Start
CloseProcesses:
HKU\S-1-5-21-1758440541-3978537159-2615947404-1001\Software\Classes\regfile:  <==== ATTENTION
Folder: C:\WINDOWS\system32\ruxim
End