Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Cleaners/a...er.exe
windows7-x64
9Cleaners/a...er.exe
windows10-2004-x64
9Cleaners/a...rm.exe
windows7-x64
7Cleaners/a...rm.exe
windows10-2004-x64
7Cleaners/clean1.bat
windows7-x64
7Cleaners/clean1.bat
windows10-2004-x64
5Cleaners/clean2.bat
windows7-x64
7Cleaners/clean2.bat
windows10-2004-x64
4Cleaners/clean3.bat
windows7-x64
1Cleaners/clean3.bat
windows10-2004-x64
1Cleaners/clean4.bat
windows7-x64
1Cleaners/clean4.bat
windows10-2004-x64
1Cleaners/clean5.bat
windows7-x64
7Cleaners/clean5.bat
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:24
Behavioral task
behavioral1
Sample
Cleaners/applecleaner.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cleaners/applecleaner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Cleaners/applecperm.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Cleaners/applecperm.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Cleaners/clean1.bat
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Cleaners/clean1.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Cleaners/clean2.bat
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Cleaners/clean2.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Cleaners/clean3.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Cleaners/clean3.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Cleaners/clean4.bat
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Cleaners/clean4.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Cleaners/clean5.bat
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Cleaners/clean5.bat
Resource
win10v2004-20240709-en
General
-
Target
Cleaners/clean1.bat
-
Size
578KB
-
MD5
471546f6de675803f384262a9d0d17de
-
SHA1
da7ae8fc83f5feee8bf16517f04fbc20d8b61cfa
-
SHA256
880dc9c7a7291a729d4ce07bc300d90665f262834cfb6501505ab3061b7a06dc
-
SHA512
010d32d05ee599f67b036d1852d8deac0422d168ed68ad4b5147bb858252f348b882d563efd087922b474915ada9c39852c25e569de408bdd4a4d6fb7ebefbbb
-
SSDEEP
1536:5iYLmcHjgkpYLmcTzg8gcDRnvplQL5LvLpLjLwazhztzh4Wo:gYScH9YScTzg8gURnvpWzhztzhDo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1748 cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\LogFiles\SQM\SQMLOG~1.002 cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\BITS\bitsctr.h cmd.exe File opened for modification C:\Windows\INF\SERVIC~2.0\0407\_ServiceModelServicePerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\TAPISRV\0410\tapiperf.ini cmd.exe File opened for modification C:\Windows\INF\UGATHE~1\0409\gsrvctr.ini cmd.exe File opened for modification C:\Windows\INF\en-US\netavpna.inf_loc cmd.exe File opened for modification C:\Windows\INF\es-ES\netavpna.inf_loc cmd.exe File opened for modification C:\Windows\INF\WINDOW~1.0\0000\PerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~1\0410\_DataOracleClientPerfCounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\BITS\0409\bitsctrs.ini cmd.exe File opened for modification C:\Windows\INF\SMSVCH~1.0\0000\_SMSvcHostPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\TERMSE~1\0409\tslabels.ini cmd.exe File opened for modification C:\Windows\INF\MSDTC\0407\msdtcprf.ini cmd.exe File opened for modification C:\Windows\INF\MSDTC\msdtcprf.h cmd.exe File opened for modification C:\Windows\INF\nettcpip.inf cmd.exe File opened for modification C:\Windows\INF\en-US\netavpnt.inf_loc cmd.exe File opened for modification C:\Windows\INF\netvwififlt.inf cmd.exe File opened for modification C:\Windows\INF\sceregvl.inf cmd.exe File opened for modification C:\Windows\INF\SERVIC~3.0\040C\_ServiceModelOperationPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\TAPISRV\0407\tapiperf.ini cmd.exe File opened for modification C:\Windows\INF\WSEARC~1\0407\idxcntrs.ini cmd.exe File opened for modification C:\Windows\INF\NETFRA~1\040C\corperfmonsymbols_D.ini cmd.exe File opened for modification C:\Windows\INF\netavpnt.inf cmd.exe File opened for modification C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h cmd.exe File opened for modification C:\Windows\INF\TAPISRV\0000\tapiperf.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~2\0C0A\_dataperfcounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\ESENT\0410\esentprf.ini cmd.exe File opened for modification C:\Windows\INF\MSDTC\0C0A\msdtcprf.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~1\0000\_DataOracleClientPerfCounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~1\040C\_DataOracleClientPerfCounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\ndisuio.inf cmd.exe File opened for modification C:\Windows\INF\BITS\0000\bitsctrs.ini cmd.exe File opened for modification C:\Windows\INF\MSDTCB~1.0\0000\_TransactionBridgePerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\netmscli.inf cmd.exe File opened for modification C:\Windows\INF\TERMSE~1\0407\tslabels.ini cmd.exe File opened for modification C:\Windows\INF\ESENT\0411\esentprf.ini cmd.exe File opened for modification C:\Windows\INF\netpacer.inf cmd.exe File opened for modification C:\Windows\INF\SERVIC~1.0\0000\_ServiceModelEndpointPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\fr-FR\netavpna.inf_loc cmd.exe File opened for modification C:\Windows\INF\MSDTC\0409\msdtcprf.ini cmd.exe File opened for modification C:\Windows\INF\MSDTC\0410\msdtcprf.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~1\_DataOracleClientPerfCounters_shared12_neutral.ini cmd.exe File opened for modification C:\Windows\INF\BITS\0C0A\bitsctrs.ini cmd.exe File opened for modification C:\Windows\INF\SERVIC~1.0\040C\_ServiceModelEndpointPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~2\0411\_dataperfcounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\rdyboost\040C\ReadyBoostPerfCounters.ini cmd.exe File opened for modification C:\Windows\INF\REMOTE~1\0411\rasctrs.ini cmd.exe File opened for modification C:\Windows\INF\SERVIC~3.0\0C0A\_ServiceModelOperationPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\Prefetch\READYB~1\READYB~1.ETL cmd.exe File opened for modification C:\Windows\INF\TAPISRV\perfctr.h cmd.exe File opened for modification C:\Windows\INF\UGTHRSVC\gthrctr.h cmd.exe File opened for modification C:\Windows\INF\REMOTE~1\0C0A\rasctrs.ini cmd.exe File opened for modification C:\Windows\INF\UGATHE~1\0000\gsrvctr.ini cmd.exe File opened for modification C:\Windows\INF\netserv.inf cmd.exe File opened for modification C:\Windows\INF\TERMSE~1\0410\tslabels.ini cmd.exe File opened for modification C:\Windows\INF\usbhub\0000\usbperf.ini cmd.exe File opened for modification C:\Windows\INF\NETCLR~1\0409\_DataPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\NETCLR~1\0410\_DataPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\NETDAT~2\0000\_dataperfcounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\netpgm.inf cmd.exe File opened for modification C:\Windows\INF\NETDAT~2\040C\_dataperfcounters_shared12_neutral_D.ini cmd.exe File opened for modification C:\Windows\INF\ESENT\0409\esentprf.ini cmd.exe File opened for modification C:\Windows\INF\SERVIC~1.0\0410\_ServiceModelEndpointPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\SERVIC~3.0\0407\_ServiceModelOperationPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\NETCLR~1\_DataPerfCounters.h cmd.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 reg.exe Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2228 ipconfig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2792 1748 cmd.exe 31 PID 1748 wrote to memory of 2792 1748 cmd.exe 31 PID 1748 wrote to memory of 2792 1748 cmd.exe 31 PID 1748 wrote to memory of 2796 1748 cmd.exe 32 PID 1748 wrote to memory of 2796 1748 cmd.exe 32 PID 1748 wrote to memory of 2796 1748 cmd.exe 32 PID 1748 wrote to memory of 2820 1748 cmd.exe 33 PID 1748 wrote to memory of 2820 1748 cmd.exe 33 PID 1748 wrote to memory of 2820 1748 cmd.exe 33 PID 1748 wrote to memory of 2836 1748 cmd.exe 34 PID 1748 wrote to memory of 2836 1748 cmd.exe 34 PID 1748 wrote to memory of 2836 1748 cmd.exe 34 PID 1748 wrote to memory of 2940 1748 cmd.exe 35 PID 1748 wrote to memory of 2940 1748 cmd.exe 35 PID 1748 wrote to memory of 2940 1748 cmd.exe 35 PID 1748 wrote to memory of 2728 1748 cmd.exe 36 PID 1748 wrote to memory of 2728 1748 cmd.exe 36 PID 1748 wrote to memory of 2728 1748 cmd.exe 36 PID 1748 wrote to memory of 2724 1748 cmd.exe 37 PID 1748 wrote to memory of 2724 1748 cmd.exe 37 PID 1748 wrote to memory of 2724 1748 cmd.exe 37 PID 1748 wrote to memory of 2708 1748 cmd.exe 38 PID 1748 wrote to memory of 2708 1748 cmd.exe 38 PID 1748 wrote to memory of 2708 1748 cmd.exe 38 PID 1748 wrote to memory of 2472 1748 cmd.exe 39 PID 1748 wrote to memory of 2472 1748 cmd.exe 39 PID 1748 wrote to memory of 2472 1748 cmd.exe 39 PID 1748 wrote to memory of 2928 1748 cmd.exe 40 PID 1748 wrote to memory of 2928 1748 cmd.exe 40 PID 1748 wrote to memory of 2928 1748 cmd.exe 40 PID 1748 wrote to memory of 2692 1748 cmd.exe 41 PID 1748 wrote to memory of 2692 1748 cmd.exe 41 PID 1748 wrote to memory of 2692 1748 cmd.exe 41 PID 1748 wrote to memory of 2832 1748 cmd.exe 42 PID 1748 wrote to memory of 2832 1748 cmd.exe 42 PID 1748 wrote to memory of 2832 1748 cmd.exe 42 PID 1748 wrote to memory of 2776 1748 cmd.exe 43 PID 1748 wrote to memory of 2776 1748 cmd.exe 43 PID 1748 wrote to memory of 2776 1748 cmd.exe 43 PID 1748 wrote to memory of 2852 1748 cmd.exe 44 PID 1748 wrote to memory of 2852 1748 cmd.exe 44 PID 1748 wrote to memory of 2852 1748 cmd.exe 44 PID 1748 wrote to memory of 2904 1748 cmd.exe 45 PID 1748 wrote to memory of 2904 1748 cmd.exe 45 PID 1748 wrote to memory of 2904 1748 cmd.exe 45 PID 1748 wrote to memory of 2604 1748 cmd.exe 46 PID 1748 wrote to memory of 2604 1748 cmd.exe 46 PID 1748 wrote to memory of 2604 1748 cmd.exe 46 PID 1748 wrote to memory of 2872 1748 cmd.exe 47 PID 1748 wrote to memory of 2872 1748 cmd.exe 47 PID 1748 wrote to memory of 2872 1748 cmd.exe 47 PID 1748 wrote to memory of 2760 1748 cmd.exe 48 PID 1748 wrote to memory of 2760 1748 cmd.exe 48 PID 1748 wrote to memory of 2760 1748 cmd.exe 48 PID 1748 wrote to memory of 2616 1748 cmd.exe 49 PID 1748 wrote to memory of 2616 1748 cmd.exe 49 PID 1748 wrote to memory of 2616 1748 cmd.exe 49 PID 1748 wrote to memory of 2712 1748 cmd.exe 50 PID 1748 wrote to memory of 2712 1748 cmd.exe 50 PID 1748 wrote to memory of 2712 1748 cmd.exe 50 PID 1748 wrote to memory of 2812 1748 cmd.exe 51 PID 1748 wrote to memory of 2812 1748 cmd.exe 51 PID 1748 wrote to memory of 2812 1748 cmd.exe 51 PID 1748 wrote to memory of 2624 1748 cmd.exe 52
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Cleaners\clean1.bat"1⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Electronic Arts\EA Core\Staging\194908\ergc" /f2⤵PID:2792
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Electronic Arts" /f2⤵PID:2796
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Respawn\Apex\Product GUID" /f2⤵PID:2820
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\origin" /f2⤵PID:2836
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\origin2" /f2⤵PID:2940
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\origin" /f2⤵PID:2728
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\origin2" /f2⤵PID:2724
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\Applications\Origin.exe" /f2⤵PID:2708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\Applications\Origin.exe" /f2⤵PID:2472
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.Origin" /f2⤵PID:2928
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\Origin Client Service" /f2⤵PID:2692
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\Origin Web Helper Service" /f2⤵PID:2832
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Origin Client Service" /f2⤵PID:2776
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Origin Web Helper Service" /f2⤵PID:2852
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Origin.exe" /f2⤵PID:2904
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\Applications\Origin.exe" /f2⤵PID:2604
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\Applications\Origin.exe" /f2⤵PID:2872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.Origin" /f2⤵PID:2760
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /f2⤵PID:2616
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /f2⤵PID:2712
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /f2⤵PID:2812
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /f2⤵PID:2624
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /f2⤵PID:2828
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /f2⤵PID:2632
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad" /f2⤵PID:2576
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93" /f2⤵PID:2572
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93\ac" /f2⤵PID:2592
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93" /f2⤵PID:2608
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93\ad" /f2⤵PID:2628
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180" /f2⤵PID:2648
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181" /f2⤵PID:2696
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182" /f2⤵PID:2744
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\180" /f2⤵PID:3060
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:2844
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:1920
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:3012
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:3024
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:1656
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:844
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:264
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:572
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:484
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:548
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:1160
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:296
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:1320
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:580
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:1616
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:1492
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:3004
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:2988
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f2⤵PID:2292
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f2⤵PID:764
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security" /f2⤵PID:2104
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f2⤵PID:2188
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat\Security" /f2⤵PID:2116
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Classes\Installer\Dependencies" /v MSICache /f2⤵PID:2268
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f2⤵PID:2260
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /f2⤵
- Checks processor information in registry
PID:2172
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /f2⤵PID:2196
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /f2⤵PID:2180
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /f2⤵PID:2252
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /f2⤵PID:1060
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /f2⤵PID:1040
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /f2⤵PID:2664
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad" /f2⤵PID:1156
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93" /f2⤵PID:1440
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93\ac" /f2⤵PID:1776
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93" /f2⤵PID:304
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93\ad" /f2⤵PID:2328
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180" /f2⤵PID:1648
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181" /f2⤵PID:2636
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182" /f2⤵PID:1744
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\180" /f2⤵PID:308
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\181" /f2⤵PID:2644
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\182" /f2⤵PID:1128
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /f2⤵PID:2484
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /f2⤵PID:1416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:1760
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:1420
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:1964
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:2880
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:2884
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:1768
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:1856
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:1380
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:2892
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:2900
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:2916
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:1604
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:848
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:2140
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:1948
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:1988
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:1932
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\kz2LMQg4+pNfXggv65DcWFQ9SiekWR4B4WMWT+pcqbU: 0x00000002" /f2⤵PID:1936
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\4JSyFFDDKUMXDyK2USgAjbiksFnqOb3f8RPZBPSpEfU: 0x00000002" /f2⤵PID:1940
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\62bDlCzxB/xxIWLkQdDRYcAqhmZhNOMUtjhRkAgTvkQ: 0x00000002" /f2⤵PID:1984
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Package: 0x00000181" /f2⤵PID:1972
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Index: 0x00000000" /f2⤵PID:2560
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Flags: 0x00000000" /f2⤵PID:2304
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\PackageRelativeApplicationId: "App"" /f2⤵PID:2956
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:2756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Executable: "GameBar.exe"" /f2⤵PID:2960
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Entrypoint: "GameBar.App"" /f2⤵PID:2948
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\StartPage: (NULL!)" /f2⤵PID:2556
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\_IndexKeys: 50 61 63 6B 61 67 65 5C 31 38 31 5C 39 33 00 50 61 63 6B 61 67 65 41 6E 64 50 61 63 6B 61 67 65 52 65 6C 61 74 69 76 65 41 70 70 6C 69 63 61 74 69 6F 6E 49 64 5C 31 38 31 5E 41 70 70 00 00" /f2⤵PID:1680
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\Application: 0x00000093" /f2⤵PID:2308
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\User: 0x00000003" /f2⤵PID:2412
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:2352
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\_IndexKeys: 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 5C 33 5E 39 33 00 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 55 73 65 72 4D 6F 64 65 6C 49 64 5C 33 5E 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 21 41 70 70 00 00" /f2⤵PID:804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\Application: 0x00000093" /f2⤵PID:2480
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\User: 0x00000004" /f2⤵PID:2288
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:768
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\_IndexKeys: 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 5C 34 5E 39 33 00 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 55 73 65 72 4D 6F 64 65 6C 49 64 5C 34 5E 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 21 41 70 70 00 00" /f2⤵PID:2164
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe"" /f2⤵PID:2416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageFamily: 0x0000004E" /f2⤵PID:2068
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageType: 0x00000008" /f2⤵PID:1692
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\Flags: 0x00000000" /f2⤵PID:2276
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageOrigin: 0x00000003" /f2⤵PID:1880
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\Volume: 0x00000001" /f2⤵PID:668
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe"" /f2⤵PID:1212
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 30 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 6E 65 75 74 72 61 6C 5F 7E 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:856
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe"" /f2⤵PID:692
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageFamily: 0x0000004E" /f2⤵PID:1484
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageType: 0x00000001" /f2⤵PID:2456
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\Flags: 0x00000000" /f2⤵PID:1788
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageOrigin: 0x00000003" /f2⤵PID:820
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\Volume: 0x00000001" /f2⤵PID:1360
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe"" /f2⤵PID:1628
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 31 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 78 36 34 5F 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:624
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale-100_8wekyb3d8bbwe"" /f2⤵PID:1732
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageFamily: 0x0000004E" /f2⤵PID:2208
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageType: 0x00000004" /f2⤵PID:2232
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\Flags: 0x00000000" /f2⤵PID:3068
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageOrigin: 0x00000003" /f2⤵PID:1528
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\Volume: 0x00000001" /f2⤵PID:1872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale-100_8wekyb3d8bbwe"" /f2⤵PID:1140
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 32 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 6E 65 75 74 72 61 6C 5F 73 70 6C 69 74 2E 73 63 61 6C 65 2D 31 30 30 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\Package: 0x00000180" /f2⤵PID:1956
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\User: 0x00000003" /f2⤵PID:300
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 30 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 30 00 00" /f2⤵PID:976
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\Package: 0x00000181" /f2⤵PID:780
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\User: 0x00000003" /f2⤵PID:1444
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 31 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 31 00 00" /f2⤵PID:944
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\Package: 0x00000182" /f2⤵PID:1308
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\User: 0x00000003" /f2⤵PID:1612
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 32 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 32 00 00" /f2⤵PID:2320
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\Package: 0x00000180" /f2⤵PID:1876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\User: 0x00000004" /f2⤵PID:1668
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\_IndexKeys: 55 73 65 72 5C 34 5C 31 61 38 33 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 34 5E 31 38 30 00 00" /f2⤵PID:1740
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\Package: 0x00000181" /f2⤵PID:1736
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\User: 0x00000004" /f2⤵PID:1728
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\_IndexKeys: 55 73 65 72 5C 34 5C 31 61 38 34 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 34 5E 31 38 31 00 00" /f2⤵PID:1712
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3D39855: 01 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 02 00 1C 00 01 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 0B 00 00 00 04 00 00 00" /f2⤵PID:1228
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3CF4055: 01 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 02 00 1C 00 01 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 0B 00 00 00 04 00 00 00" /f2⤵PID:1724
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f2⤵PID:2444
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862software: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:1716
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_sid: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 2E 64 61 74 00 00" /f2⤵PID:1324
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_classes: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 43 6C 61 73 73 65 73 2E 64 61 74 00 00" /f2⤵PID:880
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Siloe6b4a779-bfe1-62d8-47ac-fa19e9becbbecom: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 5F 43 4F 4D 31 35 2E 64 61 74 00 00" /f2⤵PID:896
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862com: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:568
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\bam\State\UserType: 0x00000010" /f2⤵PID:684
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f2⤵PID:3044
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security\Security: 01 00 14 80 A0 00 00 00 AC 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 70 00 05 00 00 00 00 00 14 00 30 00 02 00 01 01 00 00 00 00 00 01 00 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 06 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00" /f2⤵PID:2520
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862software: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:3040
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_sid: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 2E 64 61 74 00 00" /f2⤵PID:2656
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_classes: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 43 6C 61 73 73 65 73 2E 64 61 74 00 00" /f2⤵PID:2516
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Siloe6b4a779-bfe1-62d8-47ac-fa19e9becbbecom: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 5F 43 4F 4D 31 35 2E 64 61 74 00 00" /f2⤵PID:2660
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862com: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:1520
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f2⤵PID:1540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /f2⤵PID:1488
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /f2⤵PID:744
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:3056
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:1064
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:288
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:1200
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:972
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:1192
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:1804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:868
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:1068
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:2072
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:2100
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:1672
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:1564
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:1596
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:1688
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:1592
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:2804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Type: 0x00000010" /f2⤵PID:2808
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Start: 0x00000003" /f2⤵PID:2824
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ErrorControl: 0x00000001" /f2⤵PID:2840
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ImagePath: ""C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe""" /f2⤵PID:2788
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\DisplayName: "EasyAntiCheat"" /f2⤵PID:2732
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\WOW64: 0x0000014C" /f2⤵PID:2700
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ObjectName: "LocalSystem"" /f2⤵PID:2584
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:2168
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:2848
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:2736
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:1764
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:2612
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:2780
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:2752
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:2896
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\0" /f2⤵PID:2600
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000205B6" /f2⤵PID:2868
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000403D6" /f2⤵PID:496
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000405DE" /f2⤵PID:2740
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060286" /f2⤵PID:2748
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009042E" /f2⤵PID:2688
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A03B4" /f2⤵PID:2044
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A0430" /f2⤵PID:2772
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B0532" /f2⤵PID:2580
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B05D6" /f2⤵PID:2588
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0430" /f2⤵PID:2596
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0586" /f2⤵PID:2620
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E03D2" /f2⤵PID:2640
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E0406" /f2⤵PID:2652
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000100430" /f2⤵PID:1256
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001103EE" /f2⤵PID:3008
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000011041E" /f2⤵PID:3016
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000012047E" /f2⤵PID:376
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001303EE" /f2⤵PID:2056
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001304F2" /f2⤵PID:3020
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000014041E" /f2⤵PID:1076
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001703E6" /f2⤵PID:1652
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000170440" /f2⤵PID:2336
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001704FC" /f2⤵PID:536
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU" /f2⤵PID:332
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MrtCache\C:CProgram FilesCWindowsAppsCMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbweCmicrosoft.system.package.metadataCS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri" /f2⤵PID:776
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:1104
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:1164
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:860
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:1336
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:644
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:1640
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:588
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:3028
-
-
C:\Windows\system32\reg.exeREG DELETE "HKEY_CURRENT_USER\Software\Classes\Installer\Dependencies" /v MSICache /f2⤵PID:2236
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:2228
-
-
C:\Windows\system32\netsh.exenetsh interface ip delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:764
-
-
C:\Windows\system32\certutil.execertutil -URLCache * delete2⤵PID:2268
-
-
C:\Windows\system32\netsh.exenetsh int ip reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2252
-
-
C:\Windows\system32\netsh.exenetsh int ipv4 reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1156
-
-
C:\Windows\system32\netsh.exenetsh int ipv6 reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2328
-
-
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:308
-