Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Cleaners/a...er.exe
windows7-x64
9Cleaners/a...er.exe
windows10-2004-x64
9Cleaners/a...rm.exe
windows7-x64
7Cleaners/a...rm.exe
windows10-2004-x64
7Cleaners/clean1.bat
windows7-x64
7Cleaners/clean1.bat
windows10-2004-x64
5Cleaners/clean2.bat
windows7-x64
7Cleaners/clean2.bat
windows10-2004-x64
4Cleaners/clean3.bat
windows7-x64
1Cleaners/clean3.bat
windows10-2004-x64
1Cleaners/clean4.bat
windows7-x64
1Cleaners/clean4.bat
windows10-2004-x64
1Cleaners/clean5.bat
windows7-x64
7Cleaners/clean5.bat
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 07:24
Behavioral task
behavioral1
Sample
Cleaners/applecleaner.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cleaners/applecleaner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Cleaners/applecperm.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Cleaners/applecperm.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Cleaners/clean1.bat
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Cleaners/clean1.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Cleaners/clean2.bat
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Cleaners/clean2.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Cleaners/clean3.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Cleaners/clean3.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Cleaners/clean4.bat
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Cleaners/clean4.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Cleaners/clean5.bat
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Cleaners/clean5.bat
Resource
win10v2004-20240709-en
General
-
Target
Cleaners/clean1.bat
-
Size
578KB
-
MD5
471546f6de675803f384262a9d0d17de
-
SHA1
da7ae8fc83f5feee8bf16517f04fbc20d8b61cfa
-
SHA256
880dc9c7a7291a729d4ce07bc300d90665f262834cfb6501505ab3061b7a06dc
-
SHA512
010d32d05ee599f67b036d1852d8deac0422d168ed68ad4b5147bb858252f348b882d563efd087922b474915ada9c39852c25e569de408bdd4a4d6fb7ebefbbb
-
SSDEEP
1536:5iYLmcHjgkpYLmcTzg8gcDRnvplQL5LvLpLjLwazhztzh4Wo:gYScH9YScTzg8gURnvpWzhztzhDo
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\LogFiles\WMI\DIAGTR~1.005 cmd.exe File opened for modification C:\Windows\System32\LogFiles\WMI\LWTNET~1.ETL cmd.exe File opened for modification C:\Windows\System32\LogFiles\WMI\MICROS~1.ETL cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\mdmrock4.inf cmd.exe File opened for modification C:\Windows\INF\netwew01.inf cmd.exe File opened for modification C:\Windows\INF\prnms010.inf cmd.exe File opened for modification C:\Windows\INF\unknown.inf cmd.exe File opened for modification C:\Windows\INF\ws3cap.inf cmd.exe File opened for modification C:\Windows\INF\SMSVCH~1.0\0407\_SMSvcHostPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\TAPISRV\0407\tapiperf.ini cmd.exe File opened for modification C:\Windows\INF\bthspp.inf cmd.exe File opened for modification C:\Windows\INF\mdmcrtix.inf cmd.exe File opened for modification C:\Windows\INF\mdmarn.inf cmd.exe File opened for modification C:\Windows\INF\netr7364.inf cmd.exe File opened for modification C:\Windows\INF\genericusbfn.inf cmd.exe File opened for modification C:\Windows\INF\hidinterrupt.inf cmd.exe File opened for modification C:\Windows\INF\netefe3e.inf cmd.exe File opened for modification C:\Windows\INF\acpipagr.inf cmd.exe File opened for modification C:\Windows\INF\mdmtkr.inf cmd.exe File opened for modification C:\Windows\INF\wsearchidxpi\0409\idxcntrs.ini cmd.exe File opened for modification C:\Windows\INF\.NETFramework\corperfmonsymbols.ini cmd.exe File opened for modification C:\Windows\INF\c_ucm.inf cmd.exe File opened for modification C:\Windows\INF\mdmaus.inf cmd.exe File opened for modification C:\Windows\INF\usbhub3.inf cmd.exe File opened for modification C:\Windows\INF\c_firmware.inf cmd.exe File opened for modification C:\Windows\INF\netbvbda.inf cmd.exe File opened for modification C:\Windows\INF\mdmpin.inf cmd.exe File opened for modification C:\Windows\INF\wave.inf cmd.exe File opened for modification C:\Windows\INF\btampm.inf cmd.exe File opened for modification C:\Windows\INF\ehstortcgdrv.inf cmd.exe File opened for modification C:\Windows\INF\mdmmetri.inf cmd.exe File opened for modification C:\Windows\INF\usbncm.inf cmd.exe File opened for modification C:\Windows\INF\c_fsreplication.inf cmd.exe File opened for modification C:\Windows\INF\c_fshsm.inf cmd.exe File opened for modification C:\Windows\INF\halextpl080.inf cmd.exe File opened for modification C:\Windows\INF\mdmeric.inf cmd.exe File opened for modification C:\Windows\INF\monitor.inf cmd.exe File opened for modification C:\Windows\INF\sensorsalsdriver.inf cmd.exe File opened for modification C:\Windows\INF\c_fsvirtualization.inf cmd.exe File opened for modification C:\Windows\INF\umbus.inf cmd.exe File opened for modification C:\Windows\INF\.NET Data Provider for Oracle\0411\_DataOracleClientPerfCounters_shared12_neutral_d.ini cmd.exe File opened for modification C:\Windows\INF\c_scmvolume.inf cmd.exe File opened for modification C:\Windows\INF\mdmnokia.inf cmd.exe File opened for modification C:\Windows\INF\mdmgl007.inf cmd.exe File opened for modification C:\Windows\INF\oposdrv.inf cmd.exe File opened for modification C:\Windows\INF\SERVIC~2.0\040C\_ServiceModelOperationPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\amdi2c.inf cmd.exe File opened for modification C:\Windows\INF\microsoft_bluetooth_hfp.inf cmd.exe File opened for modification C:\Windows\INF\TermService\0410\tslabels.ini cmd.exe File opened for modification C:\Windows\INF\TermService\0C0A\tslabels.ini cmd.exe File opened for modification C:\Windows\INF\.NET Data Provider for Oracle\0C0A\_DataOracleClientPerfCounters_shared12_neutral_d.ini cmd.exe File opened for modification C:\Windows\INF\e2xw10x64.inf cmd.exe File opened for modification C:\Windows\INF\netpacer.inf cmd.exe File opened for modification C:\Windows\INF\mdmgl009.inf cmd.exe File opened for modification C:\Windows\INF\SMSvcHost 4.0.0.0\_SMSvcHostPerfCounters.h cmd.exe File opened for modification C:\Windows\INF\usbcir.inf cmd.exe File opened for modification C:\Windows\INF\c_fscopyprotection.inf cmd.exe File opened for modification C:\Windows\INF\iagpio.inf cmd.exe File opened for modification C:\Windows\INF\mdmmhzel.inf cmd.exe File opened for modification C:\Windows\INF\PerceptionSimulationSixDofModels.inf cmd.exe File opened for modification C:\Windows\INF\mdmcpq.inf cmd.exe File opened for modification C:\Windows\INF\mdmtdk.inf cmd.exe File opened for modification C:\Windows\INF\net8187bv64.inf cmd.exe File opened for modification C:\Windows\INF\sceregvl.inf cmd.exe File opened for modification C:\Windows\Logs\WAASME~1\WAASME~3.ETL cmd.exe File opened for modification C:\Windows\INF\basicrender.inf cmd.exe File opened for modification C:\Windows\INF\mdmntt1.inf cmd.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 reg.exe Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1472 ipconfig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4748 wrote to memory of 1660 4748 cmd.exe 87 PID 4748 wrote to memory of 1660 4748 cmd.exe 87 PID 4748 wrote to memory of 3380 4748 cmd.exe 88 PID 4748 wrote to memory of 3380 4748 cmd.exe 88 PID 4748 wrote to memory of 3100 4748 cmd.exe 89 PID 4748 wrote to memory of 3100 4748 cmd.exe 89 PID 4748 wrote to memory of 2908 4748 cmd.exe 90 PID 4748 wrote to memory of 2908 4748 cmd.exe 90 PID 4748 wrote to memory of 1540 4748 cmd.exe 91 PID 4748 wrote to memory of 1540 4748 cmd.exe 91 PID 4748 wrote to memory of 2260 4748 cmd.exe 92 PID 4748 wrote to memory of 2260 4748 cmd.exe 92 PID 4748 wrote to memory of 2604 4748 cmd.exe 93 PID 4748 wrote to memory of 2604 4748 cmd.exe 93 PID 4748 wrote to memory of 4564 4748 cmd.exe 94 PID 4748 wrote to memory of 4564 4748 cmd.exe 94 PID 4748 wrote to memory of 3712 4748 cmd.exe 95 PID 4748 wrote to memory of 3712 4748 cmd.exe 95 PID 4748 wrote to memory of 4084 4748 cmd.exe 96 PID 4748 wrote to memory of 4084 4748 cmd.exe 96 PID 4748 wrote to memory of 3556 4748 cmd.exe 97 PID 4748 wrote to memory of 3556 4748 cmd.exe 97 PID 4748 wrote to memory of 3776 4748 cmd.exe 98 PID 4748 wrote to memory of 3776 4748 cmd.exe 98 PID 4748 wrote to memory of 1648 4748 cmd.exe 99 PID 4748 wrote to memory of 1648 4748 cmd.exe 99 PID 4748 wrote to memory of 464 4748 cmd.exe 100 PID 4748 wrote to memory of 464 4748 cmd.exe 100 PID 4748 wrote to memory of 1248 4748 cmd.exe 101 PID 4748 wrote to memory of 1248 4748 cmd.exe 101 PID 4748 wrote to memory of 3704 4748 cmd.exe 102 PID 4748 wrote to memory of 3704 4748 cmd.exe 102 PID 4748 wrote to memory of 2080 4748 cmd.exe 103 PID 4748 wrote to memory of 2080 4748 cmd.exe 103 PID 4748 wrote to memory of 3464 4748 cmd.exe 104 PID 4748 wrote to memory of 3464 4748 cmd.exe 104 PID 4748 wrote to memory of 1032 4748 cmd.exe 105 PID 4748 wrote to memory of 1032 4748 cmd.exe 105 PID 4748 wrote to memory of 4676 4748 cmd.exe 106 PID 4748 wrote to memory of 4676 4748 cmd.exe 106 PID 4748 wrote to memory of 4444 4748 cmd.exe 107 PID 4748 wrote to memory of 4444 4748 cmd.exe 107 PID 4748 wrote to memory of 552 4748 cmd.exe 108 PID 4748 wrote to memory of 552 4748 cmd.exe 108 PID 4748 wrote to memory of 1528 4748 cmd.exe 109 PID 4748 wrote to memory of 1528 4748 cmd.exe 109 PID 4748 wrote to memory of 1792 4748 cmd.exe 110 PID 4748 wrote to memory of 1792 4748 cmd.exe 110 PID 4748 wrote to memory of 1348 4748 cmd.exe 111 PID 4748 wrote to memory of 1348 4748 cmd.exe 111 PID 4748 wrote to memory of 5088 4748 cmd.exe 112 PID 4748 wrote to memory of 5088 4748 cmd.exe 112 PID 4748 wrote to memory of 2492 4748 cmd.exe 113 PID 4748 wrote to memory of 2492 4748 cmd.exe 113 PID 4748 wrote to memory of 1456 4748 cmd.exe 114 PID 4748 wrote to memory of 1456 4748 cmd.exe 114 PID 4748 wrote to memory of 3388 4748 cmd.exe 115 PID 4748 wrote to memory of 3388 4748 cmd.exe 115 PID 4748 wrote to memory of 1848 4748 cmd.exe 116 PID 4748 wrote to memory of 1848 4748 cmd.exe 116 PID 4748 wrote to memory of 4896 4748 cmd.exe 117 PID 4748 wrote to memory of 4896 4748 cmd.exe 117 PID 4748 wrote to memory of 2668 4748 cmd.exe 118 PID 4748 wrote to memory of 2668 4748 cmd.exe 118
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cleaners\clean1.bat"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Electronic Arts\EA Core\Staging\194908\ergc" /f2⤵PID:1660
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Electronic Arts" /f2⤵PID:3380
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Respawn\Apex\Product GUID" /f2⤵PID:3100
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\origin" /f2⤵PID:2908
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\origin2" /f2⤵PID:1540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\origin" /f2⤵PID:2260
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\origin2" /f2⤵PID:2604
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\Applications\Origin.exe" /f2⤵PID:4564
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\Applications\Origin.exe" /f2⤵PID:3712
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.Origin" /f2⤵PID:4084
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\Origin Client Service" /f2⤵PID:3556
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\Origin Web Helper Service" /f2⤵PID:3776
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Origin Client Service" /f2⤵PID:1648
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Origin Web Helper Service" /f2⤵PID:464
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Origin.exe" /f2⤵PID:1248
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\Applications\Origin.exe" /f2⤵PID:3704
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\Applications\Origin.exe" /f2⤵PID:2080
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.Origin" /f2⤵PID:3464
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /f2⤵PID:1032
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /f2⤵PID:4676
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /f2⤵PID:4444
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /f2⤵PID:552
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /f2⤵PID:1528
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /f2⤵PID:1792
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad" /f2⤵PID:1348
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93" /f2⤵PID:5088
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93\ac" /f2⤵PID:2492
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93" /f2⤵PID:1456
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93\ad" /f2⤵PID:3388
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180" /f2⤵PID:1848
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181" /f2⤵PID:4896
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182" /f2⤵PID:2668
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\180" /f2⤵PID:3992
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:940
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:3168
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:1932
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:4228
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:2544
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:1100
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:4416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:3780
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:1652
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:4540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:676
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:1204
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:1352
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:1412
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:4944
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:3756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:3240
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:5028
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f2⤵PID:1400
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f2⤵PID:3596
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security" /f2⤵PID:3024
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f2⤵PID:1564
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat\Security" /f2⤵PID:1288
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Classes\Installer\Dependencies" /v MSICache /f2⤵PID:3440
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f2⤵PID:1504
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /f2⤵
- Checks processor information in registry
PID:4384
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /f2⤵PID:532
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /f2⤵PID:4524
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /f2⤵PID:1048
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /f2⤵PID:4780
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /f2⤵PID:4320
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /f2⤵PID:4388
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad" /f2⤵PID:2152
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93" /f2⤵PID:4464
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93\ac" /f2⤵PID:4832
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93" /f2⤵PID:2344
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93\ad" /f2⤵PID:2704
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180" /f2⤵PID:4808
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181" /f2⤵PID:4888
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182" /f2⤵PID:2264
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\180" /f2⤵PID:2328
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\181" /f2⤵PID:4100
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\182" /f2⤵PID:4960
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /f2⤵PID:4348
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /f2⤵PID:1912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:4452
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:372
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:748
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:3468
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:324
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:3444
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:4852
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:4172
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:316
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:2596
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:4404
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:216
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:3568
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:2736
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:436
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:1996
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:2416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\kz2LMQg4+pNfXggv65DcWFQ9SiekWR4B4WMWT+pcqbU: 0x00000002" /f2⤵PID:3288
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\4JSyFFDDKUMXDyK2USgAjbiksFnqOb3f8RPZBPSpEfU: 0x00000002" /f2⤵PID:3216
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\62bDlCzxB/xxIWLkQdDRYcAqhmZhNOMUtjhRkAgTvkQ: 0x00000002" /f2⤵PID:740
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Package: 0x00000181" /f2⤵PID:1128
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Index: 0x00000000" /f2⤵PID:2388
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Flags: 0x00000000" /f2⤵PID:4860
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\PackageRelativeApplicationId: "App"" /f2⤵PID:752
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:3332
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Executable: "GameBar.exe"" /f2⤵PID:4724
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Entrypoint: "GameBar.App"" /f2⤵PID:1428
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\StartPage: (NULL!)" /f2⤵PID:876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\_IndexKeys: 50 61 63 6B 61 67 65 5C 31 38 31 5C 39 33 00 50 61 63 6B 61 67 65 41 6E 64 50 61 63 6B 61 67 65 52 65 6C 61 74 69 76 65 41 70 70 6C 69 63 61 74 69 6F 6E 49 64 5C 31 38 31 5E 41 70 70 00 00" /f2⤵PID:1664
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\Application: 0x00000093" /f2⤵PID:4876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\User: 0x00000003" /f2⤵PID:4500
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:3920
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\_IndexKeys: 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 5C 33 5E 39 33 00 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 55 73 65 72 4D 6F 64 65 6C 49 64 5C 33 5E 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 21 41 70 70 00 00" /f2⤵PID:1112
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\Application: 0x00000093" /f2⤵PID:1708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\User: 0x00000004" /f2⤵PID:2092
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:5044
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\_IndexKeys: 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 5C 34 5E 39 33 00 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 55 73 65 72 4D 6F 64 65 6C 49 64 5C 34 5E 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 21 41 70 70 00 00" /f2⤵PID:3700
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe"" /f2⤵PID:2016
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageFamily: 0x0000004E" /f2⤵PID:1744
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageType: 0x00000008" /f2⤵PID:1700
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\Flags: 0x00000000" /f2⤵PID:900
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageOrigin: 0x00000003" /f2⤵PID:4468
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\Volume: 0x00000001" /f2⤵PID:4672
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe"" /f2⤵PID:3264
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 30 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 6E 65 75 74 72 61 6C 5F 7E 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:1952
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe"" /f2⤵PID:2276
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageFamily: 0x0000004E" /f2⤵PID:1584
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageType: 0x00000001" /f2⤵PID:812
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\Flags: 0x00000000" /f2⤵PID:4552
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageOrigin: 0x00000003" /f2⤵PID:2836
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\Volume: 0x00000001" /f2⤵PID:4376
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe"" /f2⤵PID:2600
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 31 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 78 36 34 5F 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:4804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale-100_8wekyb3d8bbwe"" /f2⤵PID:2068
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageFamily: 0x0000004E" /f2⤵PID:2580
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageType: 0x00000004" /f2⤵PID:228
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\Flags: 0x00000000" /f2⤵PID:5072
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageOrigin: 0x00000003" /f2⤵PID:3176
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\Volume: 0x00000001" /f2⤵PID:4148
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale-100_8wekyb3d8bbwe"" /f2⤵PID:2280
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 32 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 6E 65 75 74 72 61 6C 5F 73 70 6C 69 74 2E 73 63 61 6C 65 2D 31 30 30 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:4448
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\Package: 0x00000180" /f2⤵PID:536
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\User: 0x00000003" /f2⤵PID:3340
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 30 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 30 00 00" /f2⤵PID:3588
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\Package: 0x00000181" /f2⤵PID:4460
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\User: 0x00000003" /f2⤵PID:4316
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 31 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 31 00 00" /f2⤵PID:3092
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\Package: 0x00000182" /f2⤵PID:4124
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\User: 0x00000003" /f2⤵PID:3536
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 32 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 32 00 00" /f2⤵PID:1252
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\Package: 0x00000180" /f2⤵PID:3968
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\User: 0x00000004" /f2⤵PID:2212
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\_IndexKeys: 55 73 65 72 5C 34 5C 31 61 38 33 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 34 5E 31 38 30 00 00" /f2⤵PID:424
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\Package: 0x00000181" /f2⤵PID:4756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\User: 0x00000004" /f2⤵PID:3740
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\_IndexKeys: 55 73 65 72 5C 34 5C 31 61 38 34 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 34 5E 31 38 31 00 00" /f2⤵PID:4064
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3D39855: 01 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 02 00 1C 00 01 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 0B 00 00 00 04 00 00 00" /f2⤵PID:1500
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3CF4055: 01 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 02 00 1C 00 01 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 0B 00 00 00 04 00 00 00" /f2⤵PID:1640
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f2⤵PID:3684
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862software: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:1536
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_sid: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 2E 64 61 74 00 00" /f2⤵PID:3008
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_classes: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 43 6C 61 73 73 65 73 2E 64 61 74 00 00" /f2⤵PID:400
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Siloe6b4a779-bfe1-62d8-47ac-fa19e9becbbecom: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 5F 43 4F 4D 31 35 2E 64 61 74 00 00" /f2⤵PID:4872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862com: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:1728
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\bam\State\UserType: 0x00000010" /f2⤵PID:2020
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f2⤵PID:4008
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security\Security: 01 00 14 80 A0 00 00 00 AC 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 70 00 05 00 00 00 00 00 14 00 30 00 02 00 01 01 00 00 00 00 00 01 00 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 06 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00" /f2⤵PID:2032
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862software: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:4372
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_sid: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 2E 64 61 74 00 00" /f2⤵PID:3308
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_classes: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 43 6C 61 73 73 65 73 2E 64 61 74 00 00" /f2⤵PID:3692
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Siloe6b4a779-bfe1-62d8-47ac-fa19e9becbbecom: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 5F 43 4F 4D 31 35 2E 64 61 74 00 00" /f2⤵PID:3912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862com: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:4340
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f2⤵PID:4212
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /f2⤵PID:4436
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /f2⤵PID:512
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:3800
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:2672
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:1476
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:4048
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:4856
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:3428
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:2112
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:3852
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:2488
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:2804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:4588
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:1876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:1420
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:2368
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:4492
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:744
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:3448
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:4256
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Type: 0x00000010" /f2⤵PID:4236
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Start: 0x00000003" /f2⤵PID:4052
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ErrorControl: 0x00000001" /f2⤵PID:3180
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ImagePath: ""C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe""" /f2⤵PID:4532
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\DisplayName: "EasyAntiCheat"" /f2⤵PID:3672
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\WOW64: 0x0000014C" /f2⤵PID:3996
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ObjectName: "LocalSystem"" /f2⤵PID:3856
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:4668
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:2364
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:2480
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:4508
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:1376
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:112
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:3148
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:1268
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\0" /f2⤵PID:212
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000205B6" /f2⤵PID:4952
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000403D6" /f2⤵PID:756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000405DE" /f2⤵PID:3324
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060286" /f2⤵PID:5008
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009042E" /f2⤵PID:3432
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A03B4" /f2⤵PID:1340
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A0430" /f2⤵PID:4940
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B0532" /f2⤵PID:2560
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B05D6" /f2⤵PID:832
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0430" /f2⤵PID:4016
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0586" /f2⤵PID:1648
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E03D2" /f2⤵PID:3052
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E0406" /f2⤵PID:3728
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000100430" /f2⤵PID:4068
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001103EE" /f2⤵PID:4836
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000011041E" /f2⤵PID:2192
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000012047E" /f2⤵PID:3096
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001303EE" /f2⤵PID:2988
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001304F2" /f2⤵PID:2304
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000014041E" /f2⤵PID:5080
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001703E6" /f2⤵PID:1528
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000170440" /f2⤵PID:1792
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001704FC" /f2⤵PID:2916
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU" /f2⤵PID:4328
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MrtCache\C:CProgram FilesCWindowsAppsCMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbweCmicrosoft.system.package.metadataCS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri" /f2⤵PID:2612
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:1120
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:924
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:1848
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:3344
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:4816
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:1920
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:1944
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:3696
-
-
C:\Windows\system32\reg.exeREG DELETE "HKEY_CURRENT_USER\Software\Classes\Installer\Dependencies" /v MSICache /f2⤵PID:4304
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:1472
-
-
C:\Windows\system32\netsh.exenetsh interface ip delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4456
-
-
C:\Windows\system32\certutil.execertutil -URLCache * delete2⤵PID:1404
-
-
C:\Windows\system32\netsh.exenetsh int ip reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4540
-
-
C:\Windows\system32\netsh.exenetsh int ipv4 reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3536
-
-
C:\Windows\system32\netsh.exenetsh int ipv6 reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4020
-
-
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2700
-