HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Temp

Sort Order

1e 3 16 9

.405F2A		75 50 >> 40 48	<--expired
.41319E		nagscreen,po tym jz ma byc jmp
