Overview
overview
9Static
static
7lcb spoofe...er.exe
windows7-x64
1lcb spoofe...er.exe
windows10-2004-x64
1lcb spoofe...er.bat
windows7-x64
1lcb spoofe...er.bat
windows10-2004-x64
1lcb spoofe...er.bat
windows7-x64
1lcb spoofe...er.bat
windows10-2004-x64
1lcb spoofe...ht.bat
windows7-x64
8lcb spoofe...ht.bat
windows10-2004-x64
8lcb spoofe...er.exe
windows7-x64
1lcb spoofe...er.exe
windows10-2004-x64
1lcb spoofe...er.exe
windows7-x64
1lcb spoofe...er.exe
windows10-2004-x64
1lcb spoofe...er.bat
windows7-x64
9lcb spoofe...er.bat
windows10-2004-x64
9lcb spoofe...er.exe
windows7-x64
9lcb spoofe...er.exe
windows10-2004-x64
9lcb spoofe...n1.bat
windows7-x64
7lcb spoofe...n1.bat
windows10-2004-x64
5lcb spoofe...n2.bat
windows7-x64
8lcb spoofe...n2.bat
windows10-2004-x64
8lcb spoofe...n3.bat
windows7-x64
7lcb spoofe...n3.bat
windows10-2004-x64
1lcb spoofe...AC.bat
windows7-x64
4lcb spoofe...AC.bat
windows10-2004-x64
4lcb spoofe...up.exe
windows7-x64
3lcb spoofe...up.exe
windows10-2004-x64
3lcb spoofe...ck.exe
windows7-x64
1lcb spoofe...ck.exe
windows10-2004-x64
1lcb spoofe...64.dll
windows7-x64
1lcb spoofe...64.dll
windows10-2004-x64
1lcb spoofe...64.dll
windows7-x64
1lcb spoofe...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 17:28
Behavioral task
behavioral1
Sample
lcb spoofer_updated_quack/Loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
lcb spoofer_updated_quack/Loader.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
lcb spoofer_updated_quack/Serial Checker.bat
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
lcb spoofer_updated_quack/Serial Checker.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
lcb spoofer_updated_quack/cleaners/FortniteCleaner.bat
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
lcb spoofer_updated_quack/cleaners/FortniteCleaner.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
lcb spoofer_updated_quack/cleaners/Midnight.bat
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
lcb spoofer_updated_quack/cleaners/Midnight.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
lcb spoofer_updated_quack/cleaners/Toruney_Cleaner.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
lcb spoofer_updated_quack/cleaners/Toruney_Cleaner.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
lcb spoofer_updated_quack/cleaners/cleaner.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
lcb spoofer_updated_quack/cleaners/cleaner.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/New Cleaner.bat
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/New Cleaner.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/applecleaner.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/applecleaner.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/clean1.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/clean1.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/clean2.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/clean2.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/clean3.bat
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/clean3.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EAC.bat
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EAC.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EasyAntiCheat_EOS_Setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EasyAntiCheat_EOS_Setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
lcb spoofer_updated_quack/lcb_spoof_crack.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
lcb spoofer_updated_quack/lcb_spoof_crack.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
lcb spoofer_updated_quack/libcrypto-3-x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
lcb spoofer_updated_quack/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
lcb spoofer_updated_quack/libssl-3-x64.dll
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
lcb spoofer_updated_quack/libssl-3-x64.dll
Resource
win10v2004-20241007-en
General
-
Target
lcb spoofer_updated_quack/cleaners/leakedshit/clean1.bat
-
Size
567KB
-
MD5
4bf8dd140901a615b1a5fa5136728521
-
SHA1
00e8b5a27ecea6d6a9c52739f15a71c5559724c7
-
SHA256
e2b6ce87a5fa871709665b0306e15d45cd7b5550a4de6701a8ce31e811a646ed
-
SHA512
5600ff59e7383fafc77ca98849b34c784fb85a86c2b6bb0d7cde2aec83c0db026f84cce7259ad3c20aec75a561f97150563e6f1068e9f9993bd4443ef4eb7537
-
SSDEEP
1536:iYLmcHjAkpYLmcTzg8gFDRnvplGL5LvLpLjLw3z5z5z5zg:iYScHNYScTzg8gRRnvpFz5z5z5zg
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\LogFiles\WMI\MICROS~1.ETL cmd.exe File opened for modification C:\Windows\System32\LogFiles\WMI\DIAGTR~1.005 cmd.exe File opened for modification C:\Windows\System32\LogFiles\WMI\LWTNET~1.ETL cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\.NETFramework\corperfmonsymbols.ini cmd.exe File opened for modification C:\Windows\INF\mdmcpq2.inf cmd.exe File opened for modification C:\Windows\INF\mdmcrtix.inf cmd.exe File opened for modification C:\Windows\INF\netirda.inf cmd.exe File opened for modification C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0407\PerfCounters_d.ini cmd.exe File opened for modification C:\Windows\INF\c_volsnap.inf cmd.exe File opened for modification C:\Windows\INF\iastorav.inf cmd.exe File opened for modification C:\Windows\INF\mdmbtmdm.inf cmd.exe File opened for modification C:\Windows\INF\mdmcommu.inf cmd.exe File opened for modification C:\Windows\INF\sti.inf cmd.exe File opened for modification C:\Windows\INF\c_cdrom.inf cmd.exe File opened for modification C:\Windows\INF\c_proximity.inf cmd.exe File opened for modification C:\Windows\INF\ESENT\0410\esentprf.ini cmd.exe File opened for modification C:\Windows\INF\mdmsupra.inf cmd.exe File opened for modification C:\Windows\INF\netnb.inf cmd.exe File opened for modification C:\Windows\INF\.NET Data Provider for Oracle\0407\_DataOracleClientPerfCounters_shared12_neutral_d.ini cmd.exe File opened for modification C:\Windows\INF\hidscanner.inf cmd.exe File opened for modification C:\Windows\INF\netmyk64.inf cmd.exe File opened for modification C:\Windows\INF\UGatherer\0411\gsrvctr.ini cmd.exe File opened for modification C:\Windows\INF\.NET Memory Cache 4.0\0C0A\netmemorycache_d.ini cmd.exe File opened for modification C:\Windows\INF\c_memory.inf cmd.exe File opened for modification C:\Windows\INF\c_pnpprinters.inf cmd.exe File opened for modification C:\Windows\INF\tdibth.inf cmd.exe File opened for modification C:\Windows\INF\netsstpa.inf cmd.exe File opened for modification C:\Windows\INF\sdbus.inf cmd.exe File opened for modification C:\Windows\INF\hidcfu.inf cmd.exe File opened for modification C:\Windows\INF\netl1e64.inf cmd.exe File opened for modification C:\Windows\INF\puwk.inf cmd.exe File opened for modification C:\Windows\INF\mdmusrg.inf cmd.exe File opened for modification C:\Windows\INF\ndisimplatform.inf cmd.exe File opened for modification C:\Windows\INF\net1ic64.inf cmd.exe File opened for modification C:\Windows\INF\UGatherer\0000\gsrvctr.ini cmd.exe File opened for modification C:\Windows\INF\1394.inf cmd.exe File opened for modification C:\Windows\INF\netrtwlane.inf cmd.exe File opened for modification C:\Windows\INF\spaceport.inf cmd.exe File opened for modification C:\Windows\INF\.NET CLR Data\_DataPerfCounters.ini cmd.exe File opened for modification C:\Windows\INF\.NET Memory Cache 4.0\0411\netmemorycache_d.ini cmd.exe File opened for modification C:\Windows\INF\BthOob.inf cmd.exe File opened for modification C:\Windows\INF\lltdio.inf cmd.exe File opened for modification C:\Windows\INF\sdstor.inf cmd.exe File opened for modification C:\Windows\INF\whyperkbd.inf cmd.exe File opened for modification C:\Windows\INF\basicrender.inf cmd.exe File opened for modification C:\Windows\INF\BthLCPen.inf cmd.exe File opened for modification C:\Windows\INF\c_tapedrive.inf cmd.exe File opened for modification C:\Windows\INF\netpacer.inf cmd.exe File opened for modification C:\Windows\INF\netxex64.inf cmd.exe File opened for modification C:\Windows\INF\wceisvista.inf cmd.exe File opened for modification C:\Windows\INF\c_net.inf cmd.exe File opened for modification C:\Windows\INF\mdmcom1.inf cmd.exe File opened for modification C:\Windows\INF\MSDTCB~1.0\040C\_TransactionBridgePerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\netrtwlanu.inf cmd.exe File opened for modification C:\Windows\INF\TAPISRV\0409\tapiperf.ini cmd.exe File opened for modification C:\Windows\INF\wsearchidxpi\0409\idxcntrs.ini cmd.exe File opened for modification C:\Windows\INF\c_magneticstripereader.inf cmd.exe File opened for modification C:\Windows\INF\microsoft_bluetooth_avrcptransport.inf cmd.exe File opened for modification C:\Windows\INF\net8185.inf cmd.exe File opened for modification C:\Windows\INF\scrawpdo.inf cmd.exe File opened for modification C:\Windows\INF\prnms012.inf cmd.exe File opened for modification C:\Windows\INF\SERVIC~1.0\0C0A\_ServiceModelEndpointPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\c_netclient.inf cmd.exe File opened for modification C:\Windows\INF\hiddigi.inf cmd.exe File opened for modification C:\Windows\INF\mdmlasno.inf cmd.exe File opened for modification C:\Windows\INF\TAPISRV\perfctr.h cmd.exe File opened for modification C:\Windows\INF\.NETFramework\0407\corperfmonsymbols_d.ini cmd.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 reg.exe Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1132 ipconfig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1844 1964 cmd.exe 88 PID 1964 wrote to memory of 1844 1964 cmd.exe 88 PID 1964 wrote to memory of 5040 1964 cmd.exe 89 PID 1964 wrote to memory of 5040 1964 cmd.exe 89 PID 1964 wrote to memory of 2832 1964 cmd.exe 90 PID 1964 wrote to memory of 2832 1964 cmd.exe 90 PID 1964 wrote to memory of 3132 1964 cmd.exe 91 PID 1964 wrote to memory of 3132 1964 cmd.exe 91 PID 1964 wrote to memory of 3416 1964 cmd.exe 92 PID 1964 wrote to memory of 3416 1964 cmd.exe 92 PID 1964 wrote to memory of 2540 1964 cmd.exe 93 PID 1964 wrote to memory of 2540 1964 cmd.exe 93 PID 1964 wrote to memory of 4976 1964 cmd.exe 94 PID 1964 wrote to memory of 4976 1964 cmd.exe 94 PID 1964 wrote to memory of 3708 1964 cmd.exe 95 PID 1964 wrote to memory of 3708 1964 cmd.exe 95 PID 1964 wrote to memory of 3620 1964 cmd.exe 96 PID 1964 wrote to memory of 3620 1964 cmd.exe 96 PID 1964 wrote to memory of 1956 1964 cmd.exe 97 PID 1964 wrote to memory of 1956 1964 cmd.exe 97 PID 1964 wrote to memory of 3888 1964 cmd.exe 98 PID 1964 wrote to memory of 3888 1964 cmd.exe 98 PID 1964 wrote to memory of 4716 1964 cmd.exe 99 PID 1964 wrote to memory of 4716 1964 cmd.exe 99 PID 1964 wrote to memory of 1136 1964 cmd.exe 100 PID 1964 wrote to memory of 1136 1964 cmd.exe 100 PID 1964 wrote to memory of 1764 1964 cmd.exe 101 PID 1964 wrote to memory of 1764 1964 cmd.exe 101 PID 1964 wrote to memory of 2316 1964 cmd.exe 102 PID 1964 wrote to memory of 2316 1964 cmd.exe 102 PID 1964 wrote to memory of 2076 1964 cmd.exe 103 PID 1964 wrote to memory of 2076 1964 cmd.exe 103 PID 1964 wrote to memory of 552 1964 cmd.exe 104 PID 1964 wrote to memory of 552 1964 cmd.exe 104 PID 1964 wrote to memory of 848 1964 cmd.exe 105 PID 1964 wrote to memory of 848 1964 cmd.exe 105 PID 1964 wrote to memory of 4080 1964 cmd.exe 106 PID 1964 wrote to memory of 4080 1964 cmd.exe 106 PID 1964 wrote to memory of 1924 1964 cmd.exe 107 PID 1964 wrote to memory of 1924 1964 cmd.exe 107 PID 1964 wrote to memory of 1848 1964 cmd.exe 108 PID 1964 wrote to memory of 1848 1964 cmd.exe 108 PID 1964 wrote to memory of 4152 1964 cmd.exe 109 PID 1964 wrote to memory of 4152 1964 cmd.exe 109 PID 1964 wrote to memory of 1920 1964 cmd.exe 110 PID 1964 wrote to memory of 1920 1964 cmd.exe 110 PID 1964 wrote to memory of 396 1964 cmd.exe 111 PID 1964 wrote to memory of 396 1964 cmd.exe 111 PID 1964 wrote to memory of 1556 1964 cmd.exe 112 PID 1964 wrote to memory of 1556 1964 cmd.exe 112 PID 1964 wrote to memory of 424 1964 cmd.exe 113 PID 1964 wrote to memory of 424 1964 cmd.exe 113 PID 1964 wrote to memory of 5008 1964 cmd.exe 114 PID 1964 wrote to memory of 5008 1964 cmd.exe 114 PID 1964 wrote to memory of 1644 1964 cmd.exe 115 PID 1964 wrote to memory of 1644 1964 cmd.exe 115 PID 1964 wrote to memory of 1148 1964 cmd.exe 116 PID 1964 wrote to memory of 1148 1964 cmd.exe 116 PID 1964 wrote to memory of 3088 1964 cmd.exe 117 PID 1964 wrote to memory of 3088 1964 cmd.exe 117 PID 1964 wrote to memory of 1496 1964 cmd.exe 118 PID 1964 wrote to memory of 1496 1964 cmd.exe 118 PID 1964 wrote to memory of 4280 1964 cmd.exe 119 PID 1964 wrote to memory of 4280 1964 cmd.exe 119
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\leakedshit\clean1.bat"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Electronic Arts\EA Core\Staging\194908\ergc" /f2⤵PID:1844
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Electronic Arts" /f2⤵PID:5040
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Respawn\Apex\Product GUID" /f2⤵PID:2832
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\origin" /f2⤵PID:3132
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\origin2" /f2⤵PID:3416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\origin" /f2⤵PID:2540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\origin2" /f2⤵PID:4976
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\Applications\Origin.exe" /f2⤵PID:3708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\Applications\Origin.exe" /f2⤵PID:3620
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.Origin" /f2⤵PID:1956
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\Origin Client Service" /f2⤵PID:3888
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\Origin Web Helper Service" /f2⤵PID:4716
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Origin Client Service" /f2⤵PID:1136
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Origin Web Helper Service" /f2⤵PID:1764
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Origin.exe" /f2⤵PID:2316
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCR\Applications\Origin.exe" /f2⤵PID:2076
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Classes\Applications\Origin.exe" /f2⤵PID:552
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.Origin" /f2⤵PID:848
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /f2⤵PID:4080
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /f2⤵PID:1924
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /f2⤵PID:1848
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /f2⤵PID:4152
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /f2⤵PID:1920
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /f2⤵PID:396
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad" /f2⤵PID:1556
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93" /f2⤵PID:424
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93\ac" /f2⤵PID:5008
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93" /f2⤵PID:1644
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93\ad" /f2⤵PID:1148
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180" /f2⤵PID:3088
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181" /f2⤵PID:1496
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182" /f2⤵PID:4280
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\180" /f2⤵PID:1580
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:1240
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:3832
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:2928
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:964
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:2488
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:5000
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:3608
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:4600
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:2768
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:3604
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:1324
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:2860
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:3000
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:4612
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:3460
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:2604
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:1540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:1752
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f2⤵PID:2240
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f2⤵PID:1756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security" /f2⤵PID:1276
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f2⤵PID:3036
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat\Security" /f2⤵PID:3756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Classes\Installer\Dependencies" /v MSICache /f2⤵PID:2940
-
-
C:\Windows\system32\reg.exeREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f2⤵PID:2752
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /f2⤵
- Checks processor information in registry
PID:3360
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /f2⤵PID:4416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /f2⤵PID:5080
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /f2⤵PID:4872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /f2⤵PID:912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /f2⤵PID:2888
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /f2⤵PID:2984
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad" /f2⤵PID:4472
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93" /f2⤵PID:1176
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\3^93\ac" /f2⤵PID:4888
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93" /f2⤵PID:3576
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\4^93\ad" /f2⤵PID:2624
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180" /f2⤵PID:3956
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181" /f2⤵PID:1904
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182" /f2⤵PID:2780
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\180" /f2⤵PID:4380
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\181" /f2⤵PID:4756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\182" /f2⤵PID:2332
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /f2⤵PID:4732
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /f2⤵PID:4544
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:4692
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:2312
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:2136
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:4300
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:4452
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:1432
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:1180
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:4712
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:2596
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:2708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:4824
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:2828
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:1280
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:5028
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:4708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:5012
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:3400
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\kz2LMQg4+pNfXggv65DcWFQ9SiekWR4B4WMWT+pcqbU: 0x00000002" /f2⤵PID:3844
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\4JSyFFDDKUMXDyK2USgAjbiksFnqOb3f8RPZBPSpEfU: 0x00000002" /f2⤵PID:2020
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\62bDlCzxB/xxIWLkQdDRYcAqhmZhNOMUtjhRkAgTvkQ: 0x00000002" /f2⤵PID:2816
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Package: 0x00000181" /f2⤵PID:1400
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Index: 0x00000000" /f2⤵PID:3704
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Flags: 0x00000000" /f2⤵PID:2912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\PackageRelativeApplicationId: "App"" /f2⤵PID:2428
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:1828
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Executable: "GameBar.exe"" /f2⤵PID:2084
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\Entrypoint: "GameBar.App"" /f2⤵PID:1736
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\StartPage: (NULL!)" /f2⤵PID:3184
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93\_IndexKeys: 50 61 63 6B 61 67 65 5C 31 38 31 5C 39 33 00 50 61 63 6B 61 67 65 41 6E 64 50 61 63 6B 61 67 65 52 65 6C 61 74 69 76 65 41 70 70 6C 69 63 61 74 69 6F 6E 49 64 5C 31 38 31 5E 41 70 70 00 00" /f2⤵PID:4700
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\Application: 0x00000093" /f2⤵PID:2916
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\User: 0x00000003" /f2⤵PID:1924
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:4876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac\_IndexKeys: 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 5C 33 5E 39 33 00 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 55 73 65 72 4D 6F 64 65 6C 49 64 5C 33 5E 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 21 41 70 70 00 00" /f2⤵PID:2924
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\Application: 0x00000093" /f2⤵PID:4320
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\User: 0x00000004" /f2⤵PID:2212
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\ApplicationUserModelId: "Microsoft.XboxGameOverlay_8wekyb3d8bbwe!App"" /f2⤵PID:4252
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ad\_IndexKeys: 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 5C 34 5E 39 33 00 55 73 65 72 41 6E 64 41 70 70 6C 69 63 61 74 69 6F 6E 55 73 65 72 4D 6F 64 65 6C 49 64 5C 34 5E 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 21 41 70 70 00 00" /f2⤵PID:4992
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe"" /f2⤵PID:1256
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageFamily: 0x0000004E" /f2⤵PID:1652
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageType: 0x00000008" /f2⤵PID:1328
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\Flags: 0x00000000" /f2⤵PID:1804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\PackageOrigin: 0x00000003" /f2⤵PID:836
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\Volume: 0x00000001" /f2⤵PID:1236
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe"" /f2⤵PID:1620
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\180\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 30 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 6E 65 75 74 72 61 6C 5F 7E 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:2544
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe"" /f2⤵PID:716
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageFamily: 0x0000004E" /f2⤵PID:4008
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageType: 0x00000001" /f2⤵PID:4912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\Flags: 0x00000000" /f2⤵PID:3060
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\PackageOrigin: 0x00000003" /f2⤵PID:2244
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\Volume: 0x00000001" /f2⤵PID:4904
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe"" /f2⤵PID:3976
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\181\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 31 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 78 36 34 5F 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:1568
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageFullName: "Microsoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale-100_8wekyb3d8bbwe"" /f2⤵PID:2688
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageFamily: 0x0000004E" /f2⤵PID:1352
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageType: 0x00000004" /f2⤵PID:4868
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\Flags: 0x00000000" /f2⤵PID:4072
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\PackageOrigin: 0x00000003" /f2⤵PID:5020
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\Volume: 0x00000001" /f2⤵PID:4160
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\InstalledLocation: "C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale-100_8wekyb3d8bbwe"" /f2⤵PID:4832
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\182\_IndexKeys: 50 61 63 6B 61 67 65 46 61 6D 69 6C 79 5C 34 65 5C 31 38 32 00 50 61 63 6B 61 67 65 46 75 6C 6C 4E 61 6D 65 5C 4D 69 63 72 6F 73 6F 66 74 2E 58 62 6F 78 47 61 6D 65 4F 76 65 72 6C 61 79 5F 31 2E 34 31 2E 32 34 30 30 31 2E 30 5F 6E 65 75 74 72 61 6C 5F 73 70 6C 69 74 2E 73 63 61 6C 65 2D 31 30 30 5F 38 77 65 6B 79 62 33 64 38 62 62 77 65 00 00" /f2⤵PID:4076
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\Package: 0x00000180" /f2⤵PID:3220
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\User: 0x00000003" /f2⤵PID:1112
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 30 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 30 00 00" /f2⤵PID:2636
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\Package: 0x00000181" /f2⤵PID:4632
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\User: 0x00000003" /f2⤵PID:4648
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 31 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 31 00 00" /f2⤵PID:2144
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\Package: 0x00000182" /f2⤵PID:3120
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\User: 0x00000003" /f2⤵PID:4204
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82\_IndexKeys: 55 73 65 72 5C 33 5C 31 61 38 32 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 33 5E 31 38 32 00 00" /f2⤵PID:2732
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\Package: 0x00000180" /f2⤵PID:4416
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\User: 0x00000004" /f2⤵PID:5080
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83\_IndexKeys: 55 73 65 72 5C 34 5C 31 61 38 33 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 34 5E 31 38 30 00 00" /f2⤵PID:4872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\Package: 0x00000181" /f2⤵PID:912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\User: 0x00000004" /f2⤵PID:2888
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84\_IndexKeys: 55 73 65 72 5C 34 5C 31 61 38 34 00 55 73 65 72 41 6E 64 50 61 63 6B 61 67 65 5C 34 5E 31 38 31 00 00" /f2⤵PID:2984
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3D39855: 01 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 02 00 1C 00 01 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 0B 00 00 00 04 00 00 00" /f2⤵PID:4472
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3CF4055: 01 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 02 00 1C 00 01 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 0B 00 00 00 04 00 00 00" /f2⤵PID:1176
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f2⤵PID:4888
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862software: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:4092
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_sid: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 2E 64 61 74 00 00" /f2⤵PID:3576
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_classes: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 43 6C 61 73 73 65 73 2E 64 61 74 00 00" /f2⤵PID:3956
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Siloe6b4a779-bfe1-62d8-47ac-fa19e9becbbecom: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 5F 43 4F 4D 31 35 2E 64 61 74 00 00" /f2⤵PID:1904
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862com: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:2780
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\bam\State\UserType: 0x00000010" /f2⤵PID:4380
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f2⤵PID:4756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security\Security: 01 00 14 80 A0 00 00 00 AC 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 70 00 05 00 00 00 00 00 14 00 30 00 02 00 01 01 00 00 00 00 00 01 00 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 06 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00" /f2⤵PID:2332
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862software: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:1372
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_sid: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 2E 64 61 74 00 00" /f2⤵PID:3024
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862user_classes: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 55 73 65 72 43 6C 61 73 73 65 73 2E 64 61 74 00 00" /f2⤵PID:700
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Siloe6b4a779-bfe1-62d8-47ac-fa19e9becbbecom: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 5F 43 4F 4D 31 35 2E 64 61 74 00 00" /f2⤵PID:2908
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\hivelist\\REGISTRY\WC\Silo19faac47-bee9-becb-79a7-b4e6e1bfd862com: 5C 44 65 76 69 63 65 5C 48 61 72 64 64 69 73 6B 56 6F 6C 75 6D 65 33 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 50 61 63 6B 61 67 65 73 5C 4D 69 63 72 6F 73 6F 66 74 2E 53 6B 79 70 65 41 70 70 5F 6B 7A 66 38 71 78 66 33 38 7A 67 35 63 5C 53 2D 31 2D 35 2D 32 31 2D 32 35 33 32 33 38 32 35 32 38 2D 35 38 31 32 31 34 38 33 34 2D 32 35 33 34 34 37 34 32 34 38 2D 31 30 30 31 5C 53 79 73 74 65 6D 41 70 70 44 61 74 61 5C 48 65 6C 69 75 6D 5C 43 61 63 68 65 5C 35 63 38 63 62 62 36 61 61 37 65 61 31 34 32 34 2E 64 61 74 00 00" /f2⤵PID:4308
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f2⤵PID:1960
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /f2⤵PID:1432
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /f2⤵PID:324
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a82" /f2⤵PID:3540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a83" /f2⤵PID:2228
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a84" /f2⤵PID:2128
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a80" /f2⤵PID:2708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a81" /f2⤵PID:1060
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\3\1a82" /f2⤵PID:2828
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a83" /f2⤵PID:1280
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\User\4\1a84" /f2⤵PID:5028
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180" /f2⤵PID:4708
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^180\1a80" /f2⤵PID:5012
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181" /f2⤵PID:3400
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^181\1a81" /f2⤵PID:3844
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182" /f2⤵PID:2020
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\3^182\1a82" /f2⤵PID:2816
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180" /f2⤵PID:1400
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^180\1a83" /f2⤵PID:3704
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181" /f2⤵PID:2912
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Index\UserAndPackage\4^181\1a84" /f2⤵PID:2428
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Type: 0x00000010" /f2⤵PID:1828
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Start: 0x00000003" /f2⤵PID:2084
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ErrorControl: 0x00000001" /f2⤵PID:1736
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ImagePath: ""C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe""" /f2⤵PID:3184
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\DisplayName: "EasyAntiCheat"" /f2⤵PID:1384
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\WOW64: 0x0000014C" /f2⤵PID:4700
-
-
C:\Windows\system32\reg.exeREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ObjectName: "LocalSystem"" /f2⤵PID:1924
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:4876
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:2924
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:4320
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:2212
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:4252
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:4992
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:1256
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:1652
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\0" /f2⤵PID:1328
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000205B6" /f2⤵PID:1804
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000403D6" /f2⤵PID:836
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000405DE" /f2⤵PID:1236
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060286" /f2⤵PID:1620
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009042E" /f2⤵PID:2544
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A03B4" /f2⤵PID:4512
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A0430" /f2⤵PID:5000
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B0532" /f2⤵PID:1688
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B05D6" /f2⤵PID:3180
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0430" /f2⤵PID:3500
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0586" /f2⤵PID:4548
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E03D2" /f2⤵PID:1424
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E0406" /f2⤵PID:1188
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000100430" /f2⤵PID:1992
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001103EE" /f2⤵PID:1380
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000011041E" /f2⤵PID:3460
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000012047E" /f2⤵PID:4760
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001303EE" /f2⤵PID:4828
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001304F2" /f2⤵PID:4540
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000014041E" /f2⤵PID:4704
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001703E6" /f2⤵PID:1756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000170440" /f2⤵PID:1276
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001704FC" /f2⤵PID:3036
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU" /f2⤵PID:3756
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MrtCache\C:CProgram FilesCWindowsAppsCMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbweCmicrosoft.system.package.metadataCS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri" /f2⤵PID:2144
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:3120
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:4204
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:4404
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:2408
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher" /f2⤵PID:3100
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates" /f2⤵PID:4872
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs" /f2⤵PID:1012
-
-
C:\Windows\system32\reg.exeREG DELETE "HKU\S-1-5-18\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs" /f2⤵PID:4536
-
-
C:\Windows\system32\reg.exeREG DELETE "HKEY_CURRENT_USER\Software\Classes\Installer\Dependencies" /v MSICache /f2⤵PID:1948
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:1132
-
-
C:\Windows\system32\netsh.exenetsh interface ip delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3384
-
-
C:\Windows\system32\certutil.execertutil -URLCache * delete2⤵PID:2504
-
-
C:\Windows\system32\netsh.exenetsh int ip reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1364
-
-
C:\Windows\system32\netsh.exenetsh int ipv4 reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4732
-
-
C:\Windows\system32\netsh.exenetsh int ipv6 reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2956
-
-
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3024
-