USER\87\shell\
runas

HKEY_CURRENT_USER\87\shell\
runas\command

HKEY_CURRENT_USER\686

HKEY_CURRENT_USER\686\DefaultIcon

HKEY_CURRENT_USER\686\shell

HKEY_CURRENT_USER\686\shell\
open

HKEY_CURRENT_USER\686\shell\
open\command

HKEY_CURRENT_USER\686\shell\
runas

HKEY_CURRENT_USER\686\shell\
runas\command

HKEY_CURRENT_USER\wJ4

HKEY_CURRENT_USER\wJ4\DefaultIcon

HKEY_CURRENT_USER\wJ4\shell

HKEY_CURRENT_USER\wJ4\shell\
open

HKEY_CURRENT_USER\wJ4\shell\
open\command

HKEY_CURRENT_USER\wJ4\shell\
runas

HKEY_CURRENT_USER\wJ4\shell\
runas\command

HKEY_CURRENT_USER\08l

HKEY_CURRENT_USER\08l\DefaultIcon

HKEY_CURRENT_USER\08l\shell

HKEY_CURRENT_USER\08l\shell\
open

HKEY_CURRENT_USER\08l\shell\
open\command

HKEY_CURRENT_USER\08l\shell\
runas

HKEY_CURRENT_USER\08l\shell\
runas\command

HKEY_CURRENT_USER\et

HKEY_CURRENT_USER\et\DefaultIcon

HKEY_CURRENT_USER\et\shell

HKEY_CURRENT_USER\et\shell\
open

HKEY_CURRENT_USER\et\shell\
open\command

HKEY_CURRENT_USER\et\shell\
runas

HKEY_CURRENT_USER\et\shell\
runas\command

HKEY_CURRENT_USER\qc

HKEY_CURRENT_USER\qc\DefaultIcon

HKEY_CURRENT_USER\qc\shell

HKEY_CURRENT_USER\qc\shell\
open

HKEY_CURRENT_USER\qc\shell\
open\command

HKEY_CURRENT_USER\qc\shell\
runas

HKEY_CURRENT_USER\qc\shell\
runas\command

HKEY_CURRENT_USER\KT

HKEY_CURRENT_USER\KT\DefaultIcon

HKEY_CURRENT_USER\KT\shell

HKEY_CURRENT_USER\KT\shell\
open

HKEY_CURRENT_USER\KT\shell\
open\command

HKEY_CURRENT_USER\KT\shell\
runas

HKEY_CURRENT_USER\KT\shell\
runas\command

HKEY_CURRENT_USER\yS

HKEY_CURRENT_USER\yS\DefaultIcon

HKEY_CURRENT_USER\yS\shell

HKEY_CURRENT_USER\yS\shell\
open

HKEY_CURRENT_USER\yS\shell\
open\command

HKEY_CURRENT_USER\yS\shell\
runas

HKEY_CURRENT_USER\yS\shell\
runas\command

HKEY_CURRENT_USER\YrH

HKEY_CURRENT_USER\YrH\DefaultIcon

HKEY_CURRENT_USER\YrH\shell

HKEY_CURRENT_USER\YrH\shell\
open

HKEY_CURRENT_USER\YrH\shell\
open\command

HKEY_CURRENT_USER\YrH\shell\
runas

HKEY_CURRENT_USER\YrH\shell\
runas\command

HKEY_CURRENT_USER\3Xa

HKEY_CURRENT_USER\3Xa\DefaultIcon

HKEY_CURRENT_USER\3Xa\shell

HKEY_CURRENT_USER\3Xa\shell\
open

HKEY_CURRENT_USER\3Xa\shell\
open\command

HKEY_CURRENT_USER\3Xa\shell\
runas

HKEY_CURRENT_USER\3Xa\shell\
runas\command

HKEY_CURRENT_USER\hI

HKEY_CURRENT_USER\hI\DefaultIcon

HKEY_CURRENT_USER\hI\shell

HKEY_CURRENT_USER\hI\shell\
open

HKEY_CURRENT_USER\hI\shell\
open\command

HKEY_CURRENT_USER\hI\shell\
runas

HKEY_CURRENT_USER\hI\shell\
runas\command

HKEY_CURRENT_USER\SCq

HKEY_CURRENT_USER\SCq\DefaultIcon

HKEY_CURRENT_USER\SCq\shell

HKEY_CURRENT_USER\SCq\shell\
open

HKEY_CURRENT_USER\SCq\shell\
open\command

HKEY_CURRENT_USER\SCq\shell\
runas

HKEY_CURRENT_USER\SCq\shell\
runas\command

HKEY_CURRENT_USER\im

HKEY_CURRENT_USER\im\DefaultIcon

HKEY_CURRENT_USER\im\shell

HKEY_CURRENT_USER\im\shell\
open

HKEY_CURRENT_USER\im\shell\
open\command

HKEY_CURRENT_USER\im\shell\
runas

HKEY_CURRENT_USER\im\shell\
runas\command

HKEY_CURRENT_USER\808

HKEY_CURRENT_USER\808\DefaultIcon

HKEY_CURRENT_USER\808\shell

HKEY_CURRENT_USER\808\shell\
open

HKEY_CURRENT_USER\808\shell\
open\command

HKEY_CURRENT_USER\808\shell\
runas

HKEY_CURRENT_USER\808\shell\
runas\command

HKEY_CURRENT_USER\67y

HKEY_CURRENT_USER\67y\DefaultIcon

HKEY_CURRENT_USER\67y\shell

HKEY_CURRENT_USER\67y\shell\
open

HKEY_CURRENT_USER\67y\shell\
open\command

HKEY_CURRENT_USER\67y\shell\
runas

HKEY_CURRENT_USER\67y\shell\
runas\command

HKEY_CURRENT_USER\cm

HKEY_CURRENT_USER\cm\DefaultIcon

HKEY_CURRENT_USER\cm\shell

HKEY_CURRENT_USER\cm\shell\
open

HKEY_CURRENT_USER\cm\shell\
open\command

HKEY_CURRENT_USER\cm\shell\
runas

HKEY_CURRENT_USER\cm\shell\
runas\command

HKEY_CURRENT_USER\Vrf

HKEY_CURRENT_USER\Vrf\DefaultIcon

HKEY_CURRENT_USER\Vrf\shell

HKEY_CURRENT_USER\Vrf\shell\
open

HKEY_CURRENT_USER\Vrf\shell\
open\command

HKEY_CURRENT_USER\Vrf\shell\
runas

HKEY_CURRENT_USER\Vrf\shell\
runas\command

HKEY_CURRENT_USER\u6R

HKEY_CURRENT_USER\u6R\DefaultIcon

HKEY_CURRENT_USER\u6R\shell

HKEY_CURRENT_USER\u6R\shell\
open

HKEY_CURRENT_USER\u6R\shell\
open\command

HKEY_CURRENT_USER\u6R\shell\
runas

HKEY_CURRENT_USER\u6R\shell\
runas\command

HKEY_CURRENT_USER\eEu

HKEY_CURRENT_USER\eEu\DefaultIcon

HKEY_CURRENT_USER\eEu\shell

HKEY_CURRENT_USER\eEu\shell\
open

HKEY_CURRENT_USER\eEu\shell\
open\command

HKEY_CURRENT_USER\eEu\shell\
runas

HKEY_CURRENT_USER\eEu\shell\
runas\command

HKEY_CURRENT_USER\1NS

HKEY_CURRENT_USER\1NS\DefaultIcon

HKEY_CURRENT_USER\1NS\shell

HKEY_CURRENT_USER\1NS\shell\
open

HKEY_CURRENT_USER\1NS\shell\
open\command

HKEY_CURRENT_USER\1NS\shell\
runas

HKEY_CURRENT_USER\1NS\shell\
runas\command

HKEY_CURRENT_USER\BNv

HKEY_CURRENT_USER\BNv\DefaultIcon

HKEY_CURRENT_USER\BNv\shell

HKEY_CURRENT_USER\BNv\shell\
open

HKEY_CURRENT_USER\BNv\shell\
open\command

HKEY_CURRENT_USER\BNv\shell\
runas

HKEY_CURRENT_USER\BNv\shell\
runas\command

HKEY_CURRENT_USER\7L

HKEY_CURRENT_USER\7L\DefaultIcon

HKEY_CURRENT_USER\7L\shell

HKEY_CURRENT_USER\7L\shell\
open

HKEY_CURRENT_USER\7L\shell\
open\command

HKEY_CURRENT_USER\7L\shell\
runas

HKEY_CURRENT_USER\7L\shell\
runas\command

HKEY_CURRENT_USER\Tu

HKEY_CURRENT_USER\Tu\DefaultIcon

HKEY_CURRENT_USER\Tu\shell

HKEY_CURRENT_USER\Tu\shell\
open

HKEY_CURRENT_USER\Tu\shell\
open\command

HKEY_CURRENT_USER\Tu\shell\
runas

HKEY_CURRENT_USER\Tu\shell\
runas\command

HKEY_CURRENT_USER\p7

HKEY_CURRENT_USER\p7\DefaultIcon

HKEY_CURRENT_USER\p7\shell

HKEY_CURRENT_USER\p7\shell\
open

HKEY_CURRENT_USER\p7\shell\
open\command

HKEY_CURRENT_USER\p7\shell\
runas

HKEY_CURRENT_USER\p7\shell\
runas\command

HKEY_CURRENT_USER\iSB

HKEY_CURRENT_USER\iSB\DefaultIcon

HKEY_CURRENT_USER\iSB\shell

HKEY_CURRENT_USER\iSB\shell\
open

HKEY_CURRENT_USER\iSB\shell\
open\command

HKEY_CURRENT_USER\iSB\shell\
runas

HKEY_CURRENT_USER\iSB\shell\
runas\command

HKEY_CURRENT_USER\27w

HKEY_CURRENT_USER\27w\DefaultIcon

HKEY_CURRENT_USER\27w\shell

HKEY_CURRENT_USER\27w\shell\
open

HKEY_CURRENT_USER\27w\shell\
open\command

HKEY_CURRENT_USER\27w\shell\
runas

HKEY_CURRENT_USER\27w\shell\
runas\command

HKEY_CURRENT_USER\7B

HKEY_CURRENT_USER\7B\DefaultIcon

HKEY_CURRENT_USER\7B\shell

HKEY_CURRENT_USER\7B\shell\
open

HKEY_CURRENT_USER\7B\shell\
open\command

HKEY_CURRENT_USER\7B\shell\
runas

HKEY_CURRENT_USER\7B\shell\
runas\command

HKEY_CURRENT_USER\BP

HKEY_CURRENT_USER\BP\DefaultIcon

HKEY_CURRENT_USER\BP\shell

HKEY_CURRENT_USER\BP\shell\
open

HKEY_CURRENT_USER\BP\shell\
open\command

HKEY_CURRENT_USER\BP\shell\
runas

HKEY_CURRENT_USER\BP\shell\
runas\command

HKEY_CURRENT_USER\CEq

HKEY_CURRENT_USER\CEq\DefaultIcon

HKEY_CURRENT_USER\CEq\shell

HKEY_CURRENT_USER\CEq\shell\
open

HKEY_CURRENT_USER\CEq\shell\
open\command

HKEY_CURRENT_USER\CEq\shell\
runas

HKEY_CURRENT_USER\CEq\shell\
runas\command

HKEY_CURRENT_USER\5m

HKEY_CURRENT_USER\5m\DefaultIcon

HKEY_CURRENT_USER\5m\shell

HKEY_CURRENT_USER\5m\shell\
open

HKEY_CURRENT_USER\5m\shell\
open\command

HKEY_CURRENT_USER\5m\shell\
runas

HKEY_CURRENT_USER\5m\shell\
runas\command

HKEY_CURRENT_USER\7c5

HKEY_CURRENT_USER\7c5\DefaultIcon

HKEY_CURRENT_USER\7c5\shell

HKEY_CURRENT_USER\7c5\shell\
open

HKEY_CURRENT_USER\7c5\shell\
open\command

HKEY_CURRENT_USER\7c5\shell\
runas

HKEY_CURRENT_USER\7c5\shell\
runas\command

HKEY_CURRENT_USER\X0

HKEY_CURRENT_USER\X0\DefaultIcon

HKEY_CURRENT_USER\X0\shell

HKEY_CURRENT_USER\X0\shell\
open

HKEY_CURRENT_USER\X0\shell\
open\command

HKEY_CURRENT_USER\X0\shell\
runas

HKEY_CURRENT_USER\X0\shell\
runas\command

HKEY_CURRENT_USER\sr5

HKEY_CURRENT_USER\sr5\DefaultIcon

HKEY_CURRENT_USER\sr5\shell

HKEY_CURRENT_USER\sr5\shell\
open

HKEY_CURRENT_USER\sr5\shell\
open\command

HKEY_CURRENT_USER\sr5\shell\
runas

HKEY_CURRENT_USER\sr5\shell\
runas\command

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

HKEY_CURRENT_USER\.exe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\.exe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\.exe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hb\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hb\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Software\Microsoft\
Windows
Local = "ab19919"

HKEY_CURRENT_USER\b8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\b8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\701
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\701\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\701\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3cU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3cU\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3cU\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\48\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\c7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Qu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k6n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\k6n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k6n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3rs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3rs\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3rs\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\enF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\enF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\enF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gUm
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gUm\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gUm\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xti
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xti\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xti\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8E2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8E2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8E2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EW3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\EW3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EW3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h6v
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h6v\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h6v\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6x6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6x6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6x6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gdI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gdI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gdI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\84
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\84\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\84\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tdG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tdG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tdG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6X
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\M6X\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6X\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\atn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\atn\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\atn\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lWb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lWb\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lWb\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\QP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\le
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\le\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\le\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\35
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\35\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\35\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\36
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\36\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\36\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ja
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ja\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ja\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1T1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1T1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1T1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\l6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WEd
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\WEd\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WEd\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\86Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\86Q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\86Q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TM
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\TM\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TM\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gss
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gss\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gss\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wf\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wf\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1V
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1V\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1V\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6G5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6G5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6G5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\15c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I28
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\I28\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I28\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\LH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kf5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Kf5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kf5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wy
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Wy\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wy\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\72
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\72\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\72\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y1c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y1c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y1c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ct
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ct\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ct\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rxa
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rxa\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rxa\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U88
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\U88\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U88\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1x\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1x\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gx
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gx\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gx\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lh5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lh5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lh5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Rp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Rp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Rp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3b
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3b\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3b\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wyp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wyp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wyp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JEy
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JEy\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JEy\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6oX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6oX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6oX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QO1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\QO1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QO1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\chF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\chF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\chF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cl
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cl\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cl\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\38\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55L
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\55L\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55L\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\08\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\70
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\70\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\70\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\624
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\624\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\624\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Cbd
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Cbd\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Cbd\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\O1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\O1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\O1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\IA\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IA\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0At
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0At\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0At\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b4W
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\b4W\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b4W\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5BF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5BF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5BF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pK\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pK\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\50g
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\50g\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\50g\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Tb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6Tb\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Tb\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RP2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\RP2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RP2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V4w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V4w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V4w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\52Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\52Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\52Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kgx
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Kgx\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kgx\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HFB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\HFB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HFB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\EX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7vF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7vF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7vF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jvg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jvg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jvg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0W
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0W\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0W\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vK4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\vK4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vK4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\dJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\558
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\558\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\558\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tq1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tq1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tq1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tC8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tC8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tC8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SIr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SIr\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SIr\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rj6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rj6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rj6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uhs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uhs\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uhs\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\11
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\11\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\11\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4TD
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4TD\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4TD\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\T8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\oeP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oeP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\oeP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xtj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Xtj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xtj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\s1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\s1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\s1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\42R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\42R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\42R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L1p
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L1p\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L1p\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\t3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\85L
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\85L\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\85L\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jk
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jk\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jk\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1oX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1oX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1oX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\547
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\547\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\547\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\18Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\18Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\18Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AiX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\AiX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AiX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7C3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7C3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7C3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V3G
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V3G\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V3G\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b63
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\b63\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b63\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TY5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\TY5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TY5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\48q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Xe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Wc\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wc\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\I2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\G0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\87\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\686
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\686\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\686\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wJ4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wJ4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wJ4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08l
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\08l\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08l\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\et
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\et\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\et\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\qc\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qc\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\KT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\KT\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\KT\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yS\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yS\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YrH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YrH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YrH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Xa
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3Xa\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Xa\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SCq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SCq\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SCq\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\im
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\im\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\im\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\808
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\808\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\808\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\67y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\67y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\67y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cm
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cm\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cm\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vrf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vrf\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vrf\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\u6R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\u6R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\u6R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eEu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\eEu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eEu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1NS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1NS\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1NS\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BNv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BNv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BNv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7L
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7L\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7L\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\p7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\iSB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\iSB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\iSB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\27w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\27w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\27w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7B\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7B\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\CEq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\CEq\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\CEq\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5m
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5m\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5m\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7c5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7c5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7c5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\X0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sr5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sr5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sr5\shell\
runas\command
IsolatedCommand = "%1 %*"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

(Note: The default value data of the said registry entry is %User Profile%\Local Settings\Application Data.)

Dropping Routine

This Trojan drops the following files:

• %Application Data%\voo.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other Details

This Trojan deletes itself after execution.

This report is generated via an automated analysis system.