Search notes:

Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Image File Execution Options\progName.exe

This registry relate to the executable with the name progName.exe.
Values that are often seen in the key is MitigationOptions and CFGOptions.

GlobalFlag

The value of GlobalFlag can be set with gflags.exe.
See also the value of GlobalFlag under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager.

See also

PE format for exes.

Index