Win32.Sality.3_ca38c3135e – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:768

The Trojan injects its code into the following process(es):

MusaLLaT.exe:352
Explorer.EXE:1684

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:768 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\MusaLLaT.exe (305 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF6AE9.tmp (0 bytes)

The process MusaLLaT.exe:352 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Declare.ini (11 bytes)
%System%\drivers\etc\hosts (4160 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:768 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a2_348" = "2494852699"
"a2_349" = "2502031882"
"a2_346" = "2480518604"
"a2_347" = "2487685419"
"a2_344" = "2466184600"
"a2_345" = "2473353060"
"a2_342" = "2451834290"
"a2_343" = "2459002859"
"a2_340" = "2437498767"
"a2_341" = "2444668252"
"a2_180" = "1290440101"
"a2_181" = "1297604285"
"a2_182" = "1304773581"
"a2_183" = "1311955764"
"a2_184" = "1319123521"
"a2_185" = "1326290894"
"a2_186" = "1333447600"
"a2_187" = "1340623978"
"a2_188" = "1347791185"
"a2_189" = "1354958777"
"a4_444" = "3183089724"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "1758189933"
"a1_434" = "2119904716"
"a1_433" = "1866007914"
"a1_432" = "3013111051"
"a1_431" = "518465261"
"a1_430" = "2206191952"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "4060141475"
"a1_184" = "1387808206"
"a1_183" = "3610698985"
"a1_182" = "2386229283"
"a1_181" = "2964149340"
"a1_180" = "3685867919"

"a4_393" = "2817464553"
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a2_405" = "2903494898"
"a2_404" = "2896327857"
"a2_407" = "2917839656"
"a2_406" = "2910662103"
"a2_401" = "2874811761"
"a2_400" = "2867645364"
"a2_403" = "2889162129"
"a2_402" = "2881979800"
"a2_409" = "2932162954"
"a2_408" = "2924995063"
"a1_222" = "253026899"
"a1_223" = "2927435685"
"a1_220" = "377690902"
"a1_221" = "1216145632"
"a1_226" = "796782334"
"a1_227" = "713761393"
"a1_224" = "1836670393"
"a1_225" = "1660633132"
"a1_228" = "1947306015"
"a1_229" = "3618478984"
"a2_351" = "2516367672"
"a2_350" = "2509185949"
"a2_353" = "2530691820"
"a2_352" = "2523534143"
"a2_355" = "2545034502"
"a2_354" = "2537869694"
"a2_357" = "2559367972"
"a2_356" = "2552204360"
"a2_359" = "2573720336"
"a2_358" = "2566538630"
"a2_193" = "1383641446"
"a2_192" = "1376473915"
"a2_191" = "1369305754"
"a2_190" = "1362124151"
"a2_197" = "1412308360"
"a2_196" = "1405142778"
"a2_195" = "1397975081"
"a2_194" = "1390807407"
"a2_199" = "1426663404"
"a2_198" = "1419477735"
"a1_89" = "2718712167"
"a1_88" = "2367670789"
"a1_85" = "4020466315"
"a1_84" = "2238027119"
"a1_87" = "1952151457"
"a1_86" = "1509737435"
"a1_81" = "486102907"
"a1_80" = "799602218"
"a1_83" = "2376988719"
"a1_82" = "4074937983"
"a1_67" = "3185874346"
"a1_66" = "861894588"
"a1_65" = "3814909435"
"a3_133" = "970345548"
"a1_63" = "3960326834"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "2564610288"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a1_438" = "3871095594"
"a1_69" = "2450613882"
"a1_68" = "266177918"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "2383600120"
"a1_409" = "3403424928"
"a1_402" = "1673329254"
"a1_403" = "4192930819"
"a1_400" = "2100799659"
"a1_401" = "3608484923"
"a1_406" = "3517041386"
"a1_407" = "1143275398"
"a1_404" = "2652453963"
"a1_405" = "1066662094"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_142" = "1034864615"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a3_448" = "3194799081"
"a3_449" = "3202245640"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a3_444" = "3166269973"
"a3_445" = "3206813364"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "4286733886"
"a1_158" = "842460133"
"a1_159" = "4155404902"
"a1_150" = "2458779556"
"a1_151" = "2366952800"
"a1_152" = "4073452363"
"a1_153" = "2088361647"
"a1_154" = "437256724"
"a1_155" = "752224971"
"a1_156" = "3788927654"
"a1_157" = "3083923769"
"a1_235" = "2862307933"
"a1_234" = "1922556659"
"a1_237" = "1834003072"
"a1_236" = "1838925875"
"a1_231" = "1436373696"
"a1_230" = "2489937995"
"a1_233" = "814895092"
"a1_232" = "1627709105"
"a1_239" = "2243565301"
"a1_238" = "3357225824"
"a2_210" = "1505511839"
"a2_211" = "1512678879"
"a2_212" = "1519861246"
"a2_213" = "1527029462"
"a2_214" = "1534194115"
"a2_215" = "1541369434"
"a2_216" = "1548529621"
"a2_217" = "1555695637"
"a2_218" = "1562863493"
"a2_219" = "1570031587"
"a2_324" = "2322802934"
"a2_325" = "2329967063"
"a2_326" = "2337129637"
"a2_327" = "2344293479"
"a2_320" = "2294110423"
"a2_321" = "2301281409"
"a2_322" = "2308463698"
"a2_323" = "2315630702"
"a2_328" = "2351464983"
"a2_329" = "2358648976"
"a1_98" = "4224973034"
"a1_99" = "3442358241"
"a1_92" = "853549666"
"a1_93" = "2793423457"
"a1_90" = "2891949943"
"a1_91" = "851792431"
"a1_96" = "3558786350"
"a1_97" = "1039465224"
"a1_94" = "1113920800"
"a1_95" = "3244275879"
"a1_74" = "3854388294"
"a1_75" = "1957515058"
"a1_76" = "2966861697"
"a1_77" = "2512073872"
"a1_70" = "1004369592"
"a1_71" = "770703806"
"a1_72" = "2477017109"
"a1_73" = "194410109"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "4215415200"
"a1_79" = "3382341814"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "1364811454"
"a1_418" = "741392344"
"a1_415" = "964100420"
"a1_414" = "888543840"
"a1_417" = "3502474091"
"a1_416" = "485837683"
"a1_411" = "2322756967"
"a1_410" = "1065235974"
"a1_413" = "1006773172"
"a1_412" = "977001167"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a2_360" = "2580885935"
"a2_361" = "2588054876"
"a2_362" = "2595218069"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a2_364" = "2609554024"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a2_365" = "2616722114"
"a2_366" = "2623903033"
"a2_367" = "2631070404"
"a2_168" = "1204406869"
"a2_169" = "1211585246"
"a4_480" = "3441178080"
"a2_160" = "1147053519"
"a2_161" = "1154235538"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a2_455" = "3261953713"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a2_459" = "3290620988"

"a1_149" = "3521857324"
"a1_148" = "3800593218"
"a1_143" = "1828666498"
"a1_142" = "243035520"
"a1_141" = "3270323118"
"a1_140" = "2145296600"
"a1_147" = "2684040650"
"a1_146" = "4188360982"
"a1_145" = "3161845165"
"a1_144" = "1951832285"
"a2_203" = "1455328739"
"a2_202" = "1448160528"
"a2_201" = "1440991936"
"a2_200" = "1433826788"
"a2_207" = "1483999344"
"a2_206" = "1476844925"
"a2_205" = "1469675738"
"a2_204" = "1462493414"
"a2_209" = "1498344377"
"a2_208" = "1491178285"
"a2_337" = "2415985392"
"a2_336" = "2408818791"
"a2_335" = "2401649655"
"a2_334" = "2394477919"
"a2_333" = "2387328364"
"a2_332" = "2380140539"
"a2_331" = "2372984786"
"a2_330" = "2365815933"
"a3_242" = "1718323611"
"a2_339" = "2430334092"
"a2_338" = "2423165194"
"a3_243" = "1725243962"
"a1_398" = "3233168905"
"a1_399" = "51874790"
"a1_392" = "2683714769"
"a1_393" = "1839934755"
"a1_390" = "326369813"
"a1_391" = "3161509716"
"a1_396" = "1809989084"
"a1_397" = "1095477782"
"a1_394" = "3684377328"
"a1_395" = "2357538581"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "4030135855"
"a1_48" = "777817081"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "2767027155"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a1_191" = "2251331075"
"a2_17" = "121866329"
"a2_16" = "114712107"
"a2_15" = "107542824"
"a2_14" = "100361915"
"a2_13" = "93192322"
"a2_12" = "86021249"
"a2_11" = "78858824"
"a2_10" = "71682321"
"a2_19" = "136211050"
"a2_18" = "129045155"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a3_127" = "927442486"
"a1_189" = "1663365867"
"a1_188" = "607174763"
"a1_187" = "377691529"
"a1_186" = "980125463"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_178" = "2516510888"
"a1_179" = "3987430427"
"a1_176" = "2805971880"
"a1_177" = "2043679915"
"a1_174" = "4011215794"
"a1_175" = "3462993153"
"a1_172" = "29730421"
"a1_173" = "194517282"
"a1_170" = "2488389433"
"a1_171" = "2015976340"
"a2_236" = "1691921272"
"a2_237" = "1699085040"
"a2_234" = "1677580229"
"a2_235" = "1684750292"
"a2_232" = "1663233840"
"a2_233" = "1670399648"
"a2_230" = "1648889729"
"a2_231" = "1656064928"
"a2_238" = "1706247489"
"a2_239" = "1713411680"
"a2_308" = "2208097923"
"a2_309" = "2215262086"
"a2_302" = "2165077245"
"a2_303" = "2172244942"
"a2_300" = "2150728847"
"a2_301" = "2157910190"
"a2_306" = "2193745815"
"a2_307" = "2200925748"
"a2_304" = "2179409074"
"a2_305" = "2186589372"
"a1_389" = "3879995567"
"a1_388" = "2682067812"
"a1_385" = "665948084"
"a1_384" = "716050454"
"a1_387" = "3660281629"
"a1_386" = "641127728"
"a1_381" = "3689548334"
"a1_380" = "1159322766"
"a1_383" = "1486620363"
"a1_382" = "3354997634"
"a1_58" = "1526832035"
"a1_59" = "2580041748"
"a1_56" = "4154082690"
"a1_57" = "2486413349"
"a1_54" = "1156379939"
"a1_55" = "554271340"
"a1_52" = "2816749827"
"a1_53" = "3769153193"
"a1_50" = "3149509727"
"a1_51" = "2364162845"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a2_62" = "444493305"
"a2_63" = "451652959"
"a2_60" = "430151857"
"a2_61" = "437318040"
"a2_66" = "473153891"
"a2_67" = "480337786"
"a2_64" = "458817847"
"a2_65" = "465988378"
"a1_41" = "3552671967"
"a1_40" = "86570130"
"a1_43" = "2575593877"
"a1_42" = "1730800823"
"a1_45" = "2781014468"
"a1_44" = "4079712745"
"a1_47" = "911138193"
"a1_46" = "2707039799"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a1_161" = "3334511964"
"a1_160" = "2198339837"
"a1_163" = "2904527246"
"a1_162" = "3732289658"
"a1_165" = "768575565"
"a1_164" = "3204416154"
"a1_167" = "2223672059"
"a1_166" = "887406938"
"a1_169" = "3575457095"
"a1_168" = "402372998"
"a4_447" = "3204597087"
"a2_319" = "2286947272"
"a2_318" = "2279779153"
"a2_315" = "2258278952"
"a2_314" = "2251097180"
"a2_317" = "2272613892"
"a2_316" = "2265448100"
"a2_311" = "2229588298"
"a2_310" = "2222429420"
"a2_313" = "2243926674"
"a2_312" = "2236760428"
"a2_229" = "1641731272"
"a2_228" = "1634564181"
"a2_221" = "1584334358"
"a2_220" = "1577212551"
"a2_223" = "1598713702"
"a2_222" = "1591547125"
"a2_225" = "1613047654"
"a2_224" = "1605881249"
"a2_227" = "1627400137"
"a2_226" = "1620230070"
"a1_370" = "2224422788"
"a1_371" = "3734468084"
"a1_372" = "1331504066"
"a1_373" = "813988334"
"a1_374" = "1351520866"
"a1_375" = "4130488089"
"a1_376" = "3715761322"
"a1_377" = "2452521994"
"a1_378" = "2407449096"
"a1_379" = "1777600446"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "4001852865"
"a1_28" = "426872754"
"a1_23" = "3694064651"
"a1_22" = "3145598990"
"a1_21" = "2967981899"
"a1_20" = "59996712"
"a1_27" = "3916811649"
"a1_26" = "574964614"
"a1_25" = "3364413728"
"a1_24" = "297090112"
"a1_284" = "816608819"
"a1_285" = "149833897"
"a1_286" = "3423296515"
"a1_287" = "274948158"
"a1_280" = "1077786941"
"a1_281" = "2094425543"
"a1_282" = "3912766284"
"a1_283" = "3047976678"
"a3_31" = "205278614"
"a1_288" = "362406743"
"a1_289" = "1930359280"
"a3_32" = "212854281"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222245064"
"a2_30" = "215080977"
"a2_33" = "236572886"
"a2_32" = "229413220"
"a2_35" = "250913454"
"a2_34" = "243747299"
"a2_37" = "265262350"
"a2_36" = "258096638"
"a2_39" = "279600463"
"a2_38" = "272431913"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"

[HKCU\Software\Aas\695404737]
"7169121" = "380"

[HKCU\Software\Aas]
"a4_199" = "1426655079"
"a2_363" = "2602387561"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "518683461"
"a1_115" = "3691602894"
"a1_116" = "1025921965"
"a1_117" = "1274324026"
"a1_110" = "2492618721"
"a1_111" = "4045670514"
"a1_112" = "2557326498"
"a1_113" = "1294492552"
"a1_118" = "1766939640"
"a1_119" = "781017526"
"a2_258" = "1849636689"
"a2_259" = "1856810593"
"a2_254" = "1820950948"
"a2_255" = "1828117976"
"a2_256" = "1835288534"
"a2_257" = "1842472175"
"a2_250" = "1792322363"
"a2_251" = "1799451870"
"a2_252" = "1806621227"
"a2_253" = "1813784277"
"a1_363" = "4176218673"
"a1_362" = "3356002192"
"a1_361" = "3951058688"
"a1_360" = "4071710503"
"a1_367" = "3747539722"
"a1_366" = "1259198325"
"a1_365" = "912197850"
"a1_364" = "2954486329"
"a1_369" = "343446205"
"a1_368" = "4127474596"
"a1_38" = "3894718521"
"a1_39" = "1319136414"
"a1_30" = "3647214711"
"a1_31" = "1091336823"
"a1_32" = "4058514744"
"a1_33" = "1677323071"
"a1_34" = "1155484599"
"a1_35" = "3885701433"
"a1_36" = "1499863291"
"a1_37" = "2116131676"
"a1_297" = "2955865016"
"a1_296" = "1826984692"
"a1_295" = "4202095353"
"a1_294" = "3413785562"
"a1_293" = "123572011"
"a1_292" = "2580097531"
"a1_291" = "1682981638"
"a1_290" = "1222363999"
"a1_299" = "1779196657"
"a1_298" = "3497991764"
"a4_286" = "2050368606"
"a2_108" = "774273606"
"a2_109" = "781428268"
"a2_100" = "716910351"
"a2_101" = "724077996"
"a2_102" = "731244413"
"a2_103" = "738426321"
"a2_104" = "745594399"
"a2_105" = "752760050"
"a2_106" = "759935473"
"a2_107" = "767092911"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a2_28" = "200730291"
"a2_29" = "207899637"
"a2_26" = "186395687"
"a2_27" = "193563804"
"a2_24" = "172063825"
"a2_25" = "179230932"
"a2_22" = "157727669"
"a2_23" = "164893032"
"a2_20" = "143376991"
"a2_21" = "150542372"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a2_7" = "50176128"
"a2_6" = "43011073"
"a2_5" = "35836932"
"a2_4" = "28684804"
"a2_3" = "21508422"
"a2_2" = "14346552"
"a2_1" = "7174930"
"a2_0" = "6619"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64530219"
"a2_8" = "57358767"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 03 C9 70 18 4C 8E 97 67 4C 84 90 4E 1A 4A C4"

[HKCU\Software\Aas]
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0400687474703A2F2F7777772E6665756572776568722D616D656C6974682E64652F626F74746F6D2E67696600687474703A2F2F6A6C736861682E636F2E696E2F696D616765732F626F74746F6D2E67696600687474703A2F2F636173616A656E73656E2E636F6D2F696D616765732F626F74746F6D2E67696600687474703A2F2F36312E31392E3235352E362F696D6167652E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a1_107" = "1895564243"
"a1_106" = "1138741880"
"a1_105" = "2521882026"
"a1_104" = "3356464032"
"a1_103" = "4080705363"
"a1_102" = "2311024607"
"a1_101" = "2786914193"
"a1_100" = "1894526394"
"a3_134" = "943841519"
"a1_109" = "1303875860"
"a1_62" = "2308873132"
"a1_61" = "2553696215"
"a3_137" = "998890944"
"a2_481" = "3448341496"
"a2_480" = "3441169413"
"a3_145" = "1022800088"
"a3_144" = "1015749817"
"a3_147" = "1070844314"
"a3_146" = "1063277947"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a3_143" = "1008236550"
"a2_249" = "1785116062"
"a2_248" = "1777934037"
"a2_247" = "1770780790"
"a2_246" = "1763601677"
"a2_245" = "1756433649"
"a2_244" = "1749267991"
"a2_243" = "1742100127"
"a2_242" = "1734933067"
"a2_241" = "1727750677"
"a2_240" = "1720582429"
"a1_356" = "3721481276"
"a1_357" = "3441796863"
"a1_354" = "2235377044"
"a1_355" = "23096633"
"a1_352" = "3838604082"
"a1_353" = "2596802710"
"a1_350" = "2243479458"
"a1_351" = "2070380229"
"a1_358" = "1659427194"
"a1_359" = "3580730940"
"a2_119" = "853128504"
"a2_118" = "845959949"
"a2_113" = "810112481"
"a2_112" = "802933675"
"a2_111" = "795780610"
"a2_110" = "788608196"
"a2_117" = "838779780"
"a2_116" = "831614037"
"a2_115" = "824457012"
"a2_114" = "817278194"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422970036"
"a2_58" = "415804317"
"a2_53" = "379969302"
"a2_52" = "372800237"
"a2_51" = "365616254"
"a2_50" = "358449415"
"a2_57" = "408648150"
"a2_56" = "401469263"
"a2_55" = "394300130"
"a2_54" = "387133761"
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Aas]
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a3_451" = "3249847498"
"a3_450" = "3242793131"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a1_138" = "2788518661"
"a1_139" = "2783859735"
"a1_132" = "3096798156"
"a1_133" = "1984868115"
"a1_130" = "2957938189"
"a1_131" = "1998744589"
"a1_136" = "1958949830"
"a1_137" = "1375704362"
"a1_134" = "2065997983"
"a1_135" = "1850970225"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a2_470" = "3369488921"
"a2_471" = "3376657408"
"a2_472" = "3383823465"
"a2_473" = "3390992158"
"a2_474" = "3398157887"
"a2_475" = "3405323986"
"a2_476" = "3412493879"
"a2_477" = "3419680114"
"a2_478" = "3426841576"
"a2_479" = "3434007172"
"a1_349" = "955569140"
"a1_348" = "823195136"
"a1_341" = "2940442778"
"a1_340" = "3484384250"
"a1_343" = "1268855113"
"a1_342" = "137681351"
"a1_345" = "4137111237"
"a1_344" = "3304278561"
"a1_347" = "918245829"
"a1_346" = "2178691014"
"a2_272" = "1949991642"
"a2_273" = "1957178150"
"a2_270" = "1935657085"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978672446"
"a2_277" = "1985839786"
"a2_274" = "1964341785"
"a2_275" = "1971504049"
"a2_278" = "1993021518"
"a2_279" = "2000177206"
"a2_298" = "2136393402"
"a2_299" = "2143562364"
"a2_290" = "2079043349"
"a2_291" = "2086208754"
"a2_292" = "2093377769"
"a2_293" = "2100558208"
"a2_294" = "2107724225"
"a2_295" = "2114893360"
"a2_296" = "2122058362"
"a2_297" = "2129221309"
"a4_450" = "3226104450"
"a4_451" = "3233273571"
"a4_452" = "3240442692"
"a4_453" = "3247611813"
"a2_128" = "917644778"
"a2_129" = "924814335"
"a2_126" = "903311757"
"a2_127" = "910486600"
"a2_124" = "888964903"
"a2_125" = "896147700"
"a2_122" = "874629207"
"a2_123" = "881795132"
"a2_120" = "860298847"
"a2_121" = "867459942"
"a3_35" = "267899754"
"a4_456" = "3269119176"
"a4_457" = "3276288297"
"a1_12" = "717342161"
"a1_13" = "672133365"
"a1_10" = "3068639382"
"a1_11" = "1128983859"
"a1_16" = "538932286"
"a1_17" = "39813672"
"a1_14" = "59981061"
"a1_15" = "308908790"
"a1_18" = "1496941980"
"a1_19" = "236657231"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_48" = "344126103"
"a2_49" = "351283430"
"a2_40" = "286765432"
"a2_41" = "293931452"
"a2_42" = "301099337"
"a2_43" = "308265194"
"a2_44" = "315450464"
"a2_45" = "322613408"
"a2_46" = "329782199"
"a2_47" = "336950432"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a3_248" = "1761236945"
"a2_172" = "1233088506"
"a4_454" = "3254780934"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a1_129" = "2793015487"
"a1_128" = "1309114333"
"a1_125" = "817464033"
"a1_124" = "259201203"
"a1_127" = "1022251073"
"a1_126" = "2669130498"
"a1_121" = "1806638071"
"a1_120" = "2010608685"
"a1_123" = "2288475093"
"a1_122" = "3100613221"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
"a2_463" = "3319311948"
"a2_462" = "3312140197"
"a2_461" = "3304974183"
"a2_460" = "3297804151"
"a2_467" = "3347973481"
"a2_466" = "3340807133"
"a2_465" = "3333638611"
"a2_464" = "3326472427"
"a2_469" = "3362309632"
"a2_468" = "3355154908"
"a1_338" = "3395952850"
"a1_339" = "569480719"
"a1_334" = "3812366900"
"a1_335" = "1965326379"
"a1_336" = "578057198"
"a1_337" = "701258127"
"a1_330" = "607883196"
"a1_331" = "461849526"
"a1_332" = "4107683447"
"a1_333" = "4220114093"
"a3_30" = "231909751"
"a1_64" = "667801136"
"a2_265" = "1899821898"
"a2_264" = "1892654417"
"a2_267" = "1914147334"
"a2_266" = "1906988778"
"a2_261" = "1871136962"
"a2_260" = "1863963589"
"a2_263" = "1885473136"
"a2_262" = "1878303149"
"a2_269" = "1928487123"
"a2_268" = "1921319291"
"a2_289" = "2071873702"
"a2_288" = "2064708695"
"a2_283" = "2028855753"
"a2_282" = "2021689186"
"a2_281" = "2014525006"
"a2_280" = "2007357685"
"a2_287" = "2057546954"
"a2_286" = "2050372405"
"a2_285" = "2043193205"
"a2_284" = "2036024194"
"a4_446" = "3197427966"
"a1_240" = "958254302"
"a1_241" = "2750075410"
"a1_242" = "1268713200"
"a1_243" = "2312311133"
"a1_244" = "417278125"
"a1_245" = "3953045131"
"a1_246" = "4285059327"
"a1_247" = "3281594283"
"a1_248" = "2066418243"
"a1_249" = "2748498711"
"a4_445" = "3190258845"
"a2_131" = "939162958"
"a2_130" = "931977873"
"a2_133" = "953498380"
"a2_132" = "946330087"
"a2_135" = "967833824"
"a2_134" = "960663924"
"a2_137" = "982167092"
"a2_136" = "974998655"
"a2_139" = "996514588"
"a2_138" = "989333015"
"a2_79" = "566355816"
"a2_78" = "559188963"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "774740006"
"a1_469" = "2455898867"
"a1_460" = "2489116449"
"a1_461" = "2811408003"
"a1_462" = "2776618439"
"a1_463" = "2647068594"
"a1_464" = "504087182"
"a1_465" = "3367363972"
"a1_466" = "2268059083"
"a1_467" = "466929223"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a3_381" = "2748124788"
"a2_456" = "3269126402"
"a2_457" = "3276285961"
"a2_454" = "3254787245"
"a3_380" = "2741212629"
"a2_452" = "3240439245"
"a2_453" = "3247605521"
"a2_450" = "3226102429"
"a2_451" = "3233271368"
"a3_387" = "2757612682"
"a2_458" = "3283452641"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a3_384" = "2769681321"
"a1_329" = "298200722"
"a1_328" = "4115398429"
"a1_327" = "3370593625"
"a1_326" = "2694416956"
"a1_325" = "3474408074"
"a1_324" = "845176332"
"a1_323" = "3754466557"
"a1_322" = "2228340316"
"a1_321" = "2198833769"
"a1_320" = "4287252467"
"a1_436" = "1534507495"
"a1_253" = "1850180483"
"a1_252" = "151392200"
"a1_251" = "2246144170"
"a1_250" = "166217701"
"a1_257" = "2263990236"
"a1_256" = "1088201278"
"a1_255" = "2616189013"
"a1_254" = "3604670083"
"a1_259" = "4057620881"
"a1_258" = "3187809438"
"a2_144" = "1032351598"
"a2_145" = "1039515674"
"a2_146" = "1046685396"
"a2_147" = "1053865689"
"a2_140" = "1003682359"
"a2_141" = "1010850042"
"a2_142" = "1018018539"
"a2_143" = "1025182170"
"a2_68" = "487492005"
"a2_69" = "494670905"
"a2_148" = "1061032393"
"a2_149" = "1068202782"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "2601627953"
"a1_478" = "3134866192"
"a1_473" = "15082210"
"a1_472" = "1366707596"
"a1_471" = "2711386670"
"a1_470" = "200188768"
"a1_477" = "983407032"
"a1_476" = "1763715410"
"a1_475" = "1237688522"
"a1_474" = "2199387316"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_151" = "1082532502"
"a2_150" = "1075365279"
"a2_271" = "1942838527"
"a2_159" = "1139884992"
"a2_158" = "1132708834"
"a3_80" = "590099577"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "0"

[HKCU\Software\Aas]
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a4_359" = "2573714439"
"a4_358" = "2566545318"

[HKCU\Software\Aas\695404737]
"50183847" = "1155C9E751204964A650FC1268A48E994F2CE60D53461AA72DB149B328BCDF94E783C77A9C678A58834E4B25A16FCE4A7CD57D848A965718CFD383B8A80F71B59A5DF35CDB06B8258E5C4533D203F74CE61044C457FB0E659DE08B39A113F4B865793CBF25E938F884D0A2B1F6A4487B470EB4EB4490D12E92A9B96261BC4D47"

[HKCU\Software\Aas]
"a1_312" = "2326018645"
"a1_313" = "3963615988"
"a1_310" = "2263086371"
"a1_311" = "1783731040"
"a1_316" = "3712703786"
"a1_317" = "373399727"
"a1_314" = "1023733377"
"a1_315" = "3391010961"
"a1_318" = "1467153856"
"a1_319" = "33777272"
"a2_449" = "3218943244"
"a2_448" = "3211768011"
"a2_441" = "3161584916"
"a2_440" = "3154420879"
"a2_443" = "3175919252"
"a2_442" = "3168752044"
"a2_445" = "3190252746"
"a2_444" = "3183084247"
"a2_447" = "3204603629"
"a2_446" = "3197434313"
"a1_266" = "1500248177"
"a1_267" = "957833361"
"a1_264" = "4248025792"
"a1_265" = "2091618879"
"a1_262" = "3212735773"
"a1_263" = "907674268"
"a1_260" = "1647474396"
"a1_261" = "1734262949"
"a1_268" = "2407065413"
"a1_269" = "3541852810"
"a2_157" = "1125554374"
"a2_156" = "1118385484"
"a2_155" = "1111220106"
"a2_154" = "1104051435"
"a2_153" = "1096870064"
"a2_152" = "1089700231"
"a2_99" = "709741191"
"a2_98" = "702576111"
"a2_97" = "695410528"
"a2_96" = "688239391"
"a2_95" = "681057496"
"a2_94" = "673891843"
"a2_93" = "666724782"
"a2_92" = "659558155"
"a2_91" = "652392708"
"a2_90" = "645223388"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a3_404" = "2913010493"
"a3_405" = "2886510428"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "3300587130"
"a1_449" = "3184734097"
"a1_446" = "786271658"
"a3_408" = "2941554865"
"a1_444" = "2158310649"
"a1_445" = "821638959"
"a1_442" = "1620111008"
"a1_443" = "1979333649"
"a1_440" = "569033664"
"a3_409" = "2949002448"

"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_476" = "3395669621"
"a1_447" = "2414722029"
"a1_441" = "3402711919"

[HKCU\Software\Aas\695404737]
"35845605" = "152"

[HKCU\Software\Aas]
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a4_168" = "1204412328"
"a1_194" = "3146095432"
"a1_195" = "3039956639"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a1_192" = "912828788"
"a1_193" = "2958609912"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a1_305" = "4226734639"
"a1_304" = "2213019789"
"a1_307" = "1799629723"
"a1_306" = "814581975"
"a1_301" = "1868299874"
"a1_300" = "108785042"
"a1_303" = "2503623028"
"a1_302" = "3215580122"
"a1_309" = "3305310055"
"a1_308" = "2517496335"
"a1_481" = "246665727"
"a2_438" = "3140069334"
"a2_439" = "3147249281"
"a2_434" = "3111399824"
"a2_435" = "3118565234"
"a2_436" = "3125732337"
"a2_437" = "3132903026"
"a2_430" = "3082716475"
"a2_431" = "3089884890"
"a2_432" = "3097064727"
"a2_433" = "3104231819"
"a1_279" = "1161252814"
"a1_278" = "1530362395"
"a1_271" = "3618202367"
"a1_270" = "873197591"
"a1_273" = "3592634159"
"a1_272" = "2170520494"
"a1_275" = "378265967"
"a1_274" = "476447740"
"a1_277" = "1482261218"
"a1_276" = "793170247"
"a2_382" = "2738610076"
"a2_383" = "2745774086"
"a2_380" = "2724260210"
"a2_381" = "2731440916"
"a2_386" = "2767288687"
"a2_387" = "2774443737"
"a2_384" = "2752939064"
"a2_385" = "2760109766"
"a2_388" = "2781623530"
"a2_389" = "2788792534"
"a2_368" = "2638237713"
"a2_369" = "2645396138"
"a2_88" = "630889521"
"a2_89" = "638058173"
"a2_84" = "602206860"
"a2_85" = "609372899"
"a2_86" = "616539452"
"a2_87" = "623708123"
"a2_80" = "573522345"
"a2_81" = "580705984"
"a2_82" = "587873123"
"a2_83" = "595038762"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161400489"
"a2_163" = "1168568651"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190082225"
"a2_167" = "1197236652"
"a2_164" = "1175738757"
"a2_165" = "1182902505"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "2657783129"
"a1_450" = "102784475"
"a1_453" = "2154148362"
"a1_452" = "390848633"
"a1_455" = "740389653"
"a1_454" = "1598729165"
"a1_457" = "4105726099"
"a1_456" = "881552378"
"a1_459" = "2660431697"
"a1_458" = "678997780"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a4_88" = "630882648"
"a4_89" = "638051769"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a4_387" = "2774449827"
"a2_75" = "537686076"
"a2_74" = "530522024"
"a2_77" = "552021932"
"a2_76" = "544855065"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509002202"
"a2_70" = "501830353"
"a2_73" = "523340483"
"a2_72" = "516168368"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a3_123" = "898388146"
"a3_122" = "891468819"
"a3_121" = "850861040"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_120" = "843343697"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "3841700533"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a1_437" = "500727595"
"a2_429" = "3075550730"
"a2_428" = "3068381452"
"a2_427" = "3061206800"
"a2_426" = "3054048833"
"a2_425" = "3046880086"
"a2_424" = "3039713367"
"a2_423" = "3032531739"
"a2_422" = "3025366417"
"a2_421" = "3018197507"
"a2_420" = "3011034581"
"a1_208" = "3169699469"
"a1_209" = "956061471"
"a1_204" = "3927012373"
"a1_205" = "3322949600"
"a1_206" = "1870960222"
"a1_207" = "82883632"
"a1_200" = "1468237468"
"a1_201" = "3911364223"
"a1_202" = "4251449850"
"a1_203" = "2072563890"
"a2_395" = "2831795297"
"a2_394" = "2824628861"
"a2_397" = "2846144022"
"a2_396" = "2838978528"
"a2_391" = "2803122656"
"a2_390" = "2795958924"
"a2_393" = "2817473630"
"a2_392" = "2810290434"
"a2_399" = "2860478157"
"a2_398" = "2853311650"
"a2_379" = "2717093580"
"a2_378" = "2709924197"
"a2_373" = "2674089548"
"a2_372" = "2666907699"
"a2_371" = "2659738380"
"a2_370" = "2652572029"
"a2_377" = "2702755990"
"a2_376" = "2695580594"
"a2_375" = "2688423480"
"a2_374" = "2681242923"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283273024"
"a2_178" = "1276106347"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254588428"
"a2_174" = "1247421403"
"a2_177" = "1268939349"
"a2_176" = "1261771355"
"a2_171" = "1225926888"
"a2_170" = "1218743111"
"a2_173" = "1240255262"
"a3_249" = "1801832560"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_424" = "3952650619"
"a1_425" = "385205961"
"a1_426" = "2859000398"
"a1_427" = "2566336630"
"a1_420" = "2939404639"
"a1_421" = "1668832827"
"a1_422" = "94201180"
"a1_423" = "3465016686"
"a3_199" = "1409969486"
"a1_428" = "2565392734"
"a1_429" = "572632311"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a1_439" = "1659469882"
"a1_198" = "1982691671"
"a1_199" = "1805417777"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "2022454557"
"a4_145" = "1039522545"
"a1_190" = "821229393"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_0" = "76186827"
"a1_1" = "590233436"
"a1_2" = "1889856892"
"a1_3" = "254429038"
"a1_4" = "1108605498"
"a1_5" = "2669952347"
"a1_6" = "3520657402"
"a1_7" = "2912786922"
"a1_8" = "4151122982"
"a1_9" = "1172910778"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953680354"
"a2_413" = "2960844792"
"a2_410" = "2939346390"
"a2_411" = "2946513516"
"a2_416" = "2982348028"
"a2_417" = "2989530327"
"a2_414" = "2968014653"
"a2_415" = "2975180532"
"a2_418" = "2996695351"
"a2_419" = "3003864654"
"a1_219" = "4208310"
"a1_218" = "1084945640"
"a1_217" = "1069113462"
"a1_216" = "1610211748"
"a1_215" = "378889895"
"a1_214" = "270893506"
"a1_213" = "3148370156"
"a1_212" = "1678035613"
"a1_211" = "3016234575"
"a1_210" = "1611394503"
"a4_443" = "3175920603"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The process MusaLLaT.exe:352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D B6 F7 9E 3E 55 46 C4 8C EF D4 79 3B F5 6C 11"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MusaLLaT" = "%Documents and Settings%\%current user%\Application Data\MusaLLaT.exe"

Dropped PE files

MD5	File path
e7051662438ecec74fac00385e599e8d	c:\kfeeko.pif

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 4722 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	threatsense.net
127.0.0.1	www.threatsense.net
127.0.0.1	www.zma.com.ar
127.0.0.1	zma.com.ar
127.0.0.1	store.ca.com
127.0.0.1	avira.com
127.0.0.1	www.antivir.com
127.0.0.1	antivir.com
127.0.0.1	www.antivir.com.tr
127.0.0.1	www.avg.com
127.0.0.1	avg.com
127.0.0.1	www.scanwith.com
127.0.0.1	scanwith.com
127.0.0.1	www.avast.gen.tr
127.0.0.1	avast.gen.tr
127.0.0.1	www.avast.com
127.0.0.1	avast.com
127.0.0.1	forum.avast.com
127.0.0.1	www.nod32.com
127.0.0.1	nod32.com
127.0.0.1	novirusthanks.org
127.0.0.1	novirusthanks.org
127.0.0.1	vscan.novirusthanks.org
127.0.0.1	virustotal-uploader.en.softonic.com
127.0.0.1	virscan.org
127.0.0.1	pandasecurity.com
127.0.0.1	www.arcabit.com
127.0.0.1	arcabit.com
127.0.0.1	www.arcabit.pl
127.0.0.1	arcabit.pl
127.0.0.1	www.freedrweb.com
127.0.0.1	freedrweb.com
127.0.0.1	www.drweb.com
127.0.0.1	drweb.com
127.0.0.1	www.drweb-online.com
127.0.0.1	drweb-online.com
127.0.0.1	www.eset.es
127.0.0.1	eset.es
127.0.0.1	www.nod32.com.tr
127.0.0.1	nod32.com.tr
127.0.0.1	nod32.gen.tr
127.0.0.1	www.nod32.gen.tr
127.0.0.1	www.eset.eu
127.0.0.1	eset.eu
127.0.0.1	89.202.157.226
127.0.0.1	www.eset.co.uk
127.0.0.1	eset.co.uk
127.0.0.1	93.184.71.27
127.0.0.1	188.240.47.45
127.0.0.1	www.avp.com
127.0.0.1	avp.com
127.0.0.1	www.nod32-es.com
127.0.0.1	nod32-es.com
127.0.0.1	www.eset.com
127.0.0.1	eset.com
127.0.0.1	www.nod32-a.com
127.0.0.1	nod32-a.com
127.0.0.1	89.202.157.135
127.0.0.1	89.202.157.136
127.0.0.1	89.202.157.137
127.0.0.1	89.202.157.138
127.0.0.1	89.202.157.139
127.0.0.1	www.kaspersky.com
127.0.0.1	www.kaspersky.com.mx
127.0.0.1	latam.kaspersky.com
127.0.0.1	usa.kaspersky.com
127.0.0.1	kaspersky.com
127.0.0.1	support.kaspersky.com
127.0.0.1	kaspersky-labs.com
127.0.0.1	my-etrust.com
127.0.0.1	www.my-etrust.com
127.0.0.1	www.bitdefender.es
127.0.0.1	bitdefender.es
127.0.0.1	www.bitdefender.com
127.0.0.1	bitdefender.com
127.0.0.1	secure.nai.com
127.0.0.1	nai.com
127.0.0.1	www.nai.com
127.0.0.1	vil.nai.com
127.0.0.1	pctools.com
127.0.0.1	www.pctools.com
127.0.0.1	update.symantec.com
127.0.0.1	updates.symantec.com
127.0.0.1	liveupdate.symantec.com
127.0.0.1	customer.symantec.com
127.0.0.1	symantec.com
127.0.0.1	www.symantec.com
127.0.0.1	security.symantec.com
127.0.0.1	shop.symantecstore.com
127.0.0.1	symantec.com
127.0.0.1	securityresponse.symantec.com
127.0.0.1	liveupdate.symantec.comliveupdate.com
127.0.0.1	service1.symantec.com
127.0.0.1	ftp.symantec.com
127.0.0.1	rads.mcafee.com
127.0.0.1	home.mcafee.com
127.0.0.1	es.mcafee.com
127.0.0.1	la.mcafee.com
127.0.0.1	us.mcafee.com
127.0.0.1	download.mcafee.com
127.0.0.1	dispatch.mcafee.com
127.0.0.1	mast.mcafee.com
127.0.0.1	www.mcafee.com
127.0.0.1	mcafee.com
127.0.0.1	dlpro.avira.com
127.0.0.1	dl1.pro.antivir.de
127.0.0.1	dl2.pro.antivir.de
127.0.0.1	dl3.pro.antivir.de
127.0.0.1	dl1.antivir.net
127.0.0.1	dl2.antivir.net
127.0.0.1	dl3.antivir.net
127.0.0.1	dl2.antivir-pe.com
127.0.0.1	freeav.net
127.0.0.1	avgate.net
127.0.0.1	trendmicro.com
127.0.0.1	www.trendmicro.com
127.0.0.1	housecall.trendmicro.com
127.0.0.1	es.trendmicro.com
127.0.0.1	la.trendmicro.com
127.0.0.1	www.trendsecure.com
127.0.0.1	trendsecure.com
127.0.0.1	pandasoftware.com
127.0.0.1	www.pandasoftware.com
127.0.0.1	www.pandasecurity.com
127.0.0.1	avg.com
127.0.0.1	guru.avg.com
127.0.0.1	free.avg.com
127.0.0.1	update.avg.com
127.0.0.1	free.grisoft.com
127.0.0.1	www.grisoft.com
127.0.0.1	grisoft.com
127.0.0.1	update.grisoft.cz
127.0.0.1	backup.grisoft.cz
127.0.0.1	akamai.grisoft.cz
127.0.0.1	clamav.net
127.0.0.1	www.clamav.net
127.0.0.1	w32.clamav.net
127.0.0.1	free-av.com
127.0.0.1	www.free-av.com
127.0.0.1	www.avast.com
127.0.0.1	avast.com
127.0.0.1	cert.org
127.0.0.1	www.cert.org
127.0.0.1	update.microsoft.com
127.0.0.1	windowsupdate.microsoft.com
127.0.0.1	www.microsoft.com
127.0.0.1	microsoft.com
127.0.0.1	www.networkassociates.com
127.0.0.1	networkassociates.com
127.0.0.1	www.ca.com
127.0.0.1	ca.com
127.0.0.1	sarc.com
127.0.0.1	www.sarc.com
127.0.0.1	www.sophos.com
127.0.0.1	sophos.com
127.0.0.1	www.viruslist.com
127.0.0.1	viruslist.com
127.0.0.1	f-secure.com
127.0.0.1	www.f-secure.com
127.0.0.1	f-prot.com
127.0.0.1	www.f-prot.com
127.0.0.1	www.virustotal.com
127.0.0.1	virustotal.com
127.0.0.1	scanner.virustotal.com
127.0.0.1	virusscan.jotti.org
127.0.0.1	jotti.org
127.0.0.1	novirusthanks.org
127.0.0.1	www.novirusthanks.org
127.0.0.1	scanner.novirusthanks.org

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:768
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\MusaLLaT.exe (305 bytes)
%Documents and Settings%\%current user%\Application Data\Declare.ini (11 bytes)
%System%\drivers\etc\hosts (4160 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MusaLLaT" = "%Documents and Settings%\%current user%\Application Data\MusaLLaT.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: z 3 r 0 _ x
Product Version: 8.01.0008
Legal Copyright:
Legal Trademarks:
Original Filename: setup.exe
Internal Name: setup.exe
File Version: 8.01.0008
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: z 3 r 0 _ xProduct Version: 8.01.0008Legal Copyright: Legal Trademarks: Original Filename: setup.exeInternal Name: setup.exeFile Version: 8.01.0008File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	434176	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	438272	53248	49664	5.52885	dd04638c67a154c7c9bb0fe5b88ac5d8
.rsrc	491520	151552	151552	4.67155	2d582fd3e2cabff4ea718f7b2cc31a90

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

MusaLLaT.exe_352:

`.rsrc

msnmsgr

3333333330

3333330

333333333333330

.LjR=W

.Jbjx=

^_^\^_\^[__^^_^^__^^^^___^__^\_\\_^^^^\^^_[__^^__^_^__^^\[^^_^_^^_^\_^_^^\^\^[^[[__^\^^^\-

4444444

333333333333333

444444444

33333333333333

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

shell32.dll

ShellExecuteA

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegCreateKeyA

VBA6.DLL

%System%\msvbvm60.dll\3

version.dll

.text

`.data

.rsrc

KERNEL32.DLL

MSVBVM60.DLL

SHELL32.DLL

MusaLLaT.exe

%Documents and Settings%\%current user%\Application Data\MusaLLaT.exe

!Y-a}0

Y.TG3

W .lsi

y-#%sL

P;!.loc

hXXp://VVV.feuerwehr-amelith.de/bottom.gif

hXXp://jlshah.co.in/images/bottom.gif

hXXp://casajensen.com/images/bottom.gif

hXXp://61.19.255.6/image.gif

nate.net.in/images/logo.gif

hXXp://rashihospital.com/logo.gif

hXXp://sadhanaindia.net/logo.gif

hXXp://tailiksahu.com/logo.gif

hXXp://VVV.radiocampoaberto.net/logo.gif

hXXp://industriasmeier.com/banner.gif

enerjielektrik.com/logo.gif

hXXp://samayer.net/logo.gif

.info/J

home.gifI888

KERNEL32.dll

h.rata

Bkrnl.exe?

= =$=(=,=

322%2`.50727)

.klkjw:9fqwi

FamXf39.sys

.pBTa8

%s:*:

Bg.laXV

&?%x=

GUrlA'

Web%w|nc

HTTP)

2GUARDCMD.

.ENHCDM

PL/KPCKwWEB

MM.PFW.

.bssf

J:CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

USER32.dll

WS2_32.dll

SHFileOperationA

D(EXE

F*\AJ:\z3r0_x Olucan Orjinal\Project1.vbp

\MusaLLaT.exe

E:\MusaLLaT.exe

zel Dosyalar.exe

Open=MusaLLaT.exe

Shell\Open\Command=MusaLLaT.exe

L:\MusaLLaT.exe

F:\MusaLLaT.exe

G:\MusaLLaT.exe

H:\MusaLLaT.exe

I:\MusaLLaT.exe

J:\MusaLLaT.exe

K:\MusaLLaT.exe

mmc.exe

127.0.0.1 thr

nse.net

127.0.0.1 VVV.t

se.net

127.0.0.1 VVV.zm

127.0.0.1 zm

om.ar

127.0.0.1 st

ore.ca.com

127.0.0.1 a

ira.com

127.0.0.1 VVV.an

ir.com

127.0.0.1 an

ir.com.tr

127.0.0.1 VVV.a

vg.com

127.0.0.1 VVV.sc

th.com

127.0.0.1 sc

anwith.com

st.gen.tr

127.0.0.1 ava

vast.com

127.0.0.1 for

127.0.0.1 VVV.nod

32.com

127.0.0.1 nod3

2.com

127.0.0.1 nov

hanks.org

anks.org

127.0.0.1 vs

can.no

127.0.0.1 vir

rweb.com

er.en.softonic.com

127.0.0.1 vi

an.org

127.0.0.1 pa

ity.com

127.0.0.1 VVV.arc

it.com

127.0.0.1 ar

127.0.0.1 VVV.ar

it.pl

127.0.0.1 VVV.fr

127.0.0.1 fre

eb.com

127.0.0.1 VVV.drw

127.0.0.1 drw

127.0.0.1 VVV.dr

web-on

line.com

127.0.0.1 dr

web-onl

ine.com

127.0.0.1 VVV.eset.es

127.0.0.1 eset.es

127.0.0.1 eset.co.uk

127.0.0.1 VVV.nod32.com.tr

127.0.0.1 nod32.com.tr

127.0.0.1 nod32.gen.tr

127.0.0.1 VVV.nod32.gen.tr

127.0.0.1 VVV.eset.eu

127.0.0.1 eset.eu

127.0.0.1 89.202.157.226

127.0.0.1 VVV.eset.co.uk

127.0.0.1 VVV.m

127.0.0.1 93.184.71.27

127.0.0.1 188.240.47.45

127.0.0.1 VVV.avp.com

127.0.0.1 avp.com

127.0.0.1 VVV.nod32-es.com

127.0.0.1 nod32-es.com

127.0.0.1 VVV.eset.com

127.0.0.1 eset.com

127.0.0.1 VVV.nod32-a.com

127.0.0.1 nod32-a.com

127.0.0.1 89.202.157.135

127.0.0.1 89.202.157.136

127.0.0.1 89.202.157.137

127.0.0.1 89.202.157.138

127.0.0.1 89.202.157.139

127.0.0.1 VVV.kaspersky.com

127.0.0.1 VVV.kaspersky.com.mx

127.0.0.1 latam.kaspersky.com

127.0.0.1 usa.kaspersky.com

127.0.0.1 kaspersky.com

127.0.0.1 support.kaspersky.com

127.0.0.1 kaspersky-labs.com

127.0.0.1 m

nks.org

127.0.0.1 VVV.bitdefender.es

127.0.0.1 bitdefender.es

127.0.0.1 VVV.bitdefender.com

127.0.0.1 bitdefender.com

127.0.0.1 s

127.0.0.1 n

127.0.0.1 VVV.n

127.0.0.1 vil.n

127.0.0.1 pctools.com

127.0.0.1 VVV.pctools.com

127.0.0.1 up

127.0.0.1 li

127.0.0.1 customer.sy

o.com

127.0.0.1 sy

127.0.0.1 VVV.sy

127.0.0.1 security.sy

127.0.0.1 shop.sy

127.0.0.1 sym

127.0.0.1 securityresponse.sym

127.0.0.1 liveupdate.sym

liveupdate.com

127.0.0.1 hou

127.0.0.1 service1.sym

127.0.0.1 PTF.sym

127.0.0.1 rad

127.0.0.1 hom

e.mca

fee.com

127.0.0.1 es.mca

127.0.0.1 la.mca

127.0.0.1 us.mca

127.0.0.1 download.mca

secall.trend

127.0.0.1 dispatch.mca

127.0.0.1 mast.mca

127.0.0.1 VVV.mca

127.0.0.1 mca

127.0.0.1 dlpro.avira.com

127.0.0.1 dl1.pro.antivir.de

127.0.0.1 dl2.pro.antivir.de

127.0.0.1 dl3.pro.antivir.de

127.0.0.1 VVV.tre

127.0.0.1 dl1.antivir.net

127.0.0.1 dl2.antivir.net

127.0.0.1 dl3.antivir.net

127.0.0.1 dl2.antivir-pe.com

127.0.0.1 fr

av.net

te.net

127.0.0.1 tren

ro.com

127.0.0.1 es.tr

icro.com

127.0.0.1 la.tre

127.0.0.1 VVV.tr

cure.com

127.0.0.1 tre

127.0.0.1 pandasoftware.com

127.0.0.1 VVV.pandasoftware.com

127.0.0.1 VVV.avast.com

127.0.0.1 VVV.pandasecurity.com

127.0.0.1 avg.com

127.0.0.1 guru.avg.com

127.0.0.1 free.avg.com

127.0.0.1 update.avg.com

127.0.0.1 free.grisoft.com

127.0.0.1 VVV.grisoft.com

127.0.0.1 grisoft.com

127.0.0.1 update.grisoft.cz

127.0.0.1 backup.grisoft.cz

127.0.0.1 akamai.grisoft.cz

127.0.0.1 clamav.net

127.0.0.1 VVV.clamav.net

127.0.0.1 w32.clamav.net

127.0.0.1 free-av.com

127.0.0.1 VVV.free-av.com

127.0.0.1 ce

rt.org

127.0.0.1 VVV.ce

date.micr

oft.com

127.0.0.1 win

date.mi

soft.com

127.0.0.1 VVV.mic

127.0.0.1 mi

ciates.com

127.0.0.1 n

127.0.0.1 VVV.c

a.com

127.0.0.1 c

127.0.0.1 sa

rc.com

127.0.0.1 VVV.sa

127.0.0.1 VVV.s

os.com

127.0.0.1 VVV.vir

st.com

ist.com

127.0.0.1 f-secu

re.com

127.0.0.1 VVV.f-se

127.0.0.1 f-pr

ot.com

127.0.0.1 VVV.f-pr

otal.com

127.0.0.1 scanner.vir

an.jo

tti.org

127.0.0.1 jotti.org

127.0.0.1 novi

127.0.0.1 VVV.novi

er.no

sthanks.org

%System%\drivers\etc\hosts

LLaT.exe

Wscript.Shell

D:\MusaLLaT.exe

\Declare.ini

\Desktop\*.*

SOFTWARE\Classes\.text

SOFTWARE\Classes\.txt\ShellNew

SOFTWARE\Classes\.txt\PersistentHandler

SOFTWARE\Classes\.txt

SOFTWARE\Classes\.vbp

SOFTWARE\Classes\.wax\PersistentHandler

SOFTWARE\Classes\.wax\OpenWithProgIds

SOFTWARE\Classes\.wax\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wax\OpenWithList

SOFTWARE\Classes\.wax

SOFTWARE\Classes\.wct

SOFTWARE\Classes\.wm

SOFTWARE\Classes\.wb2\QuattroPro.Notebook.6\ShellNew

SOFTWARE\Classes\.wb2\QuattroPro.Notebook.6

SOFTWARE\Classes\.wb2\QuattroPro.Graph.6\ShellNew

SOFTWARE\Classes\.wb2\QuattroPro.Graph.6

SOFTWARE\Classes\.wb2

SOFTWARE\Classes\.webpnp

SOFTWARE\Classes\.WHT

SOFTWARE\Classes\.wk4\123Worksheet\ShellNew

SOFTWARE\Classes\.wk4\123Worksheet

SOFTWARE\Classes\.wk4

SOFTWARE\Classes\.wll\PersistentHandler

SOFTWARE\Classes\.wll

SOFTWARE\Classes\.wlt\PersistentHandler

SOFTWARE\Classes\.wlt

SOFTWARE\Classes\.wm\PersistentHandler

SOFTWARE\Classes\.wm\OpenWithProgIds

SOFTWARE\Classes\.wm\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wm\OpenWithList

SOFTWARE\Classes\.wma\PersistentHandler

SOFTWARE\Classes\.wma\OpenWithProgIds

SOFTWARE\Classes\.wma\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wma\OpenWithList

SOFTWARE\Classes\.wma

SOFTWARE\Classes\.wmd\OpenWithProgIds

SOFTWARE\Classes\.wmd\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wmd\OpenWithList

SOFTWARE\Classes\.wmd

SOFTWARE\Classes\.wmdb

SOFTWARE\Classes\.wmf\PersistentHandler

SOFTWARE\Classes\.wmf\OpenWithProgids

SOFTWARE\Classes\.wmp\PersistentHandler

SOFTWARE\Classes\.wmp

SOFTWARE\Classes\.wms\OpenWithProgIds

SOFTWARE\Classes\.wms\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wms\OpenWithList

SOFTWARE\Classes\.wms

SOFTWARE\Classes\.wmx

SOFTWARE\Classes\.wmv\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.wmv\ShellEx

SOFTWARE\Classes\.wmv\PersistentHandler

SOFTWARE\Classes\.wmv\OpenWithProgIds

SOFTWARE\Classes\.wmv\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wmv\OpenWithList

SOFTWARE\Classes\.wmv

SOFTWARE\Classes\.wmx\PersistentHandler

SOFTWARE\Classes\.wmx\OpenWithProgIds

SOFTWARE\Classes\.wmx\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wmx\OpenWithList

SOFTWARE\Classes\.wmz\PersistentHandler

SOFTWARE\Classes\.wmz\OpenWithProgIds

SOFTWARE\Classes\.wmz\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wmz\OpenWithList

SOFTWARE\Classes\.wmz

SOFTWARE\Classes\.wpd\WPWin6.1File\ShellNew

SOFTWARE\Classes\.wpd\WPWin6.1File

SOFTWARE\Classes\.wpd

SOFTWARE\Classes\.wpg\WPDraw30.Drawing\ShellNew

SOFTWARE\Classes\.wpg\WPDraw30.Drawing

SOFTWARE\Classes\.wpg\WPDraw30.Chart\ShellNew

SOFTWARE\Classes\.wpg\WPDraw30.Chart

SOFTWARE\Classes\.wpg\TextArt.Document\ShellNew

SOFTWARE\Classes\.wpg\TextArt.Document

SOFTWARE\Classes\.wpg

SOFTWARE\Classes\.wpl\OpenWithProgIds

SOFTWARE\Classes\.wpl\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wpl\OpenWithList

SOFTWARE\Classes\.wpl

SOFTWARE\Classes\.wri\OpenWithList\WordPad.exe

SOFTWARE\Classes\.wri\OpenWithList

SOFTWARE\Classes\.wri

SOFTWARE\Classes\.wsc

SOFTWARE\Classes\.WSF

SOFTWARE\Classes\.WSH

SOFTWARE\Classes\.xhtml

SOFTWARE\Classes\.wsz\PersistentHandler

SOFTWARE\Classes\.wsz

SOFTWARE\Classes\.wtx\PersistentHandler

SOFTWARE\Classes\.wtx

SOFTWARE\Classes\.wvx\PersistentHandler

SOFTWARE\Classes\.wvx\OpenWithProgIds

SOFTWARE\Classes\.xht

SOFTWARE\Classes\.wvx\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wvx\OpenWithList

SOFTWARE\Classes\.wvx

SOFTWARE\Classes\.xbm\PersistentHandler

SOFTWARE\Classes\.xbm

SOFTWARE\Classes\.xfm

SOFTWARE\Classes\.xix\PersistentHandler

SOFTWARE\Classes\.xix

SOFTWARE\Classes\.xlb\PersistentHandler

SOFTWARE\Classes\.xlb

SOFTWARE\Classes\.xlc\PersistentHandler

SOFTWARE\Classes\.xlc

SOFTWARE\Classes\.xls\PersistentHandler

SOFTWARE\Classes\.xls\ExcelWorksheet\ShellNew

SOFTWARE\Classes\.xls\ExcelWorksheet

SOFTWARE\Classes\.xls\Excel.Sheet.5\ShellNew

SOFTWARE\Classes\.xls\Excel.Sheet.5

SOFTWARE\Classes\.xls

SOFTWARE\Classes\.xlt\PersistentHandler

SOFTWARE\Classes\.xlt

SOFTWARE\Classes\.xml\PersistentHandler

SOFTWARE\Classes\.xml

SOFTWARE\Classes\.xsl\PersistentHandler

SOFTWARE\Classes\.xsl

SOFTWARE\Classes\.xxe

SOFTWARE\Classes\.zap

SOFTWARE\Classes\.ZFSendToTarget\PersistentHandler

SOFTWARE\Classes\.ZFSendToTarget

SOFTWARE\Classes\.zip\ShellNew

SOFTWARE\Classes\.zip\PersistentHandler

SOFTWARE\Classes\.zip\OpenWithProgids

SOFTWARE\Classes\.zip\CompressedFolder\ShellNew

SOFTWARE\Classes\.zip\CompressedFolder

SOFTWARE\Classes\.zip

SOFTWARE\Classes\.aac

SOFTWARE\Classes\.ac3

SOFTWARE\Classes\.aca

SOFTWARE\Classes\.ace

SOFTWARE\Classes\.acf

SOFTWARE\Classes\.acs

SOFTWARE\Classes\.acw

SOFTWARE\Classes\.ai

SOFTWARE\Classes\.aic\OpenWithList

SOFTWARE\Classes\.aif\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.aif\OpenWithList

SOFTWARE\Classes\.aif\OpenWithProgIds

SOFTWARE\Classes\.aif\PersistentHandler

SOFTWARE\Classes\.aif

SOFTWARE\Classes\.aic\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.aic\OpenWithProgIds

SOFTWARE\Classes\.aic\PersistentHandler

SOFTWARE\Classes\.aic

SOFTWARE\Classes\.amr

SOFTWARE\Classes\.aiff\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.aiff\OpenWithList

SOFTWARE\Classes\.aiff\OpenWithProgIds

SOFTWARE\Classes\.aiff\PersistentHandler

SOFTWARE\Classes\.aiff

SOFTWARE\Classes\.ani

SOFTWARE\Classes\.ape

SOFTWARE\Classes\.aps\PersistentHandler

SOFTWARE\Classes\.aps

SOFTWARE\Classes\.arj

SOFTWARE\Classes\.asa

SOFTWARE\Classes\.ascx\PersistentHandler

SOFTWARE\Classes\.ascx

SOFTWARE\Classes\.asf\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.asf\OpenWithList

SOFTWARE\Classes\.asm

SOFTWARE\Classes\.asf\OpenWithProgIds

SOFTWARE\Classes\.asf\PersistentHandler

SOFTWARE\Classes\.asf\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.asf\ShellEx

SOFTWARE\Classes\.asm\PersistentHandler

SOFTWARE\Classes\.asmx

SOFTWARE\Classes\.asp\PersistentHandler

SOFTWARE\Classes\.asp

SOFTWARE\Classes\.aspx\PersistentHandler

SOFTWARE\Classes\.aspx

SOFTWARE\Classes\.asx\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.asx

SOFTWARE\Classes\.asx\OpenWithList

SOFTWARE\Classes\.asx\OpenWithProgIds

SOFTWARE\Classes\.asx\PersistentHandler

SOFTWARE\Classes\.asx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.asx\ShellEx

SOFTWARE\Classes\.au\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.au\OpenWithList

SOFTWARE\Classes\.au\OpenWithProgIds

SOFTWARE\Classes\.au\PersistentHandler

SOFTWARE\Classes\.au

SOFTWARE\Classes\.AudioCD\PersistentHandler

SOFTWARE\Classes\.AudioCD

SOFTWARE\Classes\.avi\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.avi\OpenWithList

SOFTWARE\Classes\.avi\OpenWithProgIds

SOFTWARE\Classes\.avi\PersistentHandler

SOFTWARE\Classes\.bfc\ShellNew\Config

SOFTWARE\Classes\.avi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.avi\ShellEx

SOFTWARE\Classes\.avi

SOFTWARE\Classes\.awb

SOFTWARE\Classes\.bas

SOFTWARE\Classes\.bat\PersistentHandler

SOFTWARE\Classes\.bat

SOFTWARE\Classes\.bfc\ShellNew

SOFTWARE\Classes\.bfc

SOFTWARE\Classes\.bin\PersistentHandler

SOFTWARE\Classes\.bin

SOFTWARE\Classes\.bkf\PersistentHandler

SOFTWARE\Classes\.bkf

SOFTWARE\Classes\.blg

SOFTWARE\Classes\.bpg

SOFTWARE\Classes\.bmp\OpenWithList\MSPaint.exe

SOFTWARE\Classes\.bmp\OpenWithList

SOFTWARE\Classes\.bmp\OpenWithProgids

SOFTWARE\Classes\.bmp\PersistentHandler

SOFTWARE\Classes\.bmp\ShellNew

SOFTWARE\Classes\.bmp

SOFTWARE\Classes\.bsc\PersistentHandler

SOFTWARE\Classes\.bsc

SOFTWARE\Classes\.bz

SOFTWARE\Classes\.bz2

SOFTWARE\Classes\.cab\PersistentHandler

SOFTWARE\Classes\.cab

SOFTWARE\Classes\.cat

SOFTWARE\Classes\.cda\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.cda\OpenWithList

SOFTWARE\Classes\.cda\OpenWithProgIds

SOFTWARE\Classes\.cda\PersistentHandler

SOFTWARE\Classes\.cda

SOFTWARE\Classes\.cdf

SOFTWARE\Classes\.cdx

SOFTWARE\Classes\.cer

SOFTWARE\Classes\.cgm\PersistentHandler

SOFTWARE\Classes\.cgm

SOFTWARE\Classes\.chk

SOFTWARE\Classes\.chm

SOFTWARE\Classes\.cin

SOFTWARE\Classes\.clp

SOFTWARE\Classes\.cls

SOFTWARE\Classes\.cmd\PersistentHandler

SOFTWARE\Classes\.cmd

SOFTWARE\Classes\.cnf

SOFTWARE\Classes\.com\PersistentHandler

SOFTWARE\Classes\.com

SOFTWARE\Classes\.cpl\PersistentHandler

SOFTWARE\Classes\.cpl

SOFTWARE\Classes\.cpp\PersistentHandler

SOFTWARE\Classes\.cpp

SOFTWARE\Classes\.crl

SOFTWARE\Classes\.crt

SOFTWARE\Classes\.css\PersistentHandler

SOFTWARE\Classes\.css

SOFTWARE\Classes\.csv

SOFTWARE\Classes\.CTT

SOFTWARE\Classes\.ctx

SOFTWARE\Classes\.cur\PersistentHandler

SOFTWARE\Classes\.cur

SOFTWARE\Classes\.cxx\PersistentHandler

SOFTWARE\Classes\.cxx

SOFTWARE\Classes\.dat

SOFTWARE\Classes\.db

SOFTWARE\Classes\.dbg\PersistentHandler

SOFTWARE\Classes\.dbg

SOFTWARE\Classes\.dct\PersistentHandler

SOFTWARE\Classes\.dct

SOFTWARE\Classes\.def\PersistentHandler

SOFTWARE\Classes\.def

SOFTWARE\Classes\.der

SOFTWARE\Classes\.DeskLink\PersistentHandler

SOFTWARE\Classes\.DeskLink

SOFTWARE\Classes\.dfm

SOFTWARE\Classes\.dib\OpenWithProgids

SOFTWARE\Classes\.dib\PersistentHandler

SOFTWARE\Classes\.dib

SOFTWARE\Classes\.dob

SOFTWARE\Classes\.dic\PersistentHandler

SOFTWARE\Classes\.dic

SOFTWARE\Classes\.diz

SOFTWARE\Classes\.dl_\PersistentHandler

SOFTWARE\Classes\.dl_

SOFTWARE\Classes\.dll\PersistentHandler

SOFTWARE\Classes\.dll

SOFTWARE\Classes\.doc\OpenWithList\WordPad.exe

SOFTWARE\Classes\.doc\OpenWithList

SOFTWARE\Classes\.doc\PersistentHandler

SOFTWARE\Classes\.doc\ShellNew

SOFTWARE\Classes\.doc\Word.Document.6\ShellNew

SOFTWARE\Classes\.dos

SOFTWARE\Classes\.doc\Word.Document.6

SOFTWARE\Classes\.doc\WordDocument\ShellNew

SOFTWARE\Classes\.doc\WordDocument

SOFTWARE\Classes\.doc\WordPad.Document.1\ShellNew

SOFTWARE\Classes\.doc\WordPad.Document.1

SOFTWARE\Classes\.doc

SOFTWARE\Classes\.dot\PersistentHandler

SOFTWARE\Classes\.dot

SOFTWARE\Classes\.dox

SOFTWARE\Classes\.dpk

SOFTWARE\Classes\.dpr

SOFTWARE\Classes\.drv\PersistentHandler

SOFTWARE\Classes\.drv

SOFTWARE\Classes\.dsm

SOFTWARE\Classes\.dsn

SOFTWARE\Classes\.dsr

SOFTWARE\Classes\.dsx

SOFTWARE\Classes\.dun

SOFTWARE\Classes\.dv

SOFTWARE\Classes\.dvd\PersistentHandler

SOFTWARE\Classes\.dvd

SOFTWARE\Classes\.dvr-ms\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.dvr-ms\OpenWithList

SOFTWARE\Classes\.dvr-ms\OpenWithProgIds

SOFTWARE\Classes\.dvr-ms

SOFTWARE\Classes\.emf\OpenWithProgids

SOFTWARE\Classes\.emf\PersistentHandler

SOFTWARE\Classes\.emf

SOFTWARE\Classes\.eml

SOFTWARE\Classes\.eps\PersistentHandler

SOFTWARE\Classes\.eps

SOFTWARE\Classes\.ex_\PersistentHandler

SOFTWARE\Classes\.ex_

SOFTWARE\Classes\.exp\PersistentHandler

SOFTWARE\Classes\.exp

SOFTWARE\Classes\.eyb\PersistentHandler

SOFTWARE\Classes\.eyb

SOFTWARE\Classes\.fif

SOFTWARE\Classes\.flac

SOFTWARE\Classes\.flc

SOFTWARE\Classes\.fli

SOFTWARE\Classes\.flv

SOFTWARE\Classes\.fnd\PersistentHandler

SOFTWARE\Classes\.fnd

SOFTWARE\Classes\.frx

SOFTWARE\Classes\.fnt\PersistentHandler

SOFTWARE\Classes\.fnt

SOFTWARE\Classes\.Folder\PersistentHandler

SOFTWARE\Classes\.Folder

SOFTWARE\Classes\.fon\PersistentHandler

SOFTWARE\Classes\.fon

SOFTWARE\Classes\.frm

SOFTWARE\Classes\.ghi\PersistentHandler

SOFTWARE\Classes\.ghi

SOFTWARE\Classes\.gif\OpenWithProgids

SOFTWARE\Classes\.gif\PersistentHandler

SOFTWARE\Classes\.gif

SOFTWARE\Classes\.grp

SOFTWARE\Classes\.gz\PersistentHandler

SOFTWARE\Classes\.gz

SOFTWARE\Classes\.hhc\PersistentHandler

SOFTWARE\Classes\.hhc

SOFTWARE\Classes\.hlp

SOFTWARE\Classes\.hpp\PersistentHandler

SOFTWARE\Classes\.hpp

SOFTWARE\Classes\.hqx\PersistentHandler

SOFTWARE\Classes\.hqx

SOFTWARE\Classes\.ht

SOFTWARE\Classes\.hta

SOFTWARE\Classes\.htc

SOFTWARE\Classes\.htm\OpenWithList\notepad.exe

SOFTWARE\Classes\.idl

SOFTWARE\Classes\.htm\OpenWithList

SOFTWARE\Classes\.htm\PersistentHandler

SOFTWARE\Classes\.htm

SOFTWARE\Classes\.html\PersistentHandler

SOFTWARE\Classes\.html

SOFTWARE\Classes\.htt\PersistentHandler

SOFTWARE\Classes\.htt

SOFTWARE\Classes\.htw\PersistentHandler

SOFTWARE\Classes\.htw

SOFTWARE\Classes\.htx\PersistentHandler

SOFTWARE\Classes\.htx

SOFTWARE\Classes\.hxx\PersistentHandler

SOFTWARE\Classes\.hxx

SOFTWARE\Classes\.icc

SOFTWARE\Classes\.icm\PersistentHandler

SOFTWARE\Classes\.icm

SOFTWARE\Classes\.ico\PersistentHandler

SOFTWARE\Classes\.ico

SOFTWARE\Classes\.idb\PersistentHandler

SOFTWARE\Classes\.idb

SOFTWARE\Classes\.idl\PersistentHandler

SOFTWARE\Classes\.idq\PersistentHandler

SOFTWARE\Classes\.idq

SOFTWARE\Classes\.iii

SOFTWARE\Classes\.ilk\PersistentHandler

SOFTWARE\Classes\.ilk

SOFTWARE\Classes\.imc\PersistentHandler

SOFTWARE\Classes\.imc

on Windows NT

SOFTWARE\Classes\.in_\PersistentHandler

SOFTWARE\Classes\.in_

SOFTWARE\Classes\.inc\PersistentHandler

SOFTWARE\Classes\.inc

SOFTWARE\Classes\.inf\PersistentHandler

SOFTWARE\Classes\.inf

SOFTWARE\Classes\.ini\PersistentHandler

SOFTWARE\Classes\.ini

SOFTWARE\Classes\.ins

SOFTWARE\Classes\.inv\PersistentHandler

SOFTWARE\Classes\.inv

SOFTWARE\Classes\.inx\PersistentHandler

SOFTWARE\Classes\.inx

SOFTWARE\Classes\.iso

SOFTWARE\Classes\.isp

SOFTWARE\Classes\.its

SOFTWARE\Classes\.ivf\PersistentHandler

SOFTWARE\Classes\.ivf

SOFTWARE\Classes\.jar

SOFTWARE\Classes\.java

SOFTWARE\Classes\.jbf\PersistentHandler

SOFTWARE\Classes\.jbf

SOFTWARE\Classes\.jpe

SOFTWARE\Classes\.jfif\OpenWithProgids

SOFTWARE\Classes\.jfif\PersistentHandler

SOFTWARE\Classes\.jfif

SOFTWARE\Classes\.job

SOFTWARE\Classes\.jod

SOFTWARE\Classes\.jpe\OpenWithProgids

SOFTWARE\Classes\.jpe\PersistentHandler

SOFTWARE\Classes\.jpeg\OpenWithProgids

SOFTWARE\Classes\.jpeg\PersistentHandler

SOFTWARE\Classes\.jpeg

SOFTWARE\Classes\.jpg\OpenWithProgids

SOFTWARE\Classes\.jpg\PersistentHandler

SOFTWARE\Classes\.jpg

SOFTWARE\Classes\.lib

SOFTWARE\Classes\.js\PersistentHandler

SOFTWARE\Classes\.js

SOFTWARE\Classes\.JSE

SOFTWARE\Classes\.latex\PersistentHandler

SOFTWARE\Classes\.latex

SOFTWARE\Classes\.lha

SOFTWARE\Classes\.lib\PersistentHandler

SOFTWARE\Classes\.lnk\ShellEx\{000214EE-0000-0000-C000-000000000046}

SOFTWARE\Classes\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}

SOFTWARE\Classes\.lnk\ShellEx\{00021500-0000-0000-C000-000000000046}

SOFTWARE\Classes\.log

SOFTWARE\Classes\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.lnk\ShellEx

SOFTWARE\Classes\.lnk\ShellNew

SOFTWARE\Classes\.lnk

SOFTWARE\Classes\.local

SOFTWARE\Classes\.log\PersistentHandler

SOFTWARE\Classes\.lwv

SOFTWARE\Classes\.lzh

SOFTWARE\Classes\.m1v\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.m3u\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.man

SOFTWARE\Classes\.manifest

SOFTWARE\Classes\.MAPIMail\PersistentHandler

SOFTWARE\Classes\.MAPIMail

SOFTWARE\Classes\.mp2

SOFTWARE\Classes\.mdb\PersistentHandler

SOFTWARE\Classes\.mfp

SOFTWARE\Classes\.mht

SOFTWARE\Classes\.mhtml

SOFTWARE\Classes\.mid\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mid\OpenWithList

SOFTWARE\Classes\.mov

SOFTWARE\Classes\.mid\OpenWithProgIds

SOFTWARE\Classes\.mid\PersistentHandler

SOFTWARE\Classes\.mid

SOFTWARE\Classes\.midi\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.midi\OpenWithList

SOFTWARE\Classes\.midi\OpenWithProgIds

SOFTWARE\Classes\.midi\PersistentHandler

SOFTWARE\Classes\.midi

SOFTWARE\Classes\.mkv

SOFTWARE\Classes\.mmf\PersistentHandler

SOFTWARE\Classes\.mmf

SOFTWARE\Classes\.mmm

SOFTWARE\Classes\.mov\PersistentHandler

SOFTWARE\Classes\.movie\PersistentHandler

SOFTWARE\Classes\.movie

SOFTWARE\Classes\.mp2\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mp2\OpenWithList

SOFTWARE\Classes\.mp2\OpenWithProgIds

SOFTWARE\Classes\.mp2\PersistentHandler

SOFTWARE\Classes\*\OpenWithList\Excel.exe

SOFTWARE\Classes\*\OpenWithList\IExplore.exe

SOFTWARE\Classes\*\OpenWithList\Notepad.exe

SOFTWARE\Classes\*\OpenWithList\Winword.exe

SOFTWARE\Classes\*\OpenWithList\WordPad.exe

SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}

SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{1F2E5C40-9550-11CE-99D2-00AA006E086C}

SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32}

SOFTWARE\Classes\.aifc\OpenWithList

SOFTWARE\Classes\.mp2v

SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{883373C3-BF89-11D1-BE35-080036B11A03}

SOFTWARE\Classes\.aifc\OpenWithList\wmplayer.exe

Keyboard

SOFTWARE\Classes\.aifc\OpenWithProgIds

SOFTWARE\Classes\.aifc\PersistentHandler

SOFTWARE\Classes\.aifc

SOFTWARE\Classes\.asf

SOFTWARE\Classes\.ctl

SOFTWARE\Classes\.mdb

SOFTWARE\Classes\*\OpenWithList\MSPaint.exe

SOFTWARE\Classes\.mp2v\PersistentHandler

SOFTWARE\Classes\.mp2v\OpenWithProgIds

SOFTWARE\Classes\.mp2v\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mp2v\OpenWithList

SOFTWARE\Classes\.mp3\PersistentHandler

SOFTWARE\Classes\.mp3\OpenWithProgIds

SOFTWARE\Classes\.mp3\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mp3\OpenWithList

SOFTWARE\Classes\.mp3

SOFTWARE\Classes\.mp4

SOFTWARE\Classes\.msi

SOFTWARE\Classes\.mpa\PersistentHandler

SOFTWARE\Classes\.mpa\OpenWithProgIds

SOFTWARE\Classes\.mpa\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mpa\OpenWithList

SOFTWARE\Classes\.mpa

SOFTWARE\Classes\.mpc

SOFTWARE\Classes\.msg

SOFTWARE\Classes\.mpe\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.mpe\ShellEx

SOFTWARE\Classes\.mpe\PersistentHandler

SOFTWARE\Classes\.mpe\OpenWithProgIds

SOFTWARE\Classes\.mpe\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mpe\OpenWithList

SOFTWARE\Classes\.mpe

SOFTWARE\Classes\.mpeg\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.mpeg\ShellEx

SOFTWARE\Classes\.mpeg\PersistentHandler

SOFTWARE\Classes\.mpg\ShellEx

SOFTWARE\Classes\.mpeg\OpenWithProgIds

SOFTWARE\Classes\.mpeg\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mpeg\OpenWithList

SOFTWARE\Classes\.mpeg

SOFTWARE\Classes\.mpg\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}

SOFTWARE\Classes\.mpg\PersistentHandler

SOFTWARE\Classes\.mpg\OpenWithProgIds

SOFTWARE\Classes\.mpg\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mpg\OpenWithList

SOFTWARE\Classes\.mpg

SOFTWARE\Classes\.mpv2\PersistentHandler

SOFTWARE\Classes\.mpv2\OpenWithProgIds

SOFTWARE\Classes\.mpv2\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.mpv2\OpenWithList

SOFTWARE\Classes\.mpv2

SOFTWARE\Classes\.msc

SOFTWARE\Classes\.msg\PersistentHandler

SOFTWARE\Classes\.msp

SOFTWARE\Classes\.MsRcIncident

SOFTWARE\Classes\.msstyles

SOFTWARE\Classes\.MSWMM

SOFTWARE\Classes\.mv\PersistentHandler

SOFTWARE\Classes\.mv

SOFTWARE\Classes\.mydocs\PersistentHandler

SOFTWARE\Classes\.mydocs

SOFTWARE\Classes\.ncb\PersistentHandler

SOFTWARE\Classes\.ncb

SOFTWARE\Classes\.nfo

SOFTWARE\Classes\.nls

SOFTWARE\Classes\.NMW

SOFTWARE\Classes\.nsc\DefaultIcon

SOFTWARE\Classes\.nsc

SOFTWARE\Classes\.nvr

SOFTWARE\Classes\.nws

SOFTWARE\Classes\.obj\PersistentHandler

SOFTWARE\Classes\.obj

SOFTWARE\Classes\.oc_\PersistentHandler

SOFTWARE\Classes\.oc_

SOFTWARE\Classes\.oca

SOFTWARE\Classes\.ocx\PersistentHandler

SOFTWARE\Classes\.ocx

SOFTWARE\Classes\.odc\PersistentHandler

SOFTWARE\Classes\.odc

SOFTWARE\Classes\.ogg

SOFTWARE\Classes\.ogm

SOFTWARE\Classes\.otf

SOFTWARE\Classes\.pag

SOFTWARE\Classes\.pas

SOFTWARE\Classes\.pbk

SOFTWARE\Classes\.pch\PersistentHandler

SOFTWARE\Classes\.pch

SOFTWARE\Classes\.pdb\PersistentHandler

SOFTWARE\Classes\.pdb

SOFTWARE\Classes\.pds\PersistentHandler

SOFTWARE\Classes\.pds

SOFTWARE\Classes\.pfm

SOFTWARE\Classes\.pfx

SOFTWARE\Classes\.pgx

SOFTWARE\Classes\.php3

SOFTWARE\Classes\.pic\PersistentHandler

SOFTWARE\Classes\.pic

SOFTWARE\Classes\.pif

SOFTWARE\Classes\.pko

SOFTWARE\Classes\.pl\PersistentHandler

SOFTWARE\Classes\.pl

SOFTWARE\Classes\.plg

SOFTWARE\Classes\.pma\PersistentHandler

SOFTWARE\Classes\.pma

SOFTWARE\Classes\.pmc\PersistentHandler

SOFTWARE\Classes\.pmc

SOFTWARE\Classes\.pml\PersistentHandler

SOFTWARE\Classes\.pml

SOFTWARE\Classes\.pmr\PersistentHandler

SOFTWARE\Classes\.pmr

SOFTWARE\Classes\.pmw

SOFTWARE\Classes\.pnf

SOFTWARE\Classes\.png\OpenWithProgids

SOFTWARE\Classes\.png\PersistentHandler

SOFTWARE\Classes\.png

SOFTWARE\Classes\.pot\PersistentHandler

SOFTWARE\Classes\.pot

SOFTWARE\Classes\.pps\PersistentHandler

SOFTWARE\Classes\.pps

SOFTWARE\Classes\.ppt\PowerPoint.Show.4\ShellNew

SOFTWARE\Classes\.ppt\PowerPoint.Show.4

SOFTWARE\Classes\.ppt\PersistentHandler

SOFTWARE\Classes\.ppt

SOFTWARE\Classes\.prf

SOFTWARE\Classes\.ps

SOFTWARE\Classes\.psd\PersistentHandler

SOFTWARE\Classes\.psd

SOFTWARE\Classes\.psw

SOFTWARE\Classes\.qds

SOFTWARE\Classes\.qt

SOFTWARE\Classes\.qtl\Shell\Open\Command

SOFTWARE\Classes\.qtl\Shell\Open

SOFTWARE\Classes\.qtl\Shell

SOFTWARE\Classes\.qtl\DefaultIcon

SOFTWARE\Classes\.qtl

SOFTWARE\Classes\.ra

SOFTWARE\Classes\.ram

SOFTWARE\Classes\.rar\ShellNew

SOFTWARE\Classes\.rar

SOFTWARE\Classes\.rat

SOFTWARE\Classes\.rc\PersistentHandler

SOFTWARE\Classes\.rc

SOFTWARE\Classes\.RDP

SOFTWARE\Classes\.reg\PersistentHandler

SOFTWARE\Classes\.reg

SOFTWARE\Classes\.res\PersistentHandler

SOFTWARE\Classes\.res

SOFTWARE\Classes\.rev

SOFTWARE\Classes\.rle\PersistentHandler

SOFTWARE\Classes\.rle

SOFTWARE\Classes\.rm

SOFTWARE\Classes\.rmi\PersistentHandler

SOFTWARE\Classes\.rmi\OpenWithProgIds

SOFTWARE\Classes\.rmi\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.rmi\OpenWithList

SOFTWARE\Classes\.rmi

SOFTWARE\Classes\.sam

SOFTWARE\Classes\.rmvb

SOFTWARE\Classes\.rnk

SOFTWARE\Classes\.rpc\PersistentHandler

SOFTWARE\Classes\.rpc

SOFTWARE\Classes\.rpm

SOFTWARE\Classes\.rsp\PersistentHandler

SOFTWARE\Classes\.rsp

SOFTWARE\Classes\.rtf\ShellNew

SOFTWARE\Classes\.rtf\PersistentHandler

SOFTWARE\Classes\.rtf\OpenWithList\WordPad.exe

SOFTWARE\Classes\.rtf\OpenWithList

SOFTWARE\Classes\.rtf

SOFTWARE\Classes\.sam\AmiProDocument\ShellNew

SOFTWARE\Classes\.sam\AmiProDocument

SOFTWARE\Classes\.sbr\PersistentHandler

SOFTWARE\Classes\.sbr

SOFTWARE\Classes\.sc2\PersistentHandler

SOFTWARE\Classes\.sc2

SOFTWARE\Classes\.scf

SOFTWARE\Classes\.scp

SOFTWARE\Classes\.scr

SOFTWARE\Classes\.sct

SOFTWARE\Classes\.sdb

SOFTWARE\Classes\.sed

SOFTWARE\Classes\.shb

SOFTWARE\Classes\.shs

SOFTWARE\Classes\.shtml

SOFTWARE\Classes\.shw\Presentations31.Show\ShellNew

SOFTWARE\Classes\.shw\Presentations31.Show

SOFTWARE\Classes\.shw

SOFTWARE\Classes\.sit\PersistentHandler

SOFTWARE\Classes\.sit

SOFTWARE\Classes\.snd\PersistentHandler

SOFTWARE\Classes\.snd\OpenWithProgIds

SOFTWARE\Classes\.snd\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.snd\OpenWithList

SOFTWARE\Classes\.snd

SOFTWARE\Classes\.sol

SOFTWARE\Classes\.sor

SOFTWARE\Classes\.spc

SOFTWARE\Classes\.spl

SOFTWARE\Classes\.sql

SOFTWARE\Classes\.sr_\PersistentHandler

SOFTWARE\Classes\.sr_

SOFTWARE\Classes\.sst

SOFTWARE\Classes\.stl

SOFTWARE\Classes\.stm\PersistentHandler

SOFTWARE\Classes\.stm

SOFTWARE\Classes\.swf\OpenWithList\IExplore.exe

SOFTWARE\Classes\.swf\OpenWithList

SOFTWARE\Classes\.swf

SOFTWARE\Classes\.swt

SOFTWARE\Classes\.sy_\PersistentHandler

SOFTWARE\Classes\.sy_

SOFTWARE\Classes\.sym\PersistentHandler

SOFTWARE\Classes\.sym

SOFTWARE\Classes\.sys\PersistentHandler

SOFTWARE\Classes\.sys

SOFTWARE\Classes\.tar\PersistentHandler

SOFTWARE\Classes\.tar

SOFTWARE\Classes\.taz

SOFTWARE\Classes\.tbz

SOFTWARE\Classes\.tbz2

SOFTWARE\Classes\.tgz\PersistentHandler

SOFTWARE\Classes\.tgz

SOFTWARE\Classes\.theme

SOFTWARE\Classes\.tif\PersistentHandler

SOFTWARE\Classes\.tif\OpenWithProgids

SOFTWARE\Classes\.tif

SOFTWARE\Classes\.tiff\PersistentHandler

SOFTWARE\Classes\.tiff\OpenWithProgids

SOFTWARE\Classes\.vbl

SOFTWARE\Classes\.tiff

SOFTWARE\Classes\.tlb\PersistentHandler

SOFTWARE\Classes\.tlb

SOFTWARE\Classes\.ts

SOFTWARE\Classes\.tsp\PersistentHandler

SOFTWARE\Classes\.tsp

SOFTWARE\Classes\.tsv

SOFTWARE\Classes\.vbg

SOFTWARE\Classes\.ttc\PersistentHandler

SOFTWARE\Classes\.ttc

SOFTWARE\Classes\.ttf\PersistentHandler

SOFTWARE\Classes\.ttf

SOFTWARE\Classes\.UDL

SOFTWARE\Classes\.uls

SOFTWARE\Classes\.uue

SOFTWARE\Classes\.VBE

SOFTWARE\Classes\.url\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8}

SOFTWARE\Classes\.url\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762}

SOFTWARE\Classes\.url\ShellEx\{00021500-0000-0000-C000-000000000046}

SOFTWARE\Classes\.uu

SOFTWARE\Classes\.url\ShellEx\{000214F9-0000-0000-C000-000000000046}

SOFTWARE\Classes\.url\ShellEx\{000214EE-0000-0000-C000-000000000046}

SOFTWARE\Classes\.url\ShellEx

SOFTWARE\Classes\.url\PersistentHandler

SOFTWARE\Classes\.url

SOFTWARE\Classes\.vbr

SOFTWARE\Classes\.vbs\PersistentHandler

SOFTWARE\Classes\.vbs

SOFTWARE\Classes\.vbw

SOFTWARE\Classes\.vbx\PersistentHandler

SOFTWARE\Classes\.vbx

SOFTWARE\Classes\.vbz

SOFTWARE\Classes\.vcf

SOFTWARE\Classes\.vob

SOFTWARE\Classes\.vxd\PersistentHandler

SOFTWARE\Classes\.vxd

SOFTWARE\Classes\.wab

SOFTWARE\Classes\.wav\ShellNew

SOFTWARE\Classes\.wav\PersistentHandler

SOFTWARE\Classes\.wav\OpenWithProgIds

SOFTWARE\Classes\.wav\OpenWithList\wmplayer.exe

SOFTWARE\Classes\.wav\OpenWithList\sndrec32.exe

SOFTWARE\Classes\.wav\OpenWithList

SOFTWARE\Classes\.wav

SOFTWARE\Classes\Folder\shellex\DragDropHandlers\{BD472F60-27FA-11cf-B8B4-444553540000}

SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}

SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}

SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}

SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}

SOFTWARE\Classes\Folder\shell\open\ddeexec\topic

SOFTWARE\Classes\Folder\shell\open\ddeexec\ifexec

SOFTWARE\Classes\Folder\shell\open\ddeexec\application

SOFTWARE\Classes\Folder\shell\open\ddeexec

SOFTWARE\Classes\Folder\shell\explore\ddeexec\topic

SOFTWARE\Classes\Folder\shell\explore\ddeexec\ifexec

SOFTWARE\Classes\Folder\shell\explore\ddeexec\application

SOFTWARE\Classes\Folder\shell\explore\ddeexec

SOFTWARE\Classes\Directory\shell\find\ddeexec\application

SOFTWARE\Classes\Directory\shellex\PropertySheetHandlers\{ef43ecfe-2ab9-4632-bf21-58909dd177f0}

SOFTWARE\Classes\Directory\shellex\PropertySheetHandlers\{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}

SOFTWARE\Classes\Directory\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}

SOFTWARE\Classes\Directory\shellex\PropertySheetHandlers\{1F2E5C40-9550-11CE-99D2-00AA006E086C}

SOFTWARE\Classes\exefile\shell\open\command

SOFTWARE\Classes\Directory\shell\find\ddeexec\topic

SOFTWARE\Classes\Directory\shell\find\ddeexec

SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32

SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}

SOFTWARE\Classes\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000011-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000011-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000011-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000300-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000300-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000303-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000303-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{00000303-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000304-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000304-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000305-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000305-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000306-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000306-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000308-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000308-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000309-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000309-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{0000030B-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{0000030B-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\AuxUserType\2

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\AuxUserType

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\Conversion\Readable\Main

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\Conversion\Readable

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\Conversion

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\DataFormats\GetSet\0

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\DataFormats\GetSet

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\DataFormats\DefaultFile

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\DataFormats

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\MiscStatus

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\DataFormats\GetSet\0

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\DataFormats\GetSet

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\AuxUserType

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\DataFormats\DefaultFile

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\DataFormats

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\AuxUserType\2

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\Conversion\Readable\Main

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\Conversion\Readable

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\Conversion

SOFTWARE\Classes\CLSID\{00000316-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\DataFormats\GetSet\0

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\DataFormats\GetSet

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\AuxUserType

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\DataFormats\DefaultFile

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\DataFormats

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\AuxUserType\2

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\Conversion\Readable\Main

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\Conversion\Readable

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\Conversion

SOFTWARE\Classes\CLSID\{00000319-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{0000031D-0000-0000-C000-000000000046}\InProcServer32

SOFTWARE\Classes\CLSID\{0000031D-0000-0000-C000-000000000046}

\SystemRoot\system32\DRIVERS\sr.sys

SOFTWARE\Classes\CLSID\{00000320-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000320-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000327-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{00000327-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00000327-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{0000032E-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{0000032E-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}\ExtendedErrors\{00000542-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}\ExtendedErrors

SOFTWARE\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}\ProgID

SOFTWARE\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}\InprocServer32

SOFTWARE\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}

SOFTWARE\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\AVIFile

SOFTWARE\Classes\CLSID\{00020000-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020001-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020001-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020001-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020003-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020003-0000-0000-C000-000000000046}\AVIFile

SOFTWARE\Classes\CLSID\{00020003-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{0002000D-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{0002000D-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{0002000D-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{0002000F-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{0002000F-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{0002000F-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32

SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer

SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020810-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020810-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020811-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020811-0000-0000-C000-000000000046}

445:TCP

SOFTWARE\Classes\CLSID\{00020820-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020820-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020821-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020821-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020900-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020900-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\verb\2

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\verb\1

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\verb\0

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\verb

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\ProgID

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\PersistentHandler

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\MiscStatus

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\LocalServer32

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\LocalServer

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\Insertable

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\InprocHandler32

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\Implemented Categories

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\DataFormats\GetSet\1

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\DataFormats\GetSet\0

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\AuxUserType

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\DataFormats\GetSet

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\DataFormats\DefaultSet

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\AuxUserType\2

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\DataFormats\DefaultFile

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\DataFormats

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\AuxUserType\3

SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}

SOFTWARE\Classes\CLSID\{4516EC41-8F20-11d0-9B6D-0000C0781BC3}\InprocServer32

SOFTWARE\Classes\CLSID\{4516EC41-8F20-11d0-9B6D-0000C0781BC3}

SOFTWARE\Classes\exefile\DefaultIcon

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\ShellFolder

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}

SOFTWARE\Classes\exefile\shell\open

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\PropertySheetHandlers\{4a7ded0a-ad25-11d0-98a8-0800361b1103}

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\PropertySheetHandlers

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\ContextMenuHandlers\Offline Files

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\ContextMenuHandlers

SOFTWARE\Classes\.exe\PersistentHandler

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\ddeexec\topic

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\ddeexec\application

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\ddeexec

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\InProcServer32

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\DefaultIcon

SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\Version

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\TypeLib

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\ToolboxBitmap32

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\Programmable

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\ProgID

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\MiscStatus\1

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\MiscStatus

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\InprocServer32

SOFTWARE\Classes\CLSID\{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}\Control

SOFTWARE\Classes\CLSID\{44EC053A-400F-11D0-9DCD-00A0C90391D3}\ProgID

SOFTWARE\Classes\CLSID\{44EC053A-400F-11D0-9DCD-00A0C90391D3}\InprocServer32

SOFTWARE\Classes\CLSID\{44EC053A-400F-11D0-9DCD-00A0C90391D3}

SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\VersionIndependentProgID

SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\ProgID

SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\InprocServer32

SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\DocObject

SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder

SOFTWARE\Classes\exefile\shell

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\PropertySheetHandlers\{645FF040-5081-101B-9F08-00AA002F954E}

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\PropertySheetHandlers

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\{645FF040-5081-101B-9F08-00AA002F954E}

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon

SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\ddeexec\topic

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\ddeexec\application

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\ddeexec

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\InProcServer32

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon

SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}

SOFTWARE\Classes\exefile

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\ddeexec\topic

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\ddeexec\application

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\ddeexec

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon

SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}

SOFTWARE\Classes\.exe

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell

SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page

SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\PifProps

SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}

SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers

SOFTWARE\Classes\exefile\shellex\DropHandler

SOFTWARE\Classes\exefile\shellex

SOFTWARE\Classes\exefile\shell\runas\command

SOFTWARE\Classes\exefile\shell\runas

SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

139:TCP

139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

137:UDP

137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

138:UDP

138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

Software\Microsoft\Windows\CurrentVersion\Policies\System

S-1-5-21-1390067357-343818398-1606980848-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SYSTEM\ControlSet001\Services\EhttpSrv

SYSTEM\CurrentControlSet\Services\EhttpSrv

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

00000000

A*\AJ:\z3r0_x Olucan Orjinal\Project1.vbp

8.01.0008

MusaLLaT.exe_352_rwx_00401000_00076000: