Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
key above is created & left behind even if user does not enable "Replace Task Manager".
How to reproduce:
- launch ProcessHackerPortable
- click Hacker > Options > Advanced Tab
- Press OK