TROJ_MENTI.ADL

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies files, disabling programs and applications from properly running. It disables Task Manager, Registry Editor, and Folder Options.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Application Data\csrss.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\Protect\

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
utdkfot = "rundll32 %User Profile%\Protect\kpqpxx.ra, pjwp"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
vyrqfd = "rundll32 %User Profile%\Protect\nykfun.pk, bhul"

Other System Modifications

This Trojan modifies the following files:

• %Application Data%\GDIPFONTCACHEV1.DAT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It deletes the following files:

• %User Profile%\Application Data\csrss.exe
• %User Profile%\Application Data\csrss.exe:Zone.Identifier
• %User Temp%\1.tmp
• %User Temp%\2.tmp
• %User Temp%\3.tmp
• %User Temp%\4.tmp
• %Application Data%\thi.exe
• %Application Data%\grr.exe
• %Application Data%\cra.exe
• %Application Data%\isy.exe
• %Application Data%\qyl.exe
• %User Profile%\Application Data\aqu.exe
• %User Profile%\Application Data\fea.exe
• %User Profile%\Application Data\adb.exe
• %User Profile%\Application Data\qxo.exe
• %User Profile%\Application Data\dik.exe
• %User Temp%\ddu.exe
• %User Temp%\mri.exe
• %User Temp%\hou.exe
• %User Temp%\ysm.exe
• %User Temp%\oao.exe
• %User Profile%\Templates\ktl.exe
• %User Profile%\Templates\kgd.exe
• %User Profile%\Templates\pyy.exe
• %User Profile%\Templates\jpe.exe
• %User Profile%\Templates\ikd.exe
• %User Profile%\Protect\gs32.txt

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CURRENT_USER\T7I\shell\
runas

HKEY_CURRENT_USER\T7I\shell\
runas\command

HKEY_CURRENT_USER\a6X

HKEY_CURRENT_USER\a6X\DefaultIcon

HKEY_CURRENT_USER\a6X\shell

HKEY_CURRENT_USER\a6X\shell\
open

HKEY_CURRENT_USER\a6X\shell\
open\command

HKEY_CURRENT_USER\a6X\shell\
runas

HKEY_CURRENT_USER\a6X\shell\
runas\command

HKEY_CURRENT_USER\4t

HKEY_CURRENT_USER\4t\DefaultIcon

HKEY_CURRENT_USER\4t\shell

HKEY_CURRENT_USER\4t\shell\
open

HKEY_CURRENT_USER\4t\shell\
open\command

HKEY_CURRENT_USER\4t\shell\
runas

HKEY_CURRENT_USER\4t\shell\
runas\command

HKEY_CURRENT_USER\QR

HKEY_CURRENT_USER\QR\DefaultIcon

HKEY_CURRENT_USER\QR\shell

HKEY_CURRENT_USER\QR\shell\
open

HKEY_CURRENT_USER\QR\shell\
open\command

HKEY_CURRENT_USER\QR\shell\
runas

HKEY_CURRENT_USER\QR\shell\
runas\command

HKEY_CURRENT_USER\I7

HKEY_CURRENT_USER\I7\DefaultIcon

HKEY_CURRENT_USER\I7\shell

HKEY_CURRENT_USER\I7\shell\
open

HKEY_CURRENT_USER\I7\shell\
open\command

HKEY_CURRENT_USER\I7\shell\
runas

HKEY_CURRENT_USER\I7\shell\
runas\command

HKEY_CURRENT_USER\G05

HKEY_CURRENT_USER\G05\DefaultIcon

HKEY_CURRENT_USER\G05\shell

HKEY_CURRENT_USER\G05\shell\
open

HKEY_CURRENT_USER\G05\shell\
open\command

HKEY_CURRENT_USER\G05\shell\
runas

HKEY_CURRENT_USER\G05\shell\
runas\command

HKEY_CURRENT_USER\2x

HKEY_CURRENT_USER\2x\DefaultIcon

HKEY_CURRENT_USER\2x\shell

HKEY_CURRENT_USER\2x\shell\
open

HKEY_CURRENT_USER\2x\shell\
open\command

HKEY_CURRENT_USER\2x\shell\
runas

HKEY_CURRENT_USER\2x\shell\
runas\command

HKEY_CURRENT_USER\1I

HKEY_CURRENT_USER\1I\DefaultIcon

HKEY_CURRENT_USER\1I\shell

HKEY_CURRENT_USER\1I\shell\
open

HKEY_CURRENT_USER\1I\shell\
open\command

HKEY_CURRENT_USER\1I\shell\
runas

HKEY_CURRENT_USER\1I\shell\
runas\command

HKEY_CURRENT_USER\qK

HKEY_CURRENT_USER\qK\DefaultIcon

HKEY_CURRENT_USER\qK\shell

HKEY_CURRENT_USER\qK\shell\
open

HKEY_CURRENT_USER\qK\shell\
open\command

HKEY_CURRENT_USER\qK\shell\
runas

HKEY_CURRENT_USER\qK\shell\
runas\command

HKEY_CURRENT_USER\hL

HKEY_CURRENT_USER\hL\DefaultIcon

HKEY_CURRENT_USER\hL\shell

HKEY_CURRENT_USER\hL\shell\
open

HKEY_CURRENT_USER\hL\shell\
open\command

HKEY_CURRENT_USER\hL\shell\
runas

HKEY_CURRENT_USER\hL\shell\
runas\command

HKEY_CURRENT_USER\xS

HKEY_CURRENT_USER\xS\DefaultIcon

HKEY_CURRENT_USER\xS\shell

HKEY_CURRENT_USER\xS\shell\
open

HKEY_CURRENT_USER\xS\shell\
open\command

HKEY_CURRENT_USER\xS\shell\
runas

HKEY_CURRENT_USER\xS\shell\
runas\command

HKEY_CURRENT_USER\ef

HKEY_CURRENT_USER\ef\DefaultIcon

HKEY_CURRENT_USER\ef\shell

HKEY_CURRENT_USER\ef\shell\
open

HKEY_CURRENT_USER\ef\shell\
open\command

HKEY_CURRENT_USER\ef\shell\
runas

HKEY_CURRENT_USER\ef\shell\
runas\command

HKEY_CURRENT_USER\6Ft

HKEY_CURRENT_USER\6Ft\DefaultIcon

HKEY_CURRENT_USER\6Ft\shell

HKEY_CURRENT_USER\6Ft\shell\
open

HKEY_CURRENT_USER\6Ft\shell\
open\command

HKEY_CURRENT_USER\6Ft\shell\
runas

HKEY_CURRENT_USER\6Ft\shell\
runas\command

HKEY_CURRENT_USER\xb

HKEY_CURRENT_USER\xb\DefaultIcon

HKEY_CURRENT_USER\xb\shell

HKEY_CURRENT_USER\xb\shell\
open

HKEY_CURRENT_USER\xb\shell\
open\command

HKEY_CURRENT_USER\xb\shell\
runas

HKEY_CURRENT_USER\xb\shell\
runas\command

HKEY_CURRENT_USER\6R4

HKEY_CURRENT_USER\6R4\DefaultIcon

HKEY_CURRENT_USER\6R4\shell

HKEY_CURRENT_USER\6R4\shell\
open

HKEY_CURRENT_USER\6R4\shell\
open\command

HKEY_CURRENT_USER\6R4\shell\
runas

HKEY_CURRENT_USER\6R4\shell\
runas\command

HKEY_CURRENT_USER\65

HKEY_CURRENT_USER\65\DefaultIcon

HKEY_CURRENT_USER\65\shell

HKEY_CURRENT_USER\65\shell\
open

HKEY_CURRENT_USER\65\shell\
open\command

HKEY_CURRENT_USER\65\shell\
runas

HKEY_CURRENT_USER\65\shell\
runas\command

HKEY_CURRENT_USER\7m0

HKEY_CURRENT_USER\7m0\DefaultIcon

HKEY_CURRENT_USER\7m0\shell

HKEY_CURRENT_USER\7m0\shell\
open

HKEY_CURRENT_USER\7m0\shell\
open\command

HKEY_CURRENT_USER\7m0\shell\
runas

HKEY_CURRENT_USER\7m0\shell\
runas\command

HKEY_CURRENT_USER\B5

HKEY_CURRENT_USER\B5\DefaultIcon

HKEY_CURRENT_USER\B5\shell

HKEY_CURRENT_USER\B5\shell\
open

HKEY_CURRENT_USER\B5\shell\
open\command

HKEY_CURRENT_USER\B5\shell\
runas

HKEY_CURRENT_USER\B5\shell\
runas\command

HKEY_CURRENT_USER\h4

HKEY_CURRENT_USER\h4\DefaultIcon

HKEY_CURRENT_USER\h4\shell

HKEY_CURRENT_USER\h4\shell\
open

HKEY_CURRENT_USER\h4\shell\
open\command

HKEY_CURRENT_USER\h4\shell\
runas

HKEY_CURRENT_USER\h4\shell\
runas\command

HKEY_CURRENT_USER\cR7

HKEY_CURRENT_USER\cR7\DefaultIcon

HKEY_CURRENT_USER\cR7\shell

HKEY_CURRENT_USER\cR7\shell\
open

HKEY_CURRENT_USER\cR7\shell\
open\command

HKEY_CURRENT_USER\cR7\shell\
runas

HKEY_CURRENT_USER\cR7\shell\
runas\command

HKEY_CURRENT_USER\sW

HKEY_CURRENT_USER\sW\DefaultIcon

HKEY_CURRENT_USER\sW\shell

HKEY_CURRENT_USER\sW\shell\
open

HKEY_CURRENT_USER\sW\shell\
open\command

HKEY_CURRENT_USER\sW\shell\
runas

HKEY_CURRENT_USER\sW\shell\
runas\command

HKEY_CURRENT_USER\34t

HKEY_CURRENT_USER\34t\DefaultIcon

HKEY_CURRENT_USER\34t\shell

HKEY_CURRENT_USER\34t\shell\
open

HKEY_CURRENT_USER\34t\shell\
open\command

HKEY_CURRENT_USER\34t\shell\
runas

HKEY_CURRENT_USER\34t\shell\
runas\command

HKEY_CURRENT_USER\56J

HKEY_CURRENT_USER\56J\DefaultIcon

HKEY_CURRENT_USER\56J\shell

HKEY_CURRENT_USER\56J\shell\
open

HKEY_CURRENT_USER\56J\shell\
open\command

HKEY_CURRENT_USER\56J\shell\
runas

HKEY_CURRENT_USER\56J\shell\
runas\command

HKEY_CURRENT_USER\uE

HKEY_CURRENT_USER\uE\DefaultIcon

HKEY_CURRENT_USER\uE\shell

HKEY_CURRENT_USER\uE\shell\
open

HKEY_CURRENT_USER\uE\shell\
open\command

HKEY_CURRENT_USER\uE\shell\
runas

HKEY_CURRENT_USER\uE\shell\
runas\command

HKEY_CURRENT_USER\a42

HKEY_CURRENT_USER\a42\DefaultIcon

HKEY_CURRENT_USER\a42\shell

HKEY_CURRENT_USER\a42\shell\
open

HKEY_CURRENT_USER\a42\shell\
open\command

HKEY_CURRENT_USER\a42\shell\
runas

HKEY_CURRENT_USER\a42\shell\
runas\command

HKEY_CURRENT_USER\8B8

HKEY_CURRENT_USER\8B8\DefaultIcon

HKEY_CURRENT_USER\8B8\shell

HKEY_CURRENT_USER\8B8\shell\
open

HKEY_CURRENT_USER\8B8\shell\
open\command

HKEY_CURRENT_USER\8B8\shell\
runas

HKEY_CURRENT_USER\8B8\shell\
runas\command

HKEY_CURRENT_USER\w2s

HKEY_CURRENT_USER\w2s\DefaultIcon

HKEY_CURRENT_USER\w2s\shell

HKEY_CURRENT_USER\w2s\shell\
open

HKEY_CURRENT_USER\w2s\shell\
open\command

HKEY_CURRENT_USER\w2s\shell\
runas

HKEY_CURRENT_USER\w2s\shell\
runas\command

HKEY_CURRENT_USER\wCc

HKEY_CURRENT_USER\wCc\DefaultIcon

HKEY_CURRENT_USER\wCc\shell

HKEY_CURRENT_USER\wCc\shell\
open

HKEY_CURRENT_USER\wCc\shell\
open\command

HKEY_CURRENT_USER\wCc\shell\
runas

HKEY_CURRENT_USER\wCc\shell\
runas\command

HKEY_CURRENT_USER\w48

HKEY_CURRENT_USER\w48\DefaultIcon

HKEY_CURRENT_USER\w48\shell

HKEY_CURRENT_USER\w48\shell\
open

HKEY_CURRENT_USER\w48\shell\
open\command

HKEY_CURRENT_USER\w48\shell\
runas

HKEY_CURRENT_USER\w48\shell\
runas\command

HKEY_CURRENT_USER\F1

HKEY_CURRENT_USER\F1\DefaultIcon

HKEY_CURRENT_USER\F1\shell

HKEY_CURRENT_USER\F1\shell\
open

HKEY_CURRENT_USER\F1\shell\
open\command

HKEY_CURRENT_USER\F1\shell\
runas

HKEY_CURRENT_USER\F1\shell\
runas\command

HKEY_CURRENT_USER\laD

HKEY_CURRENT_USER\laD\DefaultIcon

HKEY_CURRENT_USER\laD\shell

HKEY_CURRENT_USER\laD\shell\
open

HKEY_CURRENT_USER\laD\shell\
open\command

HKEY_CURRENT_USER\laD\shell\
runas

HKEY_CURRENT_USER\laD\shell\
runas\command

HKEY_CURRENT_USER\41

HKEY_CURRENT_USER\41\DefaultIcon

HKEY_CURRENT_USER\41\shell

HKEY_CURRENT_USER\41\shell\
open

HKEY_CURRENT_USER\41\shell\
open\command

HKEY_CURRENT_USER\41\shell\
runas

HKEY_CURRENT_USER\41\shell\
runas\command

HKEY_CURRENT_USER\7HF

HKEY_CURRENT_USER\7HF\DefaultIcon

HKEY_CURRENT_USER\7HF\shell

HKEY_CURRENT_USER\7HF\shell\
open

HKEY_CURRENT_USER\7HF\shell\
open\command

HKEY_CURRENT_USER\7HF\shell\
runas

HKEY_CURRENT_USER\7HF\shell\
runas\command

HKEY_CURRENT_USER\67b

HKEY_CURRENT_USER\67b\DefaultIcon

HKEY_CURRENT_USER\67b\shell

HKEY_CURRENT_USER\67b\shell\
open

HKEY_CURRENT_USER\67b\shell\
open\command

HKEY_CURRENT_USER\67b\shell\
runas

HKEY_CURRENT_USER\67b\shell\
runas\command

HKEY_CURRENT_USER\0h

HKEY_CURRENT_USER\0h\DefaultIcon

HKEY_CURRENT_USER\0h\shell

HKEY_CURRENT_USER\0h\shell\
open

HKEY_CURRENT_USER\0h\shell\
open\command

HKEY_CURRENT_USER\0h\shell\
runas

HKEY_CURRENT_USER\0h\shell\
runas\command

HKEY_CURRENT_USER\yr

HKEY_CURRENT_USER\yr\DefaultIcon

HKEY_CURRENT_USER\yr\shell

HKEY_CURRENT_USER\yr\shell\
open

HKEY_CURRENT_USER\yr\shell\
open\command

HKEY_CURRENT_USER\yr\shell\
runas

HKEY_CURRENT_USER\yr\shell\
runas\command

HKEY_CURRENT_USER\f4

HKEY_CURRENT_USER\f4\DefaultIcon

HKEY_CURRENT_USER\f4\shell

HKEY_CURRENT_USER\f4\shell\
open

HKEY_CURRENT_USER\f4\shell\
open\command

HKEY_CURRENT_USER\f4\shell\
runas

HKEY_CURRENT_USER\f4\shell\
runas\command

HKEY_CURRENT_USER\SA

HKEY_CURRENT_USER\SA\DefaultIcon

HKEY_CURRENT_USER\SA\shell

HKEY_CURRENT_USER\SA\shell\
open

HKEY_CURRENT_USER\SA\shell\
open\command

HKEY_CURRENT_USER\SA\shell\
runas

HKEY_CURRENT_USER\SA\shell\
runas\command

HKEY_CURRENT_USER\v6

HKEY_CURRENT_USER\v6\DefaultIcon

HKEY_CURRENT_USER\v6\shell

HKEY_CURRENT_USER\v6\shell\
open

HKEY_CURRENT_USER\v6\shell\
open\command

HKEY_CURRENT_USER\v6\shell\
runas

HKEY_CURRENT_USER\v6\shell\
runas\command

HKEY_CURRENT_USER\iXH

HKEY_CURRENT_USER\iXH\DefaultIcon

HKEY_CURRENT_USER\iXH\shell

HKEY_CURRENT_USER\iXH\shell\
open

HKEY_CURRENT_USER\iXH\shell\
open\command

HKEY_CURRENT_USER\iXH\shell\
runas

HKEY_CURRENT_USER\iXH\shell\
runas\command

HKEY_CURRENT_USER\6w

HKEY_CURRENT_USER\6w\DefaultIcon

HKEY_CURRENT_USER\6w\shell

HKEY_CURRENT_USER\6w\shell\
open

HKEY_CURRENT_USER\6w\shell\
open\command

HKEY_CURRENT_USER\6w\shell\
runas

HKEY_CURRENT_USER\6w\shell\
runas\command

HKEY_CURRENT_USER\YT

HKEY_CURRENT_USER\YT\DefaultIcon

HKEY_CURRENT_USER\YT\shell

HKEY_CURRENT_USER\YT\shell\
open

HKEY_CURRENT_USER\YT\shell\
open\command

HKEY_CURRENT_USER\YT\shell\
runas

HKEY_CURRENT_USER\YT\shell\
runas\command

HKEY_CURRENT_USER\C2

HKEY_CURRENT_USER\C2\DefaultIcon

HKEY_CURRENT_USER\C2\shell

HKEY_CURRENT_USER\C2\shell\
open

HKEY_CURRENT_USER\C2\shell\
open\command

HKEY_CURRENT_USER\C2\shell\
runas

HKEY_CURRENT_USER\C2\shell\
runas\command

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus

HKEY_CURRENT_USER\.exe

HKEY_CURRENT_USER\.exe\DefaultIcon

HKEY_CURRENT_USER\.exe\shell

HKEY_CURRENT_USER\.exe\shell\
open

HKEY_CURRENT_USER\.exe\shell\
open\command

HKEY_CURRENT_USER\.exe\shell\
runas

HKEY_CURRENT_USER\.exe\shell\
runas\command

HKEY_CURRENT_USER\6m7

HKEY_CURRENT_USER\6m7\DefaultIcon

HKEY_CURRENT_USER\6m7\shell

HKEY_CURRENT_USER\6m7\shell\
open

HKEY_CURRENT_USER\6m7\shell\
open\command

HKEY_CURRENT_USER\6m7\shell\
runas

HKEY_CURRENT_USER\6m7\shell\
runas\command

HKEY_CURRENT_USER\i0x

HKEY_CURRENT_USER\i0x\DefaultIcon

HKEY_CURRENT_USER\i0x\shell

HKEY_CURRENT_USER\i0x\shell\
open

HKEY_CURRENT_USER\i0x\shell\
open\command

HKEY_CURRENT_USER\i0x\shell\
runas

HKEY_CURRENT_USER\i0x\shell\
runas\command

HKEY_CURRENT_USER\oE

HKEY_CURRENT_USER\oE\DefaultIcon

HKEY_CURRENT_USER\oE\shell

HKEY_CURRENT_USER\oE\shell\
open

HKEY_CURRENT_USER\oE\shell\
open\command

HKEY_CURRENT_USER\oE\shell\
runas

HKEY_CURRENT_USER\oE\shell\
runas\command

HKEY_CURRENT_USER\744

HKEY_CURRENT_USER\744\DefaultIcon

HKEY_CURRENT_USER\744\shell

HKEY_CURRENT_USER\744\shell\
open

HKEY_CURRENT_USER\744\shell\
open\command

HKEY_CURRENT_USER\744\shell\
runas

HKEY_CURRENT_USER\744\shell\
runas\command

HKEY_CURRENT_USER\58

HKEY_CURRENT_USER\58\DefaultIcon

HKEY_CURRENT_USER\58\shell

HKEY_CURRENT_USER\58\shell\
open

HKEY_CURRENT_USER\58\shell\
open\command

HKEY_CURRENT_USER\58\shell\
runas

HKEY_CURRENT_USER\58\shell\
runas\command

HKEY_CURRENT_USER\JI2

HKEY_CURRENT_USER\JI2\DefaultIcon

HKEY_CURRENT_USER\JI2\shell

HKEY_CURRENT_USER\JI2\shell\
open

HKEY_CURRENT_USER\JI2\shell\
open\command

HKEY_CURRENT_USER\JI2\shell\
runas

HKEY_CURRENT_USER\JI2\shell\
runas\command

HKEY_CURRENT_USER\y7Q

HKEY_CURRENT_USER\y7Q\DefaultIcon

HKEY_CURRENT_USER\y7Q\shell

HKEY_CURRENT_USER\y7Q\shell\
open

HKEY_CURRENT_USER\y7Q\shell\
open\command

HKEY_CURRENT_USER\y7Q\shell\
runas

HKEY_CURRENT_USER\y7Q\shell\
runas\command

HKEY_CURRENT_USER\0Ao

HKEY_CURRENT_USER\0Ao\DefaultIcon

HKEY_CURRENT_USER\0Ao\shell

HKEY_CURRENT_USER\0Ao\shell\
open

HKEY_CURRENT_USER\0Ao\shell\
open\command

HKEY_CURRENT_USER\0Ao\shell\
runas

HKEY_CURRENT_USER\0Ao\shell\
runas\command

HKEY_CURRENT_USER\vUX

HKEY_CURRENT_USER\vUX\DefaultIcon

HKEY_CURRENT_USER\vUX\shell

HKEY_CURRENT_USER\vUX\shell\
open

HKEY_CURRENT_USER\vUX\shell\
open\command

HKEY_CURRENT_USER\vUX\shell\
runas

HKEY_CURRENT_USER\vUX\shell\
runas\command

HKEY_CURRENT_USER\GV0

HKEY_CURRENT_USER\GV0\DefaultIcon

HKEY_CURRENT_USER\GV0\shell

HKEY_CURRENT_USER\GV0\shell\
open

HKEY_CURRENT_USER\GV0\shell\
open\command

HKEY_CURRENT_USER\GV0\shell\
runas

HKEY_CURRENT_USER\GV0\shell\
runas\command

HKEY_CURRENT_USER\hV

HKEY_CURRENT_USER\hV\DefaultIcon

HKEY_CURRENT_USER\hV\shell

HKEY_CURRENT_USER\hV\shell\
open

HKEY_CURRENT_USER\hV\shell\
open\command

HKEY_CURRENT_USER\hV\shell\
runas

HKEY_CURRENT_USER\hV\shell\
runas\command

HKEY_CURRENT_USER\Jsp

HKEY_CURRENT_USER\Jsp\DefaultIcon

HKEY_CURRENT_USER\Jsp\shell

HKEY_CURRENT_USER\Jsp\shell\
open

HKEY_CURRENT_USER\Jsp\shell\
open\command

HKEY_CURRENT_USER\Jsp\shell\
runas

HKEY_CURRENT_USER\Jsp\shell\
runas\command

HKEY_CURRENT_USER\D12

HKEY_CURRENT_USER\D12\DefaultIcon

HKEY_CURRENT_USER\D12\shell

HKEY_CURRENT_USER\D12\shell\
open

HKEY_CURRENT_USER\D12\shell\
open\command

HKEY_CURRENT_USER\D12\shell\
runas

HKEY_CURRENT_USER\D12\shell\
runas\command

HKEY_CURRENT_USER\7O

HKEY_CURRENT_USER\7O\DefaultIcon

HKEY_CURRENT_USER\7O\shell

HKEY_CURRENT_USER\7O\shell\
open

HKEY_CURRENT_USER\7O\shell\
open\command

HKEY_CURRENT_USER\7O\shell\
runas

HKEY_CURRENT_USER\7O\shell\
runas\command

HKEY_CURRENT_USER\2Ed

HKEY_CURRENT_USER\2Ed\DefaultIcon

HKEY_CURRENT_USER\2Ed\shell

HKEY_CURRENT_USER\2Ed\shell\
open

HKEY_CURRENT_USER\2Ed\shell\
open\command

HKEY_CURRENT_USER\2Ed\shell\
runas

HKEY_CURRENT_USER\2Ed\shell\
runas\command

HKEY_CURRENT_USER\y2t

HKEY_CURRENT_USER\y2t\DefaultIcon

HKEY_CURRENT_USER\y2t\shell

HKEY_CURRENT_USER\y2t\shell\
open

HKEY_CURRENT_USER\y2t\shell\
open\command

HKEY_CURRENT_USER\y2t\shell\
runas

HKEY_CURRENT_USER\y2t\shell\
runas\command

HKEY_CURRENT_USER\0h6

HKEY_CURRENT_USER\0h6\DefaultIcon

HKEY_CURRENT_USER\0h6\shell

HKEY_CURRENT_USER\0h6\shell\
open

HKEY_CURRENT_USER\0h6\shell\
open\command

HKEY_CURRENT_USER\0h6\shell\
runas

HKEY_CURRENT_USER\0h6\shell\
runas\command

HKEY_CURRENT_USER\wKI

HKEY_CURRENT_USER\wKI\DefaultIcon

HKEY_CURRENT_USER\wKI\shell

HKEY_CURRENT_USER\wKI\shell\
open

HKEY_CURRENT_USER\wKI\shell\
open\command

HKEY_CURRENT_USER\wKI\shell\
runas

HKEY_CURRENT_USER\wKI\shell\
runas\command

HKEY_CURRENT_USER\5fY

HKEY_CURRENT_USER\5fY\DefaultIcon

HKEY_CURRENT_USER\5fY\shell

HKEY_CURRENT_USER\5fY\shell\
open

HKEY_CURRENT_USER\5fY\shell\
open\command

HKEY_CURRENT_USER\5fY\shell\
runas

HKEY_CURRENT_USER\5fY\shell\
runas\command

HKEY_CURRENT_USER\23

HKEY_CURRENT_USER\23\DefaultIcon

HKEY_CURRENT_USER\23\shell

HKEY_CURRENT_USER\23\shell\
open

HKEY_CURRENT_USER\23\shell\
open\command

HKEY_CURRENT_USER\23\shell\
runas

HKEY_CURRENT_USER\23\shell\
runas\command

HKEY_CURRENT_USER\o6a

HKEY_CURRENT_USER\o6a\DefaultIcon

HKEY_CURRENT_USER\o6a\shell

HKEY_CURRENT_USER\o6a\shell\
open

HKEY_CURRENT_USER\o6a\shell\
open\command

HKEY_CURRENT_USER\o6a\shell\
runas

HKEY_CURRENT_USER\o6a\shell\
runas\command

HKEY_CURRENT_USER\f1U

HKEY_CURRENT_USER\f1U\DefaultIcon

HKEY_CURRENT_USER\f1U\shell

HKEY_CURRENT_USER\f1U\shell\
open

HKEY_CURRENT_USER\f1U\shell\
open\command

HKEY_CURRENT_USER\f1U\shell\
runas

HKEY_CURRENT_USER\f1U\shell\
runas\command

HKEY_CURRENT_USER\L50

HKEY_CURRENT_USER\L50\DefaultIcon

HKEY_CURRENT_USER\L50\shell

HKEY_CURRENT_USER\L50\shell\
open

HKEY_CURRENT_USER\L50\shell\
open\command

HKEY_CURRENT_USER\L50\shell\
runas

HKEY_CURRENT_USER\L50\shell\
runas\command

HKEY_CURRENT_USER\K5

HKEY_CURRENT_USER\K5\DefaultIcon

HKEY_CURRENT_USER\K5\shell

HKEY_CURRENT_USER\K5\shell\
open

HKEY_CURRENT_USER\K5\shell\
open\command

HKEY_CURRENT_USER\K5\shell\
runas

HKEY_CURRENT_USER\K5\shell\
runas\command

HKEY_CURRENT_USER\GW

HKEY_CURRENT_USER\GW\DefaultIcon

HKEY_CURRENT_USER\GW\shell

HKEY_CURRENT_USER\GW\shell\
open

HKEY_CURRENT_USER\GW\shell\
open\command

HKEY_CURRENT_USER\GW\shell\
runas

HKEY_CURRENT_USER\GW\shell\
runas\command

HKEY_CURRENT_USER\7r

HKEY_CURRENT_USER\7r\DefaultIcon

HKEY_CURRENT_USER\7r\shell

HKEY_CURRENT_USER\7r\shell\
open

HKEY_CURRENT_USER\7r\shell\
open\command

HKEY_CURRENT_USER\7r\shell\
runas

HKEY_CURRENT_USER\7r\shell\
runas\command

HKEY_CURRENT_USER\pP1

HKEY_CURRENT_USER\pP1\DefaultIcon

HKEY_CURRENT_USER\pP1\shell

HKEY_CURRENT_USER\pP1\shell\
open

HKEY_CURRENT_USER\pP1\shell\
open\command

HKEY_CURRENT_USER\pP1\shell\
runas

HKEY_CURRENT_USER\pP1\shell\
runas\command

HKEY_CURRENT_USER\Sg1

HKEY_CURRENT_USER\Sg1\DefaultIcon

HKEY_CURRENT_USER\Sg1\shell

HKEY_CURRENT_USER\Sg1\shell\
open

HKEY_CURRENT_USER\Sg1\shell\
open\command

HKEY_CURRENT_USER\Sg1\shell\
runas

HKEY_CURRENT_USER\Sg1\shell\
runas\command

HKEY_CURRENT_USER\JIG

HKEY_CURRENT_USER\JIG\DefaultIcon

HKEY_CURRENT_USER\JIG\shell

HKEY_CURRENT_USER\JIG\shell\
open

HKEY_CURRENT_USER\JIG\shell\
open\command

HKEY_CURRENT_USER\JIG\shell\
runas

HKEY_CURRENT_USER\JIG\shell\
runas\command

HKEY_CURRENT_USER\sB

HKEY_CURRENT_USER\sB\DefaultIcon

HKEY_CURRENT_USER\sB\shell

HKEY_CURRENT_USER\sB\shell\
open

HKEY_CURRENT_USER\sB\shell\
open\command

HKEY_CURRENT_USER\sB\shell\
runas

HKEY_CURRENT_USER\sB\shell\
runas\command

HKEY_CURRENT_USER\GG

HKEY_CURRENT_USER\GG\DefaultIcon

HKEY_CURRENT_USER\GG\shell

HKEY_CURRENT_USER\GG\shell\
open

HKEY_CURRENT_USER\GG\shell\
open\command

HKEY_CURRENT_USER\GG\shell\
runas

HKEY_CURRENT_USER\GG\shell\
runas\command

HKEY_CURRENT_USER\B6Y

HKEY_CURRENT_USER\B6Y\DefaultIcon

HKEY_CURRENT_USER\B6Y\shell

HKEY_CURRENT_USER\B6Y\shell\
open

HKEY_CURRENT_USER\B6Y\shell\
open\command

HKEY_CURRENT_USER\B6Y\shell\
runas

HKEY_CURRENT_USER\B6Y\shell\
runas\command

HKEY_CURRENT_USER\854

HKEY_CURRENT_USER\854\DefaultIcon

HKEY_CURRENT_USER\854\shell

HKEY_CURRENT_USER\854\shell\
open

HKEY_CURRENT_USER\854\shell\
open\command

HKEY_CURRENT_USER\854\shell\
runas

HKEY_CURRENT_USER\854\shell\
runas\command

HKEY_CURRENT_USER\R27

HKEY_CURRENT_USER\R27\DefaultIcon

HKEY_CURRENT_USER\R27\shell

HKEY_CURRENT_USER\R27\shell\
open

HKEY_CURRENT_USER\R27\shell\
open\command

HKEY_CURRENT_USER\R27\shell\
runas

HKEY_CURRENT_USER\R27\shell\
runas\command

HKEY_CURRENT_USER\1f

HKEY_CURRENT_USER\1f\DefaultIcon

HKEY_CURRENT_USER\1f\shell

HKEY_CURRENT_USER\1f\shell\
open

HKEY_CURRENT_USER\1f\shell\
open\command

HKEY_CURRENT_USER\1f\shell\
runas

HKEY_CURRENT_USER\1f\shell\
runas\command

HKEY_CURRENT_USER\bo

HKEY_CURRENT_USER\bo\DefaultIcon

HKEY_CURRENT_USER\bo\shell

HKEY_CURRENT_USER\bo\shell\
open

HKEY_CURRENT_USER\bo\shell\
open\command

HKEY_CURRENT_USER\bo\shell\
runas

HKEY_CURRENT_USER\bo\shell\
runas\command

HKEY_CURRENT_USER\53

HKEY_CURRENT_USER\53\DefaultIcon

HKEY_CURRENT_USER\53\shell

HKEY_CURRENT_USER\53\shell\
open

HKEY_CURRENT_USER\53\shell\
open\command

HKEY_CURRENT_USER\53\shell\
runas

HKEY_CURRENT_USER\53\shell\
runas\command

HKEY_CURRENT_USER\3R

HKEY_CURRENT_USER\3R\DefaultIcon

HKEY_CURRENT_USER\3R\shell

HKEY_CURRENT_USER\3R\shell\
open

HKEY_CURRENT_USER\3R\shell\
open\command

HKEY_CURRENT_USER\3R\shell\
runas

HKEY_CURRENT_USER\3R\shell\
runas\command

HKEY_CURRENT_USER\4vI

HKEY_CURRENT_USER\4vI\DefaultIcon

HKEY_CURRENT_USER\4vI\shell

HKEY_CURRENT_USER\4vI\shell\
open

HKEY_CURRENT_USER\4vI\shell\
open\command

HKEY_CURRENT_USER\4vI\shell\
runas

HKEY_CURRENT_USER\4vI\shell\
runas\command

HKEY_CURRENT_USER\bW5

HKEY_CURRENT_USER\bW5\DefaultIcon

HKEY_CURRENT_USER\bW5\shell

HKEY_CURRENT_USER\bW5\shell\
open

HKEY_CURRENT_USER\bW5\shell\
open\command

HKEY_CURRENT_USER\bW5\shell\
runas

HKEY_CURRENT_USER\bW5\shell\
runas\command

HKEY_CURRENT_USER\28

HKEY_CURRENT_USER\28\DefaultIcon

HKEY_CURRENT_USER\28\shell

HKEY_CURRENT_USER\28\shell\
open

HKEY_CURRENT_USER\28\shell\
open\command

HKEY_CURRENT_USER\28\shell\
runas

HKEY_CURRENT_USER\28\shell\
runas\command

HKEY_CURRENT_USER\66

HKEY_CURRENT_USER\66\DefaultIcon

HKEY_CURRENT_USER\66\shell

HKEY_CURRENT_USER\66\shell\
open

HKEY_CURRENT_USER\66\shell\
open\command

HKEY_CURRENT_USER\66\shell\
runas

HKEY_CURRENT_USER\66\shell\
runas\command

HKEY_CURRENT_USER\oE3

HKEY_CURRENT_USER\oE3\DefaultIcon

HKEY_CURRENT_USER\oE3\shell

HKEY_CURRENT_USER\oE3\shell\
open

HKEY_CURRENT_USER\oE3\shell\
open\command

HKEY_CURRENT_USER\oE3\shell\
runas

HKEY_CURRENT_USER\oE3\shell\
runas\command

HKEY_CURRENT_USER\lG

HKEY_CURRENT_USER\lG\DefaultIcon

HKEY_CURRENT_USER\lG\shell

HKEY_CURRENT_USER\lG\shell\
open

HKEY_CURRENT_USER\lG\shell\
open\command

HKEY_CURRENT_USER\lG\shell\
runas

HKEY_CURRENT_USER\lG\shell\
runas\command

HKEY_CURRENT_USER\Fv

HKEY_CURRENT_USER\Fv\DefaultIcon

HKEY_CURRENT_USER\Fv\shell

HKEY_CURRENT_USER\Fv\shell\
open

HKEY_CURRENT_USER\Fv\shell\
open\command

HKEY_CURRENT_USER\Fv\shell\
runas

HKEY_CURRENT_USER\Fv\shell\
runas\command

HKEY_CURRENT_USER\7Yo

HKEY_CURRENT_USER\7Yo\DefaultIcon

HKEY_CURRENT_USER\7Yo\shell

HKEY_CURRENT_USER\7Yo\shell\
open

HKEY_CURRENT_USER\7Yo\shell\
open\command

HKEY_CURRENT_USER\7Yo\shell\
runas

HKEY_CURRENT_USER\7Yo\shell\
runas\command

HKEY_CURRENT_USER\hC

HKEY_CURRENT_USER\hC\DefaultIcon

HKEY_CURRENT_USER\hC\shell

HKEY_CURRENT_USER\hC\shell\
open

HKEY_CURRENT_USER\hC\shell\
open\command

HKEY_CURRENT_USER\hC\shell\
runas

HKEY_CURRENT_USER\hC\shell\
runas\command

HKEY_CURRENT_USER\2Qn

HKEY_CURRENT_USER\2Qn\DefaultIcon

HKEY_CURRENT_USER\2Qn\shell

HKEY_CURRENT_USER\2Qn\shell\
open

HKEY_CURRENT_USER\2Qn\shell\
open\command

HKEY_CURRENT_USER\2Qn\shell\
runas

HKEY_CURRENT_USER\2Qn\shell\
runas\command

HKEY_CURRENT_USER\X0

HKEY_CURRENT_USER\X0\DefaultIcon

HKEY_CURRENT_USER\X0\shell

HKEY_CURRENT_USER\X0\shell\
open

HKEY_CURRENT_USER\X0\shell\
open\command

HKEY_CURRENT_USER\X0\shell\
runas

HKEY_CURRENT_USER\X0\shell\
runas\command

HKEY_CURRENT_USER\0YK

HKEY_CURRENT_USER\0YK\DefaultIcon

HKEY_CURRENT_USER\0YK\shell

HKEY_CURRENT_USER\0YK\shell\
open

HKEY_CURRENT_USER\0YK\shell\
open\command

HKEY_CURRENT_USER\0YK\shell\
runas

HKEY_CURRENT_USER\0YK\shell\
runas\command

HKEY_CURRENT_USER\5UU

HKEY_CURRENT_USER\5UU\DefaultIcon

HKEY_CURRENT_USER\5UU\shell

HKEY_CURRENT_USER\5UU\shell\
open

HKEY_CURRENT_USER\5UU\shell\
open\command

HKEY_CURRENT_USER\5UU\shell\
runas

HKEY_CURRENT_USER\5UU\shell\
runas\command

HKEY_CURRENT_USER\73O

HKEY_CURRENT_USER\73O\DefaultIcon

HKEY_CURRENT_USER\73O\shell

HKEY_CURRENT_USER\73O\shell\
open

HKEY_CURRENT_USER\73O\shell\
open\command

HKEY_CURRENT_USER\73O\shell\
runas

HKEY_CURRENT_USER\73O\shell\
runas\command

HKEY_CURRENT_USER\YcT

HKEY_CURRENT_USER\YcT\DefaultIcon

HKEY_CURRENT_USER\YcT\shell

HKEY_CURRENT_USER\YcT\shell\
open

HKEY_CURRENT_USER\YcT\shell\
open\command

HKEY_CURRENT_USER\YcT\shell\
runas

HKEY_CURRENT_USER\YcT\shell\
runas\command

HKEY_CURRENT_USER\17

HKEY_CURRENT_USER\17\DefaultIcon

HKEY_CURRENT_USER\17\shell

HKEY_CURRENT_USER\17\shell\
open

HKEY_CURRENT_USER\17\shell\
open\command

HKEY_CURRENT_USER\17\shell\
runas

HKEY_CURRENT_USER\17\shell\
runas\command

HKEY_CURRENT_USER\y8o

HKEY_CURRENT_USER\y8o\DefaultIcon

HKEY_CURRENT_USER\y8o\shell

HKEY_CURRENT_USER\y8o\shell\
open

HKEY_CURRENT_USER\y8o\shell\
open\command

HKEY_CURRENT_USER\y8o\shell\
runas

HKEY_CURRENT_USER\y8o\shell\
runas\command

HKEY_CURRENT_USER\2Fb

HKEY_CURRENT_USER\2Fb\DefaultIcon

HKEY_CURRENT_USER\2Fb\shell

HKEY_CURRENT_USER\2Fb\shell\
open

HKEY_CURRENT_USER\2Fb\shell\
open\command

HKEY_CURRENT_USER\2Fb\shell\
runas

HKEY_CURRENT_USER\2Fb\shell\
runas\command

HKEY_CURRENT_USER\Pb

HKEY_CURRENT_USER\Pb\DefaultIcon

HKEY_CURRENT_USER\Pb\shell

HKEY_CURRENT_USER\Pb\shell\
open

HKEY_CURRENT_USER\Pb\shell\
open\command

HKEY_CURRENT_USER\Pb\shell\
runas

HKEY_CURRENT_USER\Pb\shell\
runas\command

HKEY_CURRENT_USER\4u5

HKEY_CURRENT_USER\4u5\DefaultIcon

HKEY_CURRENT_USER\4u5\shell

HKEY_CURRENT_USER\4u5\shell\
open

HKEY_CURRENT_USER\4u5\shell\
open\command

HKEY_CURRENT_USER\4u5\shell\
runas

HKEY_CURRENT_USER\4u5\shell\
runas\command

HKEY_CURRENT_USER\r8

HKEY_CURRENT_USER\r8\DefaultIcon

HKEY_CURRENT_USER\r8\shell

HKEY_CURRENT_USER\r8\shell\
open

HKEY_CURRENT_USER\r8\shell\
open\command

HKEY_CURRENT_USER\r8\shell\
runas

HKEY_CURRENT_USER\r8\shell\
runas\command

HKEY_CURRENT_USER\a0p

HKEY_CURRENT_USER\a0p\DefaultIcon

HKEY_CURRENT_USER\a0p\shell

HKEY_CURRENT_USER\a0p\shell\
open

HKEY_CURRENT_USER\a0p\shell\
open\command

HKEY_CURRENT_USER\a0p\shell\
runas

HKEY_CURRENT_USER\a0p\shell\
runas\command

HKEY_CURRENT_USER\Ocj

HKEY_CURRENT_USER\Ocj\DefaultIcon

HKEY_CURRENT_USER\Ocj\shell

HKEY_CURRENT_USER\Ocj\shell\
open

HKEY_CURRENT_USER\Ocj\shell\
open\command

HKEY_CURRENT_USER\Ocj\shell\
runas

HKEY_CURRENT_USER\Ocj\shell\
runas\command

HKEY_CURRENT_USER\SNu

HKEY_CURRENT_USER\SNu\DefaultIcon

HKEY_CURRENT_USER\SNu\shell

HKEY_CURRENT_USER\SNu\shell\
open

HKEY_CURRENT_USER\SNu\shell\
open\command

HKEY_CURRENT_USER\SNu\shell\
runas

HKEY_CURRENT_USER\SNu\shell\
runas\command

HKEY_CURRENT_USER\NoB

HKEY_CURRENT_USER\NoB\DefaultIcon

HKEY_CURRENT_USER\NoB\shell

HKEY_CURRENT_USER\NoB\shell\
open

HKEY_CURRENT_USER\NoB\shell\
open\command

HKEY_CURRENT_USER\NoB\shell\
runas

HKEY_CURRENT_USER\NoB\shell\
runas\command

HKEY_CURRENT_USER\8T4

HKEY_CURRENT_USER\8T4\DefaultIcon

HKEY_CURRENT_USER\8T4\shell

HKEY_CURRENT_USER\8T4\shell\
open

HKEY_CURRENT_USER\8T4\shell\
open\command

HKEY_CURRENT_USER\8T4\shell\
runas

HKEY_CURRENT_USER\8T4\shell\
runas\command

HKEY_CURRENT_USER\mCq

HKEY_CURRENT_USER\mCq\DefaultIcon

HKEY_CURRENT_USER\mCq\shell

HKEY_CURRENT_USER\mCq\shell\
open

HKEY_CURRENT_USER\mCq\shell\
open\command

HKEY_CURRENT_USER\mCq\shell\
runas

HKEY_CURRENT_USER\mCq\shell\
runas\command

HKEY_CURRENT_USER\Uv

HKEY_CURRENT_USER\Uv\DefaultIcon

HKEY_CURRENT_USER\Uv\shell

HKEY_CURRENT_USER\Uv\shell\
open

HKEY_CURRENT_USER\Uv\shell\
open\command

HKEY_CURRENT_USER\Uv\shell\
runas

HKEY_CURRENT_USER\Uv\shell\
runas\command

HKEY_CURRENT_USER\sc

HKEY_CURRENT_USER\sc\DefaultIcon

HKEY_CURRENT_USER\sc\shell

HKEY_CURRENT_USER\sc\shell\
open

HKEY_CURRENT_USER\sc\shell\
open\command

HKEY_CURRENT_USER\sc\shell\
runas

HKEY_CURRENT_USER\sc\shell\
runas\command

HKEY_CURRENT_USER\REO

HKEY_CURRENT_USER\REO\DefaultIcon

HKEY_CURRENT_USER\REO\shell

HKEY_CURRENT_USER\REO\shell\
open

HKEY_CURRENT_USER\REO\shell\
open\command

HKEY_CURRENT_USER\REO\shell\
runas

HKEY_CURRENT_USER\REO\shell\
runas\command

HKEY_CURRENT_USER\Y1N

HKEY_CURRENT_USER\Y1N\DefaultIcon

HKEY_CURRENT_USER\Y1N\shell

HKEY_CURRENT_USER\Y1N\shell\
open

HKEY_CURRENT_USER\Y1N\shell\
open\command

HKEY_CURRENT_USER\Y1N\shell\
runas

HKEY_CURRENT_USER\Y1N\shell\
runas\command

HKEY_CURRENT_USER\ht

HKEY_CURRENT_USER\ht\DefaultIcon

HKEY_CURRENT_USER\ht\shell

HKEY_CURRENT_USER\ht\shell\
open

HKEY_CURRENT_USER\ht\shell\
open\command

HKEY_CURRENT_USER\ht\shell\
runas

HKEY_CURRENT_USER\ht\shell\
runas\command

HKEY_CURRENT_USER\j8

HKEY_CURRENT_USER\j8\DefaultIcon

HKEY_CURRENT_USER\j8\shell

HKEY_CURRENT_USER\j8\shell\
open

HKEY_CURRENT_USER\j8\shell\
open\command

HKEY_CURRENT_USER\j8\shell\
runas

HKEY_CURRENT_USER\j8\shell\
runas\command

HKEY_CURRENT_USER\6a0

HKEY_CURRENT_USER\6a0\DefaultIcon

HKEY_CURRENT_USER\6a0\shell

HKEY_CURRENT_USER\6a0\shell\
open

HKEY_CURRENT_USER\6a0\shell\
open\command

HKEY_CURRENT_USER\6a0\shell\
runas

HKEY_CURRENT_USER\6a0\shell\
runas\command

HKEY_CURRENT_USER\SPA

HKEY_CURRENT_USER\SPA\DefaultIcon

HKEY_CURRENT_USER\SPA\shell

HKEY_CURRENT_USER\SPA\shell\
open

HKEY_CURRENT_USER\SPA\shell\
open\command

HKEY_CURRENT_USER\SPA\shell\
runas

HKEY_CURRENT_USER\SPA\shell\
runas\command

HKEY_CURRENT_USER\NB2

HKEY_CURRENT_USER\NB2\DefaultIcon

HKEY_CURRENT_USER\NB2\shell

HKEY_CURRENT_USER\NB2\shell\
open

HKEY_CURRENT_USER\NB2\shell\
open\command

HKEY_CURRENT_USER\NB2\shell\
runas

HKEY_CURRENT_USER\NB2\shell\
runas\command

HKEY_CURRENT_USER\Ikg

HKEY_CURRENT_USER\Ikg\DefaultIcon

HKEY_CURRENT_USER\Ikg\shell

HKEY_CURRENT_USER\Ikg\shell\
open

HKEY_CURRENT_USER\Ikg\shell\
open\command

HKEY_CURRENT_USER\Ikg\shell\
runas

HKEY_CURRENT_USER\Ikg\shell\
runas\command

HKEY_CURRENT_USER\6T

HKEY_CURRENT_USER\6T\DefaultIcon

HKEY_CURRENT_USER\6T\shell

HKEY_CURRENT_USER\6T\shell\
open

HKEY_CURRENT_USER\6T\shell\
open\command

HKEY_CURRENT_USER\6T\shell\
runas

HKEY_CURRENT_USER\6T\shell\
runas\command

HKEY_CURRENT_USER\Peo

HKEY_CURRENT_USER\Peo\DefaultIcon

HKEY_CURRENT_USER\Peo\shell

HKEY_CURRENT_USER\Peo\shell\
open

HKEY_CURRENT_USER\Peo\shell\
open\command

HKEY_CURRENT_USER\Peo\shell\
runas

HKEY_CURRENT_USER\Peo\shell\
runas\command

HKEY_CURRENT_USER\tpV

HKEY_CURRENT_USER\tpV\DefaultIcon

HKEY_CURRENT_USER\tpV\shell

HKEY_CURRENT_USER\tpV\shell\
open

HKEY_CURRENT_USER\tpV\shell\
open\command

HKEY_CURRENT_USER\tpV\shell\
runas

HKEY_CURRENT_USER\tpV\shell\
runas\command

HKEY_CURRENT_USER\jXA

HKEY_CURRENT_USER\jXA\DefaultIcon

HKEY_CURRENT_USER\jXA\shell

HKEY_CURRENT_USER\jXA\shell\
open

HKEY_CURRENT_USER\jXA\shell\
open\command

HKEY_CURRENT_USER\jXA\shell\
runas

HKEY_CURRENT_USER\jXA\shell\
runas\command

HKEY_CURRENT_USER\0DU

HKEY_CURRENT_USER\0DU\DefaultIcon

HKEY_CURRENT_USER\0DU\shell

HKEY_CURRENT_USER\0DU\shell\
open

HKEY_CURRENT_USER\0DU\shell\
open\command

HKEY_CURRENT_USER\0DU\shell\
runas

HKEY_CURRENT_USER\0DU\shell\
runas\command

HKEY_CURRENT_USER\mCp

HKEY_CURRENT_USER\mCp\DefaultIcon

HKEY_CURRENT_USER\mCp\shell

HKEY_CURRENT_USER\mCp\shell\
open

HKEY_CURRENT_USER\mCp\shell\
open\command

HKEY_CURRENT_USER\mCp\shell\
runas

HKEY_CURRENT_USER\mCp\shell\
runas\command

HKEY_CURRENT_USER\Y8

HKEY_CURRENT_USER\Y8\DefaultIcon

HKEY_CURRENT_USER\Y8\shell

HKEY_CURRENT_USER\Y8\shell\
open

HKEY_CURRENT_USER\Y8\shell\
open\command

HKEY_CURRENT_USER\Y8\shell\
runas

HKEY_CURRENT_USER\Y8\shell\
runas\command

HKEY_CURRENT_USER\yv4

HKEY_CURRENT_USER\yv4\DefaultIcon

HKEY_CURRENT_USER\yv4\shell

HKEY_CURRENT_USER\yv4\shell\
open

HKEY_CURRENT_USER\yv4\shell\
open\command

HKEY_CURRENT_USER\yv4\shell\
runas

HKEY_CURRENT_USER\yv4\shell\
runas\command

HKEY_CURRENT_USER\yu1

HKEY_CURRENT_USER\yu1\DefaultIcon

HKEY_CURRENT_USER\yu1\shell

HKEY_CURRENT_USER\yu1\shell\
open

HKEY_CURRENT_USER\yu1\shell\
open\command

HKEY_CURRENT_USER\yu1\shell\
runas

HKEY_CURRENT_USER\yu1\shell\
runas\command

HKEY_CURRENT_USER\2P

HKEY_CURRENT_USER\2P\DefaultIcon

HKEY_CURRENT_USER\2P\shell

HKEY_CURRENT_USER\2P\shell\
open

HKEY_CURRENT_USER\2P\shell\
open\command

HKEY_CURRENT_USER\2P\shell\
runas

HKEY_CURRENT_USER\2P\shell\
runas\command

HKEY_CURRENT_USER\w4

HKEY_CURRENT_USER\w4\DefaultIcon

HKEY_CURRENT_USER\w4\shell

HKEY_CURRENT_USER\w4\shell\
open

HKEY_CURRENT_USER\w4\shell\
open\command

HKEY_CURRENT_USER\w4\shell\
runas

HKEY_CURRENT_USER\w4\shell\
runas\command

HKEY_CURRENT_USER\Tw8

HKEY_CURRENT_USER\Tw8\DefaultIcon

HKEY_CURRENT_USER\Tw8\shell

HKEY_CURRENT_USER\Tw8\shell\
open

HKEY_CURRENT_USER\Tw8\shell\
open\command

HKEY_CURRENT_USER\Tw8\shell\
runas

HKEY_CURRENT_USER\Tw8\shell\
runas\command

HKEY_CURRENT_USER\iu5

HKEY_CURRENT_USER\iu5\DefaultIcon

HKEY_CURRENT_USER\iu5\shell

HKEY_CURRENT_USER\iu5\shell\
open

HKEY_CURRENT_USER\iu5\shell\
open\command

HKEY_CURRENT_USER\iu5\shell\
runas

HKEY_CURRENT_USER\iu5\shell\
runas\command

HKEY_CURRENT_USER\GNj

HKEY_CURRENT_USER\GNj\DefaultIcon

HKEY_CURRENT_USER\GNj\shell

HKEY_CURRENT_USER\GNj\shell\
open

HKEY_CURRENT_USER\GNj\shell\
open\command

HKEY_CURRENT_USER\GNj\shell\
runas

HKEY_CURRENT_USER\GNj\shell\
runas\command

HKEY_CURRENT_USER\oJ

HKEY_CURRENT_USER\oJ\DefaultIcon

HKEY_CURRENT_USER\oJ\shell

HKEY_CURRENT_USER\oJ\shell\
open

HKEY_CURRENT_USER\oJ\shell\
open\command

HKEY_CURRENT_USER\oJ\shell\
runas

HKEY_CURRENT_USER\oJ\shell\
runas\command

HKEY_CURRENT_USER\GI

HKEY_CURRENT_USER\GI\DefaultIcon

HKEY_CURRENT_USER\GI\shell

HKEY_CURRENT_USER\GI\shell\
open

HKEY_CURRENT_USER\GI\shell\
open\command

HKEY_CURRENT_USER\GI\shell\
runas

HKEY_CURRENT_USER\GI\shell\
runas\command

HKEY_CURRENT_USER\Od

HKEY_CURRENT_USER\Od\DefaultIcon

HKEY_CURRENT_USER\Od\shell

HKEY_CURRENT_USER\Od\shell\
open

HKEY_CURRENT_USER\Od\shell\
open\command

HKEY_CURRENT_USER\Od\shell\
runas

HKEY_CURRENT_USER\Od\shell\
runas\command

HKEY_CURRENT_USER\F5w

HKEY_CURRENT_USER\F5w\DefaultIcon

HKEY_CURRENT_USER\F5w\shell

HKEY_CURRENT_USER\F5w\shell\
open

HKEY_CURRENT_USER\F5w\shell\
open\command

HKEY_CURRENT_USER\F5w\shell\
runas

HKEY_CURRENT_USER\F5w\shell\
runas\command

HKEY_CURRENT_USER\P3

HKEY_CURRENT_USER\P3\DefaultIcon

HKEY_CURRENT_USER\P3\shell

HKEY_CURRENT_USER\P3\shell\
open

HKEY_CURRENT_USER\P3\shell\
open\command

HKEY_CURRENT_USER\P3\shell\
runas

HKEY_CURRENT_USER\P3\shell\
runas\command

HKEY_CURRENT_USER\0Fs

HKEY_CURRENT_USER\0Fs\DefaultIcon

HKEY_CURRENT_USER\0Fs\shell

HKEY_CURRENT_USER\0Fs\shell\
open

HKEY_CURRENT_USER\0Fs\shell\
open\command

HKEY_CURRENT_USER\0Fs\shell\
runas

HKEY_CURRENT_USER\0Fs\shell\
runas\command

HKEY_CURRENT_USER\K3

HKEY_CURRENT_USER\K3\DefaultIcon

HKEY_CURRENT_USER\K3\shell

HKEY_CURRENT_USER\K3\shell\
open

HKEY_CURRENT_USER\K3\shell\
open\command

HKEY_CURRENT_USER\K3\shell\
runas

HKEY_CURRENT_USER\K3\shell\
runas\command

HKEY_CURRENT_USER\F5

HKEY_CURRENT_USER\F5\DefaultIcon

HKEY_CURRENT_USER\F5\shell

HKEY_CURRENT_USER\F5\shell\
open

HKEY_CURRENT_USER\F5\shell\
open\command

HKEY_CURRENT_USER\F5\shell\
runas

HKEY_CURRENT_USER\F5\shell\
runas\command

HKEY_CURRENT_USER\Vs

HKEY_CURRENT_USER\Vs\DefaultIcon

HKEY_CURRENT_USER\Vs\shell

HKEY_CURRENT_USER\Vs\shell\
open

HKEY_CURRENT_USER\Vs\shell\
open\command

HKEY_CURRENT_USER\Vs\shell\
runas

HKEY_CURRENT_USER\Vs\shell\
runas\command

HKEY_CURRENT_USER\24N

HKEY_CURRENT_USER\24N\DefaultIcon

HKEY_CURRENT_USER\24N\shell

HKEY_CURRENT_USER\24N\shell\
open

HKEY_CURRENT_USER\24N\shell\
open\command

HKEY_CURRENT_USER\24N\shell\
runas

HKEY_CURRENT_USER\24N\shell\
runas\command

HKEY_CURRENT_USER\V1q

HKEY_CURRENT_USER\V1q\DefaultIcon

HKEY_CURRENT_USER\V1q\shell

HKEY_CURRENT_USER\V1q\shell\
open

HKEY_CURRENT_USER\V1q\shell\
open\command

HKEY_CURRENT_USER\V1q\shell\
runas

HKEY_CURRENT_USER\V1q\shell\
runas\command

HKEY_CURRENT_USER\KLf

HKEY_CURRENT_USER\KLf\DefaultIcon

HKEY_CURRENT_USER\KLf\shell

HKEY_CURRENT_USER\KLf\shell\
open

HKEY_CURRENT_USER\KLf\shell\
open\command

HKEY_CURRENT_USER\KLf\shell\
runas

HKEY_CURRENT_USER\KLf\shell\
runas\command

HKEY_CURRENT_USER\HN

HKEY_CURRENT_USER\HN\DefaultIcon

HKEY_CURRENT_USER\HN\shell

HKEY_CURRENT_USER\HN\shell\
open

HKEY_CURRENT_USER\HN\shell\
open\command

HKEY_CURRENT_USER\HN\shell\
runas

HKEY_CURRENT_USER\HN\shell\
runas\command

HKEY_CURRENT_USER\mp

HKEY_CURRENT_USER\mp\DefaultIcon

HKEY_CURRENT_USER\mp\shell

HKEY_CURRENT_USER\mp\shell\
open

HKEY_CURRENT_USER\mp\shell\
open\command

HKEY_CURRENT_USER\mp\shell\
runas

HKEY_CURRENT_USER\mp\shell\
runas\command

HKEY_CURRENT_USER\ax

HKEY_CURRENT_USER\ax\DefaultIcon

HKEY_CURRENT_USER\ax\shell

HKEY_CURRENT_USER\ax\shell\
open

HKEY_CURRENT_USER\ax\shell\
open\command

HKEY_CURRENT_USER\ax\shell\
runas

HKEY_CURRENT_USER\ax\shell\
runas\command

HKEY_CURRENT_USER\u14

HKEY_CURRENT_USER\u14\DefaultIcon

HKEY_CURRENT_USER\u14\shell

HKEY_CURRENT_USER\u14\shell\
open

HKEY_CURRENT_USER\u14\shell\
open\command

HKEY_CURRENT_USER\u14\shell\
runas

HKEY_CURRENT_USER\u14\shell\
runas\command

HKEY_CURRENT_USER\Tp

HKEY_CURRENT_USER\Tp\DefaultIcon

HKEY_CURRENT_USER\Tp\shell

HKEY_CURRENT_USER\Tp\shell\
open

HKEY_CURRENT_USER\Tp\shell\
open\command

HKEY_CURRENT_USER\Tp\shell\
runas

HKEY_CURRENT_USER\Tp\shell\
runas\command

HKEY_CURRENT_USER\2HW

HKEY_CURRENT_USER\2HW\DefaultIcon

HKEY_CURRENT_USER\2HW\shell

HKEY_CURRENT_USER\2HW\shell\
open

HKEY_CURRENT_USER\2HW\shell\
open\command

HKEY_CURRENT_USER\2HW\shell\
runas

HKEY_CURRENT_USER\2HW\shell\
runas\command

HKEY_CURRENT_USER\8rI

HKEY_CURRENT_USER\8rI\DefaultIcon

HKEY_CURRENT_USER\8rI\shell

HKEY_CURRENT_USER\8rI\shell\
open

HKEY_CURRENT_USER\8rI\shell\
open\command

HKEY_CURRENT_USER\8rI\shell\
runas

HKEY_CURRENT_USER\8rI\shell\
runas\command

HKEY_CURRENT_USER\8c

HKEY_CURRENT_USER\8c\DefaultIcon

HKEY_CURRENT_USER\8c\shell

HKEY_CURRENT_USER\8c\shell\
open

HKEY_CURRENT_USER\8c\shell\
open\command

HKEY_CURRENT_USER\8c\shell\
runas

HKEY_CURRENT_USER\8c\shell\
runas\command

HKEY_CURRENT_USER\Pr

HKEY_CURRENT_USER\Pr\DefaultIcon

HKEY_CURRENT_USER\Pr\shell

HKEY_CURRENT_USER\Pr\shell\
open

HKEY_CURRENT_USER\Pr\shell\
open\command

HKEY_CURRENT_USER\Pr\shell\
runas

HKEY_CURRENT_USER\Pr\shell\
runas\command

HKEY_CURRENT_USER\152

HKEY_CURRENT_USER\152\DefaultIcon

HKEY_CURRENT_USER\152\shell

HKEY_CURRENT_USER\152\shell\
open

HKEY_CURRENT_USER\152\shell\
open\command

HKEY_CURRENT_USER\152\shell\
runas

HKEY_CURRENT_USER\152\shell\
runas\command

HKEY_CURRENT_USER\26J

HKEY_CURRENT_USER\26J\DefaultIcon

HKEY_CURRENT_USER\26J\shell

HKEY_CURRENT_USER\26J\shell\
open

HKEY_CURRENT_USER\26J\shell\
open\command

HKEY_CURRENT_USER\26J\shell\
runas

HKEY_CURRENT_USER\26J\shell\
runas\command

HKEY_CURRENT_USER\y2f

HKEY_CURRENT_USER\y2f\DefaultIcon

HKEY_CURRENT_USER\y2f\shell

HKEY_CURRENT_USER\y2f\shell\
open

HKEY_CURRENT_USER\y2f\shell\
open\command

HKEY_CURRENT_USER\y2f\shell\
runas

HKEY_CURRENT_USER\y2f\shell\
runas\command

HKEY_CURRENT_USER\832

HKEY_CURRENT_USER\832\DefaultIcon

HKEY_CURRENT_USER\832\shell

HKEY_CURRENT_USER\832\shell\
open

HKEY_CURRENT_USER\832\shell\
open\command

HKEY_CURRENT_USER\832\shell\
runas

HKEY_CURRENT_USER\832\shell\
runas\command

HKEY_CURRENT_USER\15x

HKEY_CURRENT_USER\15x\DefaultIcon

HKEY_CURRENT_USER\15x\shell

HKEY_CURRENT_USER\15x\shell\
open

HKEY_CURRENT_USER\15x\shell\
open\command

HKEY_CURRENT_USER\15x\shell\
runas

HKEY_CURRENT_USER\15x\shell\
runas\command

HKEY_CURRENT_USER\B5N

HKEY_CURRENT_USER\B5N\DefaultIcon

HKEY_CURRENT_USER\B5N\shell

HKEY_CURRENT_USER\B5N\shell\
open

HKEY_CURRENT_USER\B5N\shell\
open\command

HKEY_CURRENT_USER\B5N\shell\
runas

HKEY_CURRENT_USER\B5N\shell\
runas\command

HKEY_CURRENT_USER\AJ

HKEY_CURRENT_USER\AJ\DefaultIcon

HKEY_CURRENT_USER\AJ\shell

HKEY_CURRENT_USER\AJ\shell\
open

HKEY_CURRENT_USER\AJ\shell\
open\command

HKEY_CURRENT_USER\AJ\shell\
runas

HKEY_CURRENT_USER\AJ\shell\
runas\command

HKEY_CURRENT_USER\Dh7

HKEY_CURRENT_USER\Dh7\DefaultIcon

HKEY_CURRENT_USER\Dh7\shell

HKEY_CURRENT_USER\Dh7\shell\
open

HKEY_CURRENT_USER\Dh7\shell\
open\command

HKEY_CURRENT_USER\Dh7\shell\
runas

HKEY_CURRENT_USER\Dh7\shell\
runas\command

HKEY_CURRENT_USER\4u

HKEY_CURRENT_USER\4u\DefaultIcon

HKEY_CURRENT_USER\4u\shell

HKEY_CURRENT_USER\4u\shell\
open

HKEY_CURRENT_USER\4u\shell\
open\command

HKEY_CURRENT_USER\4u\shell\
runas

HKEY_CURRENT_USER\4u\shell\
runas\command

HKEY_CURRENT_USER\55

HKEY_CURRENT_USER\55\DefaultIcon

HKEY_CURRENT_USER\55\shell

HKEY_CURRENT_USER\55\shell\
open

HKEY_CURRENT_USER\55\shell\
open\command

HKEY_CURRENT_USER\55\shell\
runas

HKEY_CURRENT_USER\55\shell\
runas\command

HKEY_CURRENT_USER\XeR

HKEY_CURRENT_USER\XeR\DefaultIcon

HKEY_CURRENT_USER\XeR\shell

HKEY_CURRENT_USER\XeR\shell\
open

HKEY_CURRENT_USER\XeR\shell\
open\command

HKEY_CURRENT_USER\XeR\shell\
runas

HKEY_CURRENT_USER\XeR\shell\
runas\command

HKEY_CURRENT_USER\7SN

HKEY_CURRENT_USER\7SN\DefaultIcon

HKEY_CURRENT_USER\7SN\shell

HKEY_CURRENT_USER\7SN\shell\
open

HKEY_CURRENT_USER\7SN\shell\
open\command

HKEY_CURRENT_USER\7SN\shell\
runas

HKEY_CURRENT_USER\7SN\shell\
runas\command

HKEY_CURRENT_USER\bf

HKEY_CURRENT_USER\bf\DefaultIcon

HKEY_CURRENT_USER\bf\shell

HKEY_CURRENT_USER\bf\shell\
open

HKEY_CURRENT_USER\bf\shell\
open\command

HKEY_CURRENT_USER\bf\shell\
runas

HKEY_CURRENT_USER\bf\shell\
runas\command

HKEY_CURRENT_USER\2wc

HKEY_CURRENT_USER\2wc\DefaultIcon

HKEY_CURRENT_USER\2wc\shell

HKEY_CURRENT_USER\2wc\shell\
open

HKEY_CURRENT_USER\2wc\shell\
open\command

HKEY_CURRENT_USER\2wc\shell\
runas

HKEY_CURRENT_USER\2wc\shell\
runas\command

HKEY_CURRENT_USER\3E

HKEY_CURRENT_USER\3E\DefaultIcon

HKEY_CURRENT_USER\3E\shell

HKEY_CURRENT_USER\3E\shell\
open

HKEY_CURRENT_USER\3E\shell\
open\command

HKEY_CURRENT_USER\3E\shell\
runas

HKEY_CURRENT_USER\3E\shell\
runas\command

HKEY_CURRENT_USER\pVk

HKEY_CURRENT_USER\pVk\DefaultIcon

HKEY_CURRENT_USER\pVk\shell

HKEY_CURRENT_USER\pVk\shell\
open

HKEY_CURRENT_USER\pVk\shell\
open\command

HKEY_CURRENT_USER\pVk\shell\
runas

HKEY_CURRENT_USER\pVk\shell\
runas\command

HKEY_CURRENT_USER\h2d

HKEY_CURRENT_USER\h2d\DefaultIcon

HKEY_CURRENT_USER\h2d\shell

HKEY_CURRENT_USER\h2d\shell\
open

HKEY_CURRENT_USER\h2d\shell\
open\command

HKEY_CURRENT_USER\h2d\shell\
runas

HKEY_CURRENT_USER\h2d\shell\
runas\command

HKEY_CURRENT_USER\3PF

HKEY_CURRENT_USER\3PF\DefaultIcon

HKEY_CURRENT_USER\3PF\shell

HKEY_CURRENT_USER\3PF\shell\
open

HKEY_CURRENT_USER\3PF\shell\
open\command

HKEY_CURRENT_USER\3PF\shell\
runas

HKEY_CURRENT_USER\3PF\shell\
runas\command

HKEY_CURRENT_USER\Myl

HKEY_CURRENT_USER\Myl\DefaultIcon

HKEY_CURRENT_USER\Myl\shell

HKEY_CURRENT_USER\Myl\shell\
open

HKEY_CURRENT_USER\Myl\shell\
open\command

HKEY_CURRENT_USER\Myl\shell\
runas

HKEY_CURRENT_USER\Myl\shell\
runas\command

HKEY_CURRENT_USER\1B

HKEY_CURRENT_USER\1B\DefaultIcon

HKEY_CURRENT_USER\1B\shell

HKEY_CURRENT_USER\1B\shell\
open

HKEY_CURRENT_USER\1B\shell\
open\command

HKEY_CURRENT_USER\1B\shell\
runas

HKEY_CURRENT_USER\1B\shell\
runas\command

HKEY_LOCAL_MACHINE\Software\Microsoft\
Sft

HKEY_CURRENT_USER\rRC

HKEY_CURRENT_USER\rRC\DefaultIcon

HKEY_CURRENT_USER\rRC\shell

HKEY_CURRENT_USER\rRC\shell\
open

HKEY_CURRENT_USER\rRC\shell\
open\command

HKEY_CURRENT_USER\rRC\shell\
runas

HKEY_CURRENT_USER\rRC\shell\
runas\command

HKEY_CURRENT_USER\T7I

HKEY_CURRENT_USER\T7I\DefaultIcon

HKEY_CURRENT_USER\T7I\shell

HKEY_CURRENT_USER\T7I\shell\
open

HKEY_CURRENT_USER\T7I\shell\
open\command

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = 4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

HKEY_CURRENT_USER\.exe
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\.exe\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\.exe\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6m7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6m7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6m7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Software\Microsoft\
Windows
Local = b7b7c935

HKEY_CURRENT_USER\i0x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\i0x\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\i0x\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oE\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\744
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\744\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\744\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\58
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\58\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\58\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JI2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JI2\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JI2\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y7Q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y7Q\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y7Q\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Ao
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0Ao\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Ao\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\vUX
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\vUX\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\vUX\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GV0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GV0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GV0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hV
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hV\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hV\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Jsp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Jsp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Jsp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\D12
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\D12\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\D12\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7O
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7O\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7O\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Ed
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Ed\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Ed\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y2t\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2t\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0h6\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h6\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wKI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wKI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wKI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5fY
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5fY\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5fY\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\23
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\23\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\23\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\o6a
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\o6a\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\o6a\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f1U
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\f1U\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f1U\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\L50
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\L50\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\L50\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\K5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GW\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GW\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7r
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7r\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7r\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pP1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pP1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pP1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Sg1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Sg1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Sg1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JIG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\JIG\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\JIG\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sB\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sB\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GG\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GG\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B6Y
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\B6Y\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B6Y\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\854
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\854\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\854\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\R27
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\R27\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\R27\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1f\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1f\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bo\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bo\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\53
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\53\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\53\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3R
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3R\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3R\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4vI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4vI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4vI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bW5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bW5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bW5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\28
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\28\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\28\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\66
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\66\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\66\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oE3\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oE3\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\lG
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\lG\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\lG\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Fv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Fv\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Fv\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7Yo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7Yo\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7Yo\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hC
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hC\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hC\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Qn
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Qn\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Qn\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\X0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\X0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\X0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0YK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0YK\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0YK\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5UU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\5UU\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\5UU\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\73O
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\73O\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\73O\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YcT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YcT\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YcT\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\17
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\17\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\17\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y8o
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y8o\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y8o\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Fb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2Fb\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2Fb\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pb\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pb\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4u5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\r8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\r8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\r8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a0p
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\a0p\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a0p\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ocj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Ocj\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ocj\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SNu
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SNu\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SNu\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NoB
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\NoB\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NoB\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8T4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8T4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8T4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCq
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mCq\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCq\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Uv
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Uv\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Uv\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sc\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sc\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\REO
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\REO\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\REO\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y1N
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y1N\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y1N\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ht
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ht\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ht\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\j8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\j8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\j8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6a0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6a0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6a0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SPA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SPA\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SPA\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NB2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\NB2\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\NB2\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ikg
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Ikg\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Ikg\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6T
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6T\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6T\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Peo
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Peo\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Peo\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\tpV
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\tpV\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\tpV\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\jXA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\jXA\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\jXA\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0DU
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0DU\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0DU\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mCp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mCp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Y8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Y8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yv4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yv4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yv4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yu1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yu1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yu1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2P
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2P\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2P\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\w4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tw8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tw8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tw8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iu5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\iu5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iu5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GNj
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GNj\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GNj\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\oJ\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\oJ\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\GI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\GI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Od
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Od\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Od\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F5w\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5w\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\P3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\P3\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\P3\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Fs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0Fs\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0Fs\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K3
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\K3\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\K3\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Vs
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Vs\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Vs\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\24N
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\24N\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\24N\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\V1q
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\V1q\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\V1q\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\KLf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\KLf\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\KLf\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\HN
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\HN\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\HN\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\mp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\mp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ax
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ax\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ax\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\u14
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\u14\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\u14\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tp
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Tp\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Tp\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2HW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2HW\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2HW\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8rI
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8rI\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8rI\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8c
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8c\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8c\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Pr\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Pr\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\152
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\152\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\152\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\26J
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\26J\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\26J\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2f
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\y2f\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\y2f\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\832
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\832\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\832\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\15x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\15x\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\15x\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5N
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\B5N\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5N\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\AJ
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\AJ\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\AJ\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Dh7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Dh7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Dh7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4u\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4u\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\55
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\55\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\55\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\XeR
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\XeR\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\XeR\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7SN
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7SN\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7SN\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bf
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\bf\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\bf\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2wc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2wc\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2wc\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3E
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3E\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3E\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\rRC
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\rRC\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\rRC\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\T7I
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\T7I\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\T7I\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a6X
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\a6X\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a6X\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\4t\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\4t\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\QR
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\QR\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\QR\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\I7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\I7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\I7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\G05
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\G05\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\G05\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2x
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\2x\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\2x\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1I
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1I\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1I\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\qK
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\qK\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\qK\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hL
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\hL\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\hL\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xS
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xS\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xS\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ef
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\ef\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\ef\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6Ft
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6Ft\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6Ft\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xb
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\xb\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\xb\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6R4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6R4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6R4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\65
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\65\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\65\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7m0
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7m0\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7m0\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\B5\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\B5\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\cR7
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\cR7\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\cR7\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sW
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\sW\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\sW\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\34t
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\34t\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\34t\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\56J
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\56J\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\56J\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\uE
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\uE\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\uE\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a42
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\a42\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\a42\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8B8
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\8B8\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\8B8\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w2s
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\w2s\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w2s\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wCc
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\wCc\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\wCc\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w48
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\w48\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\w48\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F1
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\F1\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\F1\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\laD
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\laD\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\laD\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\41
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\41\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\41\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7HF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\7HF\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\7HF\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\67b
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\67b\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\67b\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\0h\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\0h\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yr
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\yr\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\yr\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f4
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\f4\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\f4\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SA
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\SA\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\SA\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\v6
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\v6\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\v6\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iXH
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\iXH\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\iXH\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6w
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\6w\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\6w\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YT
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\YT\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\YT\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\C2
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\C2\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\C2\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pVk
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\pVk\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\pVk\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h2d
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\h2d\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\h2d\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3PF
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\3PF\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\3PF\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Myl
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Myl\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Myl\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1B
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\1B\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\1B\shell\
runas\command
IsolatedCommand = ""%1" %*"

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Policies = "%User Profile%\Application Data\csrss.exe"

Dropping Routine

This Trojan drops the following files:

• %Application Data%\sew.exe
• %User Profile%\Protect\kpqpxx.ra
• %User Profile%\Protect\s32.txt
• %User Profile%\Protect\nykfun.pk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}or2011.ru/aaa/index.php?{random characters}

This report is generated via an automated analysis system.