HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SD2014" = "%AppData%\<random>\<random>.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KB8456137 = "%LocalAppData%\KB8456137\KB8456137.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "courts" = %AppData%\p1.exe
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\<random 3 chars>.exe" -a "%1" %*