TROJ_BREDOZP.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies files, disabling programs and applications from properly running. It disables Task Manager, Registry Editor, and Folder Options.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Application Data\csrss.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\Microsoft\Protect

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
uxdi = "rundll32 %User Profile%\Protect\sjla.m, kpgw"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
djiax = "rundll32 %User Profile%\Protect\ldbeig.hf, byta"

Other System Modifications

This Trojan modifies the following files:

• %Application Data%\GDIPFONTCACHEV1.DAT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It deletes the following files:

• %User Profile%\Application Data\csrss.exe
• %User Profile%\Application Data\csrss.exe:Zone.Identifier
• %User Temp%\1.tmp
• %User Temp%\2.tmp
• %User Temp%\3.tmp
• %User Temp%\4.tmp
• %Application Data%\aeu.exe
• %Application Data%\shj.exe
• %Application Data%\duk.exe
• %Application Data%\jmq.exe
• %Application Data%\yth.exe
• %User Profile%\Application Data\fte.exe
• %User Profile%\Application Data\rvk.exe
• %User Profile%\Application Data\brx.exe
• %User Profile%\Application Data\rnw.exe
• %User Profile%\Application Data\dbf.exe
• %User Temp%\hti.exe
• %User Temp%\qyd.exe
• %User Temp%\gnq.exe
• %User Temp%\aym.exe
• %User Temp%\uct.exe
• %User Profile%\Templates\mii.exe
• %User Profile%\Templates\yrd.exe
• %User Profile%\Templates\qwg.exe
• %User Profile%\Templates\msa.exe
• %User Profile%\Templates\tgd.exe
• %User Profile%\Protect\gs32.txt

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CURRENT_USER\Mb4\shell\
runas\command

HKEY_CURRENT_USER\6r0

HKEY_CURRENT_USER\6r0\DefaultIcon

HKEY_CURRENT_USER\6r0\shell

HKEY_CURRENT_USER\6r0\shell\
open

HKEY_CURRENT_USER\6r0\shell\
open\command

HKEY_CURRENT_USER\6r0\shell\
runas

HKEY_CURRENT_USER\6r0\shell\
runas\command

HKEY_CURRENT_USER\E56

HKEY_CURRENT_USER\E56\DefaultIcon

HKEY_CURRENT_USER\E56\shell

HKEY_CURRENT_USER\E56\shell\
open

HKEY_CURRENT_USER\E56\shell\
open\command

HKEY_CURRENT_USER\E56\shell\
runas

HKEY_CURRENT_USER\E56\shell\
runas\command

HKEY_CURRENT_USER\01e

HKEY_CURRENT_USER\01e\DefaultIcon

HKEY_CURRENT_USER\01e\shell

HKEY_CURRENT_USER\01e\shell\
open

HKEY_CURRENT_USER\01e\shell\
open\command

HKEY_CURRENT_USER\01e\shell\
runas

HKEY_CURRENT_USER\01e\shell\
runas\command

HKEY_CURRENT_USER\V44

HKEY_CURRENT_USER\V44\DefaultIcon

HKEY_CURRENT_USER\V44\shell

HKEY_CURRENT_USER\V44\shell\
open

HKEY_CURRENT_USER\V44\shell\
open\command

HKEY_CURRENT_USER\V44\shell\
runas

HKEY_CURRENT_USER\V44\shell\
runas\command

HKEY_CURRENT_USER\uB8

HKEY_CURRENT_USER\uB8\DefaultIcon

HKEY_CURRENT_USER\uB8\shell

HKEY_CURRENT_USER\uB8\shell\
open

HKEY_CURRENT_USER\uB8\shell\
open\command

HKEY_CURRENT_USER\uB8\shell\
runas

HKEY_CURRENT_USER\uB8\shell\
runas\command

HKEY_CURRENT_USER\BI

HKEY_CURRENT_USER\BI\DefaultIcon

HKEY_CURRENT_USER\BI\shell

HKEY_CURRENT_USER\BI\shell\
open

HKEY_CURRENT_USER\BI\shell\
open\command

HKEY_CURRENT_USER\BI\shell\
runas

HKEY_CURRENT_USER\BI\shell\
runas\command

HKEY_CURRENT_USER\wg

HKEY_CURRENT_USER\wg\DefaultIcon

HKEY_CURRENT_USER\wg\shell

HKEY_CURRENT_USER\wg\shell\
open

HKEY_CURRENT_USER\wg\shell\
open\command

HKEY_CURRENT_USER\wg\shell\
runas

HKEY_CURRENT_USER\wg\shell\
runas\command

HKEY_CURRENT_USER\Yq8

HKEY_CURRENT_USER\Yq8\DefaultIcon

HKEY_CURRENT_USER\Yq8\shell

HKEY_CURRENT_USER\Yq8\shell\
open

HKEY_CURRENT_USER\Yq8\shell\
open\command

HKEY_CURRENT_USER\Yq8\shell\
runas

HKEY_CURRENT_USER\Yq8\shell\
runas\command

HKEY_CURRENT_USER\Jv

HKEY_CURRENT_USER\Jv\DefaultIcon

HKEY_CURRENT_USER\Jv\shell

HKEY_CURRENT_USER\Jv\shell\
open

HKEY_CURRENT_USER\Jv\shell\
open\command

HKEY_CURRENT_USER\Jv\shell\
runas

HKEY_CURRENT_USER\Jv\shell\
runas\command

HKEY_CURRENT_USER\6R

HKEY_CURRENT_USER\6R\DefaultIcon

HKEY_CURRENT_USER\6R\shell

HKEY_CURRENT_USER\6R\shell\
open

HKEY_CURRENT_USER\6R\shell\
open\command

HKEY_CURRENT_USER\6R\shell\
runas

HKEY_CURRENT_USER\6R\shell\
runas\command

HKEY_CURRENT_USER\HlB

HKEY_CURRENT_USER\HlB\DefaultIcon

HKEY_CURRENT_USER\HlB\shell

HKEY_CURRENT_USER\HlB\shell\
open

HKEY_CURRENT_USER\HlB\shell\
open\command

HKEY_CURRENT_USER\HlB\shell\
runas

HKEY_CURRENT_USER\HlB\shell\
runas\command

HKEY_CURRENT_USER\0a

HKEY_CURRENT_USER\0a\DefaultIcon

HKEY_CURRENT_USER\0a\shell

HKEY_CURRENT_USER\0a\shell\
open

HKEY_CURRENT_USER\0a\shell\
open\command

HKEY_CURRENT_USER\0a\shell\
runas

HKEY_CURRENT_USER\0a\shell\
runas\command

HKEY_CURRENT_USER\Qn

HKEY_CURRENT_USER\Qn\DefaultIcon

HKEY_CURRENT_USER\Qn\shell

HKEY_CURRENT_USER\Qn\shell\
open

HKEY_CURRENT_USER\Qn\shell\
open\command

HKEY_CURRENT_USER\Qn\shell\
runas

HKEY_CURRENT_USER\Qn\shell\
runas\command

HKEY_CURRENT_USER\Glr

HKEY_CURRENT_USER\Glr\DefaultIcon

HKEY_CURRENT_USER\Glr\shell

HKEY_CURRENT_USER\Glr\shell\
open

HKEY_CURRENT_USER\Glr\shell\
open\command

HKEY_CURRENT_USER\Glr\shell\
runas

HKEY_CURRENT_USER\Glr\shell\
runas\command

HKEY_CURRENT_USER\OW

HKEY_CURRENT_USER\OW\DefaultIcon

HKEY_CURRENT_USER\OW\shell

HKEY_CURRENT_USER\OW\shell\
open

HKEY_CURRENT_USER\OW\shell\
open\command

HKEY_CURRENT_USER\OW\shell\
runas

HKEY_CURRENT_USER\OW\shell\
runas\command

HKEY_CURRENT_USER\GH

HKEY_CURRENT_USER\GH\DefaultIcon

HKEY_CURRENT_USER\GH\shell

HKEY_CURRENT_USER\GH\shell\
open

HKEY_CURRENT_USER\GH\shell\
open\command

HKEY_CURRENT_USER\GH\shell\
runas

HKEY_CURRENT_USER\GH\shell\
runas\command

HKEY_CURRENT_USER\5Tv

HKEY_CURRENT_USER\5Tv\DefaultIcon

HKEY_CURRENT_USER\5Tv\shell

HKEY_CURRENT_USER\5Tv\shell\
open

HKEY_CURRENT_USER\5Tv\shell\
open\command

HKEY_CURRENT_USER\5Tv\shell\
runas

HKEY_CURRENT_USER\5Tv\shell\
runas\command

HKEY_CURRENT_USER\R4

HKEY_CURRENT_USER\R4\DefaultIcon

HKEY_CURRENT_USER\R4\shell

HKEY_CURRENT_USER\R4\shell\
open

HKEY_CURRENT_USER\R4\shell\
open\command

HKEY_CURRENT_USER\R4\shell\
runas

HKEY_CURRENT_USER\R4\shell\
runas\command

HKEY_CURRENT_USER\c5

HKEY_CURRENT_USER\c5\DefaultIcon

HKEY_CURRENT_USER\c5\shell

HKEY_CURRENT_USER\c5\shell\
open

HKEY_CURRENT_USER\c5\shell\
open\command

HKEY_CURRENT_USER\c5\shell\
runas

HKEY_CURRENT_USER\c5\shell\
runas\command

HKEY_CURRENT_USER\OaO

HKEY_CURRENT_USER\OaO\DefaultIcon

HKEY_CURRENT_USER\OaO\shell

HKEY_CURRENT_USER\OaO\shell\
open

HKEY_CURRENT_USER\OaO\shell\
open\command

HKEY_CURRENT_USER\OaO\shell\
runas

HKEY_CURRENT_USER\OaO\shell\
runas\command

HKEY_CURRENT_USER\3u

HKEY_CURRENT_USER\3u\DefaultIcon

HKEY_CURRENT_USER\3u\shell

HKEY_CURRENT_USER\3u\shell\
open

HKEY_CURRENT_USER\3u\shell\
open\command

HKEY_CURRENT_USER\3u\shell\
runas

HKEY_CURRENT_USER\3u\shell\
runas\command

HKEY_CURRENT_USER\L34

HKEY_CURRENT_USER\L34\DefaultIcon

HKEY_CURRENT_USER\L34\shell

HKEY_CURRENT_USER\L34\shell\
open

HKEY_CURRENT_USER\L34\shell\
open\command

HKEY_CURRENT_USER\L34\shell\
runas

HKEY_CURRENT_USER\L34\shell\
runas\command

HKEY_CURRENT_USER\bUO

HKEY_CURRENT_USER\bUO\DefaultIcon

HKEY_CURRENT_USER\bUO\shell

HKEY_CURRENT_USER\bUO\shell\
open

HKEY_CURRENT_USER\bUO\shell\
open\command

HKEY_CURRENT_USER\bUO\shell\
runas

HKEY_CURRENT_USER\bUO\shell\
runas\command

HKEY_CURRENT_USER\1Q1

HKEY_CURRENT_USER\1Q1\DefaultIcon

HKEY_CURRENT_USER\1Q1\shell

HKEY_CURRENT_USER\1Q1\shell\
open

HKEY_CURRENT_USER\1Q1\shell\
open\command

HKEY_CURRENT_USER\1Q1\shell\
runas

HKEY_CURRENT_USER\1Q1\shell\
runas\command

HKEY_CURRENT_USER\q8r

HKEY_CURRENT_USER\q8r\DefaultIcon

HKEY_CURRENT_USER\q8r\shell

HKEY_CURRENT_USER\q8r\shell\
open

HKEY_CURRENT_USER\q8r\shell\
open\command

HKEY_CURRENT_USER\q8r\shell\
runas

HKEY_CURRENT_USER\q8r\shell\
runas\command

HKEY_CURRENT_USER\1aI

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_CURRENT_USER\.exe

HKEY_CURRENT_USER\.exe\DefaultIcon

HKEY_CURRENT_USER\.exe\shell

HKEY_CURRENT_USER\.exe\shell\
open

HKEY_CURRENT_USER\.exe\shell\
open\command

HKEY_CURRENT_USER\.exe\shell\
runas

HKEY_CURRENT_USER\.exe\shell\
runas\command

HKEY_CURRENT_USER\P82

HKEY_CURRENT_USER\P82\DefaultIcon

HKEY_CURRENT_USER\P82\shell

HKEY_CURRENT_USER\P82\shell\
open

HKEY_CURRENT_USER\P82\shell\
open\command

HKEY_CURRENT_USER\P82\shell\
runas

HKEY_CURRENT_USER\P82\shell\
runas\command

HKEY_CURRENT_USER\Y8

HKEY_CURRENT_USER\Y8\DefaultIcon

HKEY_CURRENT_USER\Y8\shell

HKEY_CURRENT_USER\Y8\shell\
open

HKEY_CURRENT_USER\Y8\shell\
open\command

HKEY_CURRENT_USER\Y8\shell\
runas

HKEY_CURRENT_USER\Y8\shell\
runas\command

HKEY_CURRENT_USER\c7

HKEY_CURRENT_USER\c7\DefaultIcon

HKEY_CURRENT_USER\c7\shell

HKEY_CURRENT_USER\c7\shell\
open

HKEY_CURRENT_USER\c7\shell\
open\command

HKEY_CURRENT_USER\c7\shell\
runas

HKEY_CURRENT_USER\c7\shell\
runas\command

HKEY_CURRENT_USER\34

HKEY_CURRENT_USER\34\DefaultIcon

HKEY_CURRENT_USER\34\shell

HKEY_CURRENT_USER\34\shell\
open

HKEY_CURRENT_USER\34\shell\
open\command

HKEY_CURRENT_USER\34\shell\
runas

HKEY_CURRENT_USER\34\shell\
runas\command

HKEY_CURRENT_USER\T5

HKEY_CURRENT_USER\T5\DefaultIcon

HKEY_CURRENT_USER\T5\shell

HKEY_CURRENT_USER\T5\shell\
open

HKEY_CURRENT_USER\T5\shell\
open\command

HKEY_CURRENT_USER\T5\shell\
runas

HKEY_CURRENT_USER\T5\shell\
runas\command

HKEY_CURRENT_USER\jG

HKEY_CURRENT_USER\jG\DefaultIcon

HKEY_CURRENT_USER\jG\shell

HKEY_CURRENT_USER\jG\shell\
open

HKEY_CURRENT_USER\jG\shell\
open\command

HKEY_CURRENT_USER\jG\shell\
runas

HKEY_CURRENT_USER\jG\shell\
runas\command

HKEY_CURRENT_USER\LRO

HKEY_CURRENT_USER\LRO\DefaultIcon

HKEY_CURRENT_USER\LRO\shell

HKEY_CURRENT_USER\LRO\shell\
open

HKEY_CURRENT_USER\LRO\shell\
open\command

HKEY_CURRENT_USER\LRO\shell\
runas

HKEY_CURRENT_USER\LRO\shell\
runas\command

HKEY_CURRENT_USER\3Q

HKEY_CURRENT_USER\3Q\DefaultIcon

HKEY_CURRENT_USER\1aI\DefaultIcon

HKEY_CURRENT_USER\1aI\shell

HKEY_CURRENT_USER\1aI\shell\
open

HKEY_CURRENT_USER\1aI\shell\
open\command

HKEY_CURRENT_USER\1aI\shell\
runas

HKEY_CURRENT_USER\1aI\shell\
runas\command

HKEY_CURRENT_USER\IS

HKEY_CURRENT_USER\IS\DefaultIcon

HKEY_CURRENT_USER\IS\shell

HKEY_CURRENT_USER\IS\shell\
open

HKEY_CURRENT_USER\IS\shell\
open\command

HKEY_CURRENT_USER\IS\shell\
runas

HKEY_CURRENT_USER\IS\shell\
runas\command

HKEY_CURRENT_USER\Nn0

HKEY_CURRENT_USER\Nn0\DefaultIcon

HKEY_CURRENT_USER\Nn0\shell

HKEY_CURRENT_USER\Nn0\shell\
open

HKEY_CURRENT_USER\Nn0\shell\
open\command

HKEY_CURRENT_USER\Nn0\shell\
runas

HKEY_CURRENT_USER\Nn0\shell\
runas\command

HKEY_CURRENT_USER\17i

HKEY_CURRENT_USER\17i\DefaultIcon

HKEY_CURRENT_USER\17i\shell

HKEY_CURRENT_USER\17i\shell\
open

HKEY_CURRENT_USER\17i\shell\
open\command

HKEY_CURRENT_USER\17i\shell\
runas

HKEY_CURRENT_USER\17i\shell\
runas\command

HKEY_CURRENT_USER\wt6

HKEY_CURRENT_USER\wt6\DefaultIcon

HKEY_CURRENT_USER\wt6\shell

HKEY_CURRENT_USER\wt6\shell\
open

HKEY_CURRENT_USER\wt6\shell\
open\command

HKEY_CURRENT_USER\wt6\shell\
runas

HKEY_CURRENT_USER\wt6\shell\
runas\command

HKEY_CURRENT_USER\Nm1

HKEY_CURRENT_USER\Nm1\DefaultIcon

HKEY_CURRENT_USER\Nm1\shell

HKEY_CURRENT_USER\Nm1\shell\
open

HKEY_CURRENT_USER\Nm1\shell\
open\command

HKEY_CURRENT_USER\Nm1\shell\
runas

HKEY_CURRENT_USER\Nm1\shell\
runas\command

HKEY_CURRENT_USER\16S

HKEY_CURRENT_USER\16S\DefaultIcon

HKEY_CURRENT_USER\16S\shell

HKEY_CURRENT_USER\16S\shell\
open

HKEY_CURRENT_USER\16S\shell\
open\command

HKEY_CURRENT_USER\16S\shell\
runas

HKEY_CURRENT_USER\16S\shell\
runas\command

HKEY_CURRENT_USER\H0o

HKEY_CURRENT_USER\H0o\DefaultIcon

HKEY_CURRENT_USER\H0o\shell

HKEY_CURRENT_USER\H0o\shell\
open

HKEY_CURRENT_USER\H0o\shell\
open\command

HKEY_CURRENT_USER\H0o\shell\
runas

HKEY_CURRENT_USER\H0o\shell\
runas\command

HKEY_CURRENT_USER\BY

HKEY_CURRENT_USER\BY\DefaultIcon

HKEY_CURRENT_USER\BY\shell

HKEY_CURRENT_USER\BY\shell\
open

HKEY_CURRENT_USER\3Q\shell

HKEY_CURRENT_USER\3Q\shell\
open

HKEY_CURRENT_USER\3Q\shell\
open\command

HKEY_CURRENT_USER\3Q\shell\
runas

HKEY_CURRENT_USER\3Q\shell\
runas\command

HKEY_CURRENT_USER\xk

HKEY_CURRENT_USER\xk\DefaultIcon

HKEY_CURRENT_USER\xk\shell

HKEY_CURRENT_USER\xk\shell\
open

HKEY_CURRENT_USER\xk\shell\
open\command

HKEY_CURRENT_USER\xk\shell\
runas

HKEY_CURRENT_USER\xk\shell\
runas\command

HKEY_CURRENT_USER\13

HKEY_CURRENT_USER\13\DefaultIcon

HKEY_CURRENT_USER\13\shell

HKEY_CURRENT_USER\13\shell\
open

HKEY_CURRENT_USER\13\shell\
open\command

HKEY_CURRENT_USER\13\shell\
runas

HKEY_CURRENT_USER\13\shell\
runas\command

HKEY_CURRENT_USER\81

HKEY_CURRENT_USER\81\DefaultIcon

HKEY_CURRENT_USER\81\shell

HKEY_CURRENT_USER\81\shell\
open

HKEY_CURRENT_USER\81\shell\
open\command

HKEY_CURRENT_USER\81\shell\
runas

HKEY_CURRENT_USER\81\shell\
runas\command

HKEY_CURRENT_USER\1a

HKEY_CURRENT_USER\1a\DefaultIcon

HKEY_CURRENT_USER\1a\shell

HKEY_CURRENT_USER\1a\shell\
open

HKEY_CURRENT_USER\1a\shell\
open\command

HKEY_CURRENT_USER\1a\shell\
runas

HKEY_CURRENT_USER\1a\shell\
runas\command

HKEY_CURRENT_USER\46T

HKEY_CURRENT_USER\46T\DefaultIcon

HKEY_CURRENT_USER\46T\shell

HKEY_CURRENT_USER\46T\shell\
open

HKEY_CURRENT_USER\46T\shell\
open\command

HKEY_CURRENT_USER\46T\shell\
runas

HKEY_CURRENT_USER\46T\shell\
runas\command

HKEY_CURRENT_USER\3m

HKEY_CURRENT_USER\3m\DefaultIcon

HKEY_CURRENT_USER\3m\shell

HKEY_CURRENT_USER\3m\shell\
open

HKEY_CURRENT_USER\3m\shell\
open\command

HKEY_CURRENT_USER\3m\shell\
runas

HKEY_CURRENT_USER\3m\shell\
runas\command

HKEY_CURRENT_USER\C1

HKEY_CURRENT_USER\C1\DefaultIcon

HKEY_CURRENT_USER\C1\shell

HKEY_CURRENT_USER\C1\shell\
open

HKEY_CURRENT_USER\C1\shell\
open\command

HKEY_CURRENT_USER\C1\shell\
runas

HKEY_CURRENT_USER\C1\shell\
runas\command

HKEY_CURRENT_USER\wQ5

HKEY_CURRENT_USER\wQ5\DefaultIcon

HKEY_CURRENT_USER\wQ5\shell

HKEY_CURRENT_USER\wQ5\shell\
open

HKEY_CURRENT_USER\wQ5\shell\
open\command

HKEY_CURRENT_USER\wQ5\shell\
runas

HKEY_CURRENT_USER\BY\shell\
open\command

HKEY_CURRENT_USER\BY\shell\
runas

HKEY_CURRENT_USER\BY\shell\
runas\command

HKEY_CURRENT_USER\2Pm

HKEY_CURRENT_USER\2Pm\DefaultIcon

HKEY_CURRENT_USER\2Pm\shell

HKEY_CURRENT_USER\2Pm\shell\
open

HKEY_CURRENT_USER\2Pm\shell\
open\command

HKEY_CURRENT_USER\2Pm\shell\
runas

HKEY_CURRENT_USER\2Pm\shell\
runas\command

HKEY_CURRENT_USER\0u1

HKEY_CURRENT_USER\0u1\DefaultIcon

HKEY_CURRENT_USER\0u1\shell

HKEY_CURRENT_USER\0u1\shell\
open

HKEY_CURRENT_USER\0u1\shell\
open\command

HKEY_CURRENT_USER\0u1\shell\
runas

HKEY_CURRENT_USER\0u1\shell\
runas\command

HKEY_CURRENT_USER\74n

HKEY_CURRENT_USER\74n\DefaultIcon

HKEY_CURRENT_USER\74n\shell

HKEY_CURRENT_USER\74n\shell\
open

HKEY_CURRENT_USER\74n\shell\
open\command

HKEY_CURRENT_USER\74n\shell\
runas

HKEY_CURRENT_USER\74n\shell\
runas\command

HKEY_CURRENT_USER\py

HKEY_CURRENT_USER\py\DefaultIcon

HKEY_CURRENT_USER\py\shell

HKEY_CURRENT_USER\py\shell\
open

HKEY_CURRENT_USER\py\shell\
open\command

HKEY_CURRENT_USER\py\shell\
runas

HKEY_CURRENT_USER\py\shell\
runas\command

HKEY_CURRENT_USER\f15

HKEY_CURRENT_USER\f15\DefaultIcon

HKEY_CURRENT_USER\f15\shell

HKEY_CURRENT_USER\f15\shell\
open

HKEY_CURRENT_USER\f15\shell\
open\command

HKEY_CURRENT_USER\f15\shell\
runas

HKEY_CURRENT_USER\f15\shell\
runas\command

HKEY_CURRENT_USER\Qo

HKEY_CURRENT_USER\Qo\DefaultIcon

HKEY_CURRENT_USER\Qo\shell

HKEY_CURRENT_USER\Qo\shell\
open

HKEY_CURRENT_USER\Qo\shell\
open\command

HKEY_CURRENT_USER\Qo\shell\
runas

HKEY_CURRENT_USER\Qo\shell\
runas\command

HKEY_CURRENT_USER\l0A

HKEY_CURRENT_USER\l0A\DefaultIcon

HKEY_CURRENT_USER\l0A\shell

HKEY_CURRENT_USER\l0A\shell\
open

HKEY_CURRENT_USER\l0A\shell\
open\command

HKEY_CURRENT_USER\l0A\shell\
runas

HKEY_CURRENT_USER\l0A\shell\
runas\command

HKEY_CURRENT_USER\U52

HKEY_CURRENT_USER\U52\DefaultIcon

HKEY_CURRENT_USER\U52\shell

HKEY_CURRENT_USER\U52\shell\
open

HKEY_CURRENT_USER\U52\shell\
open\command

HKEY_CURRENT_USER\U52\shell\
runas

HKEY_CURRENT_USER\U52\shell\
runas\command

HKEY_CURRENT_USER\wQ5\shell\
runas\command

HKEY_CURRENT_USER\23

HKEY_CURRENT_USER\23\DefaultIcon

HKEY_CURRENT_USER\23\shell

HKEY_CURRENT_USER\23\shell\
open

HKEY_CURRENT_USER\23\shell\
open\command

HKEY_CURRENT_USER\23\shell\
runas

HKEY_CURRENT_USER\23\shell\
runas\command

HKEY_CURRENT_USER\D20

HKEY_CURRENT_USER\D20\DefaultIcon

HKEY_CURRENT_USER\D20\shell

HKEY_CURRENT_USER\D20\shell\
open

HKEY_CURRENT_USER\D20\shell\
open\command

HKEY_CURRENT_USER\D20\shell\
runas

HKEY_CURRENT_USER\D20\shell\
runas\command

HKEY_CURRENT_USER\1u

HKEY_CURRENT_USER\1u\DefaultIcon

HKEY_CURRENT_USER\1u\shell

HKEY_CURRENT_USER\1u\shell\
open

HKEY_CURRENT_USER\1u\shell\
open\command

HKEY_CURRENT_USER\1u\shell\
runas

HKEY_CURRENT_USER\1u\shell\
runas\command

HKEY_CURRENT_USER\OF

HKEY_CURRENT_USER\OF\DefaultIcon

HKEY_CURRENT_USER\OF\shell

HKEY_CURRENT_USER\OF\shell\
open

HKEY_CURRENT_USER\OF\shell\
open\command

HKEY_CURRENT_USER\OF\shell\
runas

HKEY_CURRENT_USER\OF\shell\
runas\command

HKEY_CURRENT_USER\Y6

HKEY_CURRENT_USER\Y6\DefaultIcon

HKEY_CURRENT_USER\Y6\shell

HKEY_CURRENT_USER\Y6\shell\
open

HKEY_CURRENT_USER\Y6\shell\
open\command

HKEY_CURRENT_USER\Y6\shell\
runas

HKEY_CURRENT_USER\Y6\shell\
runas\command

HKEY_CURRENT_USER\k7l

HKEY_CURRENT_USER\k7l\DefaultIcon

HKEY_CURRENT_USER\k7l\shell

HKEY_CURRENT_USER\k7l\shell\
open

HKEY_CURRENT_USER\k7l\shell\
open\command

HKEY_CURRENT_USER\k7l\shell\
runas

HKEY_CURRENT_USER\k7l\shell\
runas\command

HKEY_CURRENT_USER\17

HKEY_CURRENT_USER\17\DefaultIcon

HKEY_CURRENT_USER\17\shell

HKEY_CURRENT_USER\17\shell\
open

HKEY_CURRENT_USER\17\shell\
open\command

HKEY_CURRENT_USER\17\shell\
runas

HKEY_CURRENT_USER\17\shell\
runas\command

HKEY_CURRENT_USER\X51

HKEY_CURRENT_USER\X51\DefaultIcon

HKEY_CURRENT_USER\X51\shell

HKEY_CURRENT_USER\X51\shell\
open

HKEY_CURRENT_USER\X51\shell\
open\command

HKEY_CURRENT_USER\X51\shell\
runas

HKEY_CURRENT_USER\X51\shell\
runas\command

HKEY_CURRENT_USER\rk5

HKEY_CURRENT_USER\rk5\DefaultIcon

HKEY_CURRENT_USER\8UU

HKEY_CURRENT_USER\8UU\DefaultIcon

HKEY_CURRENT_USER\8UU\shell

HKEY_CURRENT_USER\8UU\shell\
open

HKEY_CURRENT_USER\8UU\shell\
open\command

HKEY_CURRENT_USER\8UU\shell\
runas

HKEY_CURRENT_USER\8UU\shell\
runas\command

HKEY_CURRENT_USER\YAY

HKEY_CURRENT_USER\YAY\DefaultIcon

HKEY_CURRENT_USER\YAY\shell

HKEY_CURRENT_USER\YAY\shell\
open

HKEY_CURRENT_USER\YAY\shell\
open\command

HKEY_CURRENT_USER\YAY\shell\
runas

HKEY_CURRENT_USER\YAY\shell\
runas\command

HKEY_CURRENT_USER\mO

HKEY_CURRENT_USER\mO\DefaultIcon

HKEY_CURRENT_USER\mO\shell

HKEY_CURRENT_USER\mO\shell\
open

HKEY_CURRENT_USER\mO\shell\
open\command

HKEY_CURRENT_USER\mO\shell\
runas

HKEY_CURRENT_USER\mO\shell\
runas\command

HKEY_CURRENT_USER\1g

HKEY_CURRENT_USER\1g\DefaultIcon

HKEY_CURRENT_USER\1g\shell

HKEY_CURRENT_USER\1g\shell\
open

HKEY_CURRENT_USER\1g\shell\
open\command

HKEY_CURRENT_USER\1g\shell\
runas

HKEY_CURRENT_USER\1g\shell\
runas\command

HKEY_CURRENT_USER\JO

HKEY_CURRENT_USER\JO\DefaultIcon

HKEY_CURRENT_USER\JO\shell

HKEY_CURRENT_USER\JO\shell\
open

HKEY_CURRENT_USER\JO\shell\
open\command

HKEY_CURRENT_USER\JO\shell\
runas

HKEY_CURRENT_USER\JO\shell\
runas\command

HKEY_CURRENT_USER\D75

HKEY_CURRENT_USER\D75\DefaultIcon

HKEY_CURRENT_USER\D75\shell

HKEY_CURRENT_USER\D75\shell\
open

HKEY_CURRENT_USER\D75\shell\
open\command

HKEY_CURRENT_USER\D75\shell\
runas

HKEY_CURRENT_USER\D75\shell\
runas\command

HKEY_CURRENT_USER\yWK

HKEY_CURRENT_USER\yWK\DefaultIcon

HKEY_CURRENT_USER\yWK\shell

HKEY_CURRENT_USER\yWK\shell\
open

HKEY_CURRENT_USER\yWK\shell\
open\command

HKEY_CURRENT_USER\yWK\shell\
runas

HKEY_CURRENT_USER\yWK\shell\
runas\command

HKEY_CURRENT_USER\FX

HKEY_CURRENT_USER\FX\DefaultIcon

HKEY_CURRENT_USER\FX\shell

HKEY_CURRENT_USER\FX\shell\
open

HKEY_CURRENT_USER\FX\shell\
open\command

HKEY_CURRENT_USER\FX\shell\
runas

HKEY_CURRENT_USER\FX\shell\
runas\command

HKEY_CURRENT_USER\t1s

HKEY_CURRENT_USER\t1s\DefaultIcon

HKEY_CURRENT_USER\t1s\shell

HKEY_CURRENT_USER\rk5\shell

HKEY_CURRENT_USER\rk5\shell\
open

HKEY_CURRENT_USER\rk5\shell\
open\command

HKEY_CURRENT_USER\rk5\shell\
runas

HKEY_CURRENT_USER\rk5\shell\
runas\command

HKEY_CURRENT_USER\eT

HKEY_CURRENT_USER\eT\DefaultIcon

HKEY_CURRENT_USER\eT\shell

HKEY_CURRENT_USER\eT\shell\
open

HKEY_CURRENT_USER\eT\shell\
open\command

HKEY_CURRENT_USER\eT\shell\
runas

HKEY_CURRENT_USER\eT\shell\
runas\command

HKEY_CURRENT_USER\7P3

HKEY_CURRENT_USER\7P3\DefaultIcon

HKEY_CURRENT_USER\7P3\shell

HKEY_CURRENT_USER\7P3\shell\
open

HKEY_CURRENT_USER\7P3\shell\
open\command

HKEY_CURRENT_USER\7P3\shell\
runas

HKEY_CURRENT_USER\7P3\shell\
runas\command

HKEY_CURRENT_USER\74Q

HKEY_CURRENT_USER\74Q\DefaultIcon

HKEY_CURRENT_USER\74Q\shell

HKEY_CURRENT_USER\74Q\shell\
open

HKEY_CURRENT_USER\74Q\shell\
open\command

HKEY_CURRENT_USER\74Q\shell\
runas

HKEY_CURRENT_USER\74Q\shell\
runas\command

HKEY_CURRENT_USER\71

HKEY_CURRENT_USER\71\DefaultIcon

HKEY_CURRENT_USER\71\shell

HKEY_CURRENT_USER\71\shell\
open

HKEY_CURRENT_USER\71\shell\
open\command

HKEY_CURRENT_USER\71\shell\
runas

HKEY_CURRENT_USER\71\shell\
runas\command

HKEY_CURRENT_USER\h1

HKEY_CURRENT_USER\h1\DefaultIcon

HKEY_CURRENT_USER\h1\shell

HKEY_CURRENT_USER\h1\shell\
open

HKEY_CURRENT_USER\h1\shell\
open\command

HKEY_CURRENT_USER\h1\shell\
runas

HKEY_CURRENT_USER\h1\shell\
runas\command

HKEY_CURRENT_USER\Gl

HKEY_CURRENT_USER\Gl\DefaultIcon

HKEY_CURRENT_USER\Gl\shell

HKEY_CURRENT_USER\Gl\shell\
open

HKEY_CURRENT_USER\Gl\shell\
open\command

HKEY_CURRENT_USER\Gl\shell\
runas

HKEY_CURRENT_USER\Gl\shell\
runas\command

HKEY_CURRENT_USER\678

HKEY_CURRENT_USER\678\DefaultIcon

HKEY_CURRENT_USER\678\shell

HKEY_CURRENT_USER\678\shell\
open

HKEY_CURRENT_USER\678\shell\
open\command

HKEY_CURRENT_USER\678\shell\
runas

HKEY_CURRENT_USER\678\shell\
runas\command

HKEY_CURRENT_USER\lGj

HKEY_CURRENT_USER\lGj\DefaultIcon

HKEY_CURRENT_USER\lGj\shell

HKEY_CURRENT_USER\lGj\shell\
open

HKEY_CURRENT_USER\lGj\shell\
open\command

HKEY_CURRENT_USER\t1s\shell\
open

HKEY_CURRENT_USER\t1s\shell\
open\command

HKEY_CURRENT_USER\t1s\shell\
runas

HKEY_CURRENT_USER\t1s\shell\
runas\command

HKEY_CURRENT_USER\acv

HKEY_CURRENT_USER\acv\DefaultIcon

HKEY_CURRENT_USER\acv\shell

HKEY_CURRENT_USER\acv\shell\
open

HKEY_CURRENT_USER\acv\shell\
open\command

HKEY_CURRENT_USER\acv\shell\
runas

HKEY_CURRENT_USER\acv\shell\
runas\command

HKEY_CURRENT_USER\DJ2

HKEY_CURRENT_USER\DJ2\DefaultIcon

HKEY_CURRENT_USER\DJ2\shell

HKEY_CURRENT_USER\DJ2\shell\
open

HKEY_CURRENT_USER\DJ2\shell\
open\command

HKEY_CURRENT_USER\DJ2\shell\
runas

HKEY_CURRENT_USER\DJ2\shell\
runas\command

HKEY_CURRENT_USER\wF

HKEY_CURRENT_USER\wF\DefaultIcon

HKEY_CURRENT_USER\wF\shell

HKEY_CURRENT_USER\wF\shell\
open

HKEY_CURRENT_USER\wF\shell\
open\command

HKEY_CURRENT_USER\wF\shell\
runas

HKEY_CURRENT_USER\wF\shell\
runas\command

HKEY_CURRENT_USER\id1

HKEY_CURRENT_USER\id1\DefaultIcon

HKEY_CURRENT_USER\id1\shell

HKEY_CURRENT_USER\id1\shell\
open

HKEY_CURRENT_USER\id1\shell\
open\command

HKEY_CURRENT_USER\id1\shell\
runas

HKEY_CURRENT_USER\id1\shell\
runas\command

HKEY_CURRENT_USER\t7q

HKEY_CURRENT_USER\t7q\DefaultIcon

HKEY_CURRENT_USER\t7q\shell

HKEY_CURRENT_USER\t7q\shell\
open

HKEY_CURRENT_USER\t7q\shell\
open\command

HKEY_CURRENT_USER\t7q\shell\
runas

HKEY_CURRENT_USER\t7q\shell\
runas\command

HKEY_CURRENT_USER\NW

HKEY_CURRENT_USER\NW\DefaultIcon

HKEY_CURRENT_USER\NW\shell

HKEY_CURRENT_USER\NW\shell\
open

HKEY_CURRENT_USER\NW\shell\
open\command

HKEY_CURRENT_USER\NW\shell\
runas

HKEY_CURRENT_USER\NW\shell\
runas\command

HKEY_CURRENT_USER\114

HKEY_CURRENT_USER\114\DefaultIcon

HKEY_CURRENT_USER\114\shell

HKEY_CURRENT_USER\114\shell\
open

HKEY_CURRENT_USER\114\shell\
open\command

HKEY_CURRENT_USER\114\shell\
runas

HKEY_CURRENT_USER\114\shell\
runas\command

HKEY_CURRENT_USER\nJ

HKEY_CURRENT_USER\nJ\DefaultIcon

HKEY_CURRENT_USER\nJ\shell

HKEY_CURRENT_USER\nJ\shell\
open

HKEY_CURRENT_USER\nJ\shell\
open\command

HKEY_CURRENT_USER\nJ\shell\
runas

HKEY_CURRENT_USER\lGj\shell\
runas

HKEY_CURRENT_USER\lGj\shell\
runas\command

HKEY_CURRENT_USER\pj

HKEY_CURRENT_USER\pj\DefaultIcon

HKEY_CURRENT_USER\pj\shell

HKEY_CURRENT_USER\pj\shell\
open

HKEY_CURRENT_USER\pj\shell\
open\command

HKEY_CURRENT_USER\pj\shell\
runas

HKEY_CURRENT_USER\pj\shell\
runas\command

HKEY_CURRENT_USER\kY

HKEY_CURRENT_USER\kY\DefaultIcon

HKEY_CURRENT_USER\kY\shell

HKEY_CURRENT_USER\kY\shell\
open

HKEY_CURRENT_USER\kY\shell\
open\command

HKEY_CURRENT_USER\kY\shell\
runas

HKEY_CURRENT_USER\kY\shell\
runas\command

HKEY_CURRENT_USER\8C

HKEY_CURRENT_USER\8C\DefaultIcon

HKEY_CURRENT_USER\8C\shell

HKEY_CURRENT_USER\8C\shell\
open

HKEY_CURRENT_USER\8C\shell\
open\command

HKEY_CURRENT_USER\8C\shell\
runas

HKEY_CURRENT_USER\8C\shell\
runas\command

HKEY_CURRENT_USER\e3

HKEY_CURRENT_USER\e3\DefaultIcon

HKEY_CURRENT_USER\e3\shell

HKEY_CURRENT_USER\e3\shell\
open

HKEY_CURRENT_USER\e3\shell\
open\command

HKEY_CURRENT_USER\e3\shell\
runas

HKEY_CURRENT_USER\e3\shell\
runas\command

HKEY_CURRENT_USER\2w

HKEY_CURRENT_USER\2w\DefaultIcon

HKEY_CURRENT_USER\2w\shell

HKEY_CURRENT_USER\2w\shell\
open

HKEY_CURRENT_USER\2w\shell\
open\command

HKEY_CURRENT_USER\2w\shell\
runas

HKEY_CURRENT_USER\2w\shell\
runas\command

HKEY_CURRENT_USER\208

HKEY_CURRENT_USER\208\DefaultIcon

HKEY_CURRENT_USER\208\shell

HKEY_CURRENT_USER\208\shell\
open

HKEY_CURRENT_USER\208\shell\
open\command

HKEY_CURRENT_USER\208\shell\
runas

HKEY_CURRENT_USER\208\shell\
runas\command

HKEY_CURRENT_USER\UEH

HKEY_CURRENT_USER\UEH\DefaultIcon

HKEY_CURRENT_USER\UEH\shell

HKEY_CURRENT_USER\UEH\shell\
open

HKEY_CURRENT_USER\UEH\shell\
open\command

HKEY_CURRENT_USER\UEH\shell\
runas

HKEY_CURRENT_USER\UEH\shell\
runas\command

HKEY_CURRENT_USER\1o

HKEY_CURRENT_USER\1o\DefaultIcon

HKEY_CURRENT_USER\1o\shell

HKEY_CURRENT_USER\1o\shell\
open

HKEY_CURRENT_USER\1o\shell\
open\command

HKEY_CURRENT_USER\1o\shell\
runas

HKEY_CURRENT_USER\1o\shell\
runas\command

HKEY_CURRENT_USER\2Ka

HKEY_CURRENT_USER\2Ka\DefaultIcon

HKEY_CURRENT_USER\nJ\shell\
runas\command

HKEY_CURRENT_USER\qd

HKEY_CURRENT_USER\qd\DefaultIcon

HKEY_CURRENT_USER\qd\shell

HKEY_CURRENT_USER\qd\shell\
open

HKEY_CURRENT_USER\qd\shell\
open\command

HKEY_CURRENT_USER\qd\shell\
runas

HKEY_CURRENT_USER\qd\shell\
runas\command

HKEY_CURRENT_USER\SWf

HKEY_CURRENT_USER\SWf\DefaultIcon

HKEY_CURRENT_USER\SWf\shell

HKEY_CURRENT_USER\SWf\shell\
open

HKEY_CURRENT_USER\SWf\shell\
open\command

HKEY_CURRENT_USER\SWf\shell\
runas

HKEY_CURRENT_USER\SWf\shell\
runas\command

HKEY_CURRENT_USER\RDt

HKEY_CURRENT_USER\RDt\DefaultIcon

HKEY_CURRENT_USER\RDt\shell

HKEY_CURRENT_USER\RDt\shell\
open

HKEY_CURRENT_USER\RDt\shell\
open\command

HKEY_CURRENT_USER\RDt\shell\
runas

HKEY_CURRENT_USER\RDt\shell\
runas\command

HKEY_CURRENT_USER\1B

HKEY_CURRENT_USER\1B\DefaultIcon

HKEY_CURRENT_USER\1B\shell

HKEY_CURRENT_USER\1B\shell\
open

HKEY_CURRENT_USER\1B\shell\
open\command

HKEY_CURRENT_USER\1B\shell\
runas

HKEY_CURRENT_USER\1B\shell\
runas\command

HKEY_CURRENT_USER\88

HKEY_CURRENT_USER\88\DefaultIcon

HKEY_CURRENT_USER\88\shell

HKEY_CURRENT_USER\88\shell\
open

HKEY_CURRENT_USER\88\shell\
open\command

HKEY_CURRENT_USER\88\shell\
runas

HKEY_CURRENT_USER\88\shell\
runas\command

HKEY_CURRENT_USER\8J8

HKEY_CURRENT_USER\8J8\DefaultIcon

HKEY_CURRENT_USER\8J8\shell

HKEY_CURRENT_USER\8J8\shell\
open

HKEY_CURRENT_USER\8J8\shell\
open\command

HKEY_CURRENT_USER\8J8\shell\
runas

HKEY_CURRENT_USER\8J8\shell\
runas\command

HKEY_CURRENT_USER\0w6

HKEY_CURRENT_USER\0w6\DefaultIcon

HKEY_CURRENT_USER\0w6\shell

HKEY_CURRENT_USER\0w6\shell\
open

HKEY_CURRENT_USER\0w6\shell\
open\command

HKEY_CURRENT_USER\0w6\shell\
runas

HKEY_CURRENT_USER\0w6\shell\
runas\command

HKEY_CURRENT_USER\SEp

HKEY_CURRENT_USER\SEp\DefaultIcon

HKEY_CURRENT_USER\SEp\shell

HKEY_CURRENT_USER\SEp\shell\
open

HKEY_CURRENT_USER\SEp\shell\
open\command

HKEY_CURRENT_USER\SEp\shell\
runas

HKEY_CURRENT_USER\SEp\shell\
runas\command

HKEY_CURRENT_USER\yJ1

HKEY_CURRENT_USER\yJ1\DefaultIcon

HKEY_CURRENT_USER\2Ka\shell

HKEY_CURRENT_USER\2Ka\shell\
open

HKEY_CURRENT_USER\2Ka\shell\
open\command

HKEY_CURRENT_USER\2Ka\shell\
runas

HKEY_CURRENT_USER\2Ka\shell\
runas\command

HKEY_CURRENT_USER\e2

HKEY_CURRENT_USER\e2\DefaultIcon

HKEY_CURRENT_USER\e2\shell

HKEY_CURRENT_USER\e2\shell\
open

HKEY_CURRENT_USER\e2\shell\
open\command

HKEY_CURRENT_USER\e2\shell\
runas

HKEY_CURRENT_USER\e2\shell\
runas\command

HKEY_CURRENT_USER\3pO

HKEY_CURRENT_USER\3pO\DefaultIcon

HKEY_CURRENT_USER\3pO\shell

HKEY_CURRENT_USER\3pO\shell\
open

HKEY_CURRENT_USER\3pO\shell\
open\command

HKEY_CURRENT_USER\3pO\shell\
runas

HKEY_CURRENT_USER\3pO\shell\
runas\command

HKEY_CURRENT_USER\uUe

HKEY_CURRENT_USER\uUe\DefaultIcon

HKEY_CURRENT_USER\uUe\shell

HKEY_CURRENT_USER\uUe\shell\
open

HKEY_CURRENT_USER\uUe\shell\
open\command

HKEY_CURRENT_USER\uUe\shell\
runas

HKEY_CURRENT_USER\uUe\shell\
runas\command

HKEY_CURRENT_USER\G3Y

HKEY_CURRENT_USER\G3Y\DefaultIcon

HKEY_CURRENT_USER\G3Y\shell

HKEY_CURRENT_USER\G3Y\shell\
open

HKEY_CURRENT_USER\G3Y\shell\
open\command

HKEY_CURRENT_USER\G3Y\shell\
runas

HKEY_CURRENT_USER\G3Y\shell\
runas\command

HKEY_CURRENT_USER\2Ey

HKEY_CURRENT_USER\2Ey\DefaultIcon

HKEY_CURRENT_USER\2Ey\shell

HKEY_CURRENT_USER\2Ey\shell\
open

HKEY_CURRENT_USER\2Ey\shell\
open\command

HKEY_CURRENT_USER\2Ey\shell\
runas

HKEY_CURRENT_USER\2Ey\shell\
runas\command

HKEY_CURRENT_USER\gE

HKEY_CURRENT_USER\gE\DefaultIcon

HKEY_CURRENT_USER\gE\shell

HKEY_CURRENT_USER\gE\shell\
open

HKEY_CURRENT_USER\gE\shell\
open\command

HKEY_CURRENT_USER\gE\shell\
runas

HKEY_CURRENT_USER\gE\shell\
runas\command

HKEY_CURRENT_USER\Up

HKEY_CURRENT_USER\Up\DefaultIcon

HKEY_CURRENT_USER\Up\shell

HKEY_CURRENT_USER\Up\shell\
open

HKEY_CURRENT_USER\Up\shell\
open\command

HKEY_CURRENT_USER\Up\shell\
runas

HKEY_CURRENT_USER\Up\shell\
runas\command

HKEY_CURRENT_USER\3O7

HKEY_CURRENT_USER\3O7\DefaultIcon

HKEY_CURRENT_USER\3O7\shell

HKEY_CURRENT_USER\3O7\shell\
open

HKEY_CURRENT_USER\3O7\shell\
open\command

HKEY_CURRENT_USER\yJ1\shell

HKEY_CURRENT_USER\yJ1\shell\
open

HKEY_CURRENT_USER\yJ1\shell\
open\command

HKEY_CURRENT_USER\yJ1\shell\
runas

HKEY_CURRENT_USER\yJ1\shell\
runas\command

HKEY_CURRENT_USER\Pl8

HKEY_CURRENT_USER\Pl8\DefaultIcon

HKEY_CURRENT_USER\Pl8\shell

HKEY_CURRENT_USER\Pl8\shell\
open

HKEY_CURRENT_USER\Pl8\shell\
open\command

HKEY_CURRENT_USER\Pl8\shell\
runas

HKEY_CURRENT_USER\Pl8\shell\
runas\command

HKEY_CURRENT_USER\5Y

HKEY_CURRENT_USER\5Y\DefaultIcon

HKEY_CURRENT_USER\5Y\shell

HKEY_CURRENT_USER\5Y\shell\
open

HKEY_CURRENT_USER\5Y\shell\
open\command

HKEY_CURRENT_USER\5Y\shell\
runas

HKEY_CURRENT_USER\5Y\shell\
runas\command

HKEY_CURRENT_USER\Eu

HKEY_CURRENT_USER\Eu\DefaultIcon

HKEY_CURRENT_USER\Eu\shell

HKEY_CURRENT_USER\Eu\shell\
open

HKEY_CURRENT_USER\Eu\shell\
open\command

HKEY_CURRENT_USER\Eu\shell\
runas

HKEY_CURRENT_USER\Eu\shell\
runas\command

HKEY_CURRENT_USER\5x

HKEY_CURRENT_USER\5x\DefaultIcon

HKEY_CURRENT_USER\5x\shell

HKEY_CURRENT_USER\5x\shell\
open

HKEY_CURRENT_USER\5x\shell\
open\command

HKEY_CURRENT_USER\5x\shell\
runas

HKEY_CURRENT_USER\5x\shell\
runas\command

HKEY_CURRENT_USER\L5

HKEY_CURRENT_USER\L5\DefaultIcon

HKEY_CURRENT_USER\L5\shell

HKEY_CURRENT_USER\L5\shell\
open

HKEY_CURRENT_USER\L5\shell\
open\command

HKEY_CURRENT_USER\L5\shell\
runas

HKEY_CURRENT_USER\L5\shell\
runas\command

HKEY_CURRENT_USER\apC

HKEY_CURRENT_USER\apC\DefaultIcon

HKEY_CURRENT_USER\apC\shell

HKEY_CURRENT_USER\apC\shell\
open

HKEY_CURRENT_USER\apC\shell\
open\command

HKEY_CURRENT_USER\apC\shell\
runas

HKEY_CURRENT_USER\apC\shell\
runas\command

HKEY_CURRENT_USER\sU1

HKEY_CURRENT_USER\sU1\DefaultIcon

HKEY_CURRENT_USER\sU1\shell

HKEY_CURRENT_USER\sU1\shell\
open

HKEY_CURRENT_USER\sU1\shell\
open\command

HKEY_CURRENT_USER\sU1\shell\
runas

HKEY_CURRENT_USER\sU1\shell\
runas\command

HKEY_CURRENT_USER\0H5

HKEY_CURRENT_USER\0H5\DefaultIcon

HKEY_CURRENT_USER\0H5\shell

HKEY_CURRENT_USER\0H5\shell\
open

HKEY_CURRENT_USER\0H5\shell\
open\command

HKEY_CURRENT_USER\3O7\shell\
runas

HKEY_CURRENT_USER\3O7\shell\
runas\command

HKEY_CURRENT_USER\4D

HKEY_CURRENT_USER\4D\DefaultIcon

HKEY_CURRENT_USER\4D\shell

HKEY_CURRENT_USER\4D\shell\
open

HKEY_CURRENT_USER\4D\shell\
open\command

HKEY_CURRENT_USER\4D\shell\
runas

HKEY_CURRENT_USER\4D\shell\
runas\command

HKEY_CURRENT_USER\fW3

HKEY_CURRENT_USER\fW3\DefaultIcon

HKEY_CURRENT_USER\fW3\shell

HKEY_CURRENT_USER\fW3\shell\
open

HKEY_CURRENT_USER\fW3\shell\
open\command

HKEY_CURRENT_USER\fW3\shell\
runas

HKEY_CURRENT_USER\fW3\shell\
runas\command

HKEY_CURRENT_USER\12y

HKEY_CURRENT_USER\12y\DefaultIcon

HKEY_CURRENT_USER\12y\shell

HKEY_CURRENT_USER\12y\shell\
open

HKEY_CURRENT_USER\12y\shell\
open\command

HKEY_CURRENT_USER\12y\shell\
runas

HKEY_CURRENT_USER\12y\shell\
runas\command

HKEY_CURRENT_USER\7D

HKEY_CURRENT_USER\7D\DefaultIcon

HKEY_CURRENT_USER\7D\shell

HKEY_CURRENT_USER\7D\shell\
open

HKEY_CURRENT_USER\7D\shell\
open\command

HKEY_CURRENT_USER\7D\shell\
runas

HKEY_CURRENT_USER\7D\shell\
runas\command

HKEY_CURRENT_USER\165

HKEY_CURRENT_USER\165\DefaultIcon

HKEY_CURRENT_USER\165\shell

HKEY_CURRENT_USER\165\shell\
open

HKEY_CURRENT_USER\165\shell\
open\command

HKEY_CURRENT_USER\165\shell\
runas

HKEY_CURRENT_USER\165\shell\
runas\command

HKEY_CURRENT_USER\00e

HKEY_CURRENT_USER\00e\DefaultIcon

HKEY_CURRENT_USER\00e\shell

HKEY_CURRENT_USER\00e\shell\
open

HKEY_CURRENT_USER\00e\shell\
open\command

HKEY_CURRENT_USER\00e\shell\
runas

HKEY_CURRENT_USER\00e\shell\
runas\command

HKEY_CURRENT_USER\e3E

HKEY_CURRENT_USER\e3E\DefaultIcon

HKEY_CURRENT_USER\e3E\shell

HKEY_CURRENT_USER\e3E\shell\
open

HKEY_CURRENT_USER\e3E\shell\
open\command

HKEY_CURRENT_USER\e3E\shell\
runas

HKEY_CURRENT_USER\e3E\shell\
runas\command

HKEY_CURRENT_USER\nE

HKEY_CURRENT_USER\nE\DefaultIcon

HKEY_CURRENT_USER\nE\shell

HKEY_CURRENT_USER\nE\shell\
open

HKEY_CURRENT_USER\nE\shell\
open\command

HKEY_CURRENT_USER\nE\shell\
runas

HKEY_CURRENT_USER\nE\shell\
runas\command

HKEY_CURRENT_USER\6Fn

HKEY_CURRENT_USER\0H5\shell\
runas

HKEY_CURRENT_USER\0H5\shell\
runas\command

HKEY_CURRENT_USER\6s

HKEY_CURRENT_USER\6s\DefaultIcon

HKEY_CURRENT_USER\6s\shell

HKEY_CURRENT_USER\6s\shell\
open

HKEY_CURRENT_USER\6s\shell\
open\command

HKEY_CURRENT_USER\6s\shell\
runas

HKEY_CURRENT_USER\6s\shell\
runas\command

HKEY_CURRENT_USER\2YG

HKEY_CURRENT_USER\2YG\DefaultIcon

HKEY_CURRENT_USER\2YG\shell

HKEY_CURRENT_USER\2YG\shell\
open

HKEY_CURRENT_USER\2YG\shell\
open\command

HKEY_CURRENT_USER\2YG\shell\
runas

HKEY_CURRENT_USER\2YG\shell\
runas\command

HKEY_CURRENT_USER\45g

HKEY_CURRENT_USER\45g\DefaultIcon

HKEY_CURRENT_USER\45g\shell

HKEY_CURRENT_USER\45g\shell\
open

HKEY_CURRENT_USER\45g\shell\
open\command

HKEY_CURRENT_USER\45g\shell\
runas

HKEY_CURRENT_USER\45g\shell\
runas\command

HKEY_CURRENT_USER\fj

HKEY_CURRENT_USER\fj\DefaultIcon

HKEY_CURRENT_USER\fj\shell

HKEY_CURRENT_USER\fj\shell\
open

HKEY_CURRENT_USER\fj\shell\
open\command

HKEY_CURRENT_USER\fj\shell\
runas

HKEY_CURRENT_USER\fj\shell\
runas\command

HKEY_CURRENT_USER\75

HKEY_CURRENT_USER\75\DefaultIcon

HKEY_CURRENT_USER\75\shell

HKEY_CURRENT_USER\75\shell\
open

HKEY_CURRENT_USER\75\shell\
open\command

HKEY_CURRENT_USER\75\shell\
runas

HKEY_CURRENT_USER\75\shell\
runas\command

HKEY_CURRENT_USER\8W

HKEY_CURRENT_USER\8W\DefaultIcon

HKEY_CURRENT_USER\8W\shell

HKEY_CURRENT_USER\8W\shell\
open

HKEY_CURRENT_USER\8W\shell\
open\command

HKEY_CURRENT_USER\8W\shell\
runas

HKEY_CURRENT_USER\8W\shell\
runas\command

HKEY_CURRENT_USER\87F

HKEY_CURRENT_USER\87F\DefaultIcon

HKEY_CURRENT_USER\87F\shell

HKEY_CURRENT_USER\87F\shell\
open

HKEY_CURRENT_USER\87F\shell\
open\command

HKEY_CURRENT_USER\87F\shell\
runas

HKEY_CURRENT_USER\87F\shell\
runas\command

HKEY_CURRENT_USER\cpA

HKEY_CURRENT_USER\cpA\DefaultIcon

HKEY_CURRENT_USER\cpA\shell

HKEY_CURRENT_USER\cpA\shell\
open

HKEY_CURRENT_USER\cpA\shell\
open\command

HKEY_CURRENT_USER\cpA\shell\
runas

HKEY_CURRENT_USER\cpA\shell\
runas\command

HKEY_CURRENT_USER\J28

HKEY_CURRENT_USER\6Fn\DefaultIcon

HKEY_CURRENT_USER\6Fn\shell

HKEY_CURRENT_USER\6Fn\shell\
open

HKEY_CURRENT_USER\6Fn\shell\
open\command

HKEY_CURRENT_USER\6Fn\shell\
runas

HKEY_CURRENT_USER\6Fn\shell\
runas\command

HKEY_CURRENT_USER\WB

HKEY_CURRENT_USER\WB\DefaultIcon

HKEY_CURRENT_USER\WB\shell

HKEY_CURRENT_USER\WB\shell\
open

HKEY_CURRENT_USER\WB\shell\
open\command

HKEY_CURRENT_USER\WB\shell\
runas

HKEY_CURRENT_USER\WB\shell\
runas\command

HKEY_CURRENT_USER\3yJ

HKEY_CURRENT_USER\3yJ\DefaultIcon

HKEY_CURRENT_USER\3yJ\shell

HKEY_CURRENT_USER\3yJ\shell\
open

HKEY_CURRENT_USER\3yJ\shell\
open\command

HKEY_CURRENT_USER\3yJ\shell\
runas

HKEY_CURRENT_USER\3yJ\shell\
runas\command

HKEY_CURRENT_USER\1R

HKEY_CURRENT_USER\1R\DefaultIcon

HKEY_CURRENT_USER\1R\shell

HKEY_CURRENT_USER\1R\shell\
open

HKEY_CURRENT_USER\1R\shell\
open\command

HKEY_CURRENT_USER\1R\shell\
runas

HKEY_CURRENT_USER\1R\shell\
runas\command

HKEY_CURRENT_USER\1i

HKEY_CURRENT_USER\1i\DefaultIcon

HKEY_CURRENT_USER\1i\shell

HKEY_CURRENT_USER\1i\shell\
open

HKEY_CURRENT_USER\1i\shell\
open\command

HKEY_CURRENT_USER\1i\shell\
runas

HKEY_CURRENT_USER\1i\shell\
runas\command

HKEY_CURRENT_USER\y2c

HKEY_CURRENT_USER\y2c\DefaultIcon

HKEY_CURRENT_USER\y2c\shell

HKEY_CURRENT_USER\y2c\shell\
open

HKEY_CURRENT_USER\y2c\shell\
open\command

HKEY_CURRENT_USER\y2c\shell\
runas

HKEY_CURRENT_USER\y2c\shell\
runas\command

HKEY_CURRENT_USER\r0

HKEY_CURRENT_USER\r0\DefaultIcon

HKEY_CURRENT_USER\r0\shell

HKEY_CURRENT_USER\r0\shell\
open

HKEY_CURRENT_USER\r0\shell\
open\command

HKEY_CURRENT_USER\r0\shell\
runas

HKEY_CURRENT_USER\r0\shell\
runas\command

HKEY_CURRENT_USER\wQ

HKEY_CURRENT_USER\wQ\DefaultIcon

HKEY_CURRENT_USER\wQ\shell

HKEY_CURRENT_USER\wQ\shell\
open

HKEY_CURRENT_USER\wQ\shell\
open\command

HKEY_CURRENT_USER\wQ\shell\
runas

HKEY_CURRENT_USER\wQ\shell\
runas\command

HKEY_CURRENT_USER\Tu

HKEY_CURRENT_USER\Tu\DefaultIcon

HKEY_CURRENT_USER\Tu\shell

HKEY_CURRENT_USER\Tu\shell\
open

HKEY_CURRENT_USER\Tu\shell\
open\command

HKEY_CURRENT_USER\J28\DefaultIcon

HKEY_CURRENT_USER\J28\shell

HKEY_CURRENT_USER\J28\shell\
open

HKEY_CURRENT_USER\J28\shell\
open\command

HKEY_CURRENT_USER\J28\shell\
runas

HKEY_CURRENT_USER\J28\shell\
runas\command

HKEY_CURRENT_USER\8D0

HKEY_CURRENT_USER\8D0\DefaultIcon

HKEY_CURRENT_USER\8D0\shell

HKEY_CURRENT_USER\8D0\shell\
open

HKEY_CURRENT_USER\8D0\shell\
open\command

HKEY_CURRENT_USER\8D0\shell\
runas

HKEY_CURRENT_USER\8D0\shell\
runas\command

HKEY_CURRENT_USER\5f

HKEY_CURRENT_USER\5f\DefaultIcon

HKEY_CURRENT_USER\5f\shell

HKEY_CURRENT_USER\5f\shell\
open

HKEY_CURRENT_USER\5f\shell\
open\command

HKEY_CURRENT_USER\5f\shell\
runas

HKEY_CURRENT_USER\5f\shell\
runas\command

HKEY_CURRENT_USER\Us

HKEY_CURRENT_USER\Us\DefaultIcon

HKEY_CURRENT_USER\Us\shell

HKEY_CURRENT_USER\Us\shell\
open

HKEY_CURRENT_USER\Us\shell\
open\command

HKEY_CURRENT_USER\Us\shell\
runas

HKEY_CURRENT_USER\Us\shell\
runas\command

HKEY_CURRENT_USER\5e

HKEY_CURRENT_USER\5e\DefaultIcon

HKEY_CURRENT_USER\5e\shell

HKEY_CURRENT_USER\5e\shell\
open

HKEY_CURRENT_USER\5e\shell\
open\command

HKEY_CURRENT_USER\5e\shell\
runas

HKEY_CURRENT_USER\5e\shell\
runas\command

HKEY_CURRENT_USER\15

HKEY_CURRENT_USER\15\DefaultIcon

HKEY_CURRENT_USER\15\shell

HKEY_CURRENT_USER\15\shell\
open

HKEY_CURRENT_USER\15\shell\
open\command

HKEY_CURRENT_USER\15\shell\
runas

HKEY_CURRENT_USER\15\shell\
runas\command

HKEY_CURRENT_USER\m2c

HKEY_CURRENT_USER\m2c\DefaultIcon

HKEY_CURRENT_USER\m2c\shell

HKEY_CURRENT_USER\m2c\shell\
open

HKEY_CURRENT_USER\m2c\shell\
open\command

HKEY_CURRENT_USER\m2c\shell\
runas

HKEY_CURRENT_USER\m2c\shell\
runas\command

HKEY_CURRENT_USER\55n

HKEY_CURRENT_USER\55n\DefaultIcon

HKEY_CURRENT_USER\55n\shell

HKEY_CURRENT_USER\55n\shell\
open

HKEY_CURRENT_USER\55n\shell\
open\command

HKEY_CURRENT_USER\55n\shell\
runas

HKEY_CURRENT_USER\55n\shell\
runas\command

HKEY_CURRENT_USER\eg

HKEY_CURRENT_USER\eg\DefaultIcon

HKEY_CURRENT_USER\eg\shell

HKEY_CURRENT_USER\eg\shell\
open

HKEY_CURRENT_USER\Tu\shell\
runas

HKEY_CURRENT_USER\Tu\shell\
runas\command

HKEY_CURRENT_USER\STy

HKEY_CURRENT_USER\STy\DefaultIcon

HKEY_CURRENT_USER\STy\shell

HKEY_CURRENT_USER\STy\shell\
open

HKEY_CURRENT_USER\STy\shell\
open\command

HKEY_CURRENT_USER\STy\shell\
runas

HKEY_CURRENT_USER\STy\shell\
runas\command

HKEY_CURRENT_USER\m0u

HKEY_CURRENT_USER\m0u\DefaultIcon

HKEY_CURRENT_USER\m0u\shell

HKEY_CURRENT_USER\m0u\shell\
open

HKEY_CURRENT_USER\m0u\shell\
open\command

HKEY_CURRENT_USER\m0u\shell\
runas

HKEY_CURRENT_USER\m0u\shell\
runas\command

HKEY_CURRENT_USER\38

HKEY_CURRENT_USER\38\DefaultIcon

HKEY_CURRENT_USER\38\shell

HKEY_CURRENT_USER\38\shell\
open

HKEY_CURRENT_USER\38\shell\
open\command

HKEY_CURRENT_USER\38\shell\
runas

HKEY_CURRENT_USER\38\shell\
runas\command

HKEY_CURRENT_USER\dG1

HKEY_CURRENT_USER\dG1\DefaultIcon

HKEY_CURRENT_USER\dG1\shell

HKEY_CURRENT_USER\dG1\shell\
open

HKEY_CURRENT_USER\dG1\shell\
open\command

HKEY_CURRENT_USER\dG1\shell\
runas

HKEY_CURRENT_USER\dG1\shell\
runas\command

HKEY_CURRENT_USER\1in

HKEY_CURRENT_USER\1in\DefaultIcon

HKEY_CURRENT_USER\1in\shell

HKEY_CURRENT_USER\1in\shell\
open

HKEY_CURRENT_USER\1in\shell\
open\command

HKEY_CURRENT_USER\1in\shell\
runas

HKEY_CURRENT_USER\1in\shell\
runas\command

HKEY_CURRENT_USER\8l

HKEY_CURRENT_USER\8l\DefaultIcon

HKEY_CURRENT_USER\8l\shell

HKEY_CURRENT_USER\8l\shell\
open

HKEY_CURRENT_USER\8l\shell\
open\command

HKEY_CURRENT_USER\8l\shell\
runas

HKEY_CURRENT_USER\8l\shell\
runas\command

HKEY_CURRENT_USER\F8

HKEY_CURRENT_USER\F8\DefaultIcon

HKEY_CURRENT_USER\F8\shell

HKEY_CURRENT_USER\F8\shell\
open

HKEY_CURRENT_USER\F8\shell\
open\command

HKEY_CURRENT_USER\F8\shell\
runas

HKEY_CURRENT_USER\F8\shell\
runas\command

HKEY_CURRENT_USER\juB

HKEY_CURRENT_USER\juB\DefaultIcon

HKEY_CURRENT_USER\juB\shell

HKEY_CURRENT_USER\juB\shell\
open

HKEY_CURRENT_USER\juB\shell\
open\command

HKEY_CURRENT_USER\juB\shell\
runas

HKEY_CURRENT_USER\juB\shell\
runas\command

HKEY_CURRENT_USER\ejJ

HKEY_CURRENT_USER\ejJ\DefaultIcon

HKEY_CURRENT_USER\ejJ\shell

HKEY_CURRENT_USER\ejJ\shell\
open

HKEY_CURRENT_USER\ejJ\shell\
open\command

HKEY_CURRENT_USER\ejJ\shell\
runas

HKEY_CURRENT_USER\ejJ\shell\
runas\command

HKEY_CURRENT_USER\p1

HKEY_CURRENT_USER\p1\DefaultIcon

HKEY_CURRENT_USER\p1\shell

HKEY_CURRENT_USER\p1\shell\
open

HKEY_CURRENT_USER\p1\shell\
open\command

HKEY_CURRENT_USER\p1\shell\
runas

HKEY_CURRENT_USER\p1\shell\
runas\command

HKEY_CURRENT_USER\rfY

HKEY_CURRENT_USER\rfY\DefaultIcon

HKEY_CURRENT_USER\rfY\shell

HKEY_CURRENT_USER\rfY\shell\
open

HKEY_CURRENT_USER\rfY\shell\
open\command

HKEY_CURRENT_USER\rfY\shell\
runas

HKEY_CURRENT_USER\rfY\shell\
runas\command

HKEY_CURRENT_USER\TH

HKEY_CURRENT_USER\TH\DefaultIcon

HKEY_CURRENT_USER\TH\shell

HKEY_CURRENT_USER\TH\shell\
open

HKEY_CURRENT_USER\TH\shell\
open\command

HKEY_CURRENT_USER\TH\shell\
runas

HKEY_CURRENT_USER\TH\shell\
runas\command

HKEY_CURRENT_USER\JQX

HKEY_CURRENT_USER\JQX\DefaultIcon

HKEY_CURRENT_USER\JQX\shell

HKEY_CURRENT_USER\JQX\shell\
open

HKEY_CURRENT_USER\JQX\shell\
open\command

HKEY_CURRENT_USER\JQX\shell\
runas

HKEY_CURRENT_USER\JQX\shell\
runas\command

HKEY_CURRENT_USER\nyP

HKEY_CURRENT_USER\nyP\DefaultIcon

HKEY_CURRENT_USER\nyP\shell

HKEY_CURRENT_USER\nyP\shell\
open

HKEY_CURRENT_USER\nyP\shell\
open\command

HKEY_CURRENT_USER\nyP\shell\
runas

HKEY_CURRENT_USER\nyP\shell\
runas\command

HKEY_CURRENT_USER\8V

HKEY_CURRENT_USER\8V\DefaultIcon

HKEY_CURRENT_USER\8V\shell

HKEY_CURRENT_USER\8V\shell\
open

HKEY_CURRENT_USER\8V\shell\
open\command

HKEY_CURRENT_USER\8V\shell\
runas

HKEY_CURRENT_USER\8V\shell\
runas\command

HKEY_CURRENT_USER\keR

HKEY_CURRENT_USER\keR\DefaultIcon

HKEY_CURRENT_USER\keR\shell

HKEY_CURRENT_USER\keR\shell\
open

HKEY_CURRENT_USER\keR\shell\
open\command

HKEY_CURRENT_USER\keR\shell\
runas

HKEY_CURRENT_USER\keR\shell\
runas\command

HKEY_CURRENT_USER\Vs

HKEY_CURRENT_USER\Vs\DefaultIcon

HKEY_CURRENT_USER\Vs\shell

HKEY_CURRENT_USER\Vs\shell\
open

HKEY_CURRENT_USER\Vs\shell\
open\command

HKEY_CURRENT_USER\Vs\shell\
runas

HKEY_CURRENT_USER\Vs\shell\
runas\command

HKEY_CURRENT_USER\6w

HKEY_CURRENT_USER\6w\DefaultIcon

HKEY_CURRENT_USER\6w\shell

HKEY_CURRENT_USER\6w\shell\
open

HKEY_CURRENT_USER\6w\shell\
open\command

HKEY_CURRENT_USER\6w\shell\
runas

HKEY_CURRENT_USER\6w\shell\
runas\command

HKEY_CURRENT_USER\vx

HKEY_CURRENT_USER\vx\DefaultIcon

HKEY_CURRENT_USER\vx\shell

HKEY_CURRENT_USER\vx\shell\
open

HKEY_CURRENT_USER\vx\shell\
open\command

HKEY_CURRENT_USER\vx\shell\
runas

HKEY_CURRENT_USER\vx\shell\
runas\command

HKEY_CURRENT_USER\M0f

HKEY_CURRENT_USER\M0f\DefaultIcon

HKEY_CURRENT_USER\M0f\shell

HKEY_CURRENT_USER\M0f\shell\
open

HKEY_CURRENT_USER\M0f\shell\
open\command

HKEY_CURRENT_USER\M0f\shell\
runas

HKEY_CURRENT_USER\M0f\shell\
runas\command

HKEY_CURRENT_USER\Y5u

HKEY_CURRENT_USER\Y5u\DefaultIcon

HKEY_CURRENT_USER\Y5u\shell

HKEY_CURRENT_USER\Y5u\shell\
open

HKEY_CURRENT_USER\Y5u\shell\
open\command

HKEY_CURRENT_USER\Y5u\shell\
runas

HKEY_CURRENT_USER\Y5u\shell\
runas\command

HKEY_CURRENT_USER\M6

HKEY_CURRENT_USER\M6\DefaultIcon

HKEY_CURRENT_USER\M6\shell

HKEY_CURRENT_USER\M6\shell\
open

HKEY_CURRENT_USER\M6\shell\
open\command

HKEY_CURRENT_USER\M6\shell\
runas

HKEY_CURRENT_USER\M6\shell\
runas\command

HKEY_CURRENT_USER\563

HKEY_CURRENT_USER\563\DefaultIcon

HKEY_CURRENT_USER\563\shell

HKEY_CURRENT_USER\563\shell\
open

HKEY_CURRENT_USER\563\shell\
open\command

HKEY_CURRENT_USER\563\shell\
runas

HKEY_CURRENT_USER\563\shell\
runas\command

HKEY_CURRENT_USER\53

HKEY_CURRENT_USER\53\DefaultIcon

HKEY_CURRENT_USER\53\shell

HKEY_CURRENT_USER\53\shell\
open

HKEY_CURRENT_USER\53\shell\
open\command

HKEY_CURRENT_USER\53\shell\
runas

HKEY_CURRENT_USER\53\shell\
runas\command

HKEY_CURRENT_USER\ca

HKEY_CURRENT_USER\ca\DefaultIcon

HKEY_CURRENT_USER\ca\shell

HKEY_CURRENT_USER\ca\shell\
open

HKEY_CURRENT_USER\ca\shell\
open\command

HKEY_CURRENT_USER\ca\shell\
runas

HKEY_CURRENT_USER\ca\shell\
runas\command

HKEY_CURRENT_USER\AD

HKEY_CURRENT_USER\AD\DefaultIcon

HKEY_CURRENT_USER\AD\shell

HKEY_CURRENT_USER\AD\shell\
open

HKEY_CURRENT_USER\AD\shell\
open\command

HKEY_CURRENT_USER\AD\shell\
runas

HKEY_CURRENT_USER\AD\shell\
runas\command

HKEY_CURRENT_USER\Vt

HKEY_CURRENT_USER\Vt\DefaultIcon

HKEY_CURRENT_USER\Vt\shell

HKEY_CURRENT_USER\Vt\shell\
open

HKEY_CURRENT_USER\Vt\shell\
open\command

HKEY_CURRENT_USER\Vt\shell\
runas

HKEY_CURRENT_USER\Vt\shell\
runas\command

HKEY_CURRENT_USER\Glw

HKEY_CURRENT_USER\Glw\DefaultIcon

HKEY_CURRENT_USER\Glw\shell

HKEY_CURRENT_USER\Glw\shell\
open

HKEY_CURRENT_USER\Glw\shell\
open\command

HKEY_CURRENT_USER\Glw\shell\
runas

HKEY_CURRENT_USER\Glw\shell\
runas\command

HKEY_CURRENT_USER\7t

HKEY_CURRENT_USER\7t\DefaultIcon

HKEY_CURRENT_USER\7t\shell

HKEY_CURRENT_USER\7t\shell\
open

HKEY_CURRENT_USER\7t\shell\
open\command

HKEY_CURRENT_USER\7t\shell\
runas

HKEY_CURRENT_USER\7t\shell\
runas\command

HKEY_CURRENT_USER\Jgt

HKEY_CURRENT_USER\Jgt\DefaultIcon

HKEY_CURRENT_USER\Jgt\shell

HKEY_CURRENT_USER\Jgt\shell\
open

HKEY_CURRENT_USER\Jgt\shell\
open\command

HKEY_CURRENT_USER\Jgt\shell\
runas

HKEY_CURRENT_USER\Jgt\shell\
runas\command

HKEY_CURRENT_USER\WUq

HKEY_CURRENT_USER\WUq\DefaultIcon

HKEY_CURRENT_USER\WUq\shell

HKEY_CURRENT_USER\WUq\shell\
open

HKEY_CURRENT_USER\WUq\shell\
open\command

HKEY_CURRENT_USER\WUq\shell\
runas

HKEY_CURRENT_USER\WUq\shell\
runas\command

HKEY_CURRENT_USER\dXH

HKEY_CURRENT_USER\dXH\DefaultIcon

HKEY_CURRENT_USER\dXH\shell

HKEY_CURRENT_USER\dXH\shell\
open

HKEY_CURRENT_USER\dXH\shell\
open\command

HKEY_CURRENT_USER\dXH\shell\
runas

HKEY_CURRENT_USER\dXH\shell\
runas\command

HKEY_CURRENT_USER\8M

HKEY_CURRENT_USER\8M\DefaultIcon

HKEY_CURRENT_USER\8M\shell

HKEY_CURRENT_USER\8M\shell\
open

HKEY_CURRENT_USER\8M\shell\
open\command

HKEY_CURRENT_USER\8M\shell\
runas

HKEY_CURRENT_USER\8M\shell\
runas\command

HKEY_CURRENT_USER\7V

HKEY_CURRENT_USER\7V\DefaultIcon

HKEY_CURRENT_USER\7V\shell

HKEY_CURRENT_USER\7V\shell\
open

HKEY_CURRENT_USER\7V\shell\
open\command

HKEY_CURRENT_USER\7V\shell\
runas

HKEY_CURRENT_USER\7V\shell\
runas\command

HKEY_CURRENT_USER\Tg

HKEY_CURRENT_USER\Tg\DefaultIcon

HKEY_CURRENT_USER\Tg\shell

HKEY_CURRENT_USER\Tg\shell\
open

HKEY_CURRENT_USER\Tg\shell\
open\command

HKEY_CURRENT_USER\Tg\shell\
runas

HKEY_CURRENT_USER\Tg\shell\
runas\command

HKEY_CURRENT_USER\o1w

HKEY_CURRENT_USER\o1w\DefaultIcon

HKEY_CURRENT_USER\o1w\shell

HKEY_CURRENT_USER\o1w\shell\
open

HKEY_CURRENT_USER\o1w\shell\
open\command

HKEY_CURRENT_USER\o1w\shell\
runas

HKEY_CURRENT_USER\o1w\shell\
runas\command

HKEY_CURRENT_USER\Ty4

HKEY_CURRENT_USER\Ty4\DefaultIcon

HKEY_CURRENT_USER\Ty4\shell

HKEY_CURRENT_USER\Ty4\shell\
open

HKEY_CURRENT_USER\Ty4\shell\
open\command

HKEY_CURRENT_USER\Ty4\shell\
runas

HKEY_CURRENT_USER\Ty4\shell\
runas\command

HKEY_CURRENT_USER\lG

HKEY_CURRENT_USER\lG\DefaultIcon

HKEY_CURRENT_USER\lG\shell

HKEY_CURRENT_USER\lG\shell\
open

HKEY_CURRENT_USER\lG\shell\
open\command

HKEY_CURRENT_USER\lG\shell\
runas

HKEY_CURRENT_USER\lG\shell\
runas\command

HKEY_CURRENT_USER\Yh

HKEY_CURRENT_USER\Yh\DefaultIcon

HKEY_CURRENT_USER\Yh\shell

HKEY_CURRENT_USER\Yh\shell\
open

HKEY_CURRENT_USER\Yh\shell\
open\command

HKEY_CURRENT_USER\Yh\shell\
runas

HKEY_CURRENT_USER\Yh\shell\
runas\command

HKEY_CURRENT_USER\h7

HKEY_CURRENT_USER\h7\DefaultIcon

HKEY_CURRENT_USER\h7\shell

HKEY_CURRENT_USER\h7\shell\
open

HKEY_CURRENT_USER\h7\shell\
open\command

HKEY_CURRENT_USER\h7\shell\
runas

HKEY_CURRENT_USER\h7\shell\
runas\command

HKEY_CURRENT_USER\Mb4

HKEY_CURRENT_USER\Mb4\DefaultIcon

HKEY_CURRENT_USER\Mb4\shell

HKEY_CURRENT_USER\Mb4\shell\
open

HKEY_CURRENT_USER\Mb4\shell\
open\command

HKEY_CURRENT_USER\Mb4\shell\
runas

HKEY_CURRENT_USER\eg\shell\
open\command

HKEY_CURRENT_USER\eg\shell\
runas

HKEY_CURRENT_USER\eg\shell\
runas\command

HKEY_CURRENT_USER\28B

HKEY_CURRENT_USER\28B\DefaultIcon

HKEY_CURRENT_USER\28B\shell

HKEY_CURRENT_USER\28B\shell\
open

HKEY_CURRENT_USER\28B\shell\
open\command

HKEY_CURRENT_USER\28B\shell\
runas

HKEY_CURRENT_USER\28B\shell\
runas\command

HKEY_CURRENT_USER\BF5

HKEY_CURRENT_USER\BF5\DefaultIcon

HKEY_CURRENT_USER\BF5\shell

HKEY_CURRENT_USER\BF5\shell\
open

HKEY_CURRENT_USER\BF5\shell\
open\command

HKEY_CURRENT_USER\BF5\shell\
runas

HKEY_CURRENT_USER\BF5\shell\
runas\command

HKEY_LOCAL_MACHINE\Software\Microsoft\
Sft

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

HKEY_CURRENT_USER\.exe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\.exe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\.exe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\P82
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\P82\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\P82\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Software\Microsoft\
Windows
Local = "2bb5abe9"

HKEY_CURRENT_USER\Y8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\c7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\34
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\34\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\34\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\T5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\T5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\jG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LRO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\LRO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\LRO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3Q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3Q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xk
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xk\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\xk\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\13
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\13\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\13\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\81
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\81\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\81\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1a
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1a\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1a\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\46T
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\46T\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\46T\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3m
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3m\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3m\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\C1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\C1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\C1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wQ5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\23
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\23\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\23\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D20
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\D20\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D20\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\OF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k7l
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\k7l\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\k7l\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\17\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X51
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\X51\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\X51\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rk5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rk5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rk5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\eT\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eT\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7P3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7P3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7P3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\74Q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74Q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\71
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\71\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\71\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Gl
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Gl\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Gl\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\678
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\678\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\678\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lGj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lGj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lGj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\pj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\kY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\kY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\kY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8C
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8C\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8C\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\e3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\208
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\208\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\208\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\UEH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\UEH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\UEH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1o
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1o\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1o\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ka
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Ka\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ka\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\e2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3pO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3pO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3pO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uUe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uUe\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uUe\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G3Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\G3Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\G3Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ey
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Ey\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Ey\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\gE\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\gE\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Up
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Up\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Up\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3O7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3O7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3O7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4D
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4D\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\4D\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fW3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\fW3\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fW3\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\12y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\12y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\12y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7D
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7D\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7D\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\165
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\165\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\165\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\00e
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\00e\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\00e\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3E
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\e3E\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\e3E\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nE\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nE\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Fn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6Fn\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6Fn\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\WB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3yJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3yJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3yJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1i
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1i\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1i\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\y2c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y2c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\y2c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\r0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\r0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\r0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wQ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wQ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\STy
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\STy\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\STy\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m0u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\m0u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m0u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\38\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\38\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dG1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\dG1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dG1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1in
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1in\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1in\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8l
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8l\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8l\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\F8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\F8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\juB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\juB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\juB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ejJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ejJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ejJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\p1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\p1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rfY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rfY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\rfY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\TH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\TH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JQX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JQX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JQX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nyP
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nyP\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nyP\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8V
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8V\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8V\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\keR
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\keR\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\keR\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vs\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vs\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vx
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\vx\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\vx\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M0f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\M0f\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M0f\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y5u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y5u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Y5u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\M6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\M6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\563
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\563\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\563\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\53
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\53\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\53\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ca
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ca\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\ca\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AD
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\AD\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\AD\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vt
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vt\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Vt\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glw
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Glw\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glw\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7t\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7t\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jgt
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jgt\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jgt\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WUq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\WUq\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\WUq\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dXH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\dXH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\dXH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8M
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8M\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8M\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7V
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7V\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\7V\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Tg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\o1w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\o1w\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\o1w\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Ty4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Ty4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Ty4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\lG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yh
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Yh\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yh\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h7\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\h7\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Mb4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Mb4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Mb4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6r0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6r0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6r0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\E56
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\E56\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\E56\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\01e
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\01e\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\01e\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V44
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V44\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\V44\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uB8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uB8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\uB8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yq8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Yq8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Yq8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Jv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6R\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6R\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HlB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\HlB\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\HlB\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0a
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0a\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0a\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Qn\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qn\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Glr\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Glr\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\OW\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OW\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\GH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GH\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\GH\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Tv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5Tv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Tv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\R4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\R4\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\R4\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\c5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\c5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OaO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\OaO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\OaO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3u\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\3u\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L34
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L34\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L34\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bUO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bUO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\bUO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1Q1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1Q1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1Q1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\q8r
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\q8r\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\q8r\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1aI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1aI\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1aI\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\IS\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\IS\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nn0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Nn0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nn0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17i
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\17i\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\17i\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wt6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wt6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wt6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nm1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Nm1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Nm1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\16S
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\16S\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\16S\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\H0o
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\H0o\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\H0o\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Pm
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Pm\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2Pm\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0u1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0u1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0u1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\74n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\74n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\py
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\py\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\py\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\f15
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\f15\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\f15\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Qo\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Qo\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l0A
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\l0A\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\l0A\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U52
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\U52\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\U52\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8UU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8UU\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8UU\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YAY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YAY\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\YAY\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\mO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\mO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1g
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1g\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1g\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JO\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\JO\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D75
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\D75\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\D75\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yWK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yWK\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yWK\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\FX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\FX\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\FX\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t1s
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\t1s\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t1s\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\acv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\acv\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\acv\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\DJ2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\DJ2\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\DJ2\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wF\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\wF\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\id1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\id1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\id1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t7q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\t7q\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\t7q\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\NW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\NW\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\NW\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\114
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\114\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\114\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\nJ\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\nJ\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qd
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\qd\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\qd\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SWf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SWf\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SWf\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RDt
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\RDt\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\RDt\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1B\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\1B\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\88
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\88\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\88\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8J8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8J8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8J8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0w6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0w6\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0w6\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SEp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SEp\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\SEp\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yJ1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yJ1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\yJ1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pl8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pl8\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Pl8\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5Y\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5Y\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Eu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Eu\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Eu\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5x\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5x\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\L5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\apC
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\apC\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\apC\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sU1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sU1\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\sU1\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0H5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0H5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\0H5\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6s
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6s\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\6s\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2YG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2YG\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\2YG\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\45g
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\45g\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\45g\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\fj\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\fj\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\75
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\75\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\75\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8W
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8W\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8W\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87F
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\87F\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\87F\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cpA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cpA\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\cpA\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\J28
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\J28\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\J28\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8D0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8D0\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\8D0\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5f\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5f\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Us
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Us\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\Us\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5e
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5e\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\5e\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\15\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\15\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m2c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\m2c\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\m2c\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55n
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\55n\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\55n\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\eg\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\eg\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\28B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\28B\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\28B\shell\
runas\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BF5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\BF5\shell\
open\command
IsolatedCommand = "%1 %*"

HKEY_CURRENT_USER\BF5\shell\
runas\command
IsolatedCommand = "%1 %*"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

(Note: The default value data of the said registry entry is %User Profile%\Local Settings\Application Data.)

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Policies = "%User Profile%\Application Data\csrss.exe"

Dropping Routine

This Trojan drops the following files:

• %Application Data%\uvu.exe
• %User Profile%\Protect\sjla.m
• %User Profile%\Protect\s32.txt
• %User Profile%\Protect\ldbeig.hf

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}or2011.ru/aaa/index.php?{random characters}

This report is generated via an automated analysis system.