ALIASES:

Rogue:Win32/FakeRean (Microsoft); PWS-Zbot-FANF!4F5D2C9239AB (McAfee); Packed.Generic.405 (Symantec); Trojan-FakeAV.Win32.CProtection.qmi (Kaspersky); FraudTool.Win32.FakeRean (Sunbelt); ERROR (FSecure); Agent (AVG)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

  TECHNICAL DETAILS

File Size: 243,712 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 26 Apr 2013

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan modifies the following file(s):

  • %Application Data%\GDIPFONTCACHEV1.DAT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following registry keys:

HKEY_CURRENT_USER\.exe

HKEY_CURRENT_USER\.exe\DefaultIcon

HKEY_CURRENT_USER\.exe\shell

HKEY_CURRENT_USER\.exe\shell\
open

HKEY_CURRENT_USER\.exe\shell\
open\command

HKEY_CURRENT_USER\.exe\shell\
runas

HKEY_CURRENT_USER\.exe\shell\
runas\command

HKEY_CURRENT_USER\hb

HKEY_CURRENT_USER\hb\DefaultIcon

HKEY_CURRENT_USER\hb\shell

HKEY_CURRENT_USER\hb\shell\
open

HKEY_CURRENT_USER\hb\shell\
open\command

HKEY_CURRENT_USER\hb\shell\
runas

HKEY_CURRENT_USER\hb\shell\
runas\command

HKEY_CURRENT_USER\b8

HKEY_CURRENT_USER\b8\DefaultIcon

HKEY_CURRENT_USER\b8\shell

HKEY_CURRENT_USER\b8\shell\
open

HKEY_CURRENT_USER\b8\shell\
open\command

HKEY_CURRENT_USER\b8\shell\
runas

HKEY_CURRENT_USER\b8\shell\
runas\command

HKEY_CURRENT_USER\701

HKEY_CURRENT_USER\701\DefaultIcon

HKEY_CURRENT_USER\701\shell

HKEY_CURRENT_USER\701\shell\
open

HKEY_CURRENT_USER\701\shell\
open\command

HKEY_CURRENT_USER\701\shell\
runas

HKEY_CURRENT_USER\701\shell\
runas\command

HKEY_CURRENT_USER\3cU

HKEY_CURRENT_USER\3cU\DefaultIcon

HKEY_CURRENT_USER\3cU\shell

HKEY_CURRENT_USER\3cU\shell\
open

HKEY_CURRENT_USER\3cU\shell\
open\command

HKEY_CURRENT_USER\3cU\shell\
runas

HKEY_CURRENT_USER\3cU\shell\
runas\command

HKEY_CURRENT_USER\48

HKEY_CURRENT_USER\48\DefaultIcon

HKEY_CURRENT_USER\48\shell

HKEY_CURRENT_USER\48\shell\
open

HKEY_CURRENT_USER\48\shell\
open\command

HKEY_CURRENT_USER\48\shell\
runas

HKEY_CURRENT_USER\48\shell\
runas\command

HKEY_CURRENT_USER\c7

HKEY_CURRENT_USER\c7\DefaultIcon

HKEY_CURRENT_USER\c7\shell

HKEY_CURRENT_USER\c7\shell\
open

HKEY_CURRENT_USER\c7\shell\
open\command

HKEY_CURRENT_USER\c7\shell\
runas

HKEY_CURRENT_USER\c7\shell\
runas\command

HKEY_CURRENT_USER\Qu

HKEY_CURRENT_USER\Qu\DefaultIcon

HKEY_CURRENT_USER\Qu\shell

HKEY_CURRENT_USER\Qu\shell\
open

HKEY_CURRENT_USER\Qu\shell\
open\command

HKEY_CURRENT_USER\Qu\shell\
runas

HKEY_CURRENT_USER\Qu\shell\
runas\command

HKEY_CURRENT_USER\k6n

HKEY_CURRENT_USER\k6n\DefaultIcon

HKEY_CURRENT_USER\k6n\shell

HKEY_CURRENT_USER\k6n\shell\
open

HKEY_CURRENT_USER\k6n\shell\
open\command

HKEY_CURRENT_USER\k6n\shell\
runas

HKEY_CURRENT_USER\k6n\shell\
runas\command

HKEY_CURRENT_USER\3rs

HKEY_CURRENT_USER\3rs\DefaultIcon

HKEY_CURRENT_USER\3rs\shell

HKEY_CURRENT_USER\3rs\shell\
open

HKEY_CURRENT_USER\3rs\shell\
open\command

HKEY_CURRENT_USER\3rs\shell\
runas

HKEY_CURRENT_USER\3rs\shell\
runas\command

HKEY_CURRENT_USER\Vp

HKEY_CURRENT_USER\Vp\DefaultIcon

HKEY_CURRENT_USER\Vp\shell

HKEY_CURRENT_USER\Vp\shell\
open

HKEY_CURRENT_USER\Vp\shell\
open\command

HKEY_CURRENT_USER\Vp\shell\
runas

HKEY_CURRENT_USER\Vp\shell\
runas\command

HKEY_CURRENT_USER\nF

HKEY_CURRENT_USER\nF\DefaultIcon

HKEY_CURRENT_USER\nF\shell

HKEY_CURRENT_USER\nF\shell\
open

HKEY_CURRENT_USER\nF\shell\
open\command

HKEY_CURRENT_USER\nF\shell\
runas

HKEY_CURRENT_USER\nF\shell\
runas\command

HKEY_CURRENT_USER\enF

HKEY_CURRENT_USER\enF\DefaultIcon

HKEY_CURRENT_USER\enF\shell

HKEY_CURRENT_USER\enF\shell\
open

HKEY_CURRENT_USER\enF\shell\
open\command

HKEY_CURRENT_USER\enF\shell\
runas

HKEY_CURRENT_USER\enF\shell\
runas\command

HKEY_CURRENT_USER\gUm

HKEY_CURRENT_USER\gUm\DefaultIcon

HKEY_CURRENT_USER\gUm\shell

HKEY_CURRENT_USER\gUm\shell\
open

HKEY_CURRENT_USER\gUm\shell\
open\command

HKEY_CURRENT_USER\gUm\shell\
runas

HKEY_CURRENT_USER\gUm\shell\
runas\command

HKEY_CURRENT_USER\xti

HKEY_CURRENT_USER\xti\DefaultIcon

HKEY_CURRENT_USER\xti\shell

HKEY_CURRENT_USER\xti\shell\
open

HKEY_CURRENT_USER\xti\shell\
open\command

HKEY_CURRENT_USER\xti\shell\
runas

HKEY_CURRENT_USER\xti\shell\
runas\command

HKEY_CURRENT_USER\8E2

HKEY_CURRENT_USER\8E2\DefaultIcon

HKEY_CURRENT_USER\8E2\shell

HKEY_CURRENT_USER\8E2\shell\
open

HKEY_CURRENT_USER\8E2\shell\
open\command

HKEY_CURRENT_USER\8E2\shell\
runas

HKEY_CURRENT_USER\8E2\shell\
runas\command

HKEY_CURRENT_USER\EW3

HKEY_CURRENT_USER\EW3\DefaultIcon

HKEY_CURRENT_USER\EW3\shell

HKEY_CURRENT_USER\EW3\shell\
open

HKEY_CURRENT_USER\EW3\shell\
open\command

HKEY_CURRENT_USER\EW3\shell\
runas

HKEY_CURRENT_USER\EW3\shell\
runas\command

HKEY_CURRENT_USER\h6v

HKEY_CURRENT_USER\h6v\DefaultIcon

HKEY_CURRENT_USER\h6v\shell

HKEY_CURRENT_USER\h6v\shell\
open

HKEY_CURRENT_USER\h6v\shell\
open\command

HKEY_CURRENT_USER\h6v\shell\
runas

HKEY_CURRENT_USER\h6v\shell\
runas\command

HKEY_CURRENT_USER\6x6

HKEY_CURRENT_USER\6x6\DefaultIcon

HKEY_CURRENT_USER\6x6\shell

HKEY_CURRENT_USER\6x6\shell\
open

HKEY_CURRENT_USER\6x6\shell\
open\command

HKEY_CURRENT_USER\6x6\shell\
runas

HKEY_CURRENT_USER\6x6\shell\
runas\command

HKEY_CURRENT_USER\gdI

HKEY_CURRENT_USER\gdI\DefaultIcon

HKEY_CURRENT_USER\gdI\shell

HKEY_CURRENT_USER\gdI\shell\
open

HKEY_CURRENT_USER\gdI\shell\
open\command

HKEY_CURRENT_USER\gdI\shell\
runas

HKEY_CURRENT_USER\gdI\shell\
runas\command

HKEY_CURRENT_USER\84

HKEY_CURRENT_USER\84\DefaultIcon

HKEY_CURRENT_USER\84\shell

HKEY_CURRENT_USER\84\shell\
open

HKEY_CURRENT_USER\84\shell\
open\command

HKEY_CURRENT_USER\84\shell\
runas

HKEY_CURRENT_USER\84\shell\
runas\command

HKEY_CURRENT_USER\tdG

HKEY_CURRENT_USER\tdG\DefaultIcon

HKEY_CURRENT_USER\tdG\shell

HKEY_CURRENT_USER\tdG\shell\
open

HKEY_CURRENT_USER\tdG\shell\
open\command

HKEY_CURRENT_USER\tdG\shell\
runas

HKEY_CURRENT_USER\tdG\shell\
runas\command

HKEY_CURRENT_USER\M6X

HKEY_CURRENT_USER\M6X\DefaultIcon

HKEY_CURRENT_USER\M6X\shell

HKEY_CURRENT_USER\M6X\shell\
open

HKEY_CURRENT_USER\M6X\shell\
open\command

HKEY_CURRENT_USER\M6X\shell\
runas

HKEY_CURRENT_USER\M6X\shell\
runas\command

HKEY_CURRENT_USER\atn

HKEY_CURRENT_USER\atn\DefaultIcon

HKEY_CURRENT_USER\atn\shell

HKEY_CURRENT_USER\atn\shell\
open

HKEY_CURRENT_USER\atn\shell\
open\command

HKEY_CURRENT_USER\atn\shell\
runas

HKEY_CURRENT_USER\atn\shell\
runas\command

HKEY_CURRENT_USER\lWb

HKEY_CURRENT_USER\lWb\DefaultIcon

HKEY_CURRENT_USER\lWb\shell

HKEY_CURRENT_USER\lWb\shell\
open

HKEY_CURRENT_USER\lWb\shell\
open\command

HKEY_CURRENT_USER\lWb\shell\
runas

HKEY_CURRENT_USER\lWb\shell\
runas\command

HKEY_CURRENT_USER\QP

HKEY_CURRENT_USER\QP\DefaultIcon

HKEY_CURRENT_USER\QP\shell

HKEY_CURRENT_USER\QP\shell\
open

HKEY_CURRENT_USER\QP\shell\
open\command

HKEY_CURRENT_USER\QP\shell\
runas

HKEY_CURRENT_USER\QP\shell\
runas\command

HKEY_CURRENT_USER\le

HKEY_CURRENT_USER\le\DefaultIcon

HKEY_CURRENT_USER\le\shell

HKEY_CURRENT_USER\le\shell\
open

HKEY_CURRENT_USER\le\shell\
open\command

HKEY_CURRENT_USER\le\shell\
runas

HKEY_CURRENT_USER\le\shell\
runas\command

HKEY_CURRENT_USER\35

HKEY_CURRENT_USER\35\DefaultIcon

HKEY_CURRENT_USER\35\shell

HKEY_CURRENT_USER\35\shell\
open

HKEY_CURRENT_USER\35\shell\
open\command

HKEY_CURRENT_USER\35\shell\
runas

HKEY_CURRENT_USER\35\shell\
runas\command

HKEY_CURRENT_USER\36

HKEY_CURRENT_USER\36\DefaultIcon

HKEY_CURRENT_USER\36\shell

HKEY_CURRENT_USER\36\shell\
open

HKEY_CURRENT_USER\36\shell\
open\command

HKEY_CURRENT_USER\36\shell\
runas

HKEY_CURRENT_USER\36\shell\
runas\command

HKEY_CURRENT_USER\ja

HKEY_CURRENT_USER\ja\DefaultIcon

HKEY_CURRENT_USER\ja\shell

HKEY_CURRENT_USER\ja\shell\
open

HKEY_CURRENT_USER\ja\shell\
open\command

HKEY_CURRENT_USER\ja\shell\
runas

HKEY_CURRENT_USER\ja\shell\
runas\command

HKEY_CURRENT_USER\1T1

HKEY_CURRENT_USER\1T1\DefaultIcon

HKEY_CURRENT_USER\1T1\shell

HKEY_CURRENT_USER\1T1\shell\
open

HKEY_CURRENT_USER\1T1\shell\
open\command

HKEY_CURRENT_USER\1T1\shell\
runas

HKEY_CURRENT_USER\1T1\shell\
runas\command

HKEY_CURRENT_USER\l6

HKEY_CURRENT_USER\l6\DefaultIcon

HKEY_CURRENT_USER\l6\shell

HKEY_CURRENT_USER\l6\shell\
open

HKEY_CURRENT_USER\l6\shell\
open\command

HKEY_CURRENT_USER\l6\shell\
runas

HKEY_CURRENT_USER\l6\shell\
runas\command

HKEY_CURRENT_USER\WEd

HKEY_CURRENT_USER\WEd\DefaultIcon

HKEY_CURRENT_USER\WEd\shell

HKEY_CURRENT_USER\WEd\shell\
open

HKEY_CURRENT_USER\WEd\shell\
open\command

HKEY_CURRENT_USER\WEd\shell\
runas

HKEY_CURRENT_USER\WEd\shell\
runas\command

HKEY_CURRENT_USER\86Q

HKEY_CURRENT_USER\86Q\DefaultIcon

HKEY_CURRENT_USER\86Q\shell

HKEY_CURRENT_USER\86Q\shell\
open

HKEY_CURRENT_USER\86Q\shell\
open\command

HKEY_CURRENT_USER\86Q\shell\
runas

HKEY_CURRENT_USER\86Q\shell\
runas\command

HKEY_CURRENT_USER\TM

HKEY_CURRENT_USER\TM\DefaultIcon

HKEY_CURRENT_USER\TM\shell

HKEY_CURRENT_USER\TM\shell\
open

HKEY_CURRENT_USER\TM\shell\
open\command

HKEY_CURRENT_USER\TM\shell\
runas

HKEY_CURRENT_USER\TM\shell\
runas\command

HKEY_CURRENT_USER\rI

HKEY_CURRENT_USER\rI\DefaultIcon

HKEY_CURRENT_USER\rI\shell

HKEY_CURRENT_USER\rI\shell\
open

HKEY_CURRENT_USER\rI\shell\
open\command

HKEY_CURRENT_USER\rI\shell\
runas

HKEY_CURRENT_USER\rI\shell\
runas\command

HKEY_CURRENT_USER\gss

HKEY_CURRENT_USER\gss\DefaultIcon

HKEY_CURRENT_USER\gss\shell

HKEY_CURRENT_USER\gss\shell\
open

HKEY_CURRENT_USER\gss\shell\
open\command

HKEY_CURRENT_USER\gss\shell\
runas

HKEY_CURRENT_USER\gss\shell\
runas\command

HKEY_CURRENT_USER\wf

HKEY_CURRENT_USER\wf\DefaultIcon

HKEY_CURRENT_USER\wf\shell

HKEY_CURRENT_USER\wf\shell\
open

HKEY_CURRENT_USER\wf\shell\
open\command

HKEY_CURRENT_USER\wf\shell\
runas

HKEY_CURRENT_USER\wf\shell\
runas\command

HKEY_CURRENT_USER\1V

HKEY_CURRENT_USER\1V\DefaultIcon

HKEY_CURRENT_USER\1V\shell

HKEY_CURRENT_USER\1V\shell\
open

HKEY_CURRENT_USER\1V\shell\
open\command

HKEY_CURRENT_USER\1V\shell\
runas

HKEY_CURRENT_USER\1V\shell\
runas\command

HKEY_CURRENT_USER\6G5

HKEY_CURRENT_USER\6G5\DefaultIcon

HKEY_CURRENT_USER\6G5\shell

HKEY_CURRENT_USER\6G5\shell\
open

HKEY_CURRENT_USER\6G5\shell\
open\command

HKEY_CURRENT_USER\6G5\shell\
runas

HKEY_CURRENT_USER\6G5\shell\
runas\command

HKEY_CURRENT_USER\15c

HKEY_CURRENT_USER\15c\DefaultIcon

HKEY_CURRENT_USER\15c\shell

HKEY_CURRENT_USER\15c\shell\
open

HKEY_CURRENT_USER\15c\shell\
open\command

HKEY_CURRENT_USER\15c\shell\
runas

HKEY_CURRENT_USER\15c\shell\
runas\command

HKEY_CURRENT_USER\I28

HKEY_CURRENT_USER\I28\DefaultIcon

HKEY_CURRENT_USER\I28\shell

HKEY_CURRENT_USER\I28\shell\
open

HKEY_CURRENT_USER\I28\shell\
open\command

HKEY_CURRENT_USER\I28\shell\
runas

HKEY_CURRENT_USER\I28\shell\
runas\command

HKEY_CURRENT_USER\LH

HKEY_CURRENT_USER\LH\DefaultIcon

HKEY_CURRENT_USER\LH\shell

HKEY_CURRENT_USER\LH\shell\
open

HKEY_CURRENT_USER\LH\shell\
open\command

HKEY_CURRENT_USER\LH\shell\
runas

HKEY_CURRENT_USER\LH\shell\
runas\command

HKEY_CURRENT_USER\Kf5

HKEY_CURRENT_USER\Kf5\DefaultIcon

HKEY_CURRENT_USER\Kf5\shell

HKEY_CURRENT_USER\Kf5\shell\
open

HKEY_CURRENT_USER\Kf5\shell\
open\command

HKEY_CURRENT_USER\Kf5\shell\
runas

HKEY_CURRENT_USER\Kf5\shell\
runas\command

HKEY_CURRENT_USER\Wy

HKEY_CURRENT_USER\Wy\DefaultIcon

HKEY_CURRENT_USER\Wy\shell

HKEY_CURRENT_USER\Wy\shell\
open

HKEY_CURRENT_USER\Wy\shell\
open\command

HKEY_CURRENT_USER\Wy\shell\
runas

HKEY_CURRENT_USER\Wy\shell\
runas\command

HKEY_CURRENT_USER\72

HKEY_CURRENT_USER\72\DefaultIcon

HKEY_CURRENT_USER\72\shell

HKEY_CURRENT_USER\72\shell\
open

HKEY_CURRENT_USER\72\shell\
open\command

HKEY_CURRENT_USER\72\shell\
runas

HKEY_CURRENT_USER\72\shell\
runas\command

HKEY_CURRENT_USER\Y1c

HKEY_CURRENT_USER\Y1c\DefaultIcon

HKEY_CURRENT_USER\Y1c\shell

HKEY_CURRENT_USER\Y1c\shell\
open

HKEY_CURRENT_USER\Y1c\shell\
open\command

HKEY_CURRENT_USER\Y1c\shell\
runas

HKEY_CURRENT_USER\Y1c\shell\
runas\command

HKEY_CURRENT_USER\ct

HKEY_CURRENT_USER\ct\DefaultIcon

HKEY_CURRENT_USER\ct\shell

HKEY_CURRENT_USER\ct\shell\
open

HKEY_CURRENT_USER\ct\shell\
open\command

HKEY_CURRENT_USER\ct\shell\
runas

HKEY_CURRENT_USER\ct\shell\
runas\command

HKEY_CURRENT_USER\rxa

HKEY_CURRENT_USER\rxa\DefaultIcon

HKEY_CURRENT_USER\rxa\shell

HKEY_CURRENT_USER\rxa\shell\
open

HKEY_CURRENT_USER\rxa\shell\
open\command

HKEY_CURRENT_USER\rxa\shell\
runas

HKEY_CURRENT_USER\rxa\shell\
runas\command

HKEY_CURRENT_USER\U88

HKEY_CURRENT_USER\U88\DefaultIcon

HKEY_CURRENT_USER\U88\shell

HKEY_CURRENT_USER\U88\shell\
open

HKEY_CURRENT_USER\U88\shell\
open\command

HKEY_CURRENT_USER\U88\shell\
runas

HKEY_CURRENT_USER\U88\shell\
runas\command

HKEY_CURRENT_USER\jY

HKEY_CURRENT_USER\jY\DefaultIcon

HKEY_CURRENT_USER\jY\shell

HKEY_CURRENT_USER\jY\shell\
open

HKEY_CURRENT_USER\jY\shell\
open\command

HKEY_CURRENT_USER\jY\shell\
runas

HKEY_CURRENT_USER\jY\shell\
runas\command

HKEY_CURRENT_USER\1x

HKEY_CURRENT_USER\1x\DefaultIcon

HKEY_CURRENT_USER\1x\shell

HKEY_CURRENT_USER\1x\shell\
open

HKEY_CURRENT_USER\1x\shell\
open\command

HKEY_CURRENT_USER\1x\shell\
runas

HKEY_CURRENT_USER\1x\shell\
runas\command

HKEY_CURRENT_USER\gg

HKEY_CURRENT_USER\gg\DefaultIcon

HKEY_CURRENT_USER\gg\shell

HKEY_CURRENT_USER\gg\shell\
open

HKEY_CURRENT_USER\gg\shell\
open\command

HKEY_CURRENT_USER\gg\shell\
runas

HKEY_CURRENT_USER\gg\shell\
runas\command

HKEY_CURRENT_USER\gx

HKEY_CURRENT_USER\gx\DefaultIcon

HKEY_CURRENT_USER\gx\shell

HKEY_CURRENT_USER\gx\shell\
open

HKEY_CURRENT_USER\gx\shell\
open\command

HKEY_CURRENT_USER\gx\shell\
runas

HKEY_CURRENT_USER\gx\shell\
runas\command

HKEY_CURRENT_USER\lh5

HKEY_CURRENT_USER\lh5\DefaultIcon

HKEY_CURRENT_USER\lh5\shell

HKEY_CURRENT_USER\lh5\shell\
open

HKEY_CURRENT_USER\lh5\shell\
open\command

HKEY_CURRENT_USER\lh5\shell\
runas

HKEY_CURRENT_USER\lh5\shell\
runas\command

HKEY_CURRENT_USER\Rp

HKEY_CURRENT_USER\Rp\DefaultIcon

HKEY_CURRENT_USER\Rp\shell

HKEY_CURRENT_USER\Rp\shell\
open

HKEY_CURRENT_USER\Rp\shell\
open\command

HKEY_CURRENT_USER\Rp\shell\
runas

HKEY_CURRENT_USER\Rp\shell\
runas\command

HKEY_CURRENT_USER\3b

HKEY_CURRENT_USER\3b\DefaultIcon

HKEY_CURRENT_USER\3b\shell

HKEY_CURRENT_USER\3b\shell\
open

HKEY_CURRENT_USER\3b\shell\
open\command

HKEY_CURRENT_USER\3b\shell\
runas

HKEY_CURRENT_USER\3b\shell\
runas\command

HKEY_CURRENT_USER\wyp

HKEY_CURRENT_USER\wyp\DefaultIcon

HKEY_CURRENT_USER\wyp\shell

HKEY_CURRENT_USER\wyp\shell\
open

HKEY_CURRENT_USER\wyp\shell\
open\command

HKEY_CURRENT_USER\wyp\shell\
runas

HKEY_CURRENT_USER\wyp\shell\
runas\command

HKEY_CURRENT_USER\Pv

HKEY_CURRENT_USER\Pv\DefaultIcon

HKEY_CURRENT_USER\Pv\shell

HKEY_CURRENT_USER\Pv\shell\
open

HKEY_CURRENT_USER\Pv\shell\
open\command

HKEY_CURRENT_USER\Pv\shell\
runas

HKEY_CURRENT_USER\Pv\shell\
runas\command

HKEY_CURRENT_USER\JEy

HKEY_CURRENT_USER\JEy\DefaultIcon

HKEY_CURRENT_USER\JEy\shell

HKEY_CURRENT_USER\JEy\shell\
open

HKEY_CURRENT_USER\JEy\shell\
open\command

HKEY_CURRENT_USER\JEy\shell\
runas

HKEY_CURRENT_USER\JEy\shell\
runas\command

HKEY_CURRENT_USER\6oX

HKEY_CURRENT_USER\6oX\DefaultIcon

HKEY_CURRENT_USER\6oX\shell

HKEY_CURRENT_USER\6oX\shell\
open

HKEY_CURRENT_USER\6oX\shell\
open\command

HKEY_CURRENT_USER\6oX\shell\
runas

HKEY_CURRENT_USER\6oX\shell\
runas\command

HKEY_CURRENT_USER\QO1

HKEY_CURRENT_USER\QO1\DefaultIcon

HKEY_CURRENT_USER\QO1\shell

HKEY_CURRENT_USER\QO1\shell\
open

HKEY_CURRENT_USER\QO1\shell\
open\command

HKEY_CURRENT_USER\QO1\shell\
runas

HKEY_CURRENT_USER\QO1\shell\
runas\command

HKEY_CURRENT_USER\chF

HKEY_CURRENT_USER\chF\DefaultIcon

HKEY_CURRENT_USER\chF\shell

HKEY_CURRENT_USER\chF\shell\
open

HKEY_CURRENT_USER\chF\shell\
open\command

HKEY_CURRENT_USER\chF\shell\
runas

HKEY_CURRENT_USER\chF\shell\
runas\command

HKEY_CURRENT_USER\6R

HKEY_CURRENT_USER\6R\DefaultIcon

HKEY_CURRENT_USER\6R\shell

HKEY_CURRENT_USER\6R\shell\
open

HKEY_CURRENT_USER\6R\shell\
open\command

HKEY_CURRENT_USER\6R\shell\
runas

HKEY_CURRENT_USER\6R\shell\
runas\command

HKEY_CURRENT_USER\6w

HKEY_CURRENT_USER\6w\DefaultIcon

HKEY_CURRENT_USER\6w\shell

HKEY_CURRENT_USER\6w\shell\
open

HKEY_CURRENT_USER\6w\shell\
open\command

HKEY_CURRENT_USER\6w\shell\
runas

HKEY_CURRENT_USER\6w\shell\
runas\command

HKEY_CURRENT_USER\cl

HKEY_CURRENT_USER\cl\DefaultIcon

HKEY_CURRENT_USER\cl\shell

HKEY_CURRENT_USER\cl\shell\
open

HKEY_CURRENT_USER\cl\shell\
open\command

HKEY_CURRENT_USER\cl\shell\
runas

HKEY_CURRENT_USER\cl\shell\
runas\command

HKEY_CURRENT_USER\38

HKEY_CURRENT_USER\38\DefaultIcon

HKEY_CURRENT_USER\38\shell

HKEY_CURRENT_USER\38\shell\
open

HKEY_CURRENT_USER\38\shell\
open\command

HKEY_CURRENT_USER\38\shell\
runas

HKEY_CURRENT_USER\38\shell\
runas\command

HKEY_CURRENT_USER\55L

HKEY_CURRENT_USER\55L\DefaultIcon

HKEY_CURRENT_USER\55L\shell

HKEY_CURRENT_USER\55L\shell\
open

HKEY_CURRENT_USER\55L\shell\
open\command

HKEY_CURRENT_USER\55L\shell\
runas

HKEY_CURRENT_USER\55L\shell\
runas\command

HKEY_CURRENT_USER\08

HKEY_CURRENT_USER\08\DefaultIcon

HKEY_CURRENT_USER\08\shell

HKEY_CURRENT_USER\08\shell\
open

HKEY_CURRENT_USER\08\shell\
open\command

HKEY_CURRENT_USER\08\shell\
runas

HKEY_CURRENT_USER\08\shell\
runas\command

HKEY_CURRENT_USER\70

HKEY_CURRENT_USER\70\DefaultIcon

HKEY_CURRENT_USER\70\shell

HKEY_CURRENT_USER\70\shell\
open

HKEY_CURRENT_USER\70\shell\
open\command

HKEY_CURRENT_USER\70\shell\
runas

HKEY_CURRENT_USER\70\shell\
runas\command

HKEY_CURRENT_USER\624

HKEY_CURRENT_USER\624\DefaultIcon

HKEY_CURRENT_USER\624\shell

HKEY_CURRENT_USER\624\shell\
open

HKEY_CURRENT_USER\624\shell\
open\command

HKEY_CURRENT_USER\624\shell\
runas

HKEY_CURRENT_USER\624\shell\
runas\command

HKEY_CURRENT_USER\Cbd

HKEY_CURRENT_USER\Cbd\DefaultIcon

HKEY_CURRENT_USER\Cbd\shell

HKEY_CURRENT_USER\Cbd\shell\
open

HKEY_CURRENT_USER\Cbd\shell\
open\command

HKEY_CURRENT_USER\Cbd\shell\
runas

HKEY_CURRENT_USER\Cbd\shell\
runas\command

HKEY_CURRENT_USER\O1

HKEY_CURRENT_USER\O1\DefaultIcon

HKEY_CURRENT_USER\O1\shell

HKEY_CURRENT_USER\O1\shell\
open

HKEY_CURRENT_USER\O1\shell\
open\command

HKEY_CURRENT_USER\O1\shell\
runas

HKEY_CURRENT_USER\O1\shell\
runas\command

HKEY_CURRENT_USER\IA

HKEY_CURRENT_USER\IA\DefaultIcon

HKEY_CURRENT_USER\IA\shell

HKEY_CURRENT_USER\IA\shell\
open

HKEY_CURRENT_USER\IA\shell\
open\command

HKEY_CURRENT_USER\IA\shell\
runas

HKEY_CURRENT_USER\IA\shell\
runas\command

HKEY_CURRENT_USER\0At

HKEY_CURRENT_USER\0At\DefaultIcon

HKEY_CURRENT_USER\0At\shell

HKEY_CURRENT_USER\0At\shell\
open

HKEY_CURRENT_USER\0At\shell\
open\command

HKEY_CURRENT_USER\0At\shell\
runas

HKEY_CURRENT_USER\0At\shell\
runas\command

HKEY_CURRENT_USER\b4W

HKEY_CURRENT_USER\b4W\DefaultIcon

HKEY_CURRENT_USER\b4W\shell

HKEY_CURRENT_USER\b4W\shell\
open

HKEY_CURRENT_USER\b4W\shell\
open\command

HKEY_CURRENT_USER\b4W\shell\
runas

HKEY_CURRENT_USER\b4W\shell\
runas\command

HKEY_CURRENT_USER\5BF

HKEY_CURRENT_USER\5BF\DefaultIcon

HKEY_CURRENT_USER\5BF\shell

HKEY_CURRENT_USER\5BF\shell\
open

HKEY_CURRENT_USER\5BF\shell\
open\command

HKEY_CURRENT_USER\5BF\shell\
runas

HKEY_CURRENT_USER\5BF\shell\
runas\command

HKEY_CURRENT_USER\pK

HKEY_CURRENT_USER\pK\DefaultIcon

HKEY_CURRENT_USER\pK\shell

HKEY_CURRENT_USER\pK\shell\
open

HKEY_CURRENT_USER\pK\shell\
open\command

HKEY_CURRENT_USER\pK\shell\
runas

HKEY_CURRENT_USER\pK\shell\
runas\command

HKEY_CURRENT_USER\50g

HKEY_CURRENT_USER\50g\DefaultIcon

HKEY_CURRENT_USER\50g\shell

HKEY_CURRENT_USER\50g\shell\
open

HKEY_CURRENT_USER\50g\shell\
open\command

HKEY_CURRENT_USER\50g\shell\
runas

HKEY_CURRENT_USER\50g\shell\
runas\command

HKEY_CURRENT_USER\JG

HKEY_CURRENT_USER\JG\DefaultIcon

HKEY_CURRENT_USER\JG\shell

HKEY_CURRENT_USER\JG\shell\
open

HKEY_CURRENT_USER\JG\shell\
open\command

HKEY_CURRENT_USER\JG\shell\
runas

HKEY_CURRENT_USER\JG\shell\
runas\command

HKEY_CURRENT_USER\bg

HKEY_CURRENT_USER\bg\DefaultIcon

HKEY_CURRENT_USER\bg\shell

HKEY_CURRENT_USER\bg\shell\
open

HKEY_CURRENT_USER\bg\shell\
open\command

HKEY_CURRENT_USER\bg\shell\
runas

HKEY_CURRENT_USER\bg\shell\
runas\command

HKEY_CURRENT_USER\6Tb

HKEY_CURRENT_USER\6Tb\DefaultIcon

HKEY_CURRENT_USER\6Tb\shell

HKEY_CURRENT_USER\6Tb\shell\
open

HKEY_CURRENT_USER\6Tb\shell\
open\command

HKEY_CURRENT_USER\6Tb\shell\
runas

HKEY_CURRENT_USER\6Tb\shell\
runas\command

HKEY_CURRENT_USER\RP2

HKEY_CURRENT_USER\RP2\DefaultIcon

HKEY_CURRENT_USER\RP2\shell

HKEY_CURRENT_USER\RP2\shell\
open

HKEY_CURRENT_USER\RP2\shell\
open\command

HKEY_CURRENT_USER\RP2\shell\
runas

HKEY_CURRENT_USER\RP2\shell\
runas\command

HKEY_CURRENT_USER\V4w

HKEY_CURRENT_USER\V4w\DefaultIcon

HKEY_CURRENT_USER\V4w\shell

HKEY_CURRENT_USER\V4w\shell\
open

HKEY_CURRENT_USER\V4w\shell\
open\command

HKEY_CURRENT_USER\V4w\shell\
runas

HKEY_CURRENT_USER\V4w\shell\
runas\command

HKEY_CURRENT_USER\52Y

HKEY_CURRENT_USER\52Y\DefaultIcon

HKEY_CURRENT_USER\52Y\shell

HKEY_CURRENT_USER\52Y\shell\
open

HKEY_CURRENT_USER\52Y\shell\
open\command

HKEY_CURRENT_USER\52Y\shell\
runas

HKEY_CURRENT_USER\52Y\shell\
runas\command

HKEY_CURRENT_USER\8R

HKEY_CURRENT_USER\8R\DefaultIcon

HKEY_CURRENT_USER\8R\shell

HKEY_CURRENT_USER\8R\shell\
open

HKEY_CURRENT_USER\8R\shell\
open\command

HKEY_CURRENT_USER\8R\shell\
runas

HKEY_CURRENT_USER\8R\shell\
runas\command

HKEY_CURRENT_USER\Kgx

HKEY_CURRENT_USER\Kgx\DefaultIcon

HKEY_CURRENT_USER\Kgx\shell

HKEY_CURRENT_USER\Kgx\shell\
open

HKEY_CURRENT_USER\Kgx\shell\
open\command

HKEY_CURRENT_USER\Kgx\shell\
runas

HKEY_CURRENT_USER\Kgx\shell\
runas\command

HKEY_CURRENT_USER\HFB

HKEY_CURRENT_USER\HFB\DefaultIcon

HKEY_CURRENT_USER\HFB\shell

HKEY_CURRENT_USER\HFB\shell\
open

HKEY_CURRENT_USER\HFB\shell\
open\command

HKEY_CURRENT_USER\HFB\shell\
runas

HKEY_CURRENT_USER\HFB\shell\
runas\command

HKEY_CURRENT_USER\EX

HKEY_CURRENT_USER\EX\DefaultIcon

HKEY_CURRENT_USER\EX\shell

HKEY_CURRENT_USER\EX\shell\
open

HKEY_CURRENT_USER\EX\shell\
open\command

HKEY_CURRENT_USER\EX\shell\
runas

HKEY_CURRENT_USER\EX\shell\
runas\command

HKEY_CURRENT_USER\7vF

HKEY_CURRENT_USER\7vF\DefaultIcon

HKEY_CURRENT_USER\7vF\shell

HKEY_CURRENT_USER\7vF\shell\
open

HKEY_CURRENT_USER\7vF\shell\
open\command

HKEY_CURRENT_USER\7vF\shell\
runas

HKEY_CURRENT_USER\7vF\shell\
runas\command

HKEY_CURRENT_USER\Jvg

HKEY_CURRENT_USER\Jvg\DefaultIcon

HKEY_CURRENT_USER\Jvg\shell

HKEY_CURRENT_USER\Jvg\shell\
open

HKEY_CURRENT_USER\Jvg\shell\
open\command

HKEY_CURRENT_USER\Jvg\shell\
runas

HKEY_CURRENT_USER\Jvg\shell\
runas\command

HKEY_CURRENT_USER\0W

HKEY_CURRENT_USER\0W\DefaultIcon

HKEY_CURRENT_USER\0W\shell

HKEY_CURRENT_USER\0W\shell\
open

HKEY_CURRENT_USER\0W\shell\
open\command

HKEY_CURRENT_USER\0W\shell\
runas

HKEY_CURRENT_USER\0W\shell\
runas\command

HKEY_CURRENT_USER\V5

HKEY_CURRENT_USER\V5\DefaultIcon

HKEY_CURRENT_USER\V5\shell

HKEY_CURRENT_USER\V5\shell\
open

HKEY_CURRENT_USER\V5\shell\
open\command

HKEY_CURRENT_USER\V5\shell\
runas

HKEY_CURRENT_USER\V5\shell\
runas\command

HKEY_CURRENT_USER\vK4

HKEY_CURRENT_USER\vK4\DefaultIcon

HKEY_CURRENT_USER\vK4\shell

HKEY_CURRENT_USER\vK4\shell\
open

HKEY_CURRENT_USER\vK4\shell\
open\command

HKEY_CURRENT_USER\vK4\shell\
runas

HKEY_CURRENT_USER\vK4\shell\
runas\command

HKEY_CURRENT_USER\dJ

HKEY_CURRENT_USER\dJ\DefaultIcon

HKEY_CURRENT_USER\dJ\shell

HKEY_CURRENT_USER\dJ\shell\
open

HKEY_CURRENT_USER\dJ\shell\
open\command

HKEY_CURRENT_USER\dJ\shell\
runas

HKEY_CURRENT_USER\dJ\shell\
runas\command

HKEY_CURRENT_USER\558

HKEY_CURRENT_USER\558\DefaultIcon

HKEY_CURRENT_USER\558\shell

HKEY_CURRENT_USER\558\shell\
open

HKEY_CURRENT_USER\558\shell\
open\command

HKEY_CURRENT_USER\558\shell\
runas

HKEY_CURRENT_USER\558\shell\
runas\command

HKEY_CURRENT_USER\tq1

HKEY_CURRENT_USER\tq1\DefaultIcon

HKEY_CURRENT_USER\tq1\shell

HKEY_CURRENT_USER\tq1\shell\
open

HKEY_CURRENT_USER\tq1\shell\
open\command

HKEY_CURRENT_USER\tq1\shell\
runas

HKEY_CURRENT_USER\tq1\shell\
runas\command

HKEY_CURRENT_USER\tC8

HKEY_CURRENT_USER\tC8\DefaultIcon

HKEY_CURRENT_USER\tC8\shell

HKEY_CURRENT_USER\tC8\shell\
open

HKEY_CURRENT_USER\tC8\shell\
open\command

HKEY_CURRENT_USER\tC8\shell\
runas

HKEY_CURRENT_USER\tC8\shell\
runas\command

HKEY_CURRENT_USER\SIr

HKEY_CURRENT_USER\SIr\DefaultIcon

HKEY_CURRENT_USER\SIr\shell

HKEY_CURRENT_USER\SIr\shell\
open

HKEY_CURRENT_USER\SIr\shell\
open\command

HKEY_CURRENT_USER\SIr\shell\
runas

HKEY_CURRENT_USER\SIr\shell\
runas\command

HKEY_CURRENT_USER\rj6

HKEY_CURRENT_USER\rj6\DefaultIcon

HKEY_CURRENT_USER\rj6\shell

HKEY_CURRENT_USER\rj6\shell\
open

HKEY_CURRENT_USER\rj6\shell\
open\command

HKEY_CURRENT_USER\rj6\shell\
runas

HKEY_CURRENT_USER\rj6\shell\
runas\command

HKEY_CURRENT_USER\uhs

HKEY_CURRENT_USER\uhs\DefaultIcon

HKEY_CURRENT_USER\uhs\shell

HKEY_CURRENT_USER\uhs\shell\
open

HKEY_CURRENT_USER\uhs\shell\
open\command

HKEY_CURRENT_USER\uhs\shell\
runas

HKEY_CURRENT_USER\uhs\shell\
runas\command

HKEY_CURRENT_USER\11

HKEY_CURRENT_USER\11\DefaultIcon

HKEY_CURRENT_USER\11\shell

HKEY_CURRENT_USER\11\shell\
open

HKEY_CURRENT_USER\11\shell\
open\command

HKEY_CURRENT_USER\11\shell\
runas

HKEY_CURRENT_USER\11\shell\
runas\command

HKEY_CURRENT_USER\4TD

HKEY_CURRENT_USER\4TD\DefaultIcon

HKEY_CURRENT_USER\4TD\shell

HKEY_CURRENT_USER\4TD\shell\
open

HKEY_CURRENT_USER\4TD\shell\
open\command

HKEY_CURRENT_USER\4TD\shell\
runas

HKEY_CURRENT_USER\4TD\shell\
runas\command

HKEY_CURRENT_USER\T8

HKEY_CURRENT_USER\T8\DefaultIcon

HKEY_CURRENT_USER\T8\shell

HKEY_CURRENT_USER\T8\shell\
open

HKEY_CURRENT_USER\T8\shell\
open\command

HKEY_CURRENT_USER\T8\shell\
runas

HKEY_CURRENT_USER\T8\shell\
runas\command

HKEY_CURRENT_USER\oeP

HKEY_CURRENT_USER\oeP\DefaultIcon

HKEY_CURRENT_USER\oeP\shell

HKEY_CURRENT_USER\oeP\shell\
open

HKEY_CURRENT_USER\oeP\shell\
open\command

HKEY_CURRENT_USER\oeP\shell\
runas

HKEY_CURRENT_USER\oeP\shell\
runas\command

HKEY_CURRENT_USER\Xtj

HKEY_CURRENT_USER\Xtj\DefaultIcon

HKEY_CURRENT_USER\Xtj\shell

HKEY_CURRENT_USER\Xtj\shell\
open

HKEY_CURRENT_USER\Xtj\shell\
open\command

HKEY_CURRENT_USER\Xtj\shell\
runas

HKEY_CURRENT_USER\Xtj\shell\
runas\command

HKEY_CURRENT_USER\s1

HKEY_CURRENT_USER\s1\DefaultIcon

HKEY_CURRENT_USER\s1\shell

HKEY_CURRENT_USER\s1\shell\
open

HKEY_CURRENT_USER\s1\shell\
open\command

HKEY_CURRENT_USER\s1\shell\
runas

HKEY_CURRENT_USER\s1\shell\
runas\command

HKEY_CURRENT_USER\42R

HKEY_CURRENT_USER\42R\DefaultIcon

HKEY_CURRENT_USER\42R\shell

HKEY_CURRENT_USER\42R\shell\
open

HKEY_CURRENT_USER\42R\shell\
open\command

HKEY_CURRENT_USER\42R\shell\
runas

HKEY_CURRENT_USER\42R\shell\
runas\command

HKEY_CURRENT_USER\L1p

HKEY_CURRENT_USER\L1p\DefaultIcon

HKEY_CURRENT_USER\L1p\shell

HKEY_CURRENT_USER\L1p\shell\
open

HKEY_CURRENT_USER\L1p\shell\
open\command

HKEY_CURRENT_USER\L1p\shell\
runas

HKEY_CURRENT_USER\L1p\shell\
runas\command

HKEY_CURRENT_USER\t3

HKEY_CURRENT_USER\t3\DefaultIcon

HKEY_CURRENT_USER\t3\shell

HKEY_CURRENT_USER\t3\shell\
open

HKEY_CURRENT_USER\t3\shell\
open\command

HKEY_CURRENT_USER\t3\shell\
runas

HKEY_CURRENT_USER\t3\shell\
runas\command

HKEY_CURRENT_USER\85L

HKEY_CURRENT_USER\85L\DefaultIcon

HKEY_CURRENT_USER\85L\shell

HKEY_CURRENT_USER\85L\shell\
open

HKEY_CURRENT_USER\85L\shell\
open\command

HKEY_CURRENT_USER\85L\shell\
runas

HKEY_CURRENT_USER\85L\shell\
runas\command

HKEY_CURRENT_USER\jk

HKEY_CURRENT_USER\jk\DefaultIcon

HKEY_CURRENT_USER\jk\shell

HKEY_CURRENT_USER\jk\shell\
open

HKEY_CURRENT_USER\jk\shell\
open\command

HKEY_CURRENT_USER\jk\shell\
runas

HKEY_CURRENT_USER\jk\shell\
runas\command

HKEY_CURRENT_USER\1oX

HKEY_CURRENT_USER\1oX\DefaultIcon

HKEY_CURRENT_USER\1oX\shell

HKEY_CURRENT_USER\1oX\shell\
open

HKEY_CURRENT_USER\1oX\shell\
open\command

HKEY_CURRENT_USER\1oX\shell\
runas

HKEY_CURRENT_USER\1oX\shell\
runas\command

HKEY_CURRENT_USER\547

HKEY_CURRENT_USER\547\DefaultIcon

HKEY_CURRENT_USER\547\shell

HKEY_CURRENT_USER\547\shell\
open

HKEY_CURRENT_USER\547\shell\
open\command

HKEY_CURRENT_USER\547\shell\
runas

HKEY_CURRENT_USER\547\shell\
runas\command

HKEY_CURRENT_USER\18Y

HKEY_CURRENT_USER\18Y\DefaultIcon

HKEY_CURRENT_USER\18Y\shell

HKEY_CURRENT_USER\18Y\shell\
open

HKEY_CURRENT_USER\18Y\shell\
open\command

HKEY_CURRENT_USER\18Y\shell\
runas

HKEY_CURRENT_USER\18Y\shell\
runas\command

HKEY_CURRENT_USER\AiX

HKEY_CURRENT_USER\AiX\DefaultIcon

HKEY_CURRENT_USER\AiX\shell

HKEY_CURRENT_USER\AiX\shell\
open

HKEY_CURRENT_USER\AiX\shell\
open\command

HKEY_CURRENT_USER\AiX\shell\
runas

HKEY_CURRENT_USER\AiX\shell\
runas\command

HKEY_CURRENT_USER\7C3

HKEY_CURRENT_USER\7C3\DefaultIcon

HKEY_CURRENT_USER\7C3\shell

HKEY_CURRENT_USER\7C3\shell\
open

HKEY_CURRENT_USER\7C3\shell\
open\command

HKEY_CURRENT_USER\7C3\shell\
runas

HKEY_CURRENT_USER\7C3\shell\
runas\command

HKEY_CURRENT_USER\V3G

HKEY_CURRENT_USER\V3G\DefaultIcon

HKEY_CURRENT_USER\V3G\shell

HKEY_CURRENT_USER\V3G\shell\
open

HKEY_CURRENT_USER\V3G\shell\
open\command

HKEY_CURRENT_USER\V3G\shell\
runas

HKEY_CURRENT_USER\V3G\shell\
runas\command

HKEY_CURRENT_USER\b63

HKEY_CURRENT_USER\b63\DefaultIcon

HKEY_CURRENT_USER\b63\shell

HKEY_CURRENT_USER\b63\shell\
open

HKEY_CURRENT_USER\b63\shell\
open\command

HKEY_CURRENT_USER\b63\shell\
runas

HKEY_CURRENT_USER\b63\shell\
runas\command

HKEY_CURRENT_USER\TY5

HKEY_CURRENT_USER\TY5\DefaultIcon

HKEY_CURRENT_USER\TY5\shell

HKEY_CURRENT_USER\TY5\shell\
open

HKEY_CURRENT_USER\TY5\shell\
open\command

HKEY_CURRENT_USER\TY5\shell\
runas

HKEY_CURRENT_USER\TY5\shell\
runas\command

HKEY_CURRENT_USER\48q

HKEY_CURRENT_USER\48q\DefaultIcon

HKEY_CURRENT_USER\48q\shell

HKEY_CURRENT_USER\48q\shell\
open

HKEY_CURRENT_USER\48q\shell\
open\command

HKEY_CURRENT_USER\48q\shell\
runas

HKEY_CURRENT_USER\48q\shell\
runas\command

HKEY_CURRENT_USER\Xe

HKEY_CURRENT_USER\Xe\DefaultIcon

HKEY_CURRENT_USER\Xe\shell

HKEY_CURRENT_USER\Xe\shell\
open

HKEY_CURRENT_USER\Xe\shell\
open\command

HKEY_CURRENT_USER\Xe\shell\
runas

HKEY_CURRENT_USER\Xe\shell\
runas\command

HKEY_CURRENT_USER\Wc

HKEY_CURRENT_USER\Wc\DefaultIcon

HKEY_CURRENT_USER\Wc\shell

HKEY_CURRENT_USER\Wc\shell\
open

HKEY_CURRENT_USER\Wc\shell\
open\command

HKEY_CURRENT_USER\Wc\shell\
runas

HKEY_CURRENT_USER\Wc\shell\
runas\command

HKEY_CURRENT_USER\7n

HKEY_CURRENT_USER\7n\DefaultIcon

HKEY_CURRENT_USER\7n\shell

HKEY_CURRENT_USER\7n\shell\
open

HKEY_CURRENT_USER\7n\shell\
open\command

HKEY_CURRENT_USER\7n\shell\
runas

HKEY_CURRENT_USER\7n\shell\
runas\command

HKEY_CURRENT_USER\I2

HKEY_CURRENT_USER\I2\DefaultIcon

HKEY_CURRENT_USER\I2\shell

HKEY_CURRENT_USER\I2\shell\
open

HKEY_CURRENT_USER\I2\shell\
open\command

HKEY_CURRENT_USER\I2\shell\
runas

HKEY_CURRENT_USER\I2\shell\
runas\command

HKEY_CURRENT_USER\G0

HKEY_CURRENT_USER\G0\DefaultIcon

HKEY_CURRENT_USER\G0\shell

HKEY_CURRENT_USER\G0\shell\
open

HKEY_CURRENT_USER\G0\shell\
open\command

HKEY_CURRENT_USER\G0\shell\
runas

HKEY_CURRENT_USER\G0\shell\
runas\command

HKEY_CURRENT_USER\87

HKEY_CURRENT_USER\87\DefaultIcon

HKEY_CURRENT_USER\87\shell

HKEY_CURRENT_USER\87\shell\
open

HKEY_CURRENT_USER\87\shell\
open\command

HKEY_CURRENT_USER\87\shell\
runas

HKEY_CURRENT_USER\87\shell\
runas\command

HKEY_CURRENT_USER\686

HKEY_CURRENT_USER\686\DefaultIcon

HKEY_CURRENT_USER\686\shell

HKEY_CURRENT_USER\686\shell\
open

HKEY_CURRENT_USER\686\shell\
open\command

HKEY_CURRENT_USER\686\shell\
runas

HKEY_CURRENT_USER\686\shell\
runas\command

HKEY_CURRENT_USER\wJ4

HKEY_CURRENT_USER\wJ4\DefaultIcon

HKEY_CURRENT_USER\wJ4\shell

HKEY_CURRENT_USER\wJ4\shell\
open

HKEY_CURRENT_USER\wJ4\shell\
open\command

HKEY_CURRENT_USER\wJ4\shell\
runas

HKEY_CURRENT_USER\wJ4\shell\
runas\command

HKEY_CURRENT_USER\08l

HKEY_CURRENT_USER\08l\DefaultIcon

HKEY_CURRENT_USER\08l\shell

HKEY_CURRENT_USER\08l\shell\
open

HKEY_CURRENT_USER\08l\shell\
open\command

HKEY_CURRENT_USER\08l\shell\
runas

HKEY_CURRENT_USER\08l\shell\
runas\command

HKEY_CURRENT_USER\et

HKEY_CURRENT_USER\et\DefaultIcon

HKEY_CURRENT_USER\et\shell

HKEY_CURRENT_USER\et\shell\
open

HKEY_CURRENT_USER\et\shell\
open\command

HKEY_CURRENT_USER\et\shell\
runas

HKEY_CURRENT_USER\et\shell\
runas\command

HKEY_CURRENT_USER\qc

HKEY_CURRENT_USER\qc\DefaultIcon

HKEY_CURRENT_USER\qc\shell

HKEY_CURRENT_USER\qc\shell\
open

HKEY_CURRENT_USER\qc\shell\
open\command

HKEY_CURRENT_USER\qc\shell\
runas

HKEY_CURRENT_USER\qc\shell\
runas\command

HKEY_CURRENT_USER\KT

HKEY_CURRENT_USER\KT\DefaultIcon

HKEY_CURRENT_USER\KT\shell

HKEY_CURRENT_USER\KT\shell\
open

HKEY_CURRENT_USER\KT\shell\
open\command

HKEY_CURRENT_USER\KT\shell\
runas

HKEY_CURRENT_USER\KT\shell\
runas\command

HKEY_CURRENT_USER\yS

HKEY_CURRENT_USER\yS\DefaultIcon

HKEY_CURRENT_USER\yS\shell

HKEY_CURRENT_USER\yS\shell\
open

HKEY_CURRENT_USER\yS\shell\
open\command

HKEY_CURRENT_USER\yS\shell\
runas

HKEY_CURRENT_USER\yS\shell\
runas\command

HKEY_CURRENT_USER\YrH

HKEY_CURRENT_USER\YrH\DefaultIcon

HKEY_CURRENT_USER\YrH\shell

HKEY_CURRENT_USER\YrH\shell\
open

HKEY_CURRENT_USER\YrH\shell\
open\command

HKEY_CURRENT_USER\YrH\shell\
runas

HKEY_CURRENT_USER\YrH\shell\
runas\command

HKEY_CURRENT_USER\3Xa

HKEY_CURRENT_USER\3Xa\DefaultIcon

HKEY_CURRENT_USER\3Xa\shell

HKEY_CURRENT_USER\3Xa\shell\
open

HKEY_CURRENT_USER\3Xa\shell\
open\command

HKEY_CURRENT_USER\3Xa\shell\
runas

HKEY_CURRENT_USER\3Xa\shell\
runas\command

HKEY_CURRENT_USER\hI

HKEY_CURRENT_USER\hI\DefaultIcon

HKEY_CURRENT_USER\hI\shell

HKEY_CURRENT_USER\hI\shell\
open

HKEY_CURRENT_USER\hI\shell\
open\command

HKEY_CURRENT_USER\hI\shell\
runas

HKEY_CURRENT_USER\hI\shell\
runas\command

HKEY_CURRENT_USER\SCq

HKEY_CURRENT_USER\SCq\DefaultIcon

HKEY_CURRENT_USER\SCq\shell

HKEY_CURRENT_USER\SCq\shell\
open

HKEY_CURRENT_USER\SCq\shell\
open\command

HKEY_CURRENT_USER\SCq\shell\
runas

HKEY_CURRENT_USER\SCq\shell\
runas\command

HKEY_CURRENT_USER\im

HKEY_CURRENT_USER\im\DefaultIcon

HKEY_CURRENT_USER\im\shell

HKEY_CURRENT_USER\im\shell\
open

HKEY_CURRENT_USER\im\shell\
open\command

HKEY_CURRENT_USER\im\shell\
runas

HKEY_CURRENT_USER\im\shell\
runas\command

HKEY_CURRENT_USER\808

HKEY_CURRENT_USER\808\DefaultIcon

HKEY_CURRENT_USER\808\shell

HKEY_CURRENT_USER\808\shell\
open

HKEY_CURRENT_USER\808\shell\
open\command

HKEY_CURRENT_USER\808\shell\
runas

HKEY_CURRENT_USER\808\shell\
runas\command

HKEY_CURRENT_USER\67y

HKEY_CURRENT_USER\67y\DefaultIcon

HKEY_CURRENT_USER\67y\shell

HKEY_CURRENT_USER\67y\shell\
open

HKEY_CURRENT_USER\67y\shell\
open\command

HKEY_CURRENT_USER\67y\shell\
runas

HKEY_CURRENT_USER\67y\shell\
runas\command

HKEY_CURRENT_USER\cm

HKEY_CURRENT_USER\cm\DefaultIcon

HKEY_CURRENT_USER\cm\shell

HKEY_CURRENT_USER\cm\shell\
open

HKEY_CURRENT_USER\cm\shell\
open\command

HKEY_CURRENT_USER\cm\shell\
runas

HKEY_CURRENT_USER\cm\shell\
runas\command

HKEY_CURRENT_USER\Vrf

HKEY_CURRENT_USER\Vrf\DefaultIcon

HKEY_CURRENT_USER\Vrf\shell

HKEY_CURRENT_USER\Vrf\shell\
open

HKEY_CURRENT_USER\Vrf\shell\
open\command

HKEY_CURRENT_USER\Vrf\shell\
runas

HKEY_CURRENT_USER\Vrf\shell\
runas\command

HKEY_CURRENT_USER\u6R

HKEY_CURRENT_USER\u6R\DefaultIcon

HKEY_CURRENT_USER\u6R\shell

HKEY_CURRENT_USER\u6R\shell\
open

HKEY_CURRENT_USER\u6R\shell\
open\command

HKEY_CURRENT_USER\u6R\shell\
runas

HKEY_CURRENT_USER\u6R\shell\
runas\command

HKEY_CURRENT_USER\eEu

HKEY_CURRENT_USER\eEu\DefaultIcon

HKEY_CURRENT_USER\eEu\shell

HKEY_CURRENT_USER\eEu\shell\
open

HKEY_CURRENT_USER\eEu\shell\
open\command

HKEY_CURRENT_USER\eEu\shell\
runas

HKEY_CURRENT_USER\eEu\shell\
runas\command

HKEY_CURRENT_USER\1NS

HKEY_CURRENT_USER\1NS\DefaultIcon

HKEY_CURRENT_USER\1NS\shell

HKEY_CURRENT_USER\1NS\shell\
open

HKEY_CURRENT_USER\1NS\shell\
open\command

HKEY_CURRENT_USER\1NS\shell\
runas

HKEY_CURRENT_USER\1NS\shell\
runas\command

HKEY_CURRENT_USER\BNv

HKEY_CURRENT_USER\BNv\DefaultIcon

HKEY_CURRENT_USER\BNv\shell

HKEY_CURRENT_USER\BNv\shell\
open

HKEY_CURRENT_USER\BNv\shell\
open\command

HKEY_CURRENT_USER\BNv\shell\
runas

HKEY_CURRENT_USER\BNv\shell\
runas\command

HKEY_CURRENT_USER\7L

HKEY_CURRENT_USER\7L\DefaultIcon

HKEY_CURRENT_USER\7L\shell

HKEY_CURRENT_USER\7L\shell\
open

HKEY_CURRENT_USER\7L\shell\
open\command

HKEY_CURRENT_USER\7L\shell\
runas

HKEY_CURRENT_USER\7L\shell\
runas\command

HKEY_CURRENT_USER\Tu

HKEY_CURRENT_USER\Tu\DefaultIcon

HKEY_CURRENT_USER\Tu\shell

HKEY_CURRENT_USER\Tu\shell\
open

HKEY_CURRENT_USER\Tu\shell\
open\command

HKEY_CURRENT_USER\Tu\shell\
runas

HKEY_CURRENT_USER\Tu\shell\
runas\command

HKEY_CURRENT_USER\p7

HKEY_CURRENT_USER\p7\DefaultIcon

HKEY_CURRENT_USER\p7\shell

HKEY_CURRENT_USER\p7\shell\
open

HKEY_CURRENT_USER\p7\shell\
open\command

HKEY_CURRENT_USER\p7\shell\
runas

HKEY_CURRENT_USER\p7\shell\
runas\command

HKEY_CURRENT_USER\iSB

HKEY_CURRENT_USER\iSB\DefaultIcon

HKEY_CURRENT_USER\iSB\shell

HKEY_CURRENT_USER\iSB\shell\
open

HKEY_CURRENT_USER\iSB\shell\
open\command

HKEY_CURRENT_USER\iSB\shell\
runas

HKEY_CURRENT_USER\iSB\shell\
runas\command

HKEY_CURRENT_USER\27w

HKEY_CURRENT_USER\27w\DefaultIcon

HKEY_CURRENT_USER\27w\shell

HKEY_CURRENT_USER\27w\shell\
open

HKEY_CURRENT_USER\27w\shell\
open\command

HKEY_CURRENT_USER\27w\shell\
runas

HKEY_CURRENT_USER\27w\shell\
runas\command

HKEY_CURRENT_USER\7B

HKEY_CURRENT_USER\7B\DefaultIcon

HKEY_CURRENT_USER\7B\shell

HKEY_CURRENT_USER\7B\shell\
open

HKEY_CURRENT_USER\7B\shell\
open\command

HKEY_CURRENT_USER\7B\shell\
runas

HKEY_CURRENT_USER\7B\shell\
runas\command

HKEY_CURRENT_USER\BP

HKEY_CURRENT_USER\BP\DefaultIcon

HKEY_CURRENT_USER\BP\shell

HKEY_CURRENT_USER\BP\shell\
open

HKEY_CURRENT_USER\BP\shell\
open\command

HKEY_CURRENT_USER\BP\shell\
runas

HKEY_CURRENT_USER\BP\shell\
runas\command

HKEY_CURRENT_USER\CEq

HKEY_CURRENT_USER\CEq\DefaultIcon

HKEY_CURRENT_USER\CEq\shell

HKEY_CURRENT_USER\CEq\shell\
open

HKEY_CURRENT_USER\CEq\shell\
open\command

HKEY_CURRENT_USER\CEq\shell\
runas

HKEY_CURRENT_USER\CEq\shell\
runas\command

HKEY_CURRENT_USER\5m

HKEY_CURRENT_USER\5m\DefaultIcon

HKEY_CURRENT_USER\5m\shell

HKEY_CURRENT_USER\5m\shell\
open

HKEY_CURRENT_USER\5m\shell\
open\command

HKEY_CURRENT_USER\5m\shell\
runas

HKEY_CURRENT_USER\5m\shell\
runas\command

HKEY_CURRENT_USER\7c5

HKEY_CURRENT_USER\7c5\DefaultIcon

HKEY_CURRENT_USER\7c5\shell

HKEY_CURRENT_USER\7c5\shell\
open

HKEY_CURRENT_USER\7c5\shell\
open\command

HKEY_CURRENT_USER\7c5\shell\
runas

HKEY_CURRENT_USER\7c5\shell\
runas\command

HKEY_CURRENT_USER\X0

HKEY_CURRENT_USER\X0\DefaultIcon

HKEY_CURRENT_USER\X0\shell

HKEY_CURRENT_USER\X0\shell\
open

HKEY_CURRENT_USER\X0\shell\
open\command

HKEY_CURRENT_USER\X0\shell\
runas

HKEY_CURRENT_USER\X0\shell\
runas\command

HKEY_CURRENT_USER\sr5

HKEY_CURRENT_USER\sr5\DefaultIcon

HKEY_CURRENT_USER\sr5\shell

HKEY_CURRENT_USER\sr5\shell\
open

HKEY_CURRENT_USER\sr5\shell\
open\command

HKEY_CURRENT_USER\sr5\shell\
runas

HKEY_CURRENT_USER\sr5\shell\
runas\command

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

HKEY_CURRENT_USER\.exe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\.exe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\.exe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hb\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hb\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Software\Microsoft\
Windows
Local = "ab19919"

HKEY_CURRENT_USER\b8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\b8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\701
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\701\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\701\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3cU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3cU\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3cU\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\48\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\c7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Qu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k6n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\k6n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k6n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3rs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3rs\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3rs\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\enF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\enF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\enF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gUm
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gUm\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gUm\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xti
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xti\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xti\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8E2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8E2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8E2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EW3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\EW3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EW3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h6v
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h6v\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h6v\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6x6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6x6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6x6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gdI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gdI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gdI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\84
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\84\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\84\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tdG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tdG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tdG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6X
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\M6X\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6X\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\atn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\atn\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\atn\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lWb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lWb\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lWb\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\QP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\le
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\le\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\le\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\35
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\35\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\35\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\36
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\36\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\36\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ja
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ja\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ja\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1T1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1T1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1T1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\l6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WEd
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\WEd\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WEd\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\86Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\86Q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\86Q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TM
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\TM\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TM\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gss
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gss\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gss\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wf\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wf\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1V
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1V\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1V\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6G5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6G5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6G5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\15c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I28
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\I28\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I28\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\LH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kf5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Kf5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kf5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wy
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Wy\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wy\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\72
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\72\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\72\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y1c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y1c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y1c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ct
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ct\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ct\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rxa
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rxa\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rxa\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U88
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\U88\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U88\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1x\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1x\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gx
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gx\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gx\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lh5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lh5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lh5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Rp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Rp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Rp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3b
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3b\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3b\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wyp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wyp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wyp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JEy
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JEy\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JEy\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6oX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6oX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6oX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QO1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\QO1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\QO1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\chF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\chF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\chF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cl
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cl\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cl\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\38\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55L
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\55L\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55L\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\08\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\70
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\70\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\70\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\624
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\624\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\624\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Cbd
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Cbd\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Cbd\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\O1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\O1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\O1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\IA\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IA\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0At
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0At\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0At\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b4W
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\b4W\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b4W\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5BF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5BF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5BF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pK\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pK\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\50g
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\50g\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\50g\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Tb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6Tb\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Tb\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RP2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\RP2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RP2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V4w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V4w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V4w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\52Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\52Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\52Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kgx
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Kgx\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Kgx\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HFB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\HFB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HFB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\EX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\EX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7vF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7vF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7vF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jvg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jvg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jvg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0W
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0W\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0W\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vK4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\vK4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vK4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\dJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\558
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\558\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\558\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tq1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tq1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tq1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tC8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tC8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\tC8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SIr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SIr\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SIr\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rj6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rj6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rj6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uhs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uhs\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uhs\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\11
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\11\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\11\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4TD
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4TD\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4TD\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\T8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\oeP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oeP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\oeP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xtj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Xtj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xtj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\s1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\s1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\s1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\42R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\42R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\42R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L1p
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L1p\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L1p\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\t3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\85L
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\85L\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\85L\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jk
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jk\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jk\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1oX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1oX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1oX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\547
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\547\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\547\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\18Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\18Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\18Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AiX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\AiX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AiX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7C3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7C3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7C3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V3G
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V3G\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V3G\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b63
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\b63\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\b63\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TY5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\TY5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TY5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\48q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\48q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Xe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Xe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Wc\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Wc\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\I2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\I2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\G0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\87\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\686
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\686\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\686\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wJ4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wJ4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wJ4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08l
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\08l\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\08l\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\et
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\et\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\et\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\qc\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qc\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\KT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\KT\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\KT\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yS\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yS\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YrH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YrH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YrH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Xa
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3Xa\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Xa\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\hI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SCq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SCq\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SCq\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\im
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\im\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\im\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\808
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\808\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\808\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\67y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\67y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\67y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cm
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cm\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cm\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vrf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vrf\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vrf\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\u6R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\u6R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\u6R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eEu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\eEu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eEu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1NS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1NS\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1NS\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BNv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BNv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BNv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7L
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7L\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7L\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\p7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\iSB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\iSB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\iSB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\27w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\27w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\27w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7B\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7B\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\CEq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\CEq\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\CEq\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5m
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5m\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5m\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7c5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7c5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7c5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\X0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sr5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sr5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sr5\shell\
runas\command
IsolatedCommand = "%1 %*"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

(Note: The default value data of the said registry entry is %User Profile%\Local Settings\Application Data.)

Dropping Routine

This Trojan drops the following files:

  • %Application Data%\voo.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other Details

This Trojan deletes itself after execution.

This report is generated via an automated analysis system.

  SOLUTION

Minimum Scan Engine: 9.300

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER
    • .exe
  • In HKEY_CURRENT_USER\.exe
    • DefaultIcon
  • In HKEY_CURRENT_USER\.exe
    • shell
  • In HKEY_CURRENT_USER\.exe\shell
    • open
  • In HKEY_CURRENT_USER\.exe\shell\open
    • command
  • In HKEY_CURRENT_USER\.exe\shell
    • runas
  • In HKEY_CURRENT_USER\.exe\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • hb
  • In HKEY_CURRENT_USER\hb
    • DefaultIcon
  • In HKEY_CURRENT_USER\hb
    • shell
  • In HKEY_CURRENT_USER\hb\shell
    • open
  • In HKEY_CURRENT_USER\hb\shell\open
    • command
  • In HKEY_CURRENT_USER\hb\shell
    • runas
  • In HKEY_CURRENT_USER\hb\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • b8
  • In HKEY_CURRENT_USER\b8
    • DefaultIcon
  • In HKEY_CURRENT_USER\b8
    • shell
  • In HKEY_CURRENT_USER\b8\shell
    • open
  • In HKEY_CURRENT_USER\b8\shell\open
    • command
  • In HKEY_CURRENT_USER\b8\shell
    • runas
  • In HKEY_CURRENT_USER\b8\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 701
  • In HKEY_CURRENT_USER\701
    • DefaultIcon
  • In HKEY_CURRENT_USER\701
    • shell
  • In HKEY_CURRENT_USER\701\shell
    • open
  • In HKEY_CURRENT_USER\701\shell\open
    • command
  • In HKEY_CURRENT_USER\701\shell
    • runas
  • In HKEY_CURRENT_USER\701\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 3cU
  • In HKEY_CURRENT_USER\3cU
    • DefaultIcon
  • In HKEY_CURRENT_USER\3cU
    • shell
  • In HKEY_CURRENT_USER\3cU\shell
    • open
  • In HKEY_CURRENT_USER\3cU\shell\open
    • command
  • In HKEY_CURRENT_USER\3cU\shell
    • runas
  • In HKEY_CURRENT_USER\3cU\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 48
  • In HKEY_CURRENT_USER\48
    • DefaultIcon
  • In HKEY_CURRENT_USER\48
    • shell
  • In HKEY_CURRENT_USER\48\shell
    • open
  • In HKEY_CURRENT_USER\48\shell\open
    • command
  • In HKEY_CURRENT_USER\48\shell
    • runas
  • In HKEY_CURRENT_USER\48\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • c7
  • In HKEY_CURRENT_USER\c7
    • DefaultIcon
  • In HKEY_CURRENT_USER\c7
    • shell
  • In HKEY_CURRENT_USER\c7\shell
    • open
  • In HKEY_CURRENT_USER\c7\shell\open
    • command
  • In HKEY_CURRENT_USER\c7\shell
    • runas
  • In HKEY_CURRENT_USER\c7\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Qu
  • In HKEY_CURRENT_USER\Qu
    • DefaultIcon
  • In HKEY_CURRENT_USER\Qu
    • shell
  • In HKEY_CURRENT_USER\Qu\shell
    • open
  • In HKEY_CURRENT_USER\Qu\shell\open
    • command
  • In HKEY_CURRENT_USER\Qu\shell
    • runas
  • In HKEY_CURRENT_USER\Qu\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • k6n
  • In HKEY_CURRENT_USER\k6n
    • DefaultIcon
  • In HKEY_CURRENT_USER\k6n
    • shell
  • In HKEY_CURRENT_USER\k6n\shell
    • open
  • In HKEY_CURRENT_USER\k6n\shell\open
    • command
  • In HKEY_CURRENT_USER\k6n\shell
    • runas
  • In HKEY_CURRENT_USER\k6n\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 3rs
  • In HKEY_CURRENT_USER\3rs
    • DefaultIcon
  • In HKEY_CURRENT_USER\3rs
    • shell
  • In HKEY_CURRENT_USER\3rs\shell
    • open
  • In HKEY_CURRENT_USER\3rs\shell\open
    • command
  • In HKEY_CURRENT_USER\3rs\shell
    • runas
  • In HKEY_CURRENT_USER\3rs\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Vp
  • In HKEY_CURRENT_USER\Vp
    • DefaultIcon
  • In HKEY_CURRENT_USER\Vp
    • shell
  • In HKEY_CURRENT_USER\Vp\shell
    • open
  • In HKEY_CURRENT_USER\Vp\shell\open
    • command
  • In HKEY_CURRENT_USER\Vp\shell
    • runas
  • In HKEY_CURRENT_USER\Vp\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • nF
  • In HKEY_CURRENT_USER\nF
    • DefaultIcon
  • In HKEY_CURRENT_USER\nF
    • shell
  • In HKEY_CURRENT_USER\nF\shell
    • open
  • In HKEY_CURRENT_USER\nF\shell\open
    • command
  • In HKEY_CURRENT_USER\nF\shell
    • runas
  • In HKEY_CURRENT_USER\nF\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • enF
  • In HKEY_CURRENT_USER\enF
    • DefaultIcon
  • In HKEY_CURRENT_USER\enF
    • shell
  • In HKEY_CURRENT_USER\enF\shell
    • open
  • In HKEY_CURRENT_USER\enF\shell\open
    • command
  • In HKEY_CURRENT_USER\enF\shell
    • runas
  • In HKEY_CURRENT_USER\enF\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • gUm
  • In HKEY_CURRENT_USER\gUm
    • DefaultIcon
  • In HKEY_CURRENT_USER\gUm
    • shell
  • In HKEY_CURRENT_USER\gUm\shell
    • open
  • In HKEY_CURRENT_USER\gUm\shell\open
    • command
  • In HKEY_CURRENT_USER\gUm\shell
    • runas
  • In HKEY_CURRENT_USER\gUm\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • xti
  • In HKEY_CURRENT_USER\xti
    • DefaultIcon
  • In HKEY_CURRENT_USER\xti
    • shell
  • In HKEY_CURRENT_USER\xti\shell
    • open
  • In HKEY_CURRENT_USER\xti\shell\open
    • command
  • In HKEY_CURRENT_USER\xti\shell
    • runas
  • In HKEY_CURRENT_USER\xti\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 8E2
  • In HKEY_CURRENT_USER\8E2
    • DefaultIcon
  • In HKEY_CURRENT_USER\8E2
    • shell
  • In HKEY_CURRENT_USER\8E2\shell
    • open
  • In HKEY_CURRENT_USER\8E2\shell\open
    • command
  • In HKEY_CURRENT_USER\8E2\shell
    • runas
  • In HKEY_CURRENT_USER\8E2\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • EW3
  • In HKEY_CURRENT_USER\EW3
    • DefaultIcon
  • In HKEY_CURRENT_USER\EW3
    • shell
  • In HKEY_CURRENT_USER\EW3\shell
    • open
  • In HKEY_CURRENT_USER\EW3\shell\open
    • command
  • In HKEY_CURRENT_USER\EW3\shell
    • runas
  • In HKEY_CURRENT_USER\EW3\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • h6v
  • In HKEY_CURRENT_USER\h6v
    • DefaultIcon
  • In HKEY_CURRENT_USER\h6v
    • shell
  • In HKEY_CURRENT_USER\h6v\shell
    • open
  • In HKEY_CURRENT_USER\h6v\shell\open
    • command
  • In HKEY_CURRENT_USER\h6v\shell
    • runas
  • In HKEY_CURRENT_USER\h6v\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 6x6
  • In HKEY_CURRENT_USER\6x6
    • DefaultIcon
  • In HKEY_CURRENT_USER\6x6
    • shell
  • In HKEY_CURRENT_USER\6x6\shell
    • open
  • In HKEY_CURRENT_USER\6x6\shell\open
    • command
  • In HKEY_CURRENT_USER\6x6\shell
    • runas
  • In HKEY_CURRENT_USER\6x6\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • gdI
  • In HKEY_CURRENT_USER\gdI
    • DefaultIcon
  • In HKEY_CURRENT_USER\gdI
    • shell
  • In HKEY_CURRENT_USER\gdI\shell
    • open
  • In HKEY_CURRENT_USER\gdI\shell\open
    • command
  • In HKEY_CURRENT_USER\gdI\shell
    • runas
  • In HKEY_CURRENT_USER\gdI\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 84
  • In HKEY_CURRENT_USER\84
    • DefaultIcon
  • In HKEY_CURRENT_USER\84
    • shell
  • In HKEY_CURRENT_USER\84\shell
    • open
  • In HKEY_CURRENT_USER\84\shell\open
    • command
  • In HKEY_CURRENT_USER\84\shell
    • runas
  • In HKEY_CURRENT_USER\84\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • tdG
  • In HKEY_CURRENT_USER\tdG
    • DefaultIcon
  • In HKEY_CURRENT_USER\tdG
    • shell
  • In HKEY_CURRENT_USER\tdG\shell
    • open
  • In HKEY_CURRENT_USER\tdG\shell\open
    • command
  • In HKEY_CURRENT_USER\tdG\shell
    • runas
  • In HKEY_CURRENT_USER\tdG\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • M6X
  • In HKEY_CURRENT_USER\M6X
    • DefaultIcon
  • In HKEY_CURRENT_USER\M6X
    • shell
  • In HKEY_CURRENT_USER\M6X\shell
    • open
  • In HKEY_CURRENT_USER\M6X\shell\open
    • command
  • In HKEY_CURRENT_USER\M6X\shell
    • runas
  • In HKEY_CURRENT_USER\M6X\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • atn
  • In HKEY_CURRENT_USER\atn
    • DefaultIcon
  • In HKEY_CURRENT_USER\atn
    • shell
  • In HKEY_CURRENT_USER\atn\shell
    • open
  • In HKEY_CURRENT_USER\atn\shell\open
    • command
  • In HKEY_CURRENT_USER\atn\shell
    • runas
  • In HKEY_CURRENT_USER\atn\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • lWb
  • In HKEY_CURRENT_USER\lWb
    • DefaultIcon
  • In HKEY_CURRENT_USER\lWb
    • shell
  • In HKEY_CURRENT_USER\lWb\shell
    • open
  • In HKEY_CURRENT_USER\lWb\shell\open
    • command
  • In HKEY_CURRENT_USER\lWb\shell
    • runas
  • In HKEY_CURRENT_USER\lWb\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • QP
  • In HKEY_CURRENT_USER\QP
    • DefaultIcon
  • In HKEY_CURRENT_USER\QP
    • shell
  • In HKEY_CURRENT_USER\QP\shell
    • open
  • In HKEY_CURRENT_USER\QP\shell\open
    • command
  • In HKEY_CURRENT_USER\QP\shell
    • runas
  • In HKEY_CURRENT_USER\QP\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • le
  • In HKEY_CURRENT_USER\le
    • DefaultIcon
  • In HKEY_CURRENT_USER\le
    • shell
  • In HKEY_CURRENT_USER\le\shell
    • open
  • In HKEY_CURRENT_USER\le\shell\open
    • command
  • In HKEY_CURRENT_USER\le\shell
    • runas
  • In HKEY_CURRENT_USER\le\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 35
  • In HKEY_CURRENT_USER\35
    • DefaultIcon
  • In HKEY_CURRENT_USER\35
    • shell
  • In HKEY_CURRENT_USER\35\shell
    • open
  • In HKEY_CURRENT_USER\35\shell\open
    • command
  • In HKEY_CURRENT_USER\35\shell
    • runas
  • In HKEY_CURRENT_USER\35\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 36
  • In HKEY_CURRENT_USER\36
    • DefaultIcon
  • In HKEY_CURRENT_USER\36
    • shell
  • In HKEY_CURRENT_USER\36\shell
    • open
  • In HKEY_CURRENT_USER\36\shell\open
    • command
  • In HKEY_CURRENT_USER\36\shell
    • runas
  • In HKEY_CURRENT_USER\36\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • ja
  • In HKEY_CURRENT_USER\ja
    • DefaultIcon
  • In HKEY_CURRENT_USER\ja
    • shell
  • In HKEY_CURRENT_USER\ja\shell
    • open
  • In HKEY_CURRENT_USER\ja\shell\open
    • command
  • In HKEY_CURRENT_USER\ja\shell
    • runas
  • In HKEY_CURRENT_USER\ja\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 1T1
  • In HKEY_CURRENT_USER\1T1
    • DefaultIcon
  • In HKEY_CURRENT_USER\1T1
    • shell
  • In HKEY_CURRENT_USER\1T1\shell
    • open
  • In HKEY_CURRENT_USER\1T1\shell\open
    • command
  • In HKEY_CURRENT_USER\1T1\shell
    • runas
  • In HKEY_CURRENT_USER\1T1\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • l6
  • In HKEY_CURRENT_USER\l6
    • DefaultIcon
  • In HKEY_CURRENT_USER\l6
    • shell
  • In HKEY_CURRENT_USER\l6\shell
    • open
  • In HKEY_CURRENT_USER\l6\shell\open
    • command
  • In HKEY_CURRENT_USER\l6\shell
    • runas
  • In HKEY_CURRENT_USER\l6\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • WEd
  • In HKEY_CURRENT_USER\WEd
    • DefaultIcon
  • In HKEY_CURRENT_USER\WEd
    • shell
  • In HKEY_CURRENT_USER\WEd\shell
    • open
  • In HKEY_CURRENT_USER\WEd\shell\open
    • command
  • In HKEY_CURRENT_USER\WEd\shell
    • runas
  • In HKEY_CURRENT_USER\WEd\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 86Q
  • In HKEY_CURRENT_USER\86Q
    • DefaultIcon
  • In HKEY_CURRENT_USER\86Q
    • shell
  • In HKEY_CURRENT_USER\86Q\shell
    • open
  • In HKEY_CURRENT_USER\86Q\shell\open
    • command
  • In HKEY_CURRENT_USER\86Q\shell
    • runas
  • In HKEY_CURRENT_USER\86Q\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • TM
  • In HKEY_CURRENT_USER\TM
    • DefaultIcon
  • In HKEY_CURRENT_USER\TM
    • shell
  • In HKEY_CURRENT_USER\TM\shell
    • open
  • In HKEY_CURRENT_USER\TM\shell\open
    • command
  • In HKEY_CURRENT_USER\TM\shell
    • runas
  • In HKEY_CURRENT_USER\TM\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • rI
  • In HKEY_CURRENT_USER\rI
    • DefaultIcon
  • In HKEY_CURRENT_USER\rI
    • shell
  • In HKEY_CURRENT_USER\rI\shell
    • open
  • In HKEY_CURRENT_USER\rI\shell\open
    • command
  • In HKEY_CURRENT_USER\rI\shell
    • runas
  • In HKEY_CURRENT_USER\rI\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • gss
  • In HKEY_CURRENT_USER\gss
    • DefaultIcon
  • In HKEY_CURRENT_USER\gss
    • shell
  • In HKEY_CURRENT_USER\gss\shell
    • open
  • In HKEY_CURRENT_USER\gss\shell\open
    • command
  • In HKEY_CURRENT_USER\gss\shell
    • runas
  • In HKEY_CURRENT_USER\gss\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • wf
  • In HKEY_CURRENT_USER\wf
    • DefaultIcon
  • In HKEY_CURRENT_USER\wf
    • shell
  • In HKEY_CURRENT_USER\wf\shell
    • open
  • In HKEY_CURRENT_USER\wf\shell\open
    • command
  • In HKEY_CURRENT_USER\wf\shell
    • runas
  • In HKEY_CURRENT_USER\wf\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 1V
  • In HKEY_CURRENT_USER\1V
    • DefaultIcon
  • In HKEY_CURRENT_USER\1V
    • shell
  • In HKEY_CURRENT_USER\1V\shell
    • open
  • In HKEY_CURRENT_USER\1V\shell\open
    • command
  • In HKEY_CURRENT_USER\1V\shell
    • runas
  • In HKEY_CURRENT_USER\1V\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 6G5
  • In HKEY_CURRENT_USER\6G5
    • DefaultIcon
  • In HKEY_CURRENT_USER\6G5
    • shell
  • In HKEY_CURRENT_USER\6G5\shell
    • open
  • In HKEY_CURRENT_USER\6G5\shell\open
    • command
  • In HKEY_CURRENT_USER\6G5\shell
    • runas
  • In HKEY_CURRENT_USER\6G5\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 15c
  • In HKEY_CURRENT_USER\15c
    • DefaultIcon
  • In HKEY_CURRENT_USER\15c
    • shell
  • In HKEY_CURRENT_USER\15c\shell
    • open
  • In HKEY_CURRENT_USER\15c\shell\open
    • command
  • In HKEY_CURRENT_USER\15c\shell
    • runas
  • In HKEY_CURRENT_USER\15c\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • I28
  • In HKEY_CURRENT_USER\I28
    • DefaultIcon
  • In HKEY_CURRENT_USER\I28
    • shell
  • In HKEY_CURRENT_USER\I28\shell
    • open
  • In HKEY_CURRENT_USER\I28\shell\open
    • command
  • In HKEY_CURRENT_USER\I28\shell
    • runas
  • In HKEY_CURRENT_USER\I28\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • LH
  • In HKEY_CURRENT_USER\LH
    • DefaultIcon
  • In HKEY_CURRENT_USER\LH
    • shell
  • In HKEY_CURRENT_USER\LH\shell
    • open
  • In HKEY_CURRENT_USER\LH\shell\open
    • command
  • In HKEY_CURRENT_USER\LH\shell
    • runas
  • In HKEY_CURRENT_USER\LH\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Kf5
  • In HKEY_CURRENT_USER\Kf5
    • DefaultIcon
  • In HKEY_CURRENT_USER\Kf5
    • shell
  • In HKEY_CURRENT_USER\Kf5\shell
    • open
  • In HKEY_CURRENT_USER\Kf5\shell\open
    • command
  • In HKEY_CURRENT_USER\Kf5\shell
    • runas
  • In HKEY_CURRENT_USER\Kf5\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Wy
  • In HKEY_CURRENT_USER\Wy
    • DefaultIcon
  • In HKEY_CURRENT_USER\Wy
    • shell
  • In HKEY_CURRENT_USER\Wy\shell
    • open
  • In HKEY_CURRENT_USER\Wy\shell\open
    • command
  • In HKEY_CURRENT_USER\Wy\shell
    • runas
  • In HKEY_CURRENT_USER\Wy\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 72
  • In HKEY_CURRENT_USER\72
    • DefaultIcon
  • In HKEY_CURRENT_USER\72
    • shell
  • In HKEY_CURRENT_USER\72\shell
    • open
  • In HKEY_CURRENT_USER\72\shell\open
    • command
  • In HKEY_CURRENT_USER\72\shell
    • runas
  • In HKEY_CURRENT_USER\72\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Y1c
  • In HKEY_CURRENT_USER\Y1c
    • DefaultIcon
  • In HKEY_CURRENT_USER\Y1c
    • shell
  • In HKEY_CURRENT_USER\Y1c\shell
    • open
  • In HKEY_CURRENT_USER\Y1c\shell\open
    • command
  • In HKEY_CURRENT_USER\Y1c\shell
    • runas
  • In HKEY_CURRENT_USER\Y1c\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • ct
  • In HKEY_CURRENT_USER\ct
    • DefaultIcon
  • In HKEY_CURRENT_USER\ct
    • shell
  • In HKEY_CURRENT_USER\ct\shell
    • open
  • In HKEY_CURRENT_USER\ct\shell\open
    • command
  • In HKEY_CURRENT_USER\ct\shell
    • runas
  • In HKEY_CURRENT_USER\ct\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • rxa
  • In HKEY_CURRENT_USER\rxa
    • DefaultIcon
  • In HKEY_CURRENT_USER\rxa
    • shell
  • In HKEY_CURRENT_USER\rxa\shell
    • open
  • In HKEY_CURRENT_USER\rxa\shell\open
    • command
  • In HKEY_CURRENT_USER\rxa\shell
    • runas
  • In HKEY_CURRENT_USER\rxa\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • U88
  • In HKEY_CURRENT_USER\U88
    • DefaultIcon
  • In HKEY_CURRENT_USER\U88
    • shell
  • In HKEY_CURRENT_USER\U88\shell
    • open
  • In HKEY_CURRENT_USER\U88\shell\open
    • command
  • In HKEY_CURRENT_USER\U88\shell
    • runas
  • In HKEY_CURRENT_USER\U88\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • jY
  • In HKEY_CURRENT_USER\jY
    • DefaultIcon
  • In HKEY_CURRENT_USER\jY
    • shell
  • In HKEY_CURRENT_USER\jY\shell
    • open
  • In HKEY_CURRENT_USER\jY\shell\open
    • command
  • In HKEY_CURRENT_USER\jY\shell
    • runas
  • In HKEY_CURRENT_USER\jY\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 1x
  • In HKEY_CURRENT_USER\1x
    • DefaultIcon
  • In HKEY_CURRENT_USER\1x
    • shell
  • In HKEY_CURRENT_USER\1x\shell
    • open
  • In HKEY_CURRENT_USER\1x\shell\open
    • command
  • In HKEY_CURRENT_USER\1x\shell
    • runas
  • In HKEY_CURRENT_USER\1x\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • gg
  • In HKEY_CURRENT_USER\gg
    • DefaultIcon
  • In HKEY_CURRENT_USER\gg
    • shell
  • In HKEY_CURRENT_USER\gg\shell
    • open
  • In HKEY_CURRENT_USER\gg\shell\open
    • command
  • In HKEY_CURRENT_USER\gg\shell
    • runas
  • In HKEY_CURRENT_USER\gg\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • gx
  • In HKEY_CURRENT_USER\gx
    • DefaultIcon
  • In HKEY_CURRENT_USER\gx
    • shell
  • In HKEY_CURRENT_USER\gx\shell
    • open
  • In HKEY_CURRENT_USER\gx\shell\open
    • command
  • In HKEY_CURRENT_USER\gx\shell
    • runas
  • In HKEY_CURRENT_USER\gx\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • lh5
  • In HKEY_CURRENT_USER\lh5
    • DefaultIcon
  • In HKEY_CURRENT_USER\lh5
    • shell
  • In HKEY_CURRENT_USER\lh5\shell
    • open
  • In HKEY_CURRENT_USER\lh5\shell\open
    • command
  • In HKEY_CURRENT_USER\lh5\shell
    • runas
  • In HKEY_CURRENT_USER\lh5\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Rp
  • In HKEY_CURRENT_USER\Rp
    • DefaultIcon
  • In HKEY_CURRENT_USER\Rp
    • shell
  • In HKEY_CURRENT_USER\Rp\shell
    • open
  • In HKEY_CURRENT_USER\Rp\shell\open
    • command
  • In HKEY_CURRENT_USER\Rp\shell
    • runas
  • In HKEY_CURRENT_USER\Rp\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 3b
  • In HKEY_CURRENT_USER\3b
    • DefaultIcon
  • In HKEY_CURRENT_USER\3b
    • shell
  • In HKEY_CURRENT_USER\3b\shell
    • open
  • In HKEY_CURRENT_USER\3b\shell\open
    • command
  • In HKEY_CURRENT_USER\3b\shell
    • runas
  • In HKEY_CURRENT_USER\3b\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • wyp
  • In HKEY_CURRENT_USER\wyp
    • DefaultIcon
  • In HKEY_CURRENT_USER\wyp
    • shell
  • In HKEY_CURRENT_USER\wyp\shell
    • open
  • In HKEY_CURRENT_USER\wyp\shell\open
    • command
  • In HKEY_CURRENT_USER\wyp\shell
    • runas
  • In HKEY_CURRENT_USER\wyp\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Pv
  • In HKEY_CURRENT_USER\Pv
    • DefaultIcon
  • In HKEY_CURRENT_USER\Pv
    • shell
  • In HKEY_CURRENT_USER\Pv\shell
    • open
  • In HKEY_CURRENT_USER\Pv\shell\open
    • command
  • In HKEY_CURRENT_USER\Pv\shell
    • runas
  • In HKEY_CURRENT_USER\Pv\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • JEy
  • In HKEY_CURRENT_USER\JEy
    • DefaultIcon
  • In HKEY_CURRENT_USER\JEy
    • shell
  • In HKEY_CURRENT_USER\JEy\shell
    • open
  • In HKEY_CURRENT_USER\JEy\shell\open
    • command
  • In HKEY_CURRENT_USER\JEy\shell
    • runas
  • In HKEY_CURRENT_USER\JEy\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 6oX
  • In HKEY_CURRENT_USER\6oX
    • DefaultIcon
  • In HKEY_CURRENT_USER\6oX
    • shell
  • In HKEY_CURRENT_USER\6oX\shell
    • open
  • In HKEY_CURRENT_USER\6oX\shell\open
    • command
  • In HKEY_CURRENT_USER\6oX\shell
    • runas
  • In HKEY_CURRENT_USER\6oX\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • QO1
  • In HKEY_CURRENT_USER\QO1
    • DefaultIcon
  • In HKEY_CURRENT_USER\QO1
    • shell
  • In HKEY_CURRENT_USER\QO1\shell
    • open
  • In HKEY_CURRENT_USER\QO1\shell\open
    • command
  • In HKEY_CURRENT_USER\QO1\shell
    • runas
  • In HKEY_CURRENT_USER\QO1\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • chF
  • In HKEY_CURRENT_USER\chF
    • DefaultIcon
  • In HKEY_CURRENT_USER\chF
    • shell
  • In HKEY_CURRENT_USER\chF\shell
    • open
  • In HKEY_CURRENT_USER\chF\shell\open
    • command
  • In HKEY_CURRENT_USER\chF\shell
    • runas
  • In HKEY_CURRENT_USER\chF\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 6R
  • In HKEY_CURRENT_USER\6R
    • DefaultIcon
  • In HKEY_CURRENT_USER\6R
    • shell
  • In HKEY_CURRENT_USER\6R\shell
    • open
  • In HKEY_CURRENT_USER\6R\shell\open
    • command
  • In HKEY_CURRENT_USER\6R\shell
    • runas
  • In HKEY_CURRENT_USER\6R\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 6w
  • In HKEY_CURRENT_USER\6w
    • DefaultIcon
  • In HKEY_CURRENT_USER\6w
    • shell
  • In HKEY_CURRENT_USER\6w\shell
    • open
  • In HKEY_CURRENT_USER\6w\shell\open
    • command
  • In HKEY_CURRENT_USER\6w\shell
    • runas
  • In HKEY_CURRENT_USER\6w\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • cl
  • In HKEY_CURRENT_USER\cl
    • DefaultIcon
  • In HKEY_CURRENT_USER\cl
    • shell
  • In HKEY_CURRENT_USER\cl\shell
    • open
  • In HKEY_CURRENT_USER\cl\shell\open
    • command
  • In HKEY_CURRENT_USER\cl\shell
    • runas
  • In HKEY_CURRENT_USER\cl\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 38
  • In HKEY_CURRENT_USER\38
    • DefaultIcon
  • In HKEY_CURRENT_USER\38
    • shell
  • In HKEY_CURRENT_USER\38\shell
    • open
  • In HKEY_CURRENT_USER\38\shell\open
    • command
  • In HKEY_CURRENT_USER\38\shell
    • runas
  • In HKEY_CURRENT_USER\38\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 55L
  • In HKEY_CURRENT_USER\55L
    • DefaultIcon
  • In HKEY_CURRENT_USER\55L
    • shell
  • In HKEY_CURRENT_USER\55L\shell
    • open
  • In HKEY_CURRENT_USER\55L\shell\open
    • command
  • In HKEY_CURRENT_USER\55L\shell
    • runas
  • In HKEY_CURRENT_USER\55L\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 08
  • In HKEY_CURRENT_USER\08
    • DefaultIcon
  • In HKEY_CURRENT_USER\08
    • shell
  • In HKEY_CURRENT_USER\08\shell
    • open
  • In HKEY_CURRENT_USER\08\shell\open
    • command
  • In HKEY_CURRENT_USER\08\shell
    • runas
  • In HKEY_CURRENT_USER\08\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 70
  • In HKEY_CURRENT_USER\70
    • DefaultIcon
  • In HKEY_CURRENT_USER\70
    • shell
  • In HKEY_CURRENT_USER\70\shell
    • open
  • In HKEY_CURRENT_USER\70\shell\open
    • command
  • In HKEY_CURRENT_USER\70\shell
    • runas
  • In HKEY_CURRENT_USER\70\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 624
  • In HKEY_CURRENT_USER\624
    • DefaultIcon
  • In HKEY_CURRENT_USER\624
    • shell
  • In HKEY_CURRENT_USER\624\shell
    • open
  • In HKEY_CURRENT_USER\624\shell\open
    • command
  • In HKEY_CURRENT_USER\624\shell
    • runas
  • In HKEY_CURRENT_USER\624\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Cbd
  • In HKEY_CURRENT_USER\Cbd
    • DefaultIcon
  • In HKEY_CURRENT_USER\Cbd
    • shell
  • In HKEY_CURRENT_USER\Cbd\shell
    • open
  • In HKEY_CURRENT_USER\Cbd\shell\open
    • command
  • In HKEY_CURRENT_USER\Cbd\shell
    • runas
  • In HKEY_CURRENT_USER\Cbd\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • O1
  • In HKEY_CURRENT_USER\O1
    • DefaultIcon
  • In HKEY_CURRENT_USER\O1
    • shell
  • In HKEY_CURRENT_USER\O1\shell
    • open
  • In HKEY_CURRENT_USER\O1\shell\open
    • command
  • In HKEY_CURRENT_USER\O1\shell
    • runas
  • In HKEY_CURRENT_USER\O1\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • IA
  • In HKEY_CURRENT_USER\IA
    • DefaultIcon
  • In HKEY_CURRENT_USER\IA
    • shell
  • In HKEY_CURRENT_USER\IA\shell
    • open
  • In HKEY_CURRENT_USER\IA\shell\open
    • command
  • In HKEY_CURRENT_USER\IA\shell
    • runas
  • In HKEY_CURRENT_USER\IA\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 0At
  • In HKEY_CURRENT_USER\0At
    • DefaultIcon
  • In HKEY_CURRENT_USER\0At
    • shell
  • In HKEY_CURRENT_USER\0At\shell
    • open
  • In HKEY_CURRENT_USER\0At\shell\open
    • command
  • In HKEY_CURRENT_USER\0At\shell
    • runas
  • In HKEY_CURRENT_USER\0At\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • b4W
  • In HKEY_CURRENT_USER\b4W
    • DefaultIcon
  • In HKEY_CURRENT_USER\b4W
    • shell
  • In HKEY_CURRENT_USER\b4W\shell
    • open
  • In HKEY_CURRENT_USER\b4W\shell\open
    • command
  • In HKEY_CURRENT_USER\b4W\shell
    • runas
  • In HKEY_CURRENT_USER\b4W\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 5BF
  • In HKEY_CURRENT_USER\5BF
    • DefaultIcon
  • In HKEY_CURRENT_USER\5BF
    • shell
  • In HKEY_CURRENT_USER\5BF\shell
    • open
  • In HKEY_CURRENT_USER\5BF\shell\open
    • command
  • In HKEY_CURRENT_USER\5BF\shell
    • runas
  • In HKEY_CURRENT_USER\5BF\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • pK
  • In HKEY_CURRENT_USER\pK
    • DefaultIcon
  • In HKEY_CURRENT_USER\pK
    • shell
  • In HKEY_CURRENT_USER\pK\shell
    • open
  • In HKEY_CURRENT_USER\pK\shell\open
    • command
  • In HKEY_CURRENT_USER\pK\shell
    • runas
  • In HKEY_CURRENT_USER\pK\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 50g
  • In HKEY_CURRENT_USER\50g
    • DefaultIcon
  • In HKEY_CURRENT_USER\50g
    • shell
  • In HKEY_CURRENT_USER\50g\shell
    • open
  • In HKEY_CURRENT_USER\50g\shell\open
    • command
  • In HKEY_CURRENT_USER\50g\shell
    • runas
  • In HKEY_CURRENT_USER\50g\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • JG
  • In HKEY_CURRENT_USER\JG
    • DefaultIcon
  • In HKEY_CURRENT_USER\JG
    • shell
  • In HKEY_CURRENT_USER\JG\shell
    • open
  • In HKEY_CURRENT_USER\JG\shell\open
    • command
  • In HKEY_CURRENT_USER\JG\shell
    • runas
  • In HKEY_CURRENT_USER\JG\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • bg
  • In HKEY_CURRENT_USER\bg
    • DefaultIcon
  • In HKEY_CURRENT_USER\bg
    • shell
  • In HKEY_CURRENT_USER\bg\shell
    • open
  • In HKEY_CURRENT_USER\bg\shell\open
    • command
  • In HKEY_CURRENT_USER\bg\shell
    • runas
  • In HKEY_CURRENT_USER\bg\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 6Tb
  • In HKEY_CURRENT_USER\6Tb
    • DefaultIcon
  • In HKEY_CURRENT_USER\6Tb
    • shell
  • In HKEY_CURRENT_USER\6Tb\shell
    • open
  • In HKEY_CURRENT_USER\6Tb\shell\open
    • command
  • In HKEY_CURRENT_USER\6Tb\shell
    • runas
  • In HKEY_CURRENT_USER\6Tb\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • RP2
  • In HKEY_CURRENT_USER\RP2
    • DefaultIcon
  • In HKEY_CURRENT_USER\RP2
    • shell
  • In HKEY_CURRENT_USER\RP2\shell
    • open
  • In HKEY_CURRENT_USER\RP2\shell\open
    • command
  • In HKEY_CURRENT_USER\RP2\shell
    • runas
  • In HKEY_CURRENT_USER\RP2\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • V4w
  • In HKEY_CURRENT_USER\V4w
    • DefaultIcon
  • In HKEY_CURRENT_USER\V4w
    • shell
  • In HKEY_CURRENT_USER\V4w\shell
    • open
  • In HKEY_CURRENT_USER\V4w\shell\open
    • command
  • In HKEY_CURRENT_USER\V4w\shell
    • runas
  • In HKEY_CURRENT_USER\V4w\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 52Y
  • In HKEY_CURRENT_USER\52Y
    • DefaultIcon
  • In HKEY_CURRENT_USER\52Y
    • shell
  • In HKEY_CURRENT_USER\52Y\shell
    • open
  • In HKEY_CURRENT_USER\52Y\shell\open
    • command
  • In HKEY_CURRENT_USER\52Y\shell
    • runas
  • In HKEY_CURRENT_USER\52Y\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 8R
  • In HKEY_CURRENT_USER\8R
    • DefaultIcon
  • In HKEY_CURRENT_USER\8R
    • shell
  • In HKEY_CURRENT_USER\8R\shell
    • open
  • In HKEY_CURRENT_USER\8R\shell\open
    • command
  • In HKEY_CURRENT_USER\8R\shell
    • runas
  • In HKEY_CURRENT_USER\8R\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Kgx
  • In HKEY_CURRENT_USER\Kgx
    • DefaultIcon
  • In HKEY_CURRENT_USER\Kgx
    • shell
  • In HKEY_CURRENT_USER\Kgx\shell
    • open
  • In HKEY_CURRENT_USER\Kgx\shell\open
    • command
  • In HKEY_CURRENT_USER\Kgx\shell
    • runas
  • In HKEY_CURRENT_USER\Kgx\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • HFB
  • In HKEY_CURRENT_USER\HFB
    • DefaultIcon
  • In HKEY_CURRENT_USER\HFB
    • shell
  • In HKEY_CURRENT_USER\HFB\shell
    • open
  • In HKEY_CURRENT_USER\HFB\shell\open
    • command
  • In HKEY_CURRENT_USER\HFB\shell
    • runas
  • In HKEY_CURRENT_USER\HFB\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • EX
  • In HKEY_CURRENT_USER\EX
    • DefaultIcon
  • In HKEY_CURRENT_USER\EX
    • shell
  • In HKEY_CURRENT_USER\EX\shell
    • open
  • In HKEY_CURRENT_USER\EX\shell\open
    • command
  • In HKEY_CURRENT_USER\EX\shell
    • runas
  • In HKEY_CURRENT_USER\EX\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 7vF
  • In HKEY_CURRENT_USER\7vF
    • DefaultIcon
  • In HKEY_CURRENT_USER\7vF
    • shell
  • In HKEY_CURRENT_USER\7vF\shell
    • open
  • In HKEY_CURRENT_USER\7vF\shell\open
    • command
  • In HKEY_CURRENT_USER\7vF\shell
    • runas
  • In HKEY_CURRENT_USER\7vF\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Jvg
  • In HKEY_CURRENT_USER\Jvg
    • DefaultIcon
  • In HKEY_CURRENT_USER\Jvg
    • shell
  • In HKEY_CURRENT_USER\Jvg\shell
    • open
  • In HKEY_CURRENT_USER\Jvg\shell\open
    • command
  • In HKEY_CURRENT_USER\Jvg\shell
    • runas
  • In HKEY_CURRENT_USER\Jvg\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 0W
  • In HKEY_CURRENT_USER\0W
    • DefaultIcon
  • In HKEY_CURRENT_USER\0W
    • shell
  • In HKEY_CURRENT_USER\0W\shell
    • open
  • In HKEY_CURRENT_USER\0W\shell\open
    • command
  • In HKEY_CURRENT_USER\0W\shell
    • runas
  • In HKEY_CURRENT_USER\0W\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • V5
  • In HKEY_CURRENT_USER\V5
    • DefaultIcon
  • In HKEY_CURRENT_USER\V5
    • shell
  • In HKEY_CURRENT_USER\V5\shell
    • open
  • In HKEY_CURRENT_USER\V5\shell\open
    • command
  • In HKEY_CURRENT_USER\V5\shell
    • runas
  • In HKEY_CURRENT_USER\V5\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • vK4
  • In HKEY_CURRENT_USER\vK4
    • DefaultIcon
  • In HKEY_CURRENT_USER\vK4
    • shell
  • In HKEY_CURRENT_USER\vK4\shell
    • open
  • In HKEY_CURRENT_USER\vK4\shell\open
    • command
  • In HKEY_CURRENT_USER\vK4\shell
    • runas
  • In HKEY_CURRENT_USER\vK4\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • dJ
  • In HKEY_CURRENT_USER\dJ
    • DefaultIcon
  • In HKEY_CURRENT_USER\dJ
    • shell
  • In HKEY_CURRENT_USER\dJ\shell
    • open
  • In HKEY_CURRENT_USER\dJ\shell\open
    • command
  • In HKEY_CURRENT_USER\dJ\shell
    • runas
  • In HKEY_CURRENT_USER\dJ\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 558
  • In HKEY_CURRENT_USER\558
    • DefaultIcon
  • In HKEY_CURRENT_USER\558
    • shell
  • In HKEY_CURRENT_USER\558\shell
    • open
  • In HKEY_CURRENT_USER\558\shell\open
    • command
  • In HKEY_CURRENT_USER\558\shell
    • runas
  • In HKEY_CURRENT_USER\558\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • tq1
  • In HKEY_CURRENT_USER\tq1
    • DefaultIcon
  • In HKEY_CURRENT_USER\tq1
    • shell
  • In HKEY_CURRENT_USER\tq1\shell
    • open
  • In HKEY_CURRENT_USER\tq1\shell\open
    • command
  • In HKEY_CURRENT_USER\tq1\shell
    • runas
  • In HKEY_CURRENT_USER\tq1\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • tC8
  • In HKEY_CURRENT_USER\tC8
    • DefaultIcon
  • In HKEY_CURRENT_USER\tC8
    • shell
  • In HKEY_CURRENT_USER\tC8\shell
    • open
  • In HKEY_CURRENT_USER\tC8\shell\open
    • command
  • In HKEY_CURRENT_USER\tC8\shell
    • runas
  • In HKEY_CURRENT_USER\tC8\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • SIr
  • In HKEY_CURRENT_USER\SIr
    • DefaultIcon
  • In HKEY_CURRENT_USER\SIr
    • shell
  • In HKEY_CURRENT_USER\SIr\shell
    • open
  • In HKEY_CURRENT_USER\SIr\shell\open
    • command
  • In HKEY_CURRENT_USER\SIr\shell
    • runas
  • In HKEY_CURRENT_USER\SIr\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • rj6
  • In HKEY_CURRENT_USER\rj6
    • DefaultIcon
  • In HKEY_CURRENT_USER\rj6
    • shell
  • In HKEY_CURRENT_USER\rj6\shell
    • open
  • In HKEY_CURRENT_USER\rj6\shell\open
    • command
  • In HKEY_CURRENT_USER\rj6\shell
    • runas
  • In HKEY_CURRENT_USER\rj6\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • uhs
  • In HKEY_CURRENT_USER\uhs
    • DefaultIcon
  • In HKEY_CURRENT_USER\uhs
    • shell
  • In HKEY_CURRENT_USER\uhs\shell
    • open
  • In HKEY_CURRENT_USER\uhs\shell\open
    • command
  • In HKEY_CURRENT_USER\uhs\shell
    • runas
  • In HKEY_CURRENT_USER\uhs\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 11
  • In HKEY_CURRENT_USER\11
    • DefaultIcon
  • In HKEY_CURRENT_USER\11
    • shell
  • In HKEY_CURRENT_USER\11\shell
    • open
  • In HKEY_CURRENT_USER\11\shell\open
    • command
  • In HKEY_CURRENT_USER\11\shell
    • runas
  • In HKEY_CURRENT_USER\11\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 4TD
  • In HKEY_CURRENT_USER\4TD
    • DefaultIcon
  • In HKEY_CURRENT_USER\4TD
    • shell
  • In HKEY_CURRENT_USER\4TD\shell
    • open
  • In HKEY_CURRENT_USER\4TD\shell\open
    • command
  • In HKEY_CURRENT_USER\4TD\shell
    • runas
  • In HKEY_CURRENT_USER\4TD\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • T8
  • In HKEY_CURRENT_USER\T8
    • DefaultIcon
  • In HKEY_CURRENT_USER\T8
    • shell
  • In HKEY_CURRENT_USER\T8\shell
    • open
  • In HKEY_CURRENT_USER\T8\shell\open
    • command
  • In HKEY_CURRENT_USER\T8\shell
    • runas
  • In HKEY_CURRENT_USER\T8\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • oeP
  • In HKEY_CURRENT_USER\oeP
    • DefaultIcon
  • In HKEY_CURRENT_USER\oeP
    • shell
  • In HKEY_CURRENT_USER\oeP\shell
    • open
  • In HKEY_CURRENT_USER\oeP\shell\open
    • command
  • In HKEY_CURRENT_USER\oeP\shell
    • runas
  • In HKEY_CURRENT_USER\oeP\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Xtj
  • In HKEY_CURRENT_USER\Xtj
    • DefaultIcon
  • In HKEY_CURRENT_USER\Xtj
    • shell
  • In HKEY_CURRENT_USER\Xtj\shell
    • open
  • In HKEY_CURRENT_USER\Xtj\shell\open
    • command
  • In HKEY_CURRENT_USER\Xtj\shell
    • runas
  • In HKEY_CURRENT_USER\Xtj\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • s1
  • In HKEY_CURRENT_USER\s1
    • DefaultIcon
  • In HKEY_CURRENT_USER\s1
    • shell
  • In HKEY_CURRENT_USER\s1\shell
    • open
  • In HKEY_CURRENT_USER\s1\shell\open
    • command
  • In HKEY_CURRENT_USER\s1\shell
    • runas
  • In HKEY_CURRENT_USER\s1\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 42R
  • In HKEY_CURRENT_USER\42R
    • DefaultIcon
  • In HKEY_CURRENT_USER\42R
    • shell
  • In HKEY_CURRENT_USER\42R\shell
    • open
  • In HKEY_CURRENT_USER\42R\shell\open
    • command
  • In HKEY_CURRENT_USER\42R\shell
    • runas
  • In HKEY_CURRENT_USER\42R\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • L1p
  • In HKEY_CURRENT_USER\L1p
    • DefaultIcon
  • In HKEY_CURRENT_USER\L1p
    • shell
  • In HKEY_CURRENT_USER\L1p\shell
    • open
  • In HKEY_CURRENT_USER\L1p\shell\open
    • command
  • In HKEY_CURRENT_USER\L1p\shell
    • runas
  • In HKEY_CURRENT_USER\L1p\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • t3
  • In HKEY_CURRENT_USER\t3
    • DefaultIcon
  • In HKEY_CURRENT_USER\t3
    • shell
  • In HKEY_CURRENT_USER\t3\shell
    • open
  • In HKEY_CURRENT_USER\t3\shell\open
    • command
  • In HKEY_CURRENT_USER\t3\shell
    • runas
  • In HKEY_CURRENT_USER\t3\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 85L
  • In HKEY_CURRENT_USER\85L
    • DefaultIcon
  • In HKEY_CURRENT_USER\85L
    • shell
  • In HKEY_CURRENT_USER\85L\shell
    • open
  • In HKEY_CURRENT_USER\85L\shell\open
    • command
  • In HKEY_CURRENT_USER\85L\shell
    • runas
  • In HKEY_CURRENT_USER\85L\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • jk
  • In HKEY_CURRENT_USER\jk
    • DefaultIcon
  • In HKEY_CURRENT_USER\jk
    • shell
  • In HKEY_CURRENT_USER\jk\shell
    • open
  • In HKEY_CURRENT_USER\jk\shell\open
    • command
  • In HKEY_CURRENT_USER\jk\shell
    • runas
  • In HKEY_CURRENT_USER\jk\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 1oX
  • In HKEY_CURRENT_USER\1oX
    • DefaultIcon
  • In HKEY_CURRENT_USER\1oX
    • shell
  • In HKEY_CURRENT_USER\1oX\shell
    • open
  • In HKEY_CURRENT_USER\1oX\shell\open
    • command
  • In HKEY_CURRENT_USER\1oX\shell
    • runas
  • In HKEY_CURRENT_USER\1oX\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 547
  • In HKEY_CURRENT_USER\547
    • DefaultIcon
  • In HKEY_CURRENT_USER\547
    • shell
  • In HKEY_CURRENT_USER\547\shell
    • open
  • In HKEY_CURRENT_USER\547\shell\open
    • command
  • In HKEY_CURRENT_USER\547\shell
    • runas
  • In HKEY_CURRENT_USER\547\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 18Y
  • In HKEY_CURRENT_USER\18Y
    • DefaultIcon
  • In HKEY_CURRENT_USER\18Y
    • shell
  • In HKEY_CURRENT_USER\18Y\shell
    • open
  • In HKEY_CURRENT_USER\18Y\shell\open
    • command
  • In HKEY_CURRENT_USER\18Y\shell
    • runas
  • In HKEY_CURRENT_USER\18Y\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • AiX
  • In HKEY_CURRENT_USER\AiX
    • DefaultIcon
  • In HKEY_CURRENT_USER\AiX
    • shell
  • In HKEY_CURRENT_USER\AiX\shell
    • open
  • In HKEY_CURRENT_USER\AiX\shell\open
    • command
  • In HKEY_CURRENT_USER\AiX\shell
    • runas
  • In HKEY_CURRENT_USER\AiX\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 7C3
  • In HKEY_CURRENT_USER\7C3
    • DefaultIcon
  • In HKEY_CURRENT_USER\7C3
    • shell
  • In HKEY_CURRENT_USER\7C3\shell
    • open
  • In HKEY_CURRENT_USER\7C3\shell\open
    • command
  • In HKEY_CURRENT_USER\7C3\shell
    • runas
  • In HKEY_CURRENT_USER\7C3\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • V3G
  • In HKEY_CURRENT_USER\V3G
    • DefaultIcon
  • In HKEY_CURRENT_USER\V3G
    • shell
  • In HKEY_CURRENT_USER\V3G\shell
    • open
  • In HKEY_CURRENT_USER\V3G\shell\open
    • command
  • In HKEY_CURRENT_USER\V3G\shell
    • runas
  • In HKEY_CURRENT_USER\V3G\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • b63
  • In HKEY_CURRENT_USER\b63
    • DefaultIcon
  • In HKEY_CURRENT_USER\b63
    • shell
  • In HKEY_CURRENT_USER\b63\shell
    • open
  • In HKEY_CURRENT_USER\b63\shell\open
    • command
  • In HKEY_CURRENT_USER\b63\shell
    • runas
  • In HKEY_CURRENT_USER\b63\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • TY5
  • In HKEY_CURRENT_USER\TY5
    • DefaultIcon
  • In HKEY_CURRENT_USER\TY5
    • shell
  • In HKEY_CURRENT_USER\TY5\shell
    • open
  • In HKEY_CURRENT_USER\TY5\shell\open
    • command
  • In HKEY_CURRENT_USER\TY5\shell
    • runas
  • In HKEY_CURRENT_USER\TY5\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 48q
  • In HKEY_CURRENT_USER\48q
    • DefaultIcon
  • In HKEY_CURRENT_USER\48q
    • shell
  • In HKEY_CURRENT_USER\48q\shell
    • open
  • In HKEY_CURRENT_USER\48q\shell\open
    • command
  • In HKEY_CURRENT_USER\48q\shell
    • runas
  • In HKEY_CURRENT_USER\48q\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Xe
  • In HKEY_CURRENT_USER\Xe
    • DefaultIcon
  • In HKEY_CURRENT_USER\Xe
    • shell
  • In HKEY_CURRENT_USER\Xe\shell
    • open
  • In HKEY_CURRENT_USER\Xe\shell\open
    • command
  • In HKEY_CURRENT_USER\Xe\shell
    • runas
  • In HKEY_CURRENT_USER\Xe\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Wc
  • In HKEY_CURRENT_USER\Wc
    • DefaultIcon
  • In HKEY_CURRENT_USER\Wc
    • shell
  • In HKEY_CURRENT_USER\Wc\shell
    • open
  • In HKEY_CURRENT_USER\Wc\shell\open
    • command
  • In HKEY_CURRENT_USER\Wc\shell
    • runas
  • In HKEY_CURRENT_USER\Wc\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 7n
  • In HKEY_CURRENT_USER\7n
    • DefaultIcon
  • In HKEY_CURRENT_USER\7n
    • shell
  • In HKEY_CURRENT_USER\7n\shell
    • open
  • In HKEY_CURRENT_USER\7n\shell\open
    • command
  • In HKEY_CURRENT_USER\7n\shell
    • runas
  • In HKEY_CURRENT_USER\7n\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • I2
  • In HKEY_CURRENT_USER\I2
    • DefaultIcon
  • In HKEY_CURRENT_USER\I2
    • shell
  • In HKEY_CURRENT_USER\I2\shell
    • open
  • In HKEY_CURRENT_USER\I2\shell\open
    • command
  • In HKEY_CURRENT_USER\I2\shell
    • runas
  • In HKEY_CURRENT_USER\I2\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • G0
  • In HKEY_CURRENT_USER\G0
    • DefaultIcon
  • In HKEY_CURRENT_USER\G0
    • shell
  • In HKEY_CURRENT_USER\G0\shell
    • open
  • In HKEY_CURRENT_USER\G0\shell\open
    • command
  • In HKEY_CURRENT_USER\G0\shell
    • runas
  • In HKEY_CURRENT_USER\G0\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 87
  • In HKEY_CURRENT_USER\87
    • DefaultIcon
  • In HKEY_CURRENT_USER\87
    • shell
  • In HKEY_CURRENT_USER\87\shell
    • open
  • In HKEY_CURRENT_USER\87\shell\open
    • command
  • In HKEY_CURRENT_USER\87\shell
    • runas
  • In HKEY_CURRENT_USER\87\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 686
  • In HKEY_CURRENT_USER\686
    • DefaultIcon
  • In HKEY_CURRENT_USER\686
    • shell
  • In HKEY_CURRENT_USER\686\shell
    • open
  • In HKEY_CURRENT_USER\686\shell\open
    • command
  • In HKEY_CURRENT_USER\686\shell
    • runas
  • In HKEY_CURRENT_USER\686\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • wJ4
  • In HKEY_CURRENT_USER\wJ4
    • DefaultIcon
  • In HKEY_CURRENT_USER\wJ4
    • shell
  • In HKEY_CURRENT_USER\wJ4\shell
    • open
  • In HKEY_CURRENT_USER\wJ4\shell\open
    • command
  • In HKEY_CURRENT_USER\wJ4\shell
    • runas
  • In HKEY_CURRENT_USER\wJ4\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 08l
  • In HKEY_CURRENT_USER\08l
    • DefaultIcon
  • In HKEY_CURRENT_USER\08l
    • shell
  • In HKEY_CURRENT_USER\08l\shell
    • open
  • In HKEY_CURRENT_USER\08l\shell\open
    • command
  • In HKEY_CURRENT_USER\08l\shell
    • runas
  • In HKEY_CURRENT_USER\08l\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • et
  • In HKEY_CURRENT_USER\et
    • DefaultIcon
  • In HKEY_CURRENT_USER\et
    • shell
  • In HKEY_CURRENT_USER\et\shell
    • open
  • In HKEY_CURRENT_USER\et\shell\open
    • command
  • In HKEY_CURRENT_USER\et\shell
    • runas
  • In HKEY_CURRENT_USER\et\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • qc
  • In HKEY_CURRENT_USER\qc
    • DefaultIcon
  • In HKEY_CURRENT_USER\qc
    • shell
  • In HKEY_CURRENT_USER\qc\shell
    • open
  • In HKEY_CURRENT_USER\qc\shell\open
    • command
  • In HKEY_CURRENT_USER\qc\shell
    • runas
  • In HKEY_CURRENT_USER\qc\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • KT
  • In HKEY_CURRENT_USER\KT
    • DefaultIcon
  • In HKEY_CURRENT_USER\KT
    • shell
  • In HKEY_CURRENT_USER\KT\shell
    • open
  • In HKEY_CURRENT_USER\KT\shell\open
    • command
  • In HKEY_CURRENT_USER\KT\shell
    • runas
  • In HKEY_CURRENT_USER\KT\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • yS
  • In HKEY_CURRENT_USER\yS
    • DefaultIcon
  • In HKEY_CURRENT_USER\yS
    • shell
  • In HKEY_CURRENT_USER\yS\shell
    • open
  • In HKEY_CURRENT_USER\yS\shell\open
    • command
  • In HKEY_CURRENT_USER\yS\shell
    • runas
  • In HKEY_CURRENT_USER\yS\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • YrH
  • In HKEY_CURRENT_USER\YrH
    • DefaultIcon
  • In HKEY_CURRENT_USER\YrH
    • shell
  • In HKEY_CURRENT_USER\YrH\shell
    • open
  • In HKEY_CURRENT_USER\YrH\shell\open
    • command
  • In HKEY_CURRENT_USER\YrH\shell
    • runas
  • In HKEY_CURRENT_USER\YrH\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 3Xa
  • In HKEY_CURRENT_USER\3Xa
    • DefaultIcon
  • In HKEY_CURRENT_USER\3Xa
    • shell
  • In HKEY_CURRENT_USER\3Xa\shell
    • open
  • In HKEY_CURRENT_USER\3Xa\shell\open
    • command
  • In HKEY_CURRENT_USER\3Xa\shell
    • runas
  • In HKEY_CURRENT_USER\3Xa\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • hI
  • In HKEY_CURRENT_USER\hI
    • DefaultIcon
  • In HKEY_CURRENT_USER\hI
    • shell
  • In HKEY_CURRENT_USER\hI\shell
    • open
  • In HKEY_CURRENT_USER\hI\shell\open
    • command
  • In HKEY_CURRENT_USER\hI\shell
    • runas
  • In HKEY_CURRENT_USER\hI\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • SCq
  • In HKEY_CURRENT_USER\SCq
    • DefaultIcon
  • In HKEY_CURRENT_USER\SCq
    • shell
  • In HKEY_CURRENT_USER\SCq\shell
    • open
  • In HKEY_CURRENT_USER\SCq\shell\open
    • command
  • In HKEY_CURRENT_USER\SCq\shell
    • runas
  • In HKEY_CURRENT_USER\SCq\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • im
  • In HKEY_CURRENT_USER\im
    • DefaultIcon
  • In HKEY_CURRENT_USER\im
    • shell
  • In HKEY_CURRENT_USER\im\shell
    • open
  • In HKEY_CURRENT_USER\im\shell\open
    • command
  • In HKEY_CURRENT_USER\im\shell
    • runas
  • In HKEY_CURRENT_USER\im\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 808
  • In HKEY_CURRENT_USER\808
    • DefaultIcon
  • In HKEY_CURRENT_USER\808
    • shell
  • In HKEY_CURRENT_USER\808\shell
    • open
  • In HKEY_CURRENT_USER\808\shell\open
    • command
  • In HKEY_CURRENT_USER\808\shell
    • runas
  • In HKEY_CURRENT_USER\808\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 67y
  • In HKEY_CURRENT_USER\67y
    • DefaultIcon
  • In HKEY_CURRENT_USER\67y
    • shell
  • In HKEY_CURRENT_USER\67y\shell
    • open
  • In HKEY_CURRENT_USER\67y\shell\open
    • command
  • In HKEY_CURRENT_USER\67y\shell
    • runas
  • In HKEY_CURRENT_USER\67y\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • cm
  • In HKEY_CURRENT_USER\cm
    • DefaultIcon
  • In HKEY_CURRENT_USER\cm
    • shell
  • In HKEY_CURRENT_USER\cm\shell
    • open
  • In HKEY_CURRENT_USER\cm\shell\open
    • command
  • In HKEY_CURRENT_USER\cm\shell
    • runas
  • In HKEY_CURRENT_USER\cm\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Vrf
  • In HKEY_CURRENT_USER\Vrf
    • DefaultIcon
  • In HKEY_CURRENT_USER\Vrf
    • shell
  • In HKEY_CURRENT_USER\Vrf\shell
    • open
  • In HKEY_CURRENT_USER\Vrf\shell\open
    • command
  • In HKEY_CURRENT_USER\Vrf\shell
    • runas
  • In HKEY_CURRENT_USER\Vrf\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • u6R
  • In HKEY_CURRENT_USER\u6R
    • DefaultIcon
  • In HKEY_CURRENT_USER\u6R
    • shell
  • In HKEY_CURRENT_USER\u6R\shell
    • open
  • In HKEY_CURRENT_USER\u6R\shell\open
    • command
  • In HKEY_CURRENT_USER\u6R\shell
    • runas
  • In HKEY_CURRENT_USER\u6R\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • eEu
  • In HKEY_CURRENT_USER\eEu
    • DefaultIcon
  • In HKEY_CURRENT_USER\eEu
    • shell
  • In HKEY_CURRENT_USER\eEu\shell
    • open
  • In HKEY_CURRENT_USER\eEu\shell\open
    • command
  • In HKEY_CURRENT_USER\eEu\shell
    • runas
  • In HKEY_CURRENT_USER\eEu\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 1NS
  • In HKEY_CURRENT_USER\1NS
    • DefaultIcon
  • In HKEY_CURRENT_USER\1NS
    • shell
  • In HKEY_CURRENT_USER\1NS\shell
    • open
  • In HKEY_CURRENT_USER\1NS\shell\open
    • command
  • In HKEY_CURRENT_USER\1NS\shell
    • runas
  • In HKEY_CURRENT_USER\1NS\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • BNv
  • In HKEY_CURRENT_USER\BNv
    • DefaultIcon
  • In HKEY_CURRENT_USER\BNv
    • shell
  • In HKEY_CURRENT_USER\BNv\shell
    • open
  • In HKEY_CURRENT_USER\BNv\shell\open
    • command
  • In HKEY_CURRENT_USER\BNv\shell
    • runas
  • In HKEY_CURRENT_USER\BNv\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 7L
  • In HKEY_CURRENT_USER\7L
    • DefaultIcon
  • In HKEY_CURRENT_USER\7L
    • shell
  • In HKEY_CURRENT_USER\7L\shell
    • open
  • In HKEY_CURRENT_USER\7L\shell\open
    • command
  • In HKEY_CURRENT_USER\7L\shell
    • runas
  • In HKEY_CURRENT_USER\7L\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • Tu
  • In HKEY_CURRENT_USER\Tu
    • DefaultIcon
  • In HKEY_CURRENT_USER\Tu
    • shell
  • In HKEY_CURRENT_USER\Tu\shell
    • open
  • In HKEY_CURRENT_USER\Tu\shell\open
    • command
  • In HKEY_CURRENT_USER\Tu\shell
    • runas
  • In HKEY_CURRENT_USER\Tu\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • p7
  • In HKEY_CURRENT_USER\p7
    • DefaultIcon
  • In HKEY_CURRENT_USER\p7
    • shell
  • In HKEY_CURRENT_USER\p7\shell
    • open
  • In HKEY_CURRENT_USER\p7\shell\open
    • command
  • In HKEY_CURRENT_USER\p7\shell
    • runas
  • In HKEY_CURRENT_USER\p7\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • iSB
  • In HKEY_CURRENT_USER\iSB
    • DefaultIcon
  • In HKEY_CURRENT_USER\iSB
    • shell
  • In HKEY_CURRENT_USER\iSB\shell
    • open
  • In HKEY_CURRENT_USER\iSB\shell\open
    • command
  • In HKEY_CURRENT_USER\iSB\shell
    • runas
  • In HKEY_CURRENT_USER\iSB\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 27w
  • In HKEY_CURRENT_USER\27w
    • DefaultIcon
  • In HKEY_CURRENT_USER\27w
    • shell
  • In HKEY_CURRENT_USER\27w\shell
    • open
  • In HKEY_CURRENT_USER\27w\shell\open
    • command
  • In HKEY_CURRENT_USER\27w\shell
    • runas
  • In HKEY_CURRENT_USER\27w\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 7B
  • In HKEY_CURRENT_USER\7B
    • DefaultIcon
  • In HKEY_CURRENT_USER\7B
    • shell
  • In HKEY_CURRENT_USER\7B\shell
    • open
  • In HKEY_CURRENT_USER\7B\shell\open
    • command
  • In HKEY_CURRENT_USER\7B\shell
    • runas
  • In HKEY_CURRENT_USER\7B\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • BP
  • In HKEY_CURRENT_USER\BP
    • DefaultIcon
  • In HKEY_CURRENT_USER\BP
    • shell
  • In HKEY_CURRENT_USER\BP\shell
    • open
  • In HKEY_CURRENT_USER\BP\shell\open
    • command
  • In HKEY_CURRENT_USER\BP\shell
    • runas
  • In HKEY_CURRENT_USER\BP\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • CEq
  • In HKEY_CURRENT_USER\CEq
    • DefaultIcon
  • In HKEY_CURRENT_USER\CEq
    • shell
  • In HKEY_CURRENT_USER\CEq\shell
    • open
  • In HKEY_CURRENT_USER\CEq\shell\open
    • command
  • In HKEY_CURRENT_USER\CEq\shell
    • runas
  • In HKEY_CURRENT_USER\CEq\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 5m
  • In HKEY_CURRENT_USER\5m
    • DefaultIcon
  • In HKEY_CURRENT_USER\5m
    • shell
  • In HKEY_CURRENT_USER\5m\shell
    • open
  • In HKEY_CURRENT_USER\5m\shell\open
    • command
  • In HKEY_CURRENT_USER\5m\shell
    • runas
  • In HKEY_CURRENT_USER\5m\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • 7c5
  • In HKEY_CURRENT_USER\7c5
    • DefaultIcon
  • In HKEY_CURRENT_USER\7c5
    • shell
  • In HKEY_CURRENT_USER\7c5\shell
    • open
  • In HKEY_CURRENT_USER\7c5\shell\open
    • command
  • In HKEY_CURRENT_USER\7c5\shell
    • runas
  • In HKEY_CURRENT_USER\7c5\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • X0
  • In HKEY_CURRENT_USER\X0
    • DefaultIcon
  • In HKEY_CURRENT_USER\X0
    • shell
  • In HKEY_CURRENT_USER\X0\shell
    • open
  • In HKEY_CURRENT_USER\X0\shell\open
    • command
  • In HKEY_CURRENT_USER\X0\shell
    • runas
  • In HKEY_CURRENT_USER\X0\shell\runas
    • command
  • In HKEY_CURRENT_USER
    • sr5
  • In HKEY_CURRENT_USER\sr5
    • DefaultIcon
  • In HKEY_CURRENT_USER\sr5
    • shell
  • In HKEY_CURRENT_USER\sr5\shell
    • open
  • In HKEY_CURRENT_USER\sr5\shell\open
    • command
  • In HKEY_CURRENT_USER\sr5\shell
    • runas
  • In HKEY_CURRENT_USER\sr5\shell\runas
    • command

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • EnableFirewall = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DoNotAllowExceptions = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DisableNotifications = "1"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
    • EnableFirewall = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
    • DoNotAllowExceptions = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
    • DisableNotifications = "1"
  • In HKEY_CURRENT_USER\.exe
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\.exe\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\.exe\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\hb
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\hb\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\hb\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows
    • Local = "ab19919"
  • In HKEY_CURRENT_USER\b8
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\b8\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\b8\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\701
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\701\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\701\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3cU
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\3cU\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3cU\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\48
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\48\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\48\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\c7
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\c7\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\c7\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Qu
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Qu\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Qu\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\k6n
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\k6n\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\k6n\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3rs
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\3rs\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3rs\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Vp
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Vp\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Vp\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\nF
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\nF\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\nF\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\enF
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\enF\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\enF\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gUm
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\gUm\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gUm\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\xti
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\xti\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\xti\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\8E2
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\8E2\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\8E2\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\EW3
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\EW3\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\EW3\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\h6v
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\h6v\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\h6v\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6x6
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\6x6\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6x6\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gdI
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\gdI\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gdI\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\84
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\84\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\84\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\tdG
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\tdG\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\tdG\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\M6X
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\M6X\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\M6X\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\atn
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\atn\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\atn\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\lWb
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\lWb\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\lWb\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\QP
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\QP\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\QP\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\le
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\le\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\le\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\35
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\35\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\35\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\36
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\36\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\36\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\ja
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\ja\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\ja\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1T1
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\1T1\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1T1\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\l6
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\l6\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\l6\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\WEd
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\WEd\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\WEd\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\86Q
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\86Q\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\86Q\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\TM
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\TM\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\TM\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\rI
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\rI\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\rI\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gss
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\gss\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gss\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\wf
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\wf\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\wf\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1V
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\1V\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1V\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6G5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\6G5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6G5\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\15c
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\15c\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\15c\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\I28
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\I28\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\I28\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\LH
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\LH\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\LH\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Kf5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Kf5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Kf5\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Wy
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Wy\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Wy\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\72
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\72\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\72\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Y1c
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Y1c\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Y1c\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\ct
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\ct\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\ct\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\rxa
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\rxa\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\rxa\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\U88
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\U88\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\U88\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\jY
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\jY\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\jY\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1x
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\1x\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1x\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gg
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\gg\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gg\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gx
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\gx\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\gx\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\lh5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\lh5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\lh5\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Rp
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Rp\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Rp\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3b
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\3b\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3b\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\wyp
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\wyp\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\wyp\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Pv
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Pv\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Pv\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\JEy
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\JEy\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\JEy\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6oX
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\6oX\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6oX\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\QO1
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\QO1\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\QO1\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\chF
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\chF\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\chF\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6R
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\6R\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6R\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6w
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\6w\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6w\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\cl
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\cl\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\cl\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\38
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\38\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\38\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\55L
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\55L\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\55L\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\08
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\08\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\08\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\70
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\70\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\70\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\624
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\624\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\624\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Cbd
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Cbd\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Cbd\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\O1
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\O1\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\O1\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\IA
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\IA\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\IA\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\0At
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\0At\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\0At\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\b4W
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\b4W\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\b4W\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\5BF
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\5BF\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\5BF\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\pK
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\pK\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\pK\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\50g
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\50g\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\50g\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\JG
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\JG\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\JG\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\bg
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\bg\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\bg\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6Tb
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\6Tb\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\6Tb\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\RP2
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\RP2\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\RP2\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\V4w
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\V4w\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\V4w\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\52Y
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\52Y\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\52Y\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\8R
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\8R\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\8R\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Kgx
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Kgx\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Kgx\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\HFB
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\HFB\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\HFB\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\EX
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\EX\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\EX\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7vF
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\7vF\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7vF\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Jvg
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Jvg\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Jvg\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\0W
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\0W\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\0W\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\V5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\V5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\V5\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\vK4
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\vK4\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\vK4\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\dJ
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\dJ\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\dJ\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\558
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\558\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\558\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\tq1
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\tq1\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\tq1\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\tC8
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\tC8\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\tC8\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\SIr
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\SIr\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\SIr\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\rj6
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\rj6\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\rj6\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\uhs
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\uhs\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\uhs\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\11
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\11\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\11\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\4TD
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\4TD\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\4TD\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\T8
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\T8\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\T8\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\oeP
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\oeP\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\oeP\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Xtj
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Xtj\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Xtj\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\s1
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\s1\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\s1\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\42R
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\42R\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\42R\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\L1p
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\L1p\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\L1p\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\t3
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\t3\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\t3\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\85L
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\85L\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\85L\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\jk
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\jk\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\jk\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1oX
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\1oX\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1oX\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\547
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\547\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\547\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\18Y
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\18Y\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\18Y\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\AiX
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\AiX\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\AiX\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7C3
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\7C3\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7C3\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\V3G
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\V3G\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\V3G\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\b63
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\b63\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\b63\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\TY5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\TY5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\TY5\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\48q
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\48q\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\48q\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Xe
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Xe\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Xe\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Wc
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Wc\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Wc\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7n
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\7n\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7n\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\I2
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\I2\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\I2\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\G0
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\G0\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\G0\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\87
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\87\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\87\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\686
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\686\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\686\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\wJ4
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\wJ4\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\wJ4\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\08l
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\08l\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\08l\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\et
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\et\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\et\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\qc
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\qc\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\qc\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\KT
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\KT\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\KT\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\yS
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\yS\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\yS\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\YrH
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\YrH\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\YrH\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3Xa
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\3Xa\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\3Xa\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\hI
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\hI\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\hI\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\SCq
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\SCq\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\SCq\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\im
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\im\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\im\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\808
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\808\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\808\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\67y
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\67y\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\67y\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\cm
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\cm\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\cm\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Vrf
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Vrf\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Vrf\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\u6R
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\u6R\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\u6R\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\eEu
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\eEu\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\eEu\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1NS
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\1NS\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\1NS\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\BNv
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\BNv\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\BNv\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7L
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\7L\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7L\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Tu
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\Tu\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\Tu\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\p7
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\p7\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\p7\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\iSB
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\iSB\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\iSB\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\27w
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\27w\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\27w\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7B
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\7B\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7B\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\BP
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\BP\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\BP\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\CEq
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\CEq\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\CEq\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\5m
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\5m\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\5m\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7c5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\7c5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\7c5\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\X0
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\X0\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\X0\shell\runas\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\sr5
    • Content Type = "application/x-msdownload"
  • In HKEY_CURRENT_USER\sr5\shell\open\command
    • IsolatedCommand = "%1 %*"
  • In HKEY_CURRENT_USER\sr5\shell\runas\command
    • IsolatedCommand = "%1 %*"

Step 4

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess
    • From: Start = "4"
      To: Start = ""2""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UpdatesDisableNotify = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
    • From: FontCachePath = "%Application Data%"
      To: FontCachePath = ""%User Profile%\Local Settings\Application Data""

Step 5

Search and delete this file

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %Application Data%\voo.exe

Step 6

Scan your computer with your Trend Micro product to delete files detected as TROJ_FAKEAV.LLV. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 7

Restore deleted/modified files and/or registry entries from backup

*Note: Only Microsoft-related files/keys/values will be restored. If this malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

    • %Application Data%\GDIPFONTCACHEV1.DAT


Did this description help? Tell us how we did.