• Email
• Facebook
• Twitter
• Google+
• Linkedin

TROJ_MENTI.ADL

---

• マルウェアタイプ: トロイの木馬型
• 破壊活動の有無: なし
• 暗号化:  
• 感染報告の有無: はい

---

  概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

マルウェアは、ファイルを改変します。これにより、該当プログラムおよびアプリケーションが正しく実行されなくなります。 マルウェアは、タスクマネージャやレジストリエディタ、フォルダオプションを無効にします。

---

  詳細

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

• %User Profile%\Application Data\csrss.exe

(註：%User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

マルウェアは、以下のフォルダを作成します。

• %User Profile%\Protect\

(註：%User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
utdkfot = "rundll32 %User Profile%\Protect\kpqpxx.ra, pjwp"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
vyrqfd = "rundll32 %User Profile%\Protect\nykfun.pk, bhul"

他のシステム変更

マルウェアは、以下のファイルを改変します。

• %Application Data%\GDIPFONTCACHEV1.DAT

(註：%Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。)

マルウェアは、以下のファイルを削除します。

• %User Profile%\Application Data\csrss.exe
• %User Profile%\Application Data\csrss.exe:Zone.Identifier
• %User Temp%\1.tmp
• %User Temp%\2.tmp
• %User Temp%\3.tmp
• %User Temp%\4.tmp
• %Application Data%\thi.exe
• %Application Data%\grr.exe
• %Application Data%\cra.exe
• %Application Data%\isy.exe
• %Application Data%\qyl.exe
• %User Profile%\Application Data\aqu.exe
• %User Profile%\Application Data\fea.exe
• %User Profile%\Application Data\adb.exe
• %User Profile%\Application Data\qxo.exe
• %User Profile%\Application Data\dik.exe
• %User Temp%\ddu.exe
• %User Temp%\mri.exe
• %User Temp%\hou.exe
• %User Temp%\ysm.exe
• %User Temp%\oao.exe
• %User Profile%\Templates\ktl.exe
• %User Profile%\Templates\kgd.exe
• %User Profile%\Templates\pyy.exe
• %User Profile%\Templates\jpe.exe
• %User Profile%\Templates\ikd.exe
• %User Profile%\Protect\gs32.txt

(註：%User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。. %User Temp%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\Temp"、Windows NT の場合、"C:\Profiles\＜ユーザー名＞\TEMP"、Windows 2000、XP、Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\TEMP" です。. %Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。)

マルウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\T7I\shell\
runas

HKEY_CURRENT_USER\T7I\shell\
runas\command

HKEY_CURRENT_USER\a6X

HKEY_CURRENT_USER\a6X\DefaultIcon

HKEY_CURRENT_USER\a6X\shell

HKEY_CURRENT_USER\a6X\shell\
open

HKEY_CURRENT_USER\a6X\shell\
open\command

HKEY_CURRENT_USER\a6X\shell\
runas

HKEY_CURRENT_USER\a6X\shell\
runas\command

HKEY_CURRENT_USER\4t

HKEY_CURRENT_USER\4t\DefaultIcon

HKEY_CURRENT_USER\4t\shell

HKEY_CURRENT_USER\4t\shell\
open

HKEY_CURRENT_USER\4t\shell\
open\command

HKEY_CURRENT_USER\4t\shell\
runas

HKEY_CURRENT_USER\4t\shell\
runas\command

HKEY_CURRENT_USER\QR

HKEY_CURRENT_USER\QR\DefaultIcon

HKEY_CURRENT_USER\QR\shell

HKEY_CURRENT_USER\QR\shell\
open

HKEY_CURRENT_USER\QR\shell\
open\command

HKEY_CURRENT_USER\QR\shell\
runas

HKEY_CURRENT_USER\QR\shell\
runas\command

HKEY_CURRENT_USER\I7

HKEY_CURRENT_USER\I7\DefaultIcon

HKEY_CURRENT_USER\I7\shell

HKEY_CURRENT_USER\I7\shell\
open

HKEY_CURRENT_USER\I7\shell\
open\command

HKEY_CURRENT_USER\I7\shell\
runas

HKEY_CURRENT_USER\I7\shell\
runas\command

HKEY_CURRENT_USER\G05

HKEY_CURRENT_USER\G05\DefaultIcon

HKEY_CURRENT_USER\G05\shell

HKEY_CURRENT_USER\G05\shell\
open

HKEY_CURRENT_USER\G05\shell\
open\command

HKEY_CURRENT_USER\G05\shell\
runas

HKEY_CURRENT_USER\G05\shell\
runas\command

HKEY_CURRENT_USER\2x

HKEY_CURRENT_USER\2x\DefaultIcon

HKEY_CURRENT_USER\2x\shell

HKEY_CURRENT_USER\2x\shell\
open

HKEY_CURRENT_USER\2x\shell\
open\command

HKEY_CURRENT_USER\2x\shell\
runas

HKEY_CURRENT_USER\2x\shell\
runas\command

HKEY_CURRENT_USER\1I

HKEY_CURRENT_USER\1I\DefaultIcon

HKEY_CURRENT_USER\1I\shell

HKEY_CURRENT_USER\1I\shell\
open

HKEY_CURRENT_USER\1I\shell\
open\command

HKEY_CURRENT_USER\1I\shell\
runas

HKEY_CURRENT_USER\1I\shell\
runas\command

HKEY_CURRENT_USER\qK

HKEY_CURRENT_USER\qK\DefaultIcon

HKEY_CURRENT_USER\qK\shell

HKEY_CURRENT_USER\qK\shell\
open

HKEY_CURRENT_USER\qK\shell\
open\command

HKEY_CURRENT_USER\qK\shell\
runas

HKEY_CURRENT_USER\qK\shell\
runas\command

HKEY_CURRENT_USER\hL

HKEY_CURRENT_USER\hL\DefaultIcon

HKEY_CURRENT_USER\hL\shell

HKEY_CURRENT_USER\hL\shell\
open

HKEY_CURRENT_USER\hL\shell\
open\command

HKEY_CURRENT_USER\hL\shell\
runas

HKEY_CURRENT_USER\hL\shell\
runas\command

HKEY_CURRENT_USER\xS

HKEY_CURRENT_USER\xS\DefaultIcon

HKEY_CURRENT_USER\xS\shell

HKEY_CURRENT_USER\xS\shell\
open

HKEY_CURRENT_USER\xS\shell\
open\command

HKEY_CURRENT_USER\xS\shell\
runas

HKEY_CURRENT_USER\xS\shell\
runas\command

HKEY_CURRENT_USER\ef

HKEY_CURRENT_USER\ef\DefaultIcon

HKEY_CURRENT_USER\ef\shell

HKEY_CURRENT_USER\ef\shell\
open

HKEY_CURRENT_USER\ef\shell\
open\command

HKEY_CURRENT_USER\ef\shell\
runas

HKEY_CURRENT_USER\ef\shell\
runas\command

HKEY_CURRENT_USER\6Ft

HKEY_CURRENT_USER\6Ft\DefaultIcon

HKEY_CURRENT_USER\6Ft\shell

HKEY_CURRENT_USER\6Ft\shell\
open

HKEY_CURRENT_USER\6Ft\shell\
open\command

HKEY_CURRENT_USER\6Ft\shell\
runas

HKEY_CURRENT_USER\6Ft\shell\
runas\command

HKEY_CURRENT_USER\xb

HKEY_CURRENT_USER\xb\DefaultIcon

HKEY_CURRENT_USER\xb\shell

HKEY_CURRENT_USER\xb\shell\
open

HKEY_CURRENT_USER\xb\shell\
open\command

HKEY_CURRENT_USER\xb\shell\
runas

HKEY_CURRENT_USER\xb\shell\
runas\command

HKEY_CURRENT_USER\6R4

HKEY_CURRENT_USER\6R4\DefaultIcon

HKEY_CURRENT_USER\6R4\shell

HKEY_CURRENT_USER\6R4\shell\
open

HKEY_CURRENT_USER\6R4\shell\
open\command

HKEY_CURRENT_USER\6R4\shell\
runas

HKEY_CURRENT_USER\6R4\shell\
runas\command

HKEY_CURRENT_USER\65

HKEY_CURRENT_USER\65\DefaultIcon

HKEY_CURRENT_USER\65\shell

HKEY_CURRENT_USER\65\shell\
open

HKEY_CURRENT_USER\65\shell\
open\command

HKEY_CURRENT_USER\65\shell\
runas

HKEY_CURRENT_USER\65\shell\
runas\command

HKEY_CURRENT_USER\7m0

HKEY_CURRENT_USER\7m0\DefaultIcon

HKEY_CURRENT_USER\7m0\shell

HKEY_CURRENT_USER\7m0\shell\
open

HKEY_CURRENT_USER\7m0\shell\
open\command

HKEY_CURRENT_USER\7m0\shell\
runas

HKEY_CURRENT_USER\7m0\shell\
runas\command

HKEY_CURRENT_USER\B5

HKEY_CURRENT_USER\B5\DefaultIcon

HKEY_CURRENT_USER\B5\shell

HKEY_CURRENT_USER\B5\shell\
open

HKEY_CURRENT_USER\B5\shell\
open\command

HKEY_CURRENT_USER\B5\shell\
runas

HKEY_CURRENT_USER\B5\shell\
runas\command

HKEY_CURRENT_USER\h4

HKEY_CURRENT_USER\h4\DefaultIcon

HKEY_CURRENT_USER\h4\shell

HKEY_CURRENT_USER\h4\shell\
open

HKEY_CURRENT_USER\h4\shell\
open\command

HKEY_CURRENT_USER\h4\shell\
runas

HKEY_CURRENT_USER\h4\shell\
runas\command

HKEY_CURRENT_USER\cR7

HKEY_CURRENT_USER\cR7\DefaultIcon

HKEY_CURRENT_USER\cR7\shell

HKEY_CURRENT_USER\cR7\shell\
open

HKEY_CURRENT_USER\cR7\shell\
open\command

HKEY_CURRENT_USER\cR7\shell\
runas

HKEY_CURRENT_USER\cR7\shell\
runas\command

HKEY_CURRENT_USER\sW

HKEY_CURRENT_USER\sW\DefaultIcon

HKEY_CURRENT_USER\sW\shell

HKEY_CURRENT_USER\sW\shell\
open

HKEY_CURRENT_USER\sW\shell\
open\command

HKEY_CURRENT_USER\sW\shell\
runas

HKEY_CURRENT_USER\sW\shell\
runas\command

HKEY_CURRENT_USER\34t

HKEY_CURRENT_USER\34t\DefaultIcon

HKEY_CURRENT_USER\34t\shell

HKEY_CURRENT_USER\34t\shell\
open

HKEY_CURRENT_USER\34t\shell\
open\command

HKEY_CURRENT_USER\34t\shell\
runas

HKEY_CURRENT_USER\34t\shell\
runas\command

HKEY_CURRENT_USER\56J

HKEY_CURRENT_USER\56J\DefaultIcon

HKEY_CURRENT_USER\56J\shell

HKEY_CURRENT_USER\56J\shell\
open

HKEY_CURRENT_USER\56J\shell\
open\command

HKEY_CURRENT_USER\56J\shell\
runas

HKEY_CURRENT_USER\56J\shell\
runas\command

HKEY_CURRENT_USER\uE

HKEY_CURRENT_USER\uE\DefaultIcon

HKEY_CURRENT_USER\uE\shell

HKEY_CURRENT_USER\uE\shell\
open

HKEY_CURRENT_USER\uE\shell\
open\command

HKEY_CURRENT_USER\uE\shell\
runas

HKEY_CURRENT_USER\uE\shell\
runas\command

HKEY_CURRENT_USER\a42

HKEY_CURRENT_USER\a42\DefaultIcon

HKEY_CURRENT_USER\a42\shell

HKEY_CURRENT_USER\a42\shell\
open

HKEY_CURRENT_USER\a42\shell\
open\command

HKEY_CURRENT_USER\a42\shell\
runas

HKEY_CURRENT_USER\a42\shell\
runas\command

HKEY_CURRENT_USER\8B8

HKEY_CURRENT_USER\8B8\DefaultIcon

HKEY_CURRENT_USER\8B8\shell

HKEY_CURRENT_USER\8B8\shell\
open

HKEY_CURRENT_USER\8B8\shell\
open\command

HKEY_CURRENT_USER\8B8\shell\
runas

HKEY_CURRENT_USER\8B8\shell\
runas\command

HKEY_CURRENT_USER\w2s

HKEY_CURRENT_USER\w2s\DefaultIcon

HKEY_CURRENT_USER\w2s\shell

HKEY_CURRENT_USER\w2s\shell\
open

HKEY_CURRENT_USER\w2s\shell\
open\command

HKEY_CURRENT_USER\w2s\shell\
runas

HKEY_CURRENT_USER\w2s\shell\
runas\command

HKEY_CURRENT_USER\wCc

HKEY_CURRENT_USER\wCc\DefaultIcon

HKEY_CURRENT_USER\wCc\shell

HKEY_CURRENT_USER\wCc\shell\
open

HKEY_CURRENT_USER\wCc\shell\
open\command

HKEY_CURRENT_USER\wCc\shell\
runas

HKEY_CURRENT_USER\wCc\shell\
runas\command

HKEY_CURRENT_USER\w48

HKEY_CURRENT_USER\w48\DefaultIcon

HKEY_CURRENT_USER\w48\shell

HKEY_CURRENT_USER\w48\shell\
open

HKEY_CURRENT_USER\w48\shell\
open\command

HKEY_CURRENT_USER\w48\shell\
runas

HKEY_CURRENT_USER\w48\shell\
runas\command

HKEY_CURRENT_USER\F1

HKEY_CURRENT_USER\F1\DefaultIcon

HKEY_CURRENT_USER\F1\shell

HKEY_CURRENT_USER\F1\shell\
open

HKEY_CURRENT_USER\F1\shell\
open\command

HKEY_CURRENT_USER\F1\shell\
runas

HKEY_CURRENT_USER\F1\shell\
runas\command

HKEY_CURRENT_USER\laD

HKEY_CURRENT_USER\laD\DefaultIcon

HKEY_CURRENT_USER\laD\shell

HKEY_CURRENT_USER\laD\shell\
open

HKEY_CURRENT_USER\laD\shell\
open\command

HKEY_CURRENT_USER\laD\shell\
runas

HKEY_CURRENT_USER\laD\shell\
runas\command

HKEY_CURRENT_USER\41

HKEY_CURRENT_USER\41\DefaultIcon

HKEY_CURRENT_USER\41\shell

HKEY_CURRENT_USER\41\shell\
open

HKEY_CURRENT_USER\41\shell\
open\command

HKEY_CURRENT_USER\41\shell\
runas

HKEY_CURRENT_USER\41\shell\
runas\command

HKEY_CURRENT_USER\7HF

HKEY_CURRENT_USER\7HF\DefaultIcon

HKEY_CURRENT_USER\7HF\shell

HKEY_CURRENT_USER\7HF\shell\
open

HKEY_CURRENT_USER\7HF\shell\
open\command

HKEY_CURRENT_USER\7HF\shell\
runas

HKEY_CURRENT_USER\7HF\shell\
runas\command

HKEY_CURRENT_USER\67b

HKEY_CURRENT_USER\67b\DefaultIcon

HKEY_CURRENT_USER\67b\shell

HKEY_CURRENT_USER\67b\shell\
open

HKEY_CURRENT_USER\67b\shell\
open\command

HKEY_CURRENT_USER\67b\shell\
runas

HKEY_CURRENT_USER\67b\shell\
runas\command

HKEY_CURRENT_USER\0h

HKEY_CURRENT_USER\0h\DefaultIcon

HKEY_CURRENT_USER\0h\shell

HKEY_CURRENT_USER\0h\shell\
open

HKEY_CURRENT_USER\0h\shell\
open\command

HKEY_CURRENT_USER\0h\shell\
runas

HKEY_CURRENT_USER\0h\shell\
runas\command

HKEY_CURRENT_USER\yr

HKEY_CURRENT_USER\yr\DefaultIcon

HKEY_CURRENT_USER\yr\shell

HKEY_CURRENT_USER\yr\shell\
open

HKEY_CURRENT_USER\yr\shell\
open\command

HKEY_CURRENT_USER\yr\shell\
runas

HKEY_CURRENT_USER\yr\shell\
runas\command

HKEY_CURRENT_USER\f4

HKEY_CURRENT_USER\f4\DefaultIcon

HKEY_CURRENT_USER\f4\shell

HKEY_CURRENT_USER\f4\shell\
open

HKEY_CURRENT_USER\f4\shell\
open\command

HKEY_CURRENT_USER\f4\shell\
runas

HKEY_CURRENT_USER\f4\shell\
runas\command

HKEY_CURRENT_USER\SA

HKEY_CURRENT_USER\SA\DefaultIcon

HKEY_CURRENT_USER\SA\shell

HKEY_CURRENT_USER\SA\shell\
open

HKEY_CURRENT_USER\SA\shell\
open\command

HKEY_CURRENT_USER\SA\shell\
runas

HKEY_CURRENT_USER\SA\shell\
runas\command

HKEY_CURRENT_USER\v6

HKEY_CURRENT_USER\v6\DefaultIcon

HKEY_CURRENT_USER\v6\shell

HKEY_CURRENT_USER\v6\shell\
open

HKEY_CURRENT_USER\v6\shell\
open\command

HKEY_CURRENT_USER\v6\shell\
runas

HKEY_CURRENT_USER\v6\shell\
runas\command

HKEY_CURRENT_USER\iXH

HKEY_CURRENT_USER\iXH\DefaultIcon

HKEY_CURRENT_USER\iXH\shell

HKEY_CURRENT_USER\iXH\shell\
open

HKEY_CURRENT_USER\iXH\shell\
open\command

HKEY_CURRENT_USER\iXH\shell\
runas

HKEY_CURRENT_USER\iXH\shell\
runas\command

HKEY_CURRENT_USER\6w

HKEY_CURRENT_USER\6w\DefaultIcon

HKEY_CURRENT_USER\6w\shell

HKEY_CURRENT_USER\6w\shell\
open

HKEY_CURRENT_USER\6w\shell\
open\command

HKEY_CURRENT_USER\6w\shell\
runas

HKEY_CURRENT_USER\6w\shell\
runas\command

HKEY_CURRENT_USER\YT

HKEY_CURRENT_USER\YT\DefaultIcon

HKEY_CURRENT_USER\YT\shell

HKEY_CURRENT_USER\YT\shell\
open

HKEY_CURRENT_USER\YT\shell\
open\command

HKEY_CURRENT_USER\YT\shell\
runas

HKEY_CURRENT_USER\YT\shell\
runas\command

HKEY_CURRENT_USER\C2

HKEY_CURRENT_USER\C2\DefaultIcon

HKEY_CURRENT_USER\C2\shell

HKEY_CURRENT_USER\C2\shell\
open

HKEY_CURRENT_USER\C2\shell\
open\command

HKEY_CURRENT_USER\C2\shell\
runas

HKEY_CURRENT_USER\C2\shell\
runas\command

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus

HKEY_CURRENT_USER\.exe

HKEY_CURRENT_USER\.exe\DefaultIcon

HKEY_CURRENT_USER\.exe\shell

HKEY_CURRENT_USER\.exe\shell\
open

HKEY_CURRENT_USER\.exe\shell\
open\command

HKEY_CURRENT_USER\.exe\shell\
runas

HKEY_CURRENT_USER\.exe\shell\
runas\command

HKEY_CURRENT_USER\6m7

HKEY_CURRENT_USER\6m7\DefaultIcon

HKEY_CURRENT_USER\6m7\shell

HKEY_CURRENT_USER\6m7\shell\
open

HKEY_CURRENT_USER\6m7\shell\
open\command

HKEY_CURRENT_USER\6m7\shell\
runas

HKEY_CURRENT_USER\6m7\shell\
runas\command

HKEY_CURRENT_USER\i0x

HKEY_CURRENT_USER\i0x\DefaultIcon

HKEY_CURRENT_USER\i0x\shell

HKEY_CURRENT_USER\i0x\shell\
open

HKEY_CURRENT_USER\i0x\shell\
open\command

HKEY_CURRENT_USER\i0x\shell\
runas

HKEY_CURRENT_USER\i0x\shell\
runas\command

HKEY_CURRENT_USER\oE

HKEY_CURRENT_USER\oE\DefaultIcon

HKEY_CURRENT_USER\oE\shell

HKEY_CURRENT_USER\oE\shell\
open

HKEY_CURRENT_USER\oE\shell\
open\command

HKEY_CURRENT_USER\oE\shell\
runas

HKEY_CURRENT_USER\oE\shell\
runas\command

HKEY_CURRENT_USER\744

HKEY_CURRENT_USER\744\DefaultIcon

HKEY_CURRENT_USER\744\shell

HKEY_CURRENT_USER\744\shell\
open

HKEY_CURRENT_USER\744\shell\
open\command

HKEY_CURRENT_USER\744\shell\
runas

HKEY_CURRENT_USER\744\shell\
runas\command

HKEY_CURRENT_USER\58

HKEY_CURRENT_USER\58\DefaultIcon

HKEY_CURRENT_USER\58\shell

HKEY_CURRENT_USER\58\shell\
open

HKEY_CURRENT_USER\58\shell\
open\command

HKEY_CURRENT_USER\58\shell\
runas

HKEY_CURRENT_USER\58\shell\
runas\command

HKEY_CURRENT_USER\JI2

HKEY_CURRENT_USER\JI2\DefaultIcon

HKEY_CURRENT_USER\JI2\shell

HKEY_CURRENT_USER\JI2\shell\
open

HKEY_CURRENT_USER\JI2\shell\
open\command

HKEY_CURRENT_USER\JI2\shell\
runas

HKEY_CURRENT_USER\JI2\shell\
runas\command

HKEY_CURRENT_USER\y7Q

HKEY_CURRENT_USER\y7Q\DefaultIcon

HKEY_CURRENT_USER\y7Q\shell

HKEY_CURRENT_USER\y7Q\shell\
open

HKEY_CURRENT_USER\y7Q\shell\
open\command

HKEY_CURRENT_USER\y7Q\shell\
runas

HKEY_CURRENT_USER\y7Q\shell\
runas\command

HKEY_CURRENT_USER\0Ao

HKEY_CURRENT_USER\0Ao\DefaultIcon

HKEY_CURRENT_USER\0Ao\shell

HKEY_CURRENT_USER\0Ao\shell\
open

HKEY_CURRENT_USER\0Ao\shell\
open\command

HKEY_CURRENT_USER\0Ao\shell\
runas

HKEY_CURRENT_USER\0Ao\shell\
runas\command

HKEY_CURRENT_USER\vUX

HKEY_CURRENT_USER\vUX\DefaultIcon

HKEY_CURRENT_USER\vUX\shell

HKEY_CURRENT_USER\vUX\shell\
open

HKEY_CURRENT_USER\vUX\shell\
open\command

HKEY_CURRENT_USER\vUX\shell\
runas

HKEY_CURRENT_USER\vUX\shell\
runas\command

HKEY_CURRENT_USER\GV0

HKEY_CURRENT_USER\GV0\DefaultIcon

HKEY_CURRENT_USER\GV0\shell

HKEY_CURRENT_USER\GV0\shell\
open

HKEY_CURRENT_USER\GV0\shell\
open\command

HKEY_CURRENT_USER\GV0\shell\
runas

HKEY_CURRENT_USER\GV0\shell\
runas\command

HKEY_CURRENT_USER\hV

HKEY_CURRENT_USER\hV\DefaultIcon

HKEY_CURRENT_USER\hV\shell

HKEY_CURRENT_USER\hV\shell\
open

HKEY_CURRENT_USER\hV\shell\
open\command

HKEY_CURRENT_USER\hV\shell\
runas

HKEY_CURRENT_USER\hV\shell\
runas\command

HKEY_CURRENT_USER\Jsp

HKEY_CURRENT_USER\Jsp\DefaultIcon

HKEY_CURRENT_USER\Jsp\shell

HKEY_CURRENT_USER\Jsp\shell\
open

HKEY_CURRENT_USER\Jsp\shell\
open\command

HKEY_CURRENT_USER\Jsp\shell\
runas

HKEY_CURRENT_USER\Jsp\shell\
runas\command

HKEY_CURRENT_USER\D12

HKEY_CURRENT_USER\D12\DefaultIcon

HKEY_CURRENT_USER\D12\shell

HKEY_CURRENT_USER\D12\shell\
open

HKEY_CURRENT_USER\D12\shell\
open\command

HKEY_CURRENT_USER\D12\shell\
runas

HKEY_CURRENT_USER\D12\shell\
runas\command

HKEY_CURRENT_USER\7O

HKEY_CURRENT_USER\7O\DefaultIcon

HKEY_CURRENT_USER\7O\shell

HKEY_CURRENT_USER\7O\shell\
open

HKEY_CURRENT_USER\7O\shell\
open\command

HKEY_CURRENT_USER\7O\shell\
runas

HKEY_CURRENT_USER\7O\shell\
runas\command

HKEY_CURRENT_USER\2Ed

HKEY_CURRENT_USER\2Ed\DefaultIcon

HKEY_CURRENT_USER\2Ed\shell

HKEY_CURRENT_USER\2Ed\shell\
open

HKEY_CURRENT_USER\2Ed\shell\
open\command

HKEY_CURRENT_USER\2Ed\shell\
runas

HKEY_CURRENT_USER\2Ed\shell\
runas\command

HKEY_CURRENT_USER\y2t

HKEY_CURRENT_USER\y2t\DefaultIcon

HKEY_CURRENT_USER\y2t\shell

HKEY_CURRENT_USER\y2t\shell\
open

HKEY_CURRENT_USER\y2t\shell\
open\command

HKEY_CURRENT_USER\y2t\shell\
runas

HKEY_CURRENT_USER\y2t\shell\
runas\command

HKEY_CURRENT_USER\0h6

HKEY_CURRENT_USER\0h6\DefaultIcon

HKEY_CURRENT_USER\0h6\shell

HKEY_CURRENT_USER\0h6\shell\
open

HKEY_CURRENT_USER\0h6\shell\
open\command

HKEY_CURRENT_USER\0h6\shell\
runas

HKEY_CURRENT_USER\0h6\shell\
runas\command

HKEY_CURRENT_USER\wKI

HKEY_CURRENT_USER\wKI\DefaultIcon

HKEY_CURRENT_USER\wKI\shell

HKEY_CURRENT_USER\wKI\shell\
open

HKEY_CURRENT_USER\wKI\shell\
open\command

HKEY_CURRENT_USER\wKI\shell\
runas

HKEY_CURRENT_USER\wKI\shell\
runas\command

HKEY_CURRENT_USER\5fY

HKEY_CURRENT_USER\5fY\DefaultIcon

HKEY_CURRENT_USER\5fY\shell

HKEY_CURRENT_USER\5fY\shell\
open

HKEY_CURRENT_USER\5fY\shell\
open\command

HKEY_CURRENT_USER\5fY\shell\
runas

HKEY_CURRENT_USER\5fY\shell\
runas\command

HKEY_CURRENT_USER\23

HKEY_CURRENT_USER\23\DefaultIcon

HKEY_CURRENT_USER\23\shell

HKEY_CURRENT_USER\23\shell\
open

HKEY_CURRENT_USER\23\shell\
open\command

HKEY_CURRENT_USER\23\shell\
runas

HKEY_CURRENT_USER\23\shell\
runas\command

HKEY_CURRENT_USER\o6a

HKEY_CURRENT_USER\o6a\DefaultIcon

HKEY_CURRENT_USER\o6a\shell

HKEY_CURRENT_USER\o6a\shell\
open

HKEY_CURRENT_USER\o6a\shell\
open\command

HKEY_CURRENT_USER\o6a\shell\
runas

HKEY_CURRENT_USER\o6a\shell\
runas\command

HKEY_CURRENT_USER\f1U

HKEY_CURRENT_USER\f1U\DefaultIcon

HKEY_CURRENT_USER\f1U\shell

HKEY_CURRENT_USER\f1U\shell\
open

HKEY_CURRENT_USER\f1U\shell\
open\command

HKEY_CURRENT_USER\f1U\shell\
runas

HKEY_CURRENT_USER\f1U\shell\
runas\command

HKEY_CURRENT_USER\L50

HKEY_CURRENT_USER\L50\DefaultIcon

HKEY_CURRENT_USER\L50\shell

HKEY_CURRENT_USER\L50\shell\
open

HKEY_CURRENT_USER\L50\shell\
open\command

HKEY_CURRENT_USER\L50\shell\
runas

HKEY_CURRENT_USER\L50\shell\
runas\command

HKEY_CURRENT_USER\K5

HKEY_CURRENT_USER\K5\DefaultIcon

HKEY_CURRENT_USER\K5\shell

HKEY_CURRENT_USER\K5\shell\
open

HKEY_CURRENT_USER\K5\shell\
open\command

HKEY_CURRENT_USER\K5\shell\
runas

HKEY_CURRENT_USER\K5\shell\
runas\command

HKEY_CURRENT_USER\GW

HKEY_CURRENT_USER\GW\DefaultIcon

HKEY_CURRENT_USER\GW\shell

HKEY_CURRENT_USER\GW\shell\
open

HKEY_CURRENT_USER\GW\shell\
open\command

HKEY_CURRENT_USER\GW\shell\
runas

HKEY_CURRENT_USER\GW\shell\
runas\command

HKEY_CURRENT_USER\7r

HKEY_CURRENT_USER\7r\DefaultIcon

HKEY_CURRENT_USER\7r\shell

HKEY_CURRENT_USER\7r\shell\
open

HKEY_CURRENT_USER\7r\shell\
open\command

HKEY_CURRENT_USER\7r\shell\
runas

HKEY_CURRENT_USER\7r\shell\
runas\command

HKEY_CURRENT_USER\pP1

HKEY_CURRENT_USER\pP1\DefaultIcon

HKEY_CURRENT_USER\pP1\shell

HKEY_CURRENT_USER\pP1\shell\
open

HKEY_CURRENT_USER\pP1\shell\
open\command

HKEY_CURRENT_USER\pP1\shell\
runas

HKEY_CURRENT_USER\pP1\shell\
runas\command

HKEY_CURRENT_USER\Sg1

HKEY_CURRENT_USER\Sg1\DefaultIcon

HKEY_CURRENT_USER\Sg1\shell

HKEY_CURRENT_USER\Sg1\shell\
open

HKEY_CURRENT_USER\Sg1\shell\
open\command

HKEY_CURRENT_USER\Sg1\shell\
runas

HKEY_CURRENT_USER\Sg1\shell\
runas\command

HKEY_CURRENT_USER\JIG

HKEY_CURRENT_USER\JIG\DefaultIcon

HKEY_CURRENT_USER\JIG\shell

HKEY_CURRENT_USER\JIG\shell\
open

HKEY_CURRENT_USER\JIG\shell\
open\command

HKEY_CURRENT_USER\JIG\shell\
runas

HKEY_CURRENT_USER\JIG\shell\
runas\command

HKEY_CURRENT_USER\sB

HKEY_CURRENT_USER\sB\DefaultIcon

HKEY_CURRENT_USER\sB\shell

HKEY_CURRENT_USER\sB\shell\
open

HKEY_CURRENT_USER\sB\shell\
open\command

HKEY_CURRENT_USER\sB\shell\
runas

HKEY_CURRENT_USER\sB\shell\
runas\command

HKEY_CURRENT_USER\GG

HKEY_CURRENT_USER\GG\DefaultIcon

HKEY_CURRENT_USER\GG\shell

HKEY_CURRENT_USER\GG\shell\
open

HKEY_CURRENT_USER\GG\shell\
open\command

HKEY_CURRENT_USER\GG\shell\
runas

HKEY_CURRENT_USER\GG\shell\
runas\command

HKEY_CURRENT_USER\B6Y

HKEY_CURRENT_USER\B6Y\DefaultIcon

HKEY_CURRENT_USER\B6Y\shell

HKEY_CURRENT_USER\B6Y\shell\
open

HKEY_CURRENT_USER\B6Y\shell\
open\command

HKEY_CURRENT_USER\B6Y\shell\
runas

HKEY_CURRENT_USER\B6Y\shell\
runas\command

HKEY_CURRENT_USER\854

HKEY_CURRENT_USER\854\DefaultIcon

HKEY_CURRENT_USER\854\shell

HKEY_CURRENT_USER\854\shell\
open

HKEY_CURRENT_USER\854\shell\
open\command

HKEY_CURRENT_USER\854\shell\
runas

HKEY_CURRENT_USER\854\shell\
runas\command

HKEY_CURRENT_USER\R27

HKEY_CURRENT_USER\R27\DefaultIcon

HKEY_CURRENT_USER\R27\shell

HKEY_CURRENT_USER\R27\shell\
open

HKEY_CURRENT_USER\R27\shell\
open\command

HKEY_CURRENT_USER\R27\shell\
runas

HKEY_CURRENT_USER\R27\shell\
runas\command

HKEY_CURRENT_USER\1f

HKEY_CURRENT_USER\1f\DefaultIcon

HKEY_CURRENT_USER\1f\shell

HKEY_CURRENT_USER\1f\shell\
open

HKEY_CURRENT_USER\1f\shell\
open\command

HKEY_CURRENT_USER\1f\shell\
runas

HKEY_CURRENT_USER\1f\shell\
runas\command

HKEY_CURRENT_USER\bo

HKEY_CURRENT_USER\bo\DefaultIcon

HKEY_CURRENT_USER\bo\shell

HKEY_CURRENT_USER\bo\shell\
open

HKEY_CURRENT_USER\bo\shell\
open\command

HKEY_CURRENT_USER\bo\shell\
runas

HKEY_CURRENT_USER\bo\shell\
runas\command

HKEY_CURRENT_USER\53

HKEY_CURRENT_USER\53\DefaultIcon

HKEY_CURRENT_USER\53\shell

HKEY_CURRENT_USER\53\shell\
open

HKEY_CURRENT_USER\53\shell\
open\command

HKEY_CURRENT_USER\53\shell\
runas

HKEY_CURRENT_USER\53\shell\
runas\command

HKEY_CURRENT_USER\3R

HKEY_CURRENT_USER\3R\DefaultIcon

HKEY_CURRENT_USER\3R\shell

HKEY_CURRENT_USER\3R\shell\
open

HKEY_CURRENT_USER\3R\shell\
open\command

HKEY_CURRENT_USER\3R\shell\
runas

HKEY_CURRENT_USER\3R\shell\
runas\command

HKEY_CURRENT_USER\4vI

HKEY_CURRENT_USER\4vI\DefaultIcon

HKEY_CURRENT_USER\4vI\shell

HKEY_CURRENT_USER\4vI\shell\
open

HKEY_CURRENT_USER\4vI\shell\
open\command

HKEY_CURRENT_USER\4vI\shell\
runas

HKEY_CURRENT_USER\4vI\shell\
runas\command

HKEY_CURRENT_USER\bW5

HKEY_CURRENT_USER\bW5\DefaultIcon

HKEY_CURRENT_USER\bW5\shell

HKEY_CURRENT_USER\bW5\shell\
open

HKEY_CURRENT_USER\bW5\shell\
open\command

HKEY_CURRENT_USER\bW5\shell\
runas

HKEY_CURRENT_USER\bW5\shell\
runas\command

HKEY_CURRENT_USER\28

HKEY_CURRENT_USER\28\DefaultIcon

HKEY_CURRENT_USER\28\shell

HKEY_CURRENT_USER\28\shell\
open

HKEY_CURRENT_USER\28\shell\
open\command

HKEY_CURRENT_USER\28\shell\
runas

HKEY_CURRENT_USER\28\shell\
runas\command

HKEY_CURRENT_USER\66

HKEY_CURRENT_USER\66\DefaultIcon

HKEY_CURRENT_USER\66\shell

HKEY_CURRENT_USER\66\shell\
open

HKEY_CURRENT_USER\66\shell\
open\command

HKEY_CURRENT_USER\66\shell\
runas

HKEY_CURRENT_USER\66\shell\
runas\command

HKEY_CURRENT_USER\oE3

HKEY_CURRENT_USER\oE3\DefaultIcon

HKEY_CURRENT_USER\oE3\shell

HKEY_CURRENT_USER\oE3\shell\
open

HKEY_CURRENT_USER\oE3\shell\
open\command

HKEY_CURRENT_USER\oE3\shell\
runas

HKEY_CURRENT_USER\oE3\shell\
runas\command

HKEY_CURRENT_USER\lG

HKEY_CURRENT_USER\lG\DefaultIcon

HKEY_CURRENT_USER\lG\shell

HKEY_CURRENT_USER\lG\shell\
open

HKEY_CURRENT_USER\lG\shell\
open\command

HKEY_CURRENT_USER\lG\shell\
runas

HKEY_CURRENT_USER\lG\shell\
runas\command

HKEY_CURRENT_USER\Fv

HKEY_CURRENT_USER\Fv\DefaultIcon

HKEY_CURRENT_USER\Fv\shell

HKEY_CURRENT_USER\Fv\shell\
open

HKEY_CURRENT_USER\Fv\shell\
open\command

HKEY_CURRENT_USER\Fv\shell\
runas

HKEY_CURRENT_USER\Fv\shell\
runas\command

HKEY_CURRENT_USER\7Yo

HKEY_CURRENT_USER\7Yo\DefaultIcon

HKEY_CURRENT_USER\7Yo\shell

HKEY_CURRENT_USER\7Yo\shell\
open

HKEY_CURRENT_USER\7Yo\shell\
open\command

HKEY_CURRENT_USER\7Yo\shell\
runas

HKEY_CURRENT_USER\7Yo\shell\
runas\command

HKEY_CURRENT_USER\hC

HKEY_CURRENT_USER\hC\DefaultIcon

HKEY_CURRENT_USER\hC\shell

HKEY_CURRENT_USER\hC\shell\
open

HKEY_CURRENT_USER\hC\shell\
open\command

HKEY_CURRENT_USER\hC\shell\
runas

HKEY_CURRENT_USER\hC\shell\
runas\command

HKEY_CURRENT_USER\2Qn

HKEY_CURRENT_USER\2Qn\DefaultIcon

HKEY_CURRENT_USER\2Qn\shell

HKEY_CURRENT_USER\2Qn\shell\
open

HKEY_CURRENT_USER\2Qn\shell\
open\command

HKEY_CURRENT_USER\2Qn\shell\
runas

HKEY_CURRENT_USER\2Qn\shell\
runas\command

HKEY_CURRENT_USER\X0

HKEY_CURRENT_USER\X0\DefaultIcon

HKEY_CURRENT_USER\X0\shell

HKEY_CURRENT_USER\X0\shell\
open

HKEY_CURRENT_USER\X0\shell\
open\command

HKEY_CURRENT_USER\X0\shell\
runas

HKEY_CURRENT_USER\X0\shell\
runas\command

HKEY_CURRENT_USER\0YK

HKEY_CURRENT_USER\0YK\DefaultIcon

HKEY_CURRENT_USER\0YK\shell

HKEY_CURRENT_USER\0YK\shell\
open

HKEY_CURRENT_USER\0YK\shell\
open\command

HKEY_CURRENT_USER\0YK\shell\
runas

HKEY_CURRENT_USER\0YK\shell\
runas\command

HKEY_CURRENT_USER\5UU

HKEY_CURRENT_USER\5UU\DefaultIcon

HKEY_CURRENT_USER\5UU\shell

HKEY_CURRENT_USER\5UU\shell\
open

HKEY_CURRENT_USER\5UU\shell\
open\command

HKEY_CURRENT_USER\5UU\shell\
runas

HKEY_CURRENT_USER\5UU\shell\
runas\command

HKEY_CURRENT_USER\73O

HKEY_CURRENT_USER\73O\DefaultIcon

HKEY_CURRENT_USER\73O\shell

HKEY_CURRENT_USER\73O\shell\
open

HKEY_CURRENT_USER\73O\shell\
open\command

HKEY_CURRENT_USER\73O\shell\
runas

HKEY_CURRENT_USER\73O\shell\
runas\command

HKEY_CURRENT_USER\YcT

HKEY_CURRENT_USER\YcT\DefaultIcon

HKEY_CURRENT_USER\YcT\shell

HKEY_CURRENT_USER\YcT\shell\
open

HKEY_CURRENT_USER\YcT\shell\
open\command

HKEY_CURRENT_USER\YcT\shell\
runas

HKEY_CURRENT_USER\YcT\shell\
runas\command

HKEY_CURRENT_USER\17

HKEY_CURRENT_USER\17\DefaultIcon

HKEY_CURRENT_USER\17\shell

HKEY_CURRENT_USER\17\shell\
open

HKEY_CURRENT_USER\17\shell\
open\command

HKEY_CURRENT_USER\17\shell\
runas

HKEY_CURRENT_USER\17\shell\
runas\command

HKEY_CURRENT_USER\y8o

HKEY_CURRENT_USER\y8o\DefaultIcon

HKEY_CURRENT_USER\y8o\shell

HKEY_CURRENT_USER\y8o\shell\
open

HKEY_CURRENT_USER\y8o\shell\
open\command

HKEY_CURRENT_USER\y8o\shell\
runas

HKEY_CURRENT_USER\y8o\shell\
runas\command

HKEY_CURRENT_USER\2Fb

HKEY_CURRENT_USER\2Fb\DefaultIcon

HKEY_CURRENT_USER\2Fb\shell

HKEY_CURRENT_USER\2Fb\shell\
open

HKEY_CURRENT_USER\2Fb\shell\
open\command

HKEY_CURRENT_USER\2Fb\shell\
runas

HKEY_CURRENT_USER\2Fb\shell\
runas\command

HKEY_CURRENT_USER\Pb

HKEY_CURRENT_USER\Pb\DefaultIcon

HKEY_CURRENT_USER\Pb\shell

HKEY_CURRENT_USER\Pb\shell\
open

HKEY_CURRENT_USER\Pb\shell\
open\command

HKEY_CURRENT_USER\Pb\shell\
runas

HKEY_CURRENT_USER\Pb\shell\
runas\command

HKEY_CURRENT_USER\4u5

HKEY_CURRENT_USER\4u5\DefaultIcon

HKEY_CURRENT_USER\4u5\shell

HKEY_CURRENT_USER\4u5\shell\
open

HKEY_CURRENT_USER\4u5\shell\
open\command

HKEY_CURRENT_USER\4u5\shell\
runas

HKEY_CURRENT_USER\4u5\shell\
runas\command

HKEY_CURRENT_USER\r8

HKEY_CURRENT_USER\r8\DefaultIcon

HKEY_CURRENT_USER\r8\shell

HKEY_CURRENT_USER\r8\shell\
open

HKEY_CURRENT_USER\r8\shell\
open\command

HKEY_CURRENT_USER\r8\shell\
runas

HKEY_CURRENT_USER\r8\shell\
runas\command

HKEY_CURRENT_USER\a0p

HKEY_CURRENT_USER\a0p\DefaultIcon

HKEY_CURRENT_USER\a0p\shell

HKEY_CURRENT_USER\a0p\shell\
open

HKEY_CURRENT_USER\a0p\shell\
open\command

HKEY_CURRENT_USER\a0p\shell\
runas

HKEY_CURRENT_USER\a0p\shell\
runas\command

HKEY_CURRENT_USER\Ocj

HKEY_CURRENT_USER\Ocj\DefaultIcon

HKEY_CURRENT_USER\Ocj\shell

HKEY_CURRENT_USER\Ocj\shell\
open

HKEY_CURRENT_USER\Ocj\shell\
open\command

HKEY_CURRENT_USER\Ocj\shell\
runas

HKEY_CURRENT_USER\Ocj\shell\
runas\command

HKEY_CURRENT_USER\SNu

HKEY_CURRENT_USER\SNu\DefaultIcon

HKEY_CURRENT_USER\SNu\shell

HKEY_CURRENT_USER\SNu\shell\
open

HKEY_CURRENT_USER\SNu\shell\
open\command

HKEY_CURRENT_USER\SNu\shell\
runas

HKEY_CURRENT_USER\SNu\shell\
runas\command

HKEY_CURRENT_USER\NoB

HKEY_CURRENT_USER\NoB\DefaultIcon

HKEY_CURRENT_USER\NoB\shell

HKEY_CURRENT_USER\NoB\shell\
open

HKEY_CURRENT_USER\NoB\shell\
open\command

HKEY_CURRENT_USER\NoB\shell\
runas

HKEY_CURRENT_USER\NoB\shell\
runas\command

HKEY_CURRENT_USER\8T4

HKEY_CURRENT_USER\8T4\DefaultIcon

HKEY_CURRENT_USER\8T4\shell

HKEY_CURRENT_USER\8T4\shell\
open

HKEY_CURRENT_USER\8T4\shell\
open\command

HKEY_CURRENT_USER\8T4\shell\
runas

HKEY_CURRENT_USER\8T4\shell\
runas\command

HKEY_CURRENT_USER\mCq

HKEY_CURRENT_USER\mCq\DefaultIcon

HKEY_CURRENT_USER\mCq\shell

HKEY_CURRENT_USER\mCq\shell\
open

HKEY_CURRENT_USER\mCq\shell\
open\command

HKEY_CURRENT_USER\mCq\shell\
runas

HKEY_CURRENT_USER\mCq\shell\
runas\command

HKEY_CURRENT_USER\Uv

HKEY_CURRENT_USER\Uv\DefaultIcon

HKEY_CURRENT_USER\Uv\shell

HKEY_CURRENT_USER\Uv\shell\
open

HKEY_CURRENT_USER\Uv\shell\
open\command

HKEY_CURRENT_USER\Uv\shell\
runas

HKEY_CURRENT_USER\Uv\shell\
runas\command

HKEY_CURRENT_USER\sc

HKEY_CURRENT_USER\sc\DefaultIcon

HKEY_CURRENT_USER\sc\shell

HKEY_CURRENT_USER\sc\shell\
open

HKEY_CURRENT_USER\sc\shell\
open\command

HKEY_CURRENT_USER\sc\shell\
runas

HKEY_CURRENT_USER\sc\shell\
runas\command

HKEY_CURRENT_USER\REO

HKEY_CURRENT_USER\REO\DefaultIcon

HKEY_CURRENT_USER\REO\shell

HKEY_CURRENT_USER\REO\shell\
open

HKEY_CURRENT_USER\REO\shell\
open\command

HKEY_CURRENT_USER\REO\shell\
runas

HKEY_CURRENT_USER\REO\shell\
runas\command

HKEY_CURRENT_USER\Y1N

HKEY_CURRENT_USER\Y1N\DefaultIcon

HKEY_CURRENT_USER\Y1N\shell

HKEY_CURRENT_USER\Y1N\shell\
open

HKEY_CURRENT_USER\Y1N\shell\
open\command

HKEY_CURRENT_USER\Y1N\shell\
runas

HKEY_CURRENT_USER\Y1N\shell\
runas\command

HKEY_CURRENT_USER\ht

HKEY_CURRENT_USER\ht\DefaultIcon

HKEY_CURRENT_USER\ht\shell

HKEY_CURRENT_USER\ht\shell\
open

HKEY_CURRENT_USER\ht\shell\
open\command

HKEY_CURRENT_USER\ht\shell\
runas

HKEY_CURRENT_USER\ht\shell\
runas\command

HKEY_CURRENT_USER\j8

HKEY_CURRENT_USER\j8\DefaultIcon

HKEY_CURRENT_USER\j8\shell

HKEY_CURRENT_USER\j8\shell\
open

HKEY_CURRENT_USER\j8\shell\
open\command

HKEY_CURRENT_USER\j8\shell\
runas

HKEY_CURRENT_USER\j8\shell\
runas\command

HKEY_CURRENT_USER\6a0

HKEY_CURRENT_USER\6a0\DefaultIcon

HKEY_CURRENT_USER\6a0\shell

HKEY_CURRENT_USER\6a0\shell\
open

HKEY_CURRENT_USER\6a0\shell\
open\command

HKEY_CURRENT_USER\6a0\shell\
runas

HKEY_CURRENT_USER\6a0\shell\
runas\command

HKEY_CURRENT_USER\SPA

HKEY_CURRENT_USER\SPA\DefaultIcon

HKEY_CURRENT_USER\SPA\shell

HKEY_CURRENT_USER\SPA\shell\
open

HKEY_CURRENT_USER\SPA\shell\
open\command

HKEY_CURRENT_USER\SPA\shell\
runas

HKEY_CURRENT_USER\SPA\shell\
runas\command

HKEY_CURRENT_USER\NB2

HKEY_CURRENT_USER\NB2\DefaultIcon

HKEY_CURRENT_USER\NB2\shell

HKEY_CURRENT_USER\NB2\shell\
open

HKEY_CURRENT_USER\NB2\shell\
open\command

HKEY_CURRENT_USER\NB2\shell\
runas

HKEY_CURRENT_USER\NB2\shell\
runas\command

HKEY_CURRENT_USER\Ikg

HKEY_CURRENT_USER\Ikg\DefaultIcon

HKEY_CURRENT_USER\Ikg\shell

HKEY_CURRENT_USER\Ikg\shell\
open

HKEY_CURRENT_USER\Ikg\shell\
open\command

HKEY_CURRENT_USER\Ikg\shell\
runas

HKEY_CURRENT_USER\Ikg\shell\
runas\command

HKEY_CURRENT_USER\6T

HKEY_CURRENT_USER\6T\DefaultIcon

HKEY_CURRENT_USER\6T\shell

HKEY_CURRENT_USER\6T\shell\
open

HKEY_CURRENT_USER\6T\shell\
open\command

HKEY_CURRENT_USER\6T\shell\
runas

HKEY_CURRENT_USER\6T\shell\
runas\command

HKEY_CURRENT_USER\Peo

HKEY_CURRENT_USER\Peo\DefaultIcon

HKEY_CURRENT_USER\Peo\shell

HKEY_CURRENT_USER\Peo\shell\
open

HKEY_CURRENT_USER\Peo\shell\
open\command

HKEY_CURRENT_USER\Peo\shell\
runas

HKEY_CURRENT_USER\Peo\shell\
runas\command

HKEY_CURRENT_USER\tpV

HKEY_CURRENT_USER\tpV\DefaultIcon

HKEY_CURRENT_USER\tpV\shell

HKEY_CURRENT_USER\tpV\shell\
open

HKEY_CURRENT_USER\tpV\shell\
open\command

HKEY_CURRENT_USER\tpV\shell\
runas

HKEY_CURRENT_USER\tpV\shell\
runas\command

HKEY_CURRENT_USER\jXA

HKEY_CURRENT_USER\jXA\DefaultIcon

HKEY_CURRENT_USER\jXA\shell

HKEY_CURRENT_USER\jXA\shell\
open

HKEY_CURRENT_USER\jXA\shell\
open\command

HKEY_CURRENT_USER\jXA\shell\
runas

HKEY_CURRENT_USER\jXA\shell\
runas\command

HKEY_CURRENT_USER\0DU

HKEY_CURRENT_USER\0DU\DefaultIcon

HKEY_CURRENT_USER\0DU\shell

HKEY_CURRENT_USER\0DU\shell\
open

HKEY_CURRENT_USER\0DU\shell\
open\command

HKEY_CURRENT_USER\0DU\shell\
runas

HKEY_CURRENT_USER\0DU\shell\
runas\command

HKEY_CURRENT_USER\mCp

HKEY_CURRENT_USER\mCp\DefaultIcon

HKEY_CURRENT_USER\mCp\shell

HKEY_CURRENT_USER\mCp\shell\
open

HKEY_CURRENT_USER\mCp\shell\
open\command

HKEY_CURRENT_USER\mCp\shell\
runas

HKEY_CURRENT_USER\mCp\shell\
runas\command

HKEY_CURRENT_USER\Y8

HKEY_CURRENT_USER\Y8\DefaultIcon

HKEY_CURRENT_USER\Y8\shell

HKEY_CURRENT_USER\Y8\shell\
open

HKEY_CURRENT_USER\Y8\shell\
open\command

HKEY_CURRENT_USER\Y8\shell\
runas

HKEY_CURRENT_USER\Y8\shell\
runas\command

HKEY_CURRENT_USER\yv4

HKEY_CURRENT_USER\yv4\DefaultIcon

HKEY_CURRENT_USER\yv4\shell

HKEY_CURRENT_USER\yv4\shell\
open

HKEY_CURRENT_USER\yv4\shell\
open\command

HKEY_CURRENT_USER\yv4\shell\
runas

HKEY_CURRENT_USER\yv4\shell\
runas\command

HKEY_CURRENT_USER\yu1

HKEY_CURRENT_USER\yu1\DefaultIcon

HKEY_CURRENT_USER\yu1\shell

HKEY_CURRENT_USER\yu1\shell\
open

HKEY_CURRENT_USER\yu1\shell\
open\command

HKEY_CURRENT_USER\yu1\shell\
runas

HKEY_CURRENT_USER\yu1\shell\
runas\command

HKEY_CURRENT_USER\2P

HKEY_CURRENT_USER\2P\DefaultIcon

HKEY_CURRENT_USER\2P\shell

HKEY_CURRENT_USER\2P\shell\
open

HKEY_CURRENT_USER\2P\shell\
open\command

HKEY_CURRENT_USER\2P\shell\
runas

HKEY_CURRENT_USER\2P\shell\
runas\command

HKEY_CURRENT_USER\w4

HKEY_CURRENT_USER\w4\DefaultIcon

HKEY_CURRENT_USER\w4\shell

HKEY_CURRENT_USER\w4\shell\
open

HKEY_CURRENT_USER\w4\shell\
open\command

HKEY_CURRENT_USER\w4\shell\
runas

HKEY_CURRENT_USER\w4\shell\
runas\command

HKEY_CURRENT_USER\Tw8

HKEY_CURRENT_USER\Tw8\DefaultIcon

HKEY_CURRENT_USER\Tw8\shell

HKEY_CURRENT_USER\Tw8\shell\
open

HKEY_CURRENT_USER\Tw8\shell\
open\command

HKEY_CURRENT_USER\Tw8\shell\
runas

HKEY_CURRENT_USER\Tw8\shell\
runas\command

HKEY_CURRENT_USER\iu5

HKEY_CURRENT_USER\iu5\DefaultIcon

HKEY_CURRENT_USER\iu5\shell

HKEY_CURRENT_USER\iu5\shell\
open

HKEY_CURRENT_USER\iu5\shell\
open\command

HKEY_CURRENT_USER\iu5\shell\
runas

HKEY_CURRENT_USER\iu5\shell\
runas\command

HKEY_CURRENT_USER\GNj

HKEY_CURRENT_USER\GNj\DefaultIcon

HKEY_CURRENT_USER\GNj\shell

HKEY_CURRENT_USER\GNj\shell\
open

HKEY_CURRENT_USER\GNj\shell\
open\command

HKEY_CURRENT_USER\GNj\shell\
runas

HKEY_CURRENT_USER\GNj\shell\
runas\command

HKEY_CURRENT_USER\oJ

HKEY_CURRENT_USER\oJ\DefaultIcon

HKEY_CURRENT_USER\oJ\shell

HKEY_CURRENT_USER\oJ\shell\
open

HKEY_CURRENT_USER\oJ\shell\
open\command

HKEY_CURRENT_USER\oJ\shell\
runas

HKEY_CURRENT_USER\oJ\shell\
runas\command

HKEY_CURRENT_USER\GI

HKEY_CURRENT_USER\GI\DefaultIcon

HKEY_CURRENT_USER\GI\shell

HKEY_CURRENT_USER\GI\shell\
open

HKEY_CURRENT_USER\GI\shell\
open\command

HKEY_CURRENT_USER\GI\shell\
runas

HKEY_CURRENT_USER\GI\shell\
runas\command

HKEY_CURRENT_USER\Od

HKEY_CURRENT_USER\Od\DefaultIcon

HKEY_CURRENT_USER\Od\shell

HKEY_CURRENT_USER\Od\shell\
open

HKEY_CURRENT_USER\Od\shell\
open\command

HKEY_CURRENT_USER\Od\shell\
runas

HKEY_CURRENT_USER\Od\shell\
runas\command

HKEY_CURRENT_USER\F5w

HKEY_CURRENT_USER\F5w\DefaultIcon

HKEY_CURRENT_USER\F5w\shell

HKEY_CURRENT_USER\F5w\shell\
open

HKEY_CURRENT_USER\F5w\shell\
open\command

HKEY_CURRENT_USER\F5w\shell\
runas

HKEY_CURRENT_USER\F5w\shell\
runas\command

HKEY_CURRENT_USER\P3

HKEY_CURRENT_USER\P3\DefaultIcon

HKEY_CURRENT_USER\P3\shell

HKEY_CURRENT_USER\P3\shell\
open

HKEY_CURRENT_USER\P3\shell\
open\command

HKEY_CURRENT_USER\P3\shell\
runas

HKEY_CURRENT_USER\P3\shell\
runas\command

HKEY_CURRENT_USER\0Fs

HKEY_CURRENT_USER\0Fs\DefaultIcon

HKEY_CURRENT_USER\0Fs\shell

HKEY_CURRENT_USER\0Fs\shell\
open

HKEY_CURRENT_USER\0Fs\shell\
open\command

HKEY_CURRENT_USER\0Fs\shell\
runas

HKEY_CURRENT_USER\0Fs\shell\
runas\command

HKEY_CURRENT_USER\K3

HKEY_CURRENT_USER\K3\DefaultIcon

HKEY_CURRENT_USER\K3\shell

HKEY_CURRENT_USER\K3\shell\
open

HKEY_CURRENT_USER\K3\shell\
open\command

HKEY_CURRENT_USER\K3\shell\
runas

HKEY_CURRENT_USER\K3\shell\
runas\command

HKEY_CURRENT_USER\F5

HKEY_CURRENT_USER\F5\DefaultIcon

HKEY_CURRENT_USER\F5\shell

HKEY_CURRENT_USER\F5\shell\
open

HKEY_CURRENT_USER\F5\shell\
open\command

HKEY_CURRENT_USER\F5\shell\
runas

HKEY_CURRENT_USER\F5\shell\
runas\command

HKEY_CURRENT_USER\Vs

HKEY_CURRENT_USER\Vs\DefaultIcon

HKEY_CURRENT_USER\Vs\shell

HKEY_CURRENT_USER\Vs\shell\
open

HKEY_CURRENT_USER\Vs\shell\
open\command

HKEY_CURRENT_USER\Vs\shell\
runas

HKEY_CURRENT_USER\Vs\shell\
runas\command

HKEY_CURRENT_USER\24N

HKEY_CURRENT_USER\24N\DefaultIcon

HKEY_CURRENT_USER\24N\shell

HKEY_CURRENT_USER\24N\shell\
open

HKEY_CURRENT_USER\24N\shell\
open\command

HKEY_CURRENT_USER\24N\shell\
runas

HKEY_CURRENT_USER\24N\shell\
runas\command

HKEY_CURRENT_USER\V1q

HKEY_CURRENT_USER\V1q\DefaultIcon

HKEY_CURRENT_USER\V1q\shell

HKEY_CURRENT_USER\V1q\shell\
open

HKEY_CURRENT_USER\V1q\shell\
open\command

HKEY_CURRENT_USER\V1q\shell\
runas

HKEY_CURRENT_USER\V1q\shell\
runas\command

HKEY_CURRENT_USER\KLf

HKEY_CURRENT_USER\KLf\DefaultIcon

HKEY_CURRENT_USER\KLf\shell

HKEY_CURRENT_USER\KLf\shell\
open

HKEY_CURRENT_USER\KLf\shell\
open\command

HKEY_CURRENT_USER\KLf\shell\
runas

HKEY_CURRENT_USER\KLf\shell\
runas\command

HKEY_CURRENT_USER\HN

HKEY_CURRENT_USER\HN\DefaultIcon

HKEY_CURRENT_USER\HN\shell

HKEY_CURRENT_USER\HN\shell\
open

HKEY_CURRENT_USER\HN\shell\
open\command

HKEY_CURRENT_USER\HN\shell\
runas

HKEY_CURRENT_USER\HN\shell\
runas\command

HKEY_CURRENT_USER\mp

HKEY_CURRENT_USER\mp\DefaultIcon

HKEY_CURRENT_USER\mp\shell

HKEY_CURRENT_USER\mp\shell\
open

HKEY_CURRENT_USER\mp\shell\
open\command

HKEY_CURRENT_USER\mp\shell\
runas

HKEY_CURRENT_USER\mp\shell\
runas\command

HKEY_CURRENT_USER\ax

HKEY_CURRENT_USER\ax\DefaultIcon

HKEY_CURRENT_USER\ax\shell

HKEY_CURRENT_USER\ax\shell\
open

HKEY_CURRENT_USER\ax\shell\
open\command

HKEY_CURRENT_USER\ax\shell\
runas

HKEY_CURRENT_USER\ax\shell\
runas\command

HKEY_CURRENT_USER\u14

HKEY_CURRENT_USER\u14\DefaultIcon

HKEY_CURRENT_USER\u14\shell

HKEY_CURRENT_USER\u14\shell\
open

HKEY_CURRENT_USER\u14\shell\
open\command

HKEY_CURRENT_USER\u14\shell\
runas

HKEY_CURRENT_USER\u14\shell\
runas\command

HKEY_CURRENT_USER\Tp

HKEY_CURRENT_USER\Tp\DefaultIcon

HKEY_CURRENT_USER\Tp\shell

HKEY_CURRENT_USER\Tp\shell\
open

HKEY_CURRENT_USER\Tp\shell\
open\command

HKEY_CURRENT_USER\Tp\shell\
runas

HKEY_CURRENT_USER\Tp\shell\
runas\command

HKEY_CURRENT_USER\2HW

HKEY_CURRENT_USER\2HW\DefaultIcon

HKEY_CURRENT_USER\2HW\shell

HKEY_CURRENT_USER\2HW\shell\
open

HKEY_CURRENT_USER\2HW\shell\
open\command

HKEY_CURRENT_USER\2HW\shell\
runas

HKEY_CURRENT_USER\2HW\shell\
runas\command

HKEY_CURRENT_USER\8rI

HKEY_CURRENT_USER\8rI\DefaultIcon

HKEY_CURRENT_USER\8rI\shell

HKEY_CURRENT_USER\8rI\shell\
open

HKEY_CURRENT_USER\8rI\shell\
open\command

HKEY_CURRENT_USER\8rI\shell\
runas

HKEY_CURRENT_USER\8rI\shell\
runas\command

HKEY_CURRENT_USER\8c

HKEY_CURRENT_USER\8c\DefaultIcon

HKEY_CURRENT_USER\8c\shell

HKEY_CURRENT_USER\8c\shell\
open

HKEY_CURRENT_USER\8c\shell\
open\command

HKEY_CURRENT_USER\8c\shell\
runas

HKEY_CURRENT_USER\8c\shell\
runas\command

HKEY_CURRENT_USER\Pr

HKEY_CURRENT_USER\Pr\DefaultIcon

HKEY_CURRENT_USER\Pr\shell

HKEY_CURRENT_USER\Pr\shell\
open

HKEY_CURRENT_USER\Pr\shell\
open\command

HKEY_CURRENT_USER\Pr\shell\
runas

HKEY_CURRENT_USER\Pr\shell\
runas\command

HKEY_CURRENT_USER\152

HKEY_CURRENT_USER\152\DefaultIcon

HKEY_CURRENT_USER\152\shell

HKEY_CURRENT_USER\152\shell\
open

HKEY_CURRENT_USER\152\shell\
open\command

HKEY_CURRENT_USER\152\shell\
runas

HKEY_CURRENT_USER\152\shell\
runas\command

HKEY_CURRENT_USER\26J

HKEY_CURRENT_USER\26J\DefaultIcon

HKEY_CURRENT_USER\26J\shell

HKEY_CURRENT_USER\26J\shell\
open

HKEY_CURRENT_USER\26J\shell\
open\command

HKEY_CURRENT_USER\26J\shell\
runas

HKEY_CURRENT_USER\26J\shell\
runas\command

HKEY_CURRENT_USER\y2f

HKEY_CURRENT_USER\y2f\DefaultIcon

HKEY_CURRENT_USER\y2f\shell

HKEY_CURRENT_USER\y2f\shell\
open

HKEY_CURRENT_USER\y2f\shell\
open\command

HKEY_CURRENT_USER\y2f\shell\
runas

HKEY_CURRENT_USER\y2f\shell\
runas\command

HKEY_CURRENT_USER\832

HKEY_CURRENT_USER\832\DefaultIcon

HKEY_CURRENT_USER\832\shell

HKEY_CURRENT_USER\832\shell\
open

HKEY_CURRENT_USER\832\shell\
open\command

HKEY_CURRENT_USER\832\shell\
runas

HKEY_CURRENT_USER\832\shell\
runas\command

HKEY_CURRENT_USER\15x

HKEY_CURRENT_USER\15x\DefaultIcon

HKEY_CURRENT_USER\15x\shell

HKEY_CURRENT_USER\15x\shell\
open

HKEY_CURRENT_USER\15x\shell\
open\command

HKEY_CURRENT_USER\15x\shell\
runas

HKEY_CURRENT_USER\15x\shell\
runas\command

HKEY_CURRENT_USER\B5N

HKEY_CURRENT_USER\B5N\DefaultIcon

HKEY_CURRENT_USER\B5N\shell

HKEY_CURRENT_USER\B5N\shell\
open

HKEY_CURRENT_USER\B5N\shell\
open\command

HKEY_CURRENT_USER\B5N\shell\
runas

HKEY_CURRENT_USER\B5N\shell\
runas\command

HKEY_CURRENT_USER\AJ

HKEY_CURRENT_USER\AJ\DefaultIcon

HKEY_CURRENT_USER\AJ\shell

HKEY_CURRENT_USER\AJ\shell\
open

HKEY_CURRENT_USER\AJ\shell\
open\command

HKEY_CURRENT_USER\AJ\shell\
runas

HKEY_CURRENT_USER\AJ\shell\
runas\command

HKEY_CURRENT_USER\Dh7

HKEY_CURRENT_USER\Dh7\DefaultIcon

HKEY_CURRENT_USER\Dh7\shell

HKEY_CURRENT_USER\Dh7\shell\
open

HKEY_CURRENT_USER\Dh7\shell\
open\command

HKEY_CURRENT_USER\Dh7\shell\
runas

HKEY_CURRENT_USER\Dh7\shell\
runas\command

HKEY_CURRENT_USER\4u

HKEY_CURRENT_USER\4u\DefaultIcon

HKEY_CURRENT_USER\4u\shell

HKEY_CURRENT_USER\4u\shell\
open

HKEY_CURRENT_USER\4u\shell\
open\command

HKEY_CURRENT_USER\4u\shell\
runas

HKEY_CURRENT_USER\4u\shell\
runas\command

HKEY_CURRENT_USER\55

HKEY_CURRENT_USER\55\DefaultIcon

HKEY_CURRENT_USER\55\shell

HKEY_CURRENT_USER\55\shell\
open

HKEY_CURRENT_USER\55\shell\
open\command

HKEY_CURRENT_USER\55\shell\
runas

HKEY_CURRENT_USER\55\shell\
runas\command

HKEY_CURRENT_USER\XeR

HKEY_CURRENT_USER\XeR\DefaultIcon

HKEY_CURRENT_USER\XeR\shell

HKEY_CURRENT_USER\XeR\shell\
open

HKEY_CURRENT_USER\XeR\shell\
open\command

HKEY_CURRENT_USER\XeR\shell\
runas

HKEY_CURRENT_USER\XeR\shell\
runas\command

HKEY_CURRENT_USER\7SN

HKEY_CURRENT_USER\7SN\DefaultIcon

HKEY_CURRENT_USER\7SN\shell

HKEY_CURRENT_USER\7SN\shell\
open

HKEY_CURRENT_USER\7SN\shell\
open\command

HKEY_CURRENT_USER\7SN\shell\
runas

HKEY_CURRENT_USER\7SN\shell\
runas\command

HKEY_CURRENT_USER\bf

HKEY_CURRENT_USER\bf\DefaultIcon

HKEY_CURRENT_USER\bf\shell

HKEY_CURRENT_USER\bf\shell\
open

HKEY_CURRENT_USER\bf\shell\
open\command

HKEY_CURRENT_USER\bf\shell\
runas

HKEY_CURRENT_USER\bf\shell\
runas\command

HKEY_CURRENT_USER\2wc

HKEY_CURRENT_USER\2wc\DefaultIcon

HKEY_CURRENT_USER\2wc\shell

HKEY_CURRENT_USER\2wc\shell\
open

HKEY_CURRENT_USER\2wc\shell\
open\command

HKEY_CURRENT_USER\2wc\shell\
runas

HKEY_CURRENT_USER\2wc\shell\
runas\command

HKEY_CURRENT_USER\3E

HKEY_CURRENT_USER\3E\DefaultIcon

HKEY_CURRENT_USER\3E\shell

HKEY_CURRENT_USER\3E\shell\
open

HKEY_CURRENT_USER\3E\shell\
open\command

HKEY_CURRENT_USER\3E\shell\
runas

HKEY_CURRENT_USER\3E\shell\
runas\command

HKEY_CURRENT_USER\pVk

HKEY_CURRENT_USER\pVk\DefaultIcon

HKEY_CURRENT_USER\pVk\shell

HKEY_CURRENT_USER\pVk\shell\
open

HKEY_CURRENT_USER\pVk\shell\
open\command

HKEY_CURRENT_USER\pVk\shell\
runas

HKEY_CURRENT_USER\pVk\shell\
runas\command

HKEY_CURRENT_USER\h2d

HKEY_CURRENT_USER\h2d\DefaultIcon

HKEY_CURRENT_USER\h2d\shell

HKEY_CURRENT_USER\h2d\shell\
open

HKEY_CURRENT_USER\h2d\shell\
open\command

HKEY_CURRENT_USER\h2d\shell\
runas

HKEY_CURRENT_USER\h2d\shell\
runas\command

HKEY_CURRENT_USER\3PF

HKEY_CURRENT_USER\3PF\DefaultIcon

HKEY_CURRENT_USER\3PF\shell

HKEY_CURRENT_USER\3PF\shell\
open

HKEY_CURRENT_USER\3PF\shell\
open\command

HKEY_CURRENT_USER\3PF\shell\
runas

HKEY_CURRENT_USER\3PF\shell\
runas\command

HKEY_CURRENT_USER\Myl

HKEY_CURRENT_USER\Myl\DefaultIcon

HKEY_CURRENT_USER\Myl\shell

HKEY_CURRENT_USER\Myl\shell\
open

HKEY_CURRENT_USER\Myl\shell\
open\command

HKEY_CURRENT_USER\Myl\shell\
runas

HKEY_CURRENT_USER\Myl\shell\
runas\command

HKEY_CURRENT_USER\1B

HKEY_CURRENT_USER\1B\DefaultIcon

HKEY_CURRENT_USER\1B\shell

HKEY_CURRENT_USER\1B\shell\
open

HKEY_CURRENT_USER\1B\shell\
open\command

HKEY_CURRENT_USER\1B\shell\
runas

HKEY_CURRENT_USER\1B\shell\
runas\command

HKEY_LOCAL_MACHINE\Software\Microsoft\
Sft

HKEY_CURRENT_USER\rRC

HKEY_CURRENT_USER\rRC\DefaultIcon

HKEY_CURRENT_USER\rRC\shell

HKEY_CURRENT_USER\rRC\shell\
open

HKEY_CURRENT_USER\rRC\shell\
open\command

HKEY_CURRENT_USER\rRC\shell\
runas

HKEY_CURRENT_USER\rRC\shell\
runas\command

HKEY_CURRENT_USER\T7I

HKEY_CURRENT_USER\T7I\DefaultIcon

HKEY_CURRENT_USER\T7I\shell

HKEY_CURRENT_USER\T7I\shell\
open

HKEY_CURRENT_USER\T7I\shell\
open\command

マルウェアは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = 4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

HKEY_CURRENT_USER\.exe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\.exe\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\.exe\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6m7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6m7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6m7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Software\Microsoft\
Windows
Local = b7b7c935

HKEY_CURRENT_USER\i0x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\i0x\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\i0x\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oE\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\744
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\744\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\744\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\58
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\58\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\58\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JI2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JI2\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JI2\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y7Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y7Q\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y7Q\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Ao
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0Ao\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Ao\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\vUX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\vUX\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\vUX\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GV0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GV0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GV0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hV
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hV\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hV\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Jsp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jsp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Jsp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\D12
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\D12\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\D12\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7O
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7O\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7O\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Ed
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Ed\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Ed\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y2t\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2t\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0h6\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h6\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wKI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wKI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wKI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5fY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5fY\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5fY\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\23
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\23\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\23\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\o6a
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\o6a\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\o6a\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f1U
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\f1U\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f1U\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\L50
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L50\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\L50\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\K5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GW\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GW\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7r
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7r\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7r\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pP1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pP1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pP1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Sg1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Sg1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Sg1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JIG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JIG\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JIG\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sB\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sB\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GG\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GG\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B6Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\B6Y\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B6Y\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\854
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\854\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\854\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\R27
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\R27\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\R27\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1f\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1f\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bo\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bo\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\53
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\53\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\53\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3R\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3R\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4vI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4vI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4vI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bW5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bW5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bW5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\28
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\28\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\28\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\66
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\66\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\66\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oE3\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE3\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\lG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lG\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\lG\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Fv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Fv\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Fv\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7Yo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7Yo\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7Yo\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hC
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hC\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hC\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Qn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Qn\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Qn\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\X0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\X0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\X0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0YK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0YK\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0YK\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5UU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5UU\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5UU\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\73O
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\73O\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\73O\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YcT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YcT\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YcT\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\17
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\17\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\17\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y8o
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y8o\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y8o\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Fb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Fb\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Fb\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pb\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pb\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4u5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\r8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\r8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\r8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a0p
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\a0p\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a0p\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ocj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Ocj\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ocj\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SNu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SNu\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SNu\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NoB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\NoB\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NoB\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8T4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8T4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8T4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mCq\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCq\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Uv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Uv\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Uv\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sc\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sc\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\REO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\REO\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\REO\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y1N
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y1N\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y1N\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ht
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ht\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ht\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\j8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\j8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\j8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6a0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6a0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6a0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SPA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SPA\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SPA\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NB2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\NB2\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NB2\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ikg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Ikg\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ikg\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6T
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6T\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6T\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Peo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Peo\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Peo\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\tpV
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tpV\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\tpV\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\jXA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jXA\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\jXA\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0DU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0DU\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0DU\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mCp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yv4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yv4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yv4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yu1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yu1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yu1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2P
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2P\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2P\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\w4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tw8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tw8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tw8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iu5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\iu5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iu5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GNj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GNj\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GNj\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oJ\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oJ\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Od
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Od\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Od\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F5w\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5w\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\P3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\P3\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\P3\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Fs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0Fs\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Fs\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\K3\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K3\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Vs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vs\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Vs\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\24N
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\24N\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\24N\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\V1q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V1q\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\V1q\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\KLf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\KLf\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\KLf\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\HN
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\HN\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\HN\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ax
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ax\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ax\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\u14
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\u14\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\u14\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2HW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2HW\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2HW\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8rI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8rI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8rI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8c\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8c\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pr\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pr\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\152
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\152\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\152\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\26J
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\26J\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\26J\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y2f\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2f\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\832
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\832\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\832\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\15x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\15x\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\15x\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5N
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\B5N\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5N\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\AJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\AJ\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\AJ\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Dh7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Dh7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Dh7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4u\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\55
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\55\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\55\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\XeR
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\XeR\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\XeR\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7SN
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7SN\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7SN\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bf\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bf\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2wc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2wc\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2wc\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3E
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3E\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3E\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\rRC
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rRC\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\rRC\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\T7I
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\T7I\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\T7I\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a6X
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\a6X\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a6X\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4t\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4t\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\QR
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\QR\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\QR\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\I7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\I7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\I7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\G05
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\G05\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\G05\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2x\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2x\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1I
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1I\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1I\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\qK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\qK\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\qK\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hL
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hL\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hL\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xS\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xS\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ef
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ef\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ef\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6Ft
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6Ft\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6Ft\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xb\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xb\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6R4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6R4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6R4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\65
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\65\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\65\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7m0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7m0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7m0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\B5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\cR7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cR7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\cR7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sW\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sW\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\34t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\34t\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\34t\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\56J
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\56J\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\56J\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\uE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uE\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\uE\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a42
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\a42\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a42\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8B8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8B8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8B8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w2s
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\w2s\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w2s\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wCc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wCc\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wCc\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w48
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\w48\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w48\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\laD
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\laD\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\laD\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\41
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\41\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\41\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7HF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7HF\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7HF\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\67b
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\67b\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\67b\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0h\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yr\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yr\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\f4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SA\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SA\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\v6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\v6\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\v6\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iXH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\iXH\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iXH\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6w\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6w\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YT\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YT\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\C2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\C2\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\C2\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pVk
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pVk\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pVk\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h2d
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h2d\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h2d\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3PF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3PF\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3PF\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Myl
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Myl\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Myl\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1B\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1B\shell\
runas\command
IsolatedCommand = ""%1" %*"

マルウェアは、以下のレジストリ値を追加し、タスクマネージャやレジストリエディタ、フォルダオプションを無効にします。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Policies = "%User Profile%\Application Data\csrss.exe"

作成活動

マルウェアは、以下のファイルを作成します。

• %Application Data%\sew.exe
• %User Profile%\Protect\kpqpxx.ra
• %User Profile%\Protect\s32.txt
• %User Profile%\Protect\nykfun.pk

(註：%Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。. %User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}or2011.ru/aaa/index.php?{random characters}

このウイルス情報は、自動解析システムにより作成されました。

---

  対応方法

ご利用はいかがでしたか？　アンケートにご協力ください