4eccca4eba74d76934827596ec0c7b2bc0f7db149dfc5fb1bb5cf8a4f4b7cf79

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dimmi/x64/Release/Spoof/Cleaners/clean4.bat
Size 1.4MB
Sample260604-s2vdmsaw2j
SHA256 4eccca4eba74d76934827596ec0c7b2bc0f7db149dfc5fb1bb5cf8a4f4b7cf79
MD5 49f9f195b3c0bd82a2b5bcfef94be391
SHA1 4be260b5bd5d442c39b9cb792f1ffba09d851df9
SHA512 e612bc43843f9b244c89418be49f460240cf78c1aeb050b60af2f3867f25eb5db86f15841ce90daa99fc69ef9c5e0d144d0afaada8dbd92a30e4269a9971e392
SSDEEP 12288:tcFSOojunYATI9sMrPkuipWvDIkORU14n7:eFSOojunYATI9sMrPkuipWvDIkORV7
TLSH
T197657400A2259272D4A321C8D3DF991D39BCD18732A07B9352E56E4DDC8E83C557FEEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\READYB~1\READYB~1.ETL	cmd.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6092	sc.exe
3860	sc.exe
2948	sc.exe
3976	sc.exe
1052	sc.exe
3076	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3076	sc.exe
6092	sc.exe
3860	sc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3616	Process not Found
5764	Process not Found

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\P8Dph	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\HLfhM	Process not Found
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\QVSYrBhYbFTc	Process not Found

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
4988	taskkill.exe
3676	taskkill.exe
1020	taskkill.exe
1244	taskkill.exe
6040	taskkill.exe
2036	taskkill.exe
2532	taskkill.exe
1084	taskkill.exe
5264	taskkill.exe
2128	taskkill.exe
4556	taskkill.exe
4004	taskkill.exe
5460	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	2532	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	5460	taskkill.exe
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	5264	taskkill.exe
Token: SeDebugPrivilege	1020	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1620	4492	cmd.exe	91
PID 4492 wrote to memory of 1584	4492	cmd.exe	92
PID 4492 wrote to memory of 1244	4492	cmd.exe	93
PID 4492 wrote to memory of 2128	4492	cmd.exe	96
PID 4492 wrote to memory of 4556	4492	cmd.exe	97
PID 4492 wrote to memory of 6040	4492	cmd.exe	98
PID 4492 wrote to memory of 2036	4492	cmd.exe	99
PID 4492 wrote to memory of 2532	4492	cmd.exe	100
PID 4492 wrote to memory of 4004	4492	cmd.exe	101
PID 4492 wrote to memory of 1052	4492	cmd.exe	102
PID 4492 wrote to memory of 3076	4492	cmd.exe	103
PID 4492 wrote to memory of 6092	4492	cmd.exe	104
PID 4492 wrote to memory of 3860	4492	cmd.exe	105
PID 4492 wrote to memory of 2948	4492	cmd.exe	106
PID 4492 wrote to memory of 3976	4492	cmd.exe	107
PID 4492 wrote to memory of 5460	4492	cmd.exe	108
PID 4492 wrote to memory of 4988	4492	cmd.exe	109
PID 4492 wrote to memory of 1084	4492	cmd.exe	110
PID 4492 wrote to memory of 3676	4492	cmd.exe	111
PID 4492 wrote to memory of 5264	4492	cmd.exe	112
PID 4492 wrote to memory of 1020	4492	cmd.exe	113
PID 4492 wrote to memory of 3572	4492	cmd.exe	114
PID 4492 wrote to memory of 5828	4492	cmd.exe	116
PID 4492 wrote to memory of 2424	4492	cmd.exe	117
PID 4492 wrote to memory of 4948	4492	cmd.exe	118
PID 4492 wrote to memory of 3292	4492	cmd.exe	119
PID 4492 wrote to memory of 3476	4492	cmd.exe	125
PID 4492 wrote to memory of 2852	4492	cmd.exe	126
PID 4492 wrote to memory of 3724	4492	cmd.exe	127
PID 4492 wrote to memory of 3168	4492	cmd.exe	128
PID 4492 wrote to memory of 4628	4492	cmd.exe	129
PID 4492 wrote to memory of 3284	4492	cmd.exe	130
PID 4492 wrote to memory of 1300	4492	cmd.exe	131
PID 4492 wrote to memory of 3496	4492	cmd.exe	132
PID 4492 wrote to memory of 3568	4492	cmd.exe	133
PID 4492 wrote to memory of 5140	4492	cmd.exe	134
PID 4492 wrote to memory of 3744	4492	cmd.exe	135
PID 4492 wrote to memory of 1608	4492	cmd.exe	136
PID 4492 wrote to memory of 4560	4492	cmd.exe	137
PID 4492 wrote to memory of 4580	4492	cmd.exe	138
PID 4492 wrote to memory of 5940	4492	cmd.exe	139
PID 4492 wrote to memory of 4308	4492	cmd.exe	140
PID 4492 wrote to memory of 4424	4492	cmd.exe	141
PID 4492 wrote to memory of 4572	4492	cmd.exe	142
PID 4492 wrote to memory of 4408	4492	cmd.exe	143
PID 4492 wrote to memory of 6096	4492	cmd.exe	144
PID 4492 wrote to memory of 1776	4492	cmd.exe	145
PID 4492 wrote to memory of 4716	4492	cmd.exe	146
PID 4492 wrote to memory of 2980	4492	cmd.exe	147
PID 4492 wrote to memory of 4900	4492	cmd.exe	148
PID 4492 wrote to memory of 4816	4492	cmd.exe	149
PID 4492 wrote to memory of 3512	4492	cmd.exe	150
PID 4492 wrote to memory of 4516	4492	cmd.exe	151
PID 4492 wrote to memory of 5228	4492	cmd.exe	152
PID 4492 wrote to memory of 5504	4492	cmd.exe	153
PID 4492 wrote to memory of 1724	4492	cmd.exe	154
PID 4492 wrote to memory of 5800	4492	cmd.exe	155
PID 4492 wrote to memory of 2628	4492	cmd.exe	156
PID 4492 wrote to memory of 1888	4492	cmd.exe	157
PID 4492 wrote to memory of 2012	4492	cmd.exe	158
PID 4492 wrote to memory of 1948	4492	cmd.exe	159
PID 4492 wrote to memory of 5916	4492	cmd.exe	160
PID 4492 wrote to memory of 5516	4492	cmd.exe	161
PID 4492 wrote to memory of 2444	4492	cmd.exe	162

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dimmi\x64\Release\Spoof\Cleaners\clean4.bat"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f"
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f"
  2⤵
  PID:1584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC_EOS.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:1052
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC_EOS
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3076
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6092
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_BE
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3860
- C:\Windows\system32\sc.exe
  sc stop NvContainerLocalSystem
  2⤵
  - Launches sc.exe
  PID:2948
- C:\Windows\system32\sc.exe
  sc stop NVDisplay.ContainerLocalSystem
  2⤵
  - Launches sc.exe
  PID:3976
- C:\Windows\system32\taskkill.exe
  taskkill /f /im nvcontainer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im NVDisplay.Container.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "NVIDIA Web Helper.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "NVIDIA Share.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im nvsphelper64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- C:\Windows\system32\reg.exe
  REG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f
  2⤵
  PID:3572
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_TrackProgs /t REG_DWORD /d 0 /f
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f
  2⤵
  PID:4948
- C:\Windows\system32\cmd.exe
  cmd /C del /s /f /q "C:\Windows\INF\*.*"
  2⤵
  PID:3292
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Windows\temp"
  2⤵
  PID:3476
- C:\Windows\system32\cmd.exe
  cmd /C mkdir "C:\Windows\temp"
  2⤵
  PID:2852
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Windows\Prefetch"
  2⤵
  PID:3724
- C:\Windows\system32\cmd.exe
  cmd /C mkdir "C:\Windows\Prefetch"
  2⤵
  PID:3168
- C:\Windows\system32\cmd.exe
  cmd /C del /s /f /q "C:\Users\Admin\AppData\Local\IconCache.db"
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache"
  2⤵
  PID:3284
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches"
  2⤵
  PID:1300
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\History"
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache"
  2⤵
  PID:3568
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache"
  2⤵
  PID:5140
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache"
  2⤵
  PID:3744
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content"
  2⤵
  PID:1608
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData"
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\ProgramData\NVIDIA Corporation\Drs"
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}" /f
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}" /f
  2⤵
  PID:1724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count" /f
  2⤵
  PID:5800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}" /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\EOS" /f
  2⤵
  PID:5516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{f840bc35-59a8-4818-98dd-f637809d719e}" /f
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b4b931e9-956a-4dda-81a0-0852d33b94fc}" /f
  2⤵
  PID:5948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{8cf84386-1c42-49b0-b5d4-e3627b54df13}" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" /f
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC" /f
  2⤵
  PID:1748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open\command" /f
  2⤵
  PID:3004
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open" /f
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\DefaultIcon" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SYSTEM\ControlSet001\Services\ClipSVC\Parameters" /f
  2⤵
  PID:6060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b4b931e9-956a-4dda-81a0-0852d33b94fc}" /f
  2⤵
  PID:5292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
  2⤵
  PID:5132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
  2⤵
  PID:1244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" /f
  2⤵
  PID:640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Admin\Desktop" /v "loader.exe" /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\20900" /v "rAQBc8Wsa1xVP" /f
  2⤵
  PID:3368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\469751801" /v "DNhm3" /f
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\92978" /v "IDCdJOyapnxr" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Activision" /v "JBdT3hVOfoaM" /f
  2⤵
  PID:4392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Activision\Call Of Duty" /v "ZYFYZ5B6kzMCk" /f
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\appdatalow" /v "fRyilOYGxlSXP" /f
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\appdatalow\software" /v "Rblsaqv" /f
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Bytedance" /v "CmZFOv" /f
  2⤵
  PID:2604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Bytedance\CapCut" /v "ZpzRiKYpZgnSOK" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\CapCut" /v "g5Ayy61" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Caphyon" /v "9rklPGtfUR2I" /f
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Caphyon\Advanced Updater" /v "ciQTqVaAUnJv" /f
  2⤵
  PID:1924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\ChangeTracker" /v "y4KjsfSX" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium" /v "2u8qvJP3B6Uiu1g" /f
  2⤵
  PID:3780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\BLBeacon" /v "oDUTOX7NY" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\PreferenceMACs" /v "lvBndn4" /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\StabilityMetrics" /v "gr881" /f
  2⤵
  PID:1412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\ThirdParty" /v "L1Q4G" /f
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Clients" /v "uTlCH9WpIYaPH" /f
  2⤵
  PID:1876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Clients\Mail" /v "ds7HX27KbNC" /f
  2⤵
  PID:5460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Clients\StartMenuInternet" /v "pqiwdo3Hrdt6z3" /f
  2⤵
  PID:5384
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\DeviceInfo" /v "DtmvWvN20" /f
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\DeviceInfo\MacAddr" /v "0OSa9" /f
  2⤵
  PID:1112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Discord" /v "cKwhz" /f
  2⤵
  PID:4008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Discord\Modules" /v "PYlapdvx" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\e0b05d7f-6bca-50e8-b129-1157af44ea69" /v "OwWR2uaAtZV" /f
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /v "nZSCe8nPQH" /f
  2⤵
  PID:1652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\EOS" /v "jHkpC99I" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /v "li9Mk6pyZdA" /f
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Facepunch Studios LTD" /v "zchUSmJqhT" /f
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Facepunch Studios LTD\Rust" /v "kdKB9Ppfr6Sk" /f
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google" /v "lyLUl" /f
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\Chrome" /v "08n8Y" /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\GECommonSettings" /v "sSXvy" /f
  2⤵
  PID:1900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\Google Earth Pro" /v "A1KG3aMSFgDmn" /f
  2⤵
  PID:6116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\No Chrome Offer Until" /v "4mMxkcNZ" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\Update" /v "VlvkI3S1W" /f
  2⤵
  PID:4024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\GU" /v "5P1fJX" /f
  2⤵
  PID:316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\GU\GearUPBooster" /v "LJwWy0vNK" /f
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Hakita" /v "YKbBkp7iE8TL" /f
  2⤵
  PID:4012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Hakita\ULTRAKILL" /v "zKFZdSKQc" /f
  2⤵
  PID:968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Innersloth" /v "tYFpEFl" /f
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Innersloth\Among Us" /v "WkhVYO3dJfBuCov" /f
  2⤵
  PID:5860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\JustPlay.LOL" /v "IkbSUz2k4X" /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\JustPlay.LOL\1v1.LOL" /v "SLUcbCkFeXVwVQ" /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Khronos" /v "dtm9WgMa" /f
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Khronos\Vulkan" /v "TDHqyzKXoJ" /f
  2⤵
  PID:5192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\LogiShrd" /v "fRWIz" /f
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\LogiShrd\DownloadAssistant" /v "CmfLf8hgMcV" /f
  2⤵
  PID:5164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Logitech" /v "9GUa8m6xqqEZ1EN" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Logitech\LGHUB" /v "gMnn79" /f
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft" /v "iU1b6GvS1TiZ" /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Accessibility" /v "F3YxVeBJK" /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\AccountHealth" /v "I6BDvjwRgw6eX3a" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup" /v "qOpaZDAqyR" /f
  2⤵
  PID:2172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie" /v "tBHYf2FpMSsvHgo" /f
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ActiveSync" /v "DFDHnZw3L1" /f
  2⤵
  PID:3164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Assistance" /v "XjmxEHys" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\AuthCookies" /v "PJe5AhAz" /f
  2⤵
  PID:5920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Avalon.Graphics" /v "cxwTJIK38D" /f
  2⤵
  PID:4188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Clipboard" /v "l9nTdejMgZ" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Common" /v "ACuTi9DM5uXp9f" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\CommsAPHost" /v "ZWwjV3" /f
  2⤵
  PID:1964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Connection Manager" /v "00ZEPd" /f
  2⤵
  PID:5452
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\CTF" /v "T9cZ93mG" /f
  2⤵
  PID:5100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Device Association Framework" /v "vFnijwndit6Bb" /f
  2⤵
  PID:5760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\DeviceDirectory" /v "ptnzsTGlZHvojW" /f
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v "a2vQfNw0Kkib" /f
  2⤵
  PID:408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\DirectX" /v "CN8tTeV" /f
  2⤵
  PID:2828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\DirectX Diagnostic Tool" /v "HQNTkRuv0Hc" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Edge" /v "xfkPrCtcI90Gp" /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate" /v "mPW6Yl2M9LhIU3F" /f
  2⤵
  PID:2680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\EdgeWebView" /v "BXCBZ37CFjIy9" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\EventSystem" /v "MvfoH1VDKMYcf" /f
  2⤵
  PID:2576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\F12" /v "VSgoKEV" /f
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Fax" /v "uOR03" /f
  2⤵
  PID:5268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Feeds" /v "QFt7EeMp9cd" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\FTP" /v "XoJil2J" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "ZIwWsOrk" /f
  2⤵
  PID:3316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\GameBarApi" /v "aTgyKnutVL7pd" /f
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\GamingServices" /v "jFkhMJ9N1" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL" /v "rfwmOZGylOWSP" /f
  2⤵
  PID:3768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\IME" /v "sRaUwIQjMDtCJ" /f
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\input" /v "BawfSWL3TtuQP2t" /f
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\InputMethod" /v "6Q5IJB1U" /f
  2⤵
  PID:3996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization" /v "WCDz06yo4opxOK" /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Installer" /v "5YOvt" /f
  2⤵
  PID:6028
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Connection Wizard" /v "GR3su0Hx" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer" /v "GjxoXjAG" /f
  2⤵
  PID:4688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Keyboard" /v "c1H1JyHa" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\LanguageOverlay" /v "Tn3iS" /f
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Lighting" /v "9exXT5" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\LiveCaptions" /v "ARVZR0" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer" /v "t1fm1jomYqLM" /f
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Microsoft Management Console" /v "M8oTPRr0e6FAzwz" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\MSF" /v "iLwRDfosp" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Multimedia" /v "vGkmY5kinZ" /f
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Narrator" /v "9wGTC2s6a" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Notepad" /v "dPedIo" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Nucleus" /v "OTJcJwef0hg0A" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office" /v "9PBkwzFeaKQ" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\OneDrive" /v "kSP3msI6XZMEwGu" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Osk" /v "XSOiiZqTo9VxlS" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\PeerNet" /v "QwN3gcifOpKg0" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Personalization" /v "60OvE" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Phone" /v "zXoaswtGzU6wy9" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Pim" /v "XC9nuPUABJkOmf" /f
  2⤵
  PID:1724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Poom" /v "O6aMx3QRb0xN" /f
  2⤵
  PID:5800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Print" /v "KwO76uAIr" /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\RAS AutoDial" /v "M08iYfRYDL" /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Registration" /v "sE9f6ebsOTWb" /f
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Remote Assistance" /v "aw4Ee2fgW" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ResKit" /v "5F6wvy" /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ScreenMagnifier" /v "wYsVx5W0yG8" /f
  2⤵
  PID:5516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Sensors" /v "dSIiwEtLHXVZsOb" /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\SkyDrive" /v "pNpLPnVhxSPRW" /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Speech" /v "VaDXA" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Speech Virtual" /v "4bWozXys0Q" /f
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore" /v "U5Qe8dZhX63" /f
  2⤵
  PID:5948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Spelling" /v "Y20H08Xwi0at2j" /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\SQMClient" /v "ixWgo" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\StigRegKey" /v "58Tp9dlF4BG5xML" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\StorageLibrary" /v "0dLL7FNP3EehjT" /f
  2⤵
  PID:1892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates" /v "BtHa9qrMZEYnTQ" /f
  2⤵
  PID:3024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\TabletTip" /v "JgNakyOO9TJXQX" /f
  2⤵
  PID:5700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Touchpad" /v "aTG2C7Qia3eeM" /f
  2⤵
  PID:1564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\TPG" /v "Pm2YQ" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Unified Store" /v "pMXD22rqy" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Unistore" /v "jkOCjQJ0c" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\UserData" /v "tZ8rqYI0jH" /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\WAB" /v "OqjGagEu75Im" /f
  2⤵
  PID:1584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\WcmSvc" /v "Tp0KVDibIRx" /f
  2⤵
  PID:2212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\wfs" /v "o8LXY4dLywY" /f
  2⤵
  PID:2268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows" /v "q5Tx60luda1x" /f
  2⤵
  PID:844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Defender Security Center" /v "dX1KlWXtq" /f
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT" /v "95SzkXT8ZpDQj" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Script" /v "bJXpgSkSjB" /f
  2⤵
  PID:5784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host" /v "mdPcNj711hz" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Search" /v "4yfm8dE4WK2" /f
  2⤵
  PID:3484
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Security Health" /v "1JOkib5I5qY2lF" /f
  2⤵
  PID:1540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\WindowsAppRuntimeApplications" /v "0GIsFTnTZSg06VD" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Wisp" /v "jBRZVStd" /f
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Xbox" /v "kG1BZU" /f
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\XboxLive" /v "m7raLU" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Mojang" /v "5ieeI8tYWmFGzu" /f
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Mojang\Minecraft Launcher" /v "UFl0XjDq" /f
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software" /v "4JSgVS0q" /f
  2⤵
  PID:5772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software\Components" /v "gaixwB9dyC" /f
  2⤵
  PID:1592
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software\Debut" /v "1o6yALK" /f
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software\Suite" /v "x6mMA0N7j" /f
  2⤵
  PID:3816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Swift Sound" /v "PEPp1ZNxGFFh" /f
  2⤵
  PID:6092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Swift Sound\Components" /v "8VVWnEzSJ" /f
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation" /v "owgmHlpblyDw" /f
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation\Ansel" /v "5PlbWG9mVUhDpT" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation\Global" /v "HuylQvPuof" /f
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation\NvBackend" /v "WaDDx47Sf" /f
  2⤵
  PID:5756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Opera Software" /v "9YDQSYwvle" /f
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Opera Software\511efacfc496876407ae0db1e76d9dd1" /v "8B9EZ" /f
  2⤵
  PID:8
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Opera Software\5959b5a69bec362f0f879aeba1d1edeb" /v "cPG0rNljM2zbn" /f
  2⤵
  PID:540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\OverwolfElectron" /v "T0P5A2R8GpaaiW" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\OverwolfElectron\lpdhkekimgfofngpompbcpndlbkmaoejkpodjbcb" /v "1SH4aSk6eX" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\OverwolfPersist" /v "WDPotZIWI7qF4" /f
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\PDFEditor" /v "FxR6NBB3m" /f
  2⤵
  PID:3260
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Policies" /v "VBLAljp" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Policies\Microsoft" /v "OIb5anh2CV" /f
  2⤵
  PID:5716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Policies\Power" /v "nLjBsORXtJTrPEv" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Realtek" /v "Z8pHG8v" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Realtek\Audio" /v "P2Hfo" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\RegisteredApplications" /v "oH1PmUbEzvO2D" /f
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\RegisteredApplications\PackagedApps" /v "qQfhtdHTwRWUvJ" /f
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Rockstar Games" /v "jqhEfxVJ" /f
  2⤵
  PID:5128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\SyncEngines" /v "8fszd" /f
  2⤵
  PID:3740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\SyncEngines\Providers" /v "6SiqR" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Sysinternals" /v "vDgj5ogq" /f
  2⤵
  PID:4024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor" /v "iKDG0mzm" /f
  2⤵
  PID:316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\SystemInformation" /v "tXhWmqf" /f
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft" /v "hZFaBp" /f
  2⤵
  PID:4012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft\Launcher" /v "HW2rLc6A" /f
  2⤵
  PID:968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft\Rainbow Six - Siege" /v "W0uxd" /f
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft\Uplay" /v "jMaKXwNEFX" /f
  2⤵
  PID:5860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Valve" /v "uHR3U" /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Valve\Steam" /v "Sz24DSpKSKQ" /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR" /v "meRpfwY3Rb07" /f
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\ArcHistory" /v "IZLk4" /f
  2⤵
  PID:5192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory" /v "BuF9sP2we" /f
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\FileList" /v "6klv47" /f
  2⤵
  PID:5164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\General" /v "DQn19BblM" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\Interface" /v "NUVpy2I03lOJjOp" /f
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\Profiles" /v "lvPsLsT7iz" /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\Setup" /v "CBktRrvxr08" /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR SFX" /v "xTft0d7gh" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Wow6432Node" /v "ehAZ8Ki063ra5" /f
  2⤵
  PID:2172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft" /v "DxaARWG" /f
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes" /v "ue9CHBn2TeW" /f
  2⤵
  PID:3164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\*" /v "ojL6BYOXXsqwbl" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3fr" /v "LWrHd5" /f
  2⤵
  PID:5920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3g2" /v "WMLzbV9NINARb" /f
  2⤵
  PID:4188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp" /v "JVMzP0MMHqz" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp2" /v "wg6TacFe8b" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gpp" /v "JOAY0Q0nty9AGV3" /f
  2⤵
  PID:1964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3mf" /v "sTAMG6DFeM58Z" /f
  2⤵
  PID:5452
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.aac" /v "EhtGZw2HsSka" /f
  2⤵
  PID:5100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ac3" /v "2jDOyQ" /f
  2⤵
  PID:5760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adt" /v "OZtiaW19db" /f
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adts" /v "zgDoz" /f
  2⤵
  PID:408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.agent" /v "RWZ4KGnR4ZcC" /f
  2⤵
  PID:2828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.aiff" /v "nb6hFmvUR6NZo9" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.all" /v "89CmH" /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.amr" /v "tmzqU5sNZ8KXP" /f
  2⤵
  PID:2680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ape" /v "KotgKDM" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.apj" /v "YfJ9zyHTbCT79" /f
  2⤵
  PID:2576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appinstaller" /v "rGsRiYKLXdQrqTD" /f
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appx" /v "b2j4xTLI" /f
  2⤵
  PID:5268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appxbundle" /v "Na0vyQmHMHv" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ari" /v "X4nopK0o5" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.arw" /v "1Va9BBBj" /f
  2⤵
  PID:3316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.asf" /v "Er4uis42nxhW" /f
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avci" /v "hD6Z6bj8qIiwmZr" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avi" /v "yRzUVBu" /f
  2⤵
  PID:3768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avif" /v "1o0AagGwTPE" /f
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bay" /v "DXvhyeUzfKtepC" /f
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bmp" /v "By6oisO" /f
  2⤵
  PID:3996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.c5e2524a-ea46-4f67-841f-6a9465d9d515" /v "stJKiya5" /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.caf" /v "QebqDwFfmv" /f
  2⤵
  PID:6028
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cap" /v "zxaOIRk6uTeNuY" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cda" /v "tvXptI" /f
  2⤵
  PID:4688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cdo" /v "ELFsUD" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.copilot" /v "57ohfe8pVS51y" /f
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr2" /v "xqfaMeu3B5syb" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr3" /v "6rBfgiuujLnk9w1" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.crw" /v "kEd59kUeriQvdO" /f
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcr" /v "jfAtIJLQZ" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcs" /v "vrQoDTciQ1E" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dct" /v "LM1dtVjhna5fc39" /f
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ddp" /v "gYMsX0ldgDYOoXG" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.deproj" /v "UoLVx6d96DO" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dfx" /v "1ZsARy" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dib" /v "Tfr3WnGp1F3l0Zg" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.divx" /v "gnUvzwgQJOVOp6E" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dng" /v "wA60YgUoj75Lrn8" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.doc" /v "T7DkWk" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.docx" /v "1dDqC" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.drf" /v "aYJGlJJQ5" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.drp" /v "EU05Di1" /f
  2⤵
  PID:1724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ds2" /v "WCKVjd1" /f
  2⤵
  PID:5800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dss" /v "M7YVG" /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dv" /v "HnO6J3WSgsAv" /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ec3" /v "ofi3jZFZpay8" /f
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.eip" /v "md9Xt3L" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.emf" /v "7dAjhfZRk0" /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.eml" /v "hp4AxqrMrhGWKV" /f
  2⤵
  PID:5516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.erf" /v "z3jJqwRbsxA" /f
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.exr" /v "mhXDR4oZndj" /f
  2⤵
  PID:5216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.f4a" /v "pCqvJRIlDeLSbT" /f
  2⤵
  PID:5176
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.f4v" /v "hrqAx" /f
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fbx" /v "qmAcap" /f
  2⤵
  PID:820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fff" /v "OOxPVtJTpunw" /f
  2⤵
  PID:904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fh" /v "pWfcoaEnphSwOCm" /f
  2⤵
  PID:1472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.flac" /v "acrsr" /f
  2⤵
  PID:5152
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fluid" /v "pT0NLnfF82RpE4" /f
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.flv" /v "ArzLZ8oo75Z0" /f
  2⤵
  PID:1748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gif" /v "Gt404c" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.glb" /v "MkSx0GiXrHRl" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gltf" /v "0IVr0WZ" /f
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gsm" /v "0a8Na1Czu2zzye6" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gxanimations" /v "L9oTr" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.heic" /v "fTDntxeNsXhNyhR" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.heif" /v "DIag95oikAosBS" /f
  2⤵
  PID:6060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.hif" /v "bYLRqA" /f
  2⤵
  PID:3772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.htm" /v "Tmvk9VjDGKO3y" /f
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.html" /v "IxxC4qZp" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ico" /v "UzI0M" /f
  2⤵
  PID:5252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ics" /v "tdI0QMVC" /f
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.iiq" /v "7DwNoV" /f
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.inf" /v "nfFHwv" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ini" /v "fBatCfz" /f
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jfif" /v "N3C6XPWw35bxE" /f
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jp2" /v "zRBumJa2qu" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpe" /v "kvcVVmsAqZ8XCKa" /f
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpeg" /v "DKcbd2" /f
  2⤵
  PID:4004
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpg" /v "tNle7p95" /f
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jxl" /v "3iOUK4rfF" /f
  2⤵
  PID:3076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jxr" /v "1F1lGKI9" /f
  2⤵
  PID:3780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.k25" /v "qbH0tZLyB" /f
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.kdc" /v "9Qgft" /f
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.log" /v "qH42KmHtja2TkwC" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.loop" /v "r6G8stI" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m1v" /v "vDbbTnTXY" /f
  2⤵
  PID:944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2t" /v "4QuLYUNXT" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2ts" /v "aLgvecOOxmDnwyM" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2v" /v "pOhePXs" /f
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m3u" /v "aewOPCNVY" /f
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m3u8" /v "sjJZDGji7Fg7RiG" /f
  2⤵
  PID:1804
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4a" /v "rOxAx" /f
  2⤵
  PID:2644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4r" /v "Q5MzOciSq" /f
  2⤵
  PID:1652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4v" /v "jrc1Szv4" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCADDON" /v "yaR27KICp3LH" /f
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCEDITORADDON" /v "IzihD0tLkN4" /f
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCPACK" /v "KMrJnHhMDgo" /f
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCPERF" /v "KCy4L" /f
  2⤵
  PID:4452
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCPROJECT" /v "n1SHDLML0tdlmy" /f
  2⤵
  PID:5160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCSHORTCUT" /v "ux2rezt" /f
  2⤵
  PID:6140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCTEMPLATE" /v "48nVZhR4Srq" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCWORLD" /v "KkKQtGTObJFGb" /f
  2⤵
  PID:116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mdc" /v "JUY0rHp2" /f
  2⤵
  PID:3244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mef" /v "A8GRb33ukY" /f
  2⤵
  PID:5296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mk3d" /v "HX2RFy" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mka" /v "oN8qK" /f
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mkv" /v "MrJ4FxiaQDKL894" /f
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mod" /v "JxI2qDuEgRiSQSl" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mos" /v "YIdfKbFmpa" /f
  2⤵
  PID:3560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mov" /v "hN0tQf" /f
  2⤵
  PID:6120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp2" /v "BWGNoS" /f
  2⤵
  PID:976
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp2v" /v "jM3PhtOg3asEoX" /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp3" /v "DitBL" /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp4" /v "1iXZL" /f
  2⤵
  PID:1212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp4v" /v "0r1Hy55zODt" /f
  2⤵
  PID:5520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpa" /v "EtuGah" /f
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpdp" /v "1EaJt43KRBuPM" /f
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpe" /v "47KCo8o7tru" /f
  2⤵
  PID:2084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpeg" /v "znRscLXNP3" /f
  2⤵
  PID:2340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpeg2" /v "hG4uEAcyp" /f
  2⤵
  PID:5912
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpg" /v "alz9FHZGaFIWh" /f
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpg4" /v "aKvmfGN" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpv" /v "zFCCw" /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpv2" /v "ji5rXgWipVLkwZQ" /f
  2⤵
  PID:5456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mrw" /v "ndNkGxHlY4w" /f
  2⤵
  PID:64
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ms-lockscreencomponent-primary" /v "gUkEDDz" /f
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msg" /v "EyT2kOtSTo6" /f
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msix" /v "wxZnBR" /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msixbundle" /v "OAV8o" /f
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mts" /v "G8mtBqPyTmio5P" /f
  2⤵
  PID:5568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mxf" /v "1BtvN2a" /f
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.nef" /v "VIfLUzW0vCL" /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.note" /v "wVuBl" /f
  2⤵
  PID:872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.npp" /v "BnScbIFVU" /f
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.nrw" /v "di0rRdeuJB9Ob" /f
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.obj" /v "ZsWhuaWQjBlm" /f
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.odt" /v "qionZa" /f
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oft" /v "HyuMe8Mg" /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oga" /v "Yqu5Y" /f
  2⤵
  PID:3204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogg" /v "9aHSfT4CWQQpXjs" /f
  2⤵
  PID:5732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogm" /v "gIsU5c" /f
  2⤵
  PID:2852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogv" /v "3MCRWpbHFGm4F" /f
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogx" /v "aO88h22ADBjH3LR" /f
  2⤵
  PID:3168
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.one" /v "66hCashmz" /f
  2⤵
  PID:5464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.onetoc2" /v "d8O8hkht0" /f
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.opdownload" /v "dvD94W" /f
  2⤵
  PID:3284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.opus" /v "nsqN6mNV3aP4k" /f
  2⤵
  PID:1300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.orf" /v "gmAaIdt" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ori" /v "YU91Wc" /f
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oxps" /v "o1G4DncX" /f
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pcx" /v "5BhEo6wCiskehrF" /f
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pdf" /v "8IRCFi7HIsKs" /f
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pef" /v "IZM40tjg4" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pgf" /v "O8Q3P9p" /f
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ply" /v "sPFOtIqk" /f
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.PML" /v "kQgabTVnlEPtY" /f
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.png" /v "UjNovh" /f
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ps1" /v "DNOhw8tF1iMXO" /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.psd" /v "kV40D7" /f
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.psd1" /v "auCGW8YtzZAP" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.psm1" /v "YZc0BhWRmm7x4R" /f
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.qt" /v "cORx9b0Ky" /f
  2⤵
  PID:1168
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.R3D" /v "6zuBphIn" /f
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.raf" /v "2lWzLPpS5y" /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ras" /v "nMGhVNrqGUKFmh" /f
  2⤵
  PID:2408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.raw" /v "aLz8RK" /f
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rle" /v "Hl7SZM8XD8W" /f
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rm" /v "wrK48ORYeUjCAU8" /f
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rmv" /v "ZaA6L3Zz" /f
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rmvb" /v "vVaYFXrYDc" /f
  2⤵
  PID:472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rtf" /v "uVSxUhTXhYD" /f
  2⤵
  PID:4048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rw2" /v "V4UCok05SD6s5" /f
  2⤵
  PID:2324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rwl" /v "ra59W1paYLaq" /f
  2⤵
  PID:2608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rwz" /v "gJ0GS" /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.scp" /v "rxgSnlQy54" /f
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.shn" /v "OPXtq5aQOLvr" /f
  2⤵
  PID:5572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.shtml" /v "KA09nM" /f
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.solitairetheme8" /v "gZadbjw" /f
  2⤵
  PID:5392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.spj" /v "HHHeta" /f
  2⤵
  PID:4228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.sr2" /v "OHzc46SEcOVh1XK" /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.srf" /v "SCjjgTPxV8cd40" /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.srw" /v "CRkPwDOMj8k5" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.stl" /v "bOxZkeLZhK" /f
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tar.gz" /v "VK7EoDu8UU" /f
  2⤵
  PID:5948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tga" /v "4RXWvLMfJVaWHfJ" /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.thumb" /v "KE3FZK76" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tif" /v "eiN3QdLydir" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tiff" /v "YVUGA7KdNXy5KS" /f
  2⤵
  PID:1892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tod" /v "WUWI7npas" /f
  2⤵
  PID:3024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ts" /v "KfYvxfFlf" /f
  2⤵
  PID:5700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tts" /v "fQl5hMccL" /f
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.txt" /v "SdfcA0FJHIB" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.txt0" /v "e6trwu" /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.txt1" /v "1kQ2eKw66" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vcf" /v "P14n6" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vob" /v "dYgZ2STy3uYN3P" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.voc" /v "GEbYBHOIsXI" /f
  2⤵
  PID:6060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vox" /v "fhoDAY" /f
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vpj" /v "nFoiFcxbVHuC" /f
  2⤵
  PID:5440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wav" /v "W89th3JtMN3" /f
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wdp" /v "6bWY5oxyIRM9EZ" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.webm" /v "DUTtZ" /f
  2⤵
  PID:5784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.webp" /v "RyNutbNXarHNh" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.whiteboard" /v "7yUSJZPdR3dI3" /f
  2⤵
  PID:3484
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.winget" /v "nl9PDrPv" /f
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wm" /v "c5QnPiXD" /f
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wma" /v "yeGfk69" /f
  2⤵
  PID:1768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wmf" /v "iaJOLGPCyJs" /f
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wmv" /v "9ynRpxPDT" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wp" /v "bysHDMHZN" /f
  2⤵
  PID:1692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wpd" /v "3JBHfu8W" /f
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wpl" /v "77j3Vo" /f
  2⤵
  PID:784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wps" /v "EkzRuWZHHp" /f
  2⤵
  PID:6092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wsb" /v "aDEIBZmX" /f
  2⤵
  PID:5752
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wtx" /v "YE1Gz9LeCHw7" /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.x3f" /v "eJKeQg0mb" /f
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xht" /v "p8nlNiuc1" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xhtml" /v "buZLt4gAUsGUPuJ" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xps" /v "k9vprFlc7a9bZQ" /f
  2⤵
  PID:944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xvid" /v "8zkXSU9CePswDh" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.yuv" /v "IHYdagMBstm5t" /f
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.zpl" /v "e5pmyol0MB2o" /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ActivatableClasses" /v "JHHSYL" /f
  2⤵
  PID:3920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\amongus" /v "21KXy" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\apefile" /v "iVfT9d0KwsXLxP" /f
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\apjfile" /v "Svcnmog" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\App.34d23e337344b7f.Protocol" /v "tJt34cNS" /f
  2⤵
  PID:5716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppID" /v "UrXMBg7aWIx" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Applications" /v "4cKAWXsKJTpAHt" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppUserModelId" /v "U4XiT1yTXqeFqM" /f
  2⤵
  PID:5232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0resaq7r5ermbh4b96ke39yqc1atfhjr" /v "0XiKoS" /f
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0t69n30jztar4a12pv0h1xh91e8jsacr" /v "VkmBAVvq9" /f
  2⤵
  PID:1900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0yfn1fhybwjxhemdkvvy841hdgqqy4y4" /v "dbCS7SYPZG7kAZ" /f
  2⤵
  PID:3740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX18q1gk8kdws5gt2g5c62cxc6qydq7tsw" /v "bgRHuAcXYST113" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1akbsnxkswph8hkx1pb4f1s3d2rfbnyb" /v "kAzXv" /f
  2⤵
  PID:4024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1b0e9ytcwx0wcmvkdey0h6af04t1ta3z" /v "Wv0jMfs7KQqh" /f
  2⤵
  PID:5264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1np6bckd8pzgmy0k7rjk4xshe55bac6q" /v "7u1pD1d" /f
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1scw7cgxcz9hmq03sd8qajzg3s9t7901" /v "vzN6qPIXG3" /f
  2⤵
  PID:1020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1sy7rwrc20ggq97a6x1mgmjat0rthy51" /v "S9NZxZ" /f
  2⤵
  PID:3572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1yprbth8spa55n2rc6zbh6tc1kr1tf5h" /v "MUhty0bQHK6k" /f
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX333jbhpaq2hjpyd097614409g4kz15cw" /v "CLvxok7s8m" /f
  2⤵
  PID:5860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX3v6hct5w0szn0pd06ekse0yqavf2e8r3" /v "Hy0AzyuEv8QeRqq" /f
  2⤵
  PID:928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" /v "k25dGrBWRI5d" /f
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4mntx4h978m1v9gtzv0ewksfd6pmwsre" /v "494N8bXtlTc7a" /f
  2⤵
  PID:2428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4ra53nzs9xcdyxf1wgcp31xefscv1jnk" /v "mIuBPAFZG4F" /f
  2⤵
  PID:4944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4vt5c8cbxd42btbp6br6zs9v25a1kh5j" /v "9Y3Jvon3S" /f
  2⤵
  PID:1212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4ztfk9wxr86nxmzzq47px0nh0e58b8fw" /v "TO4JBMPVotWJbt" /f
  2⤵
  PID:5436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5nebv0xjaxafmmr3cnptgjg9pdpqcg0h" /v "HydKN" /f
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5y9g1y8x8cthhd1nd9gyrmyz0xztge18" /v "kfuv6M" /f
  2⤵
  PID:2304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6365235j7azx11tebzeay2a9hd0ngfk5" /v "QuK3dJS" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6ae6b9t9aj303935n8rmz42zdtq3fe6r" /v "G7zOnXBXFIibfDT" /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" /v "vTU8t" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6hptmm8avg1gnv71j8jda9340qk79w89" /v "RY420" /f
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6pwygraeddkpp6m3wt43c7mpk6xm5tr2" /v "oyQfL" /f
  2⤵
  PID:5920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6w6n4f8xch1s3vzwf3af6bfe88qhxbza" /v "zF4ZYD" /f
  2⤵
  PID:64
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX70hz8geay8nefwg2887gffr7tmedrrh2" /v "kbtL2xtrwj" /f
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX756ty62ph7h2hpw422178spnwb89fdhs" /v "nRrjbj1" /f
  2⤵
  PID:1076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX77a4xf1ynjnhecq6pjngc07j31r3q912" /v "7dyAoQL" /f
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX77zsthmbxzqveyvr5gqhcfpnd7mfnd5j" /v "MbucSqRu6" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX7tycjjv3satx1c8myac3gpn9ktrwns6b" /v "Y5zRC8" /f
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8mg1ky09gvfdexfmk8e77463mz4j1xcp" /v "yiTNMLx6U1w" /f
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8zw7xct41bx2wrswqekb78rm243h02yh" /v "U3c4g2AtmXsPb" /f
  2⤵
  PID:5136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9ppf2dj9szwwzyq4vhesygf8a7hf5pc9" /v "jBXRMkO4hJh" /f
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9qvny8kg50f4n257nt763xzjrjphn7jm" /v "jSXZoeq0zOL" /f
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h" /v "00QoBQG2nl5" /f
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9vwggs9kbe3mn0w816545e7zs1x6vegr" /v "mBZJQRU" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXa4x21t18evxksm0kbe6znaz8jjrjvs9e" /v "lLnwot3" /f
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXaf0097ws4bwb0wre67gmp7pc9fjr8en6" /v "stoK0GApeLYQtn" /f
  2⤵
  PID:5748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp" /v "p3d6G5" /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXamwwyj1f3ktjcdfctg7kctrcrvqd3z8p" /v "MVoSvC5" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXarc6g37bjvf299edhhmjx991tz75tcx9" /v "PDUSzC" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXassm2k5er21ec9tqj99raa72bqdy59n1" /v "2XYpAzi" /f
  2⤵
  PID:3316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXatmm9sengvzx4rehd29pf7cfqen9knc8" /v "lC27PMRSmDoKtrH" /f
  2⤵
  PID:5288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXb5yxv86nkhp530y0y50yxe69c1qwad1x" /v "Mu9jxoAH" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbfem27ddbf6ebrx72mc6gnaw2e3nkpza" /v "lzqwtrXOpSiC8" /f
  2⤵
  PID:3768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbqrd7zg39s227k5zy1mah67hhk0wgmw4" /v "X1L26l" /f
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbtxh7p534mcndn2b6d1ypwaf0hhbf5ap" /v "alBuEx4YUlMS" /f
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbx2ce4vcxjdhff3d1ms66qqzk12zn827" /v "kzVehaO" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbyq8sebsp9xh069xkxaaystpjztdp9h3" /v "LmkNyO9CFjxR56" /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbzdzkhgs0b1gj36jbm528tvp1fnha54j" /v "8U7xp" /f
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXc9vj55m1n3559gcjff0scsqeket80zp7" /v "GWde4ta" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcdh38jxzbcberv50vxg2tg4k84kfnewn" /v "qPqHq2j" /f
  2⤵
  PID:4688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcesbfs704v2mjbts9dkr42s9vmrhxbkj" /v "az1yPatmCqY" /f
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcezf6bjsrpbyaqwyjdehhb46y5e5mm3a" /v "acI32" /f
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcr7ve1e6y7nx8n3y5qv7m7s9kzz18jx5" /v "yHBORqjnDwKKE" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXctx73kz58pypptjf6jydwz2pgcks5mzk" /v "16aHA0JcAxJ97Vp" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdce4qczew6swqw0t4hf88yfjwehkyv5t" /v "0ZB8VQ" /f
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdv25x4ndb8r51pbdf6srsknmbkfnkpaq" /v "1KqvsDTDh2iwpJ5" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdyw2j75xqd0y008p4bvtxhnxp3py2t2g" /v "qncoenb9nakZ" /f
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXegssybx65447k2q6prgacs1t5gzge8at" /v "5tCFm6lkz" /f
  2⤵
  PID:1168
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXejqz5dpvfxzdkq7rwbwmnn4gyqk3hhb9" /v "0YBVqOg9bVO93" /f
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXewfz11nnnd1v7scbs4vmxpc1svxc4r90" /v "udrd25" /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXf0gv96f6b0d4mpph15j15n30wrwxk172" /v "SU1ENhV1C" /f
  2⤵
  PID:2408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXf1qkdkw713dwwyym75mwhtyrm0vexpzf" /v "BA2XP" /f
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXfeq5vwnakrw6cy02kzhq8ekhhsremh62" /v "QVSYrBhYbFTc" /f
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXfp6kkvw8823ptbxvr2be691hzfyrsazt" /v "HLfhM" /f
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXft68t6vrz4bhvpeccdeg2trg3g10vj54" /v "E2KQKo" /f
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXg280tzrpxnd0t559h02gpd27tgrma246" /v "ZEP6EzQ0" /f
  2⤵
  PID:472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXg2ew71cpjznkcwmfttfpxzc075gc7c80" /v "qzviCl" /f
  2⤵
  PID:4048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXghkdhgdax7j57pvsen8nhq2ngq8ny7e2" /v "Q4gVRDZcSBn" /f
  2⤵
  PID:2324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXgtz62cfp9761w8h33sbaykyt1vkbm4vj" /v "qevfWMIxoLju" /f
  2⤵
  PID:1072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXgwsb7drvvkp7jxvqdqst0ajpq6107yzv" /v "n2KQHAA0tykmx" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXhk4des8gf2xat3wtyzc5q06ny78jhkqx" /v "oSGPyFrO3Wo5" /f
  2⤵
  PID:728
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXhw73fxxd4pf1p5pm5r13y4m3vezj4v1b" /v "eCmuFghuzbE7vt1" /f
  2⤵
  PID:1220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjf4aqz2sx7y9mp1x29d4rbshzmz12hw9" /v "G897bQGf" /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjsdsf5vqjpck4w72a3ve2zmnsb3qfec1" /v "X93k16mCu" /f
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXk0g4vb8gvt7b93tg50ybcy892pge6jmt" /v "qjvspEtn1awf" /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkcg7y8nhftqvy2sxh5grnx46hbybnk39" /v "eTdyz3lPMUo" /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXke6eh8a1ew0cqjwpdgcvg9rj36gxfss1" /v "7hCcpg6" /f
  2⤵
  PID:5604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkmt99ynn1qvez84cxh13grbeahewhrx2" /v "HPym1Ll7u" /f
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkv2jqn1pq8ajm0p5dhgqde7aafykkrrn" /v "bt2pLYbQSzkNrKG" /f
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkytm3hnq0vzg49fdp50v6n482apdb470" /v "hv5eikCqef2" /f
  2⤵
  PID:1472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXm4fjth7rfv9b2vppk3w1gcpsf4gy9r3n" /v "AEBg6nDRXyeZMx" /f
  2⤵
  PID:740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXm8fs0gj5h36ynw4kq0x3gqnz6ecr1kvy" /v "KfWKNK27xCyvj4W" /f
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k" /v "afVGVr0awiEe" /f
  2⤵
  PID:1748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmrzewgswm3y60fdz9attr7pr39wrb9dt" /v "BhLWwKvnQxsVu" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmv6rk8z9kbjr10t0fhrvkggh6psk9vm0" /v "9OILC" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmwwyhgdj6npeeqe0bxkbr07wkr2mxjah" /v "xQlSb" /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn1scph4yxkh5tvym038c6zjjfpmdg2fg" /v "jrrbiTjG" /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn4h72dhxtarn3p3zmz4r3q8b55q4qaq6" /v "1H8fW9FHPHXI" /f
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn8vagw663cz9m3j0rmkddxpbq9x0716k" /v "xdmbXy2e" /f
  2⤵
  PID:4488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn9ye6e6n1gjh4z5wxtr6x3fvreb2w0ta" /v "60xXSxFX" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnjayypjpx6dtabtjqtt76hhmg5nsz5nm" /v "inMN4k4DC" /f
  2⤵
  PID:6060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnzh5v9w1s9pv2y889efv7t8bg0msmhca" /v "eApBP3CV" /f
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp18ym4xr204kvw1e76kcwpeev3fsaqgb" /v "utyG0WbRy3v" /f
  2⤵
  PID:5440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp5fzsrbzrrckawyxaw2mk2xpxbeqct67" /v "da6vZ" /f
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp8e2ntvbtget7f2fw6qec3j54vhd14m4" /v "CCv19xXLu1ix" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp9gkwccvk6fa6yyfq3tmsk8ws2nprk1p" /v "xI4O7CCX" /f
  2⤵
  PID:5784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpb1vntage8kvnwpyg40aqz34j851h4p1" /v "F43RJw" /f
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpdgeqrp7ntm74ffgr878trgvezwcc21n" /v "6FvcJM" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpjdwy3ckj5c1dr53c5epmrpbex5tg2g4" /v "YpUEaDNu4LG" /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpjsxda6f84877c5f65bm4q3g4qep2rxn" /v "TtpeIrzIuIV" /f
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXq8btj36kvahvgqpj75d9n4510vjppa26" /v "gkGFeuRiqIRU" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqg3xs3h3sbq285086k5jcab5aawtt9zw" /v "R34el6L2cX2tV" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs" /v "h4v2MC3Fu47weDH" /f
  2⤵
  PID:4004
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqjyfmc5mk3hmghyt3yynbcb2jsdyp4fs" /v "Ovr8ygN7oZ8" /f
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqqxzfw12he3h63rdesxs3a7r2cs9sj4w" /v "mASIzapg4V" /f
  2⤵
  PID:784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXr012b1h6210sz3stcs8x9nn2j4rfa1fc" /v "xo0HM3khMO2w" /f
  2⤵
  PID:6092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXr0k5v4yctd1tys9hmqksf0t2zqb0fqs4" /v "K9V7a0FPSIylzL" /f
  2⤵
  PID:5752
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXreyvazcs64j2pgtpwyt49g6ce85mwrwg" /v "Tqqc1" /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXrpqnz37s7938xjfwvmrs7gr5befk6fbh" /v "4i9PtL4eNaV1o" /f
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsbz2fdbdmn6pz7xyd3zc95j9syhcnyc2" /v "twKyR8N" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsej0ym0z9bfhd049b1d9e60p08gss40d" /v "UmROxSaYfw" /f
  2⤵
  PID:5384
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsh31e62qrrqa6htpvvw6p5f80q48athh" /v "tMNXOl3tLc61" /f
  2⤵
  PID:540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsr2355wnmpt66c2rh3s461vmsmqhe6r2" /v "aAkhq6MMQ" /f
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXstagsrybc2dkesq85qj0xdqq4dbn3k6a" /v "V7u94SbsSd" /f
  2⤵
  PID:3232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsywsp6kb3dx2vqg7qaqkbc26sn1pbd28" /v "fb3D0OmcEv9FZg8" /f
  2⤵
  PID:2604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsz2w8kr3vqa5h0xgxy7bdt9816yyqntm" /v "hyitHrkKVrDn" /f
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtcqqar3xwa7yjf9crdf72pvf0tjvq2ww" /v "iPvmGxlRFVvzI5" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtggqqtcfspt6ks3fjzyfppwc05yxwtwy" /v "gnvw2uIYC4" /f
  2⤵
  PID:1652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtked0qbwdp1v44z1p7ts8bc7kkwea1mh" /v "75j1gJoX3" /f
  2⤵
  PID:5376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtmyvd154r75whynphdjyax5d711yvn0s" /v "j3FVR9ff" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtsmg3v4j4x76mctp0h8w9ykwqt07rr43" /v "QjgYxnOZ7b2n" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXve2j6k0pfr77f4q8penh0d5pgejsy932" /v "qG2AAgUT" /f
  2⤵
  PID:2268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvks94gjj6kqyt3mdm6gdkn78zngpytfd" /v "quGql20nD1NhG7" /f
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvqhb9dhb3dg0mpfydfbz4qp875kpspza" /v "xAjPPbV" /f
  2⤵
  PID:5292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvsqkg1th80rv6s2rkh5m1hjp3hxryydd" /v "Eh4Cwew4Hs" /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvvr0sjtc34r6nk4mhn2e608s2xp2tezg" /v "Z1pJZC0CaOV" /f
  2⤵
  PID:3664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvvwq6wxamf7qhxd0vn6wm1wwehyxrdd6" /v "9CqY4u7kX1LeRJ" /f
  2⤵
  PID:392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwkwctjzwtre31cm4f91h5extbhywmp1w" /v "1gO7TupSYGgv" /f
  2⤵
  PID:5648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwwaj365vh56qsq113kc3zrs1rvk43s1k" /v "DdH08NT9F" /f
  2⤵
  PID:316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxccb9186h1jcjtq5zf1a0mydqxz3dpgf" /v "iXMUwmu" /f
  2⤵
  PID:3244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxf01pj590w7z9mxmyv3nx0a9ewj3e51g" /v "yfdcJOdus84" /f
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxfctf2rqj6c7b4wrvys6zq1bskprrn19" /v "TmfwgU2SzCBNqi" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXybm0hz3h6qr4z6wdaaefvpq136awdq2e" /v "SqmPk5kbPq" /f
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXyhj8780c19x3fmfxz91fzp1yzmr5wae0" /v "EsBFlQO" /f
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXyte1agk1gt765291prervr3pvygjqp1d" /v "i4P7pG" /f
  2⤵
  PID:5860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXz2d7qm1dmekjyt1p721ccpt9mfr1a0p2" /v "qXJYXefUTYaM6iW" /f
  2⤵
  PID:928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzakfgeejsmwhgzp8fdnp87dyfh9kb9m2" /v "kGfyamGqsZpKlBG" /f
  2⤵
  PID:976
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzc8ajeke9yt5s0y88h6hvwqd556b4bma" /v "O2hjs3f7ILW5G" /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzcmrn7q3gmakk1ffkbr4s3d27qwjdtbt" /v "1YtCSvPCv" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzg6fdzp57dpmt1dqardd3y48kkx0qb78" /v "X9FsrQYMF0N" /f
  2⤵
  PID:852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXztymbw55c24qp3qfb1jac0r6a8w3rtfq" /v "fixr5Lk06yE2" /f
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzwr976v2e060wada4gabrk1x69h2dbwy" /v "22QWzryqJ" /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzych6jbn7p3xzarpfwgxas39g87myyjf" /v "K7tTKIZ" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzzr7tspjvevcy65rzzvw5kdmv270eghm" /v "nIU4h" /f
  2⤵
  PID:2172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\armodelviewing" /v "FDkZAxbg3QL" /f
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\BannerNotificationHandler.BannerNotificationHandler" /v "e0TS5o8" /f
  2⤵
  PID:3164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\BannerNotificationHandler.BannerNotificationHandler.1" /v "beslOvuCd" /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingmaps" /v "sQJbeDE3SSWkMYK" /f
  2⤵
  PID:3412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingnews" /v "IV9Sfu3B2" /f
  2⤵
  PID:2440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingweather" /v "tTlYpwcZs" /f
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\caffile" /v "jLmuMWx5pIKdN" /f
  2⤵
  PID:1964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\calculator" /v "CnxCl" /f
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\callto" /v "2uePfHU4" /f
  2⤵
  PID:5568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\capcut" /v "Pz5pm6lbb" /f
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\cdofile" /v "bd8WBvgK" /f
  2⤵
  PID:872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\CLSID" /v "GCLJd2e2044Cy6" /f
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\com.clipchamp.app" /v "7lxxCBD" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\com.microsoft.3dviewer" /v "ntP0M67qjyYfF" /f
  2⤵
  PID:3480
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\csgo" /v "RpbouBya" /f
  2⤵
  PID:3288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dctfile" /v "OSxsAN" /f
  2⤵
  PID:2576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ddpfile" /v "0phQKW" /f
  2⤵
  PID:6048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ddsfile" /v "7fRM2" /f
  2⤵
  PID:5268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\deprojfile" /v "1NpQGYR7" /f
  2⤵
  PID:3452
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dfxfile" /v "Bmu7xYnGBac" /f
  2⤵
  PID:1836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Directory" /v "TWjFF" /f
  2⤵
  PID:696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Discord" /v "B63kBC9OlFGZ" /f
  2⤵
  PID:3824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-1288512934112264234" /v "IxyD4yF" /f
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-432980957394370572" /v "b57qMbU" /f
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-445956193924546560" /v "DYDpWAAo1L44h" /f
  2⤵
  PID:3284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-477175586805252107" /v "v8XL8ww92a" /f
  2⤵
  PID:1300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\docfile" /v "vHWAemL" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\docxfile" /v "Q6Vj1YlV" /f
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\drpfile" /v "T5R8m" /f
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ds2file" /v "uFcmdq3cSy" /f
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dssfile" /v "74tLmcR2CCwtbHj" /f
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dvfile" /v "ikqG9G" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\exrfile" /v "LTpBy3OANNF" /f
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Extensions" /v "2FpIDC" /f
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\feathermc" /v "j6l41XBT3A6JtY" /f
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\feedback-hub" /v "1tLBrr" /f
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.AutoPlayHandler" /v "xvmm70Y" /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.AutoPlayHandler.1" /v "40r7Da" /f
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.FileSyncClient" /v "7FpT2zTN45GzFue" /f
  2⤵
  PID:3372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.FileSyncClient.1" /v "GPW0Tfv4KOo7BHx" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Folder" /v "xBy5KOtvk4" /f
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gaming-tcui" /v "Wgf5UCVPwYjNOZ" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gamingservicesui" /v "e4wxpSSo" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\grvopen" /v "chJHEZYLn8" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gsmfile" /v "1d4wZt2xjX0e" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\heiffile" /v "4ujh1F" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL" /v "G8Cl3ZBTMwXt" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\im" /v "ZaFm0N0LU" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\insiderhub" /v "tTVnSA" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Installer" /v "MF9OQX1X" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Interface" /v "vEdtfEaXV" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\jp2file" /v "2JVAzs8NHQSVx" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\lghubapp" /v "4YbDfxe" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\lnkfile" /v "lQ7r3toKiT1Tf0" /f
  2⤵
  PID:5636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings" /v "r89H7W" /f
  2⤵
  PID:5904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mailto" /v "xTtgJi0Q2Xr" /f
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft-edge" /v "E6Y24sszv7qBtW" /f
  2⤵
  PID:5516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft-edge-holographic" /v "RuZMRTLX3xz" /f
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera" /v "yBcUXyJuy" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera.multipicker" /v "3B2QyARbqxPxRY" /f
  2⤵
  PID:5176
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera.picker" /v "o4jVjzKp" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.crop" /v "U42g4" /f
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.picker" /v "te15fOj8yJHq9b" /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.videoedit" /v "AMqfogyjduDQ96" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftmusic" /v "gMKfYrqj2hPFdGJ" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftsolitairecollection" /v "HLOZdovpXgxG5H6" /f
  2⤵
  PID:1892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftvideo" /v "CHN3G" /f
  2⤵
  PID:3024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\MIME" /v "pRBnHqPXu3L5" /f
  2⤵
  PID:5700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mpdpfile" /v "jwwmKtD0gQ" /f
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mpeg2file" /v "x7mc7rAPpb" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-advancedsettings" /v "j2oweQ5Nyt" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-appinstaller" /v "zIjj8mNCoBjCHjy" /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-calculator" /v "JECKP" /f
  2⤵
  PID:1584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-clipchamp" /v "tK3reRTqqjU" /f
  2⤵
  PID:1960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-clock" /v "G6SaLE" /f
  2⤵
  PID:3400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-contact-support" /v "6dIidNDc9l" /f
  2⤵
  PID:3772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-copilot" /v "1INENb5" /f
  2⤵
  PID:640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-crossdevice-files" /v "i1WVAk" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-crossdevice-settings" /v "XWzC1r7sLnJ" /f
  2⤵
  PID:5252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-default-location" /v "hLDbibX35L6Av" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-drive-to" /v "6ITrh" /f
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-family" /v "qSb4I0CCx0Y" /f
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamebar" /v "PlIpj9sV" /f
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamebarservices" /v "MjfxoUma" /f
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamingoverlay" /v "mmL6dCU4" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-getoffice" /v "wjqsb2gXu8GPQ" /f
  2⤵
  PID:1924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-holographicfirstrun" /v "Y4voGydI4ME" /f
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-ipmessaging" /v "7VTDfQ7iMXuKmXl" /f
  2⤵
  PID:1704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-media-player" /v "pIDLmlWvmt" /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-notepad" /v "CDDFHv" /f
  2⤵
  PID:4548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-officeapp" /v "gmfDxsmYO" /f
  2⤵
  PID:5240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-officecmd" /v "LGB8HmPPuyVhz" /f
  2⤵
  PID:368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-outlook" /v "B8odY" /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-paint" /v "WxLfAyqQAu" /f
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-people" /v "yHXJTx5IGrfhZfh" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-phone" /v "dChQVHrG" /f
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-photos" /v "4PrfsBnP3y16" /f
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-playto-audio" /v "fncPAq" /f
  2⤵
  PID:4008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-powerautomate" /v "9q3UqiHnadkNfHx" /f
  2⤵
  PID:1804
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-quick-assist" /v "igJYFbF8" /f
  2⤵
  PID:5356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-screenclip" /v "mUMy2miA6" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-screensketch" /v "QArJxhLTo" /f
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-sttoverlay" /v "m77kKjBNmgkq" /f
  2⤵
  PID:1244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-to-do" /v "lMpiEI5" /f
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-todo" /v "8AzZm0si" /f
  2⤵
  PID:844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-unistore-email" /v "1gP7PR254vH" /f
  2⤵
  PID:2212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-voip-call" /v "u2XermSRzNDn" /f
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-voip-video" /v "uJUI4i2VxWV63y" /f
  2⤵
  PID:5128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-walk-to" /v "XjonrXH4E" /f
  2⤵
  PID:1900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wcrv" /v "FCpvdZdNW7D" /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-widgetboard" /v "8tH6KX86T" /f
  2⤵
  PID:2936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-widgets" /v "nPQy1y" /f
  2⤵
  PID:2580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store" /v "QZFQI" /f
  2⤵
  PID:5264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store-deskext" /v "DhQN5U3ts0W" /f
  2⤵
  PID:4012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store2" /v "2gSyX8" /f
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wpdrmv" /v "fgBsOmKDR9fj" /f
  2⤵
  PID:3572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbet-survey" /v "QOh28" /f
  2⤵
  PID:208
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbl-3d8b930f" /v "lJVaOL" /f
  2⤵
  PID:6120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbl-6af6e7cc" /v "ulNxe4" /f
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamelaunch" /v "NCxLRME" /f
  2⤵
  PID:5192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamepass" /v "VixAjz" /f
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamingapp" /v "wKdC9eo6ZkP1cZz" /f
  2⤵
  PID:5816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnews" /v "sPM7JSgW" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnnews" /v "BK3DC0ZZ9" /f
  2⤵
  PID:5224
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnweather" /v "MLb5rrteUhE" /f
  2⤵
  PID:1760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mssharepointclient" /v "2oAj09" /f
  2⤵
  PID:1124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msteams" /v "u0qOh9bOstNAnD" /f
  2⤵
  PID:5628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msteamscanary" /v "Ke5TJi2C4Gf" /f
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mswindowsmusic" /v "C6U9Y5Lyg1O" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mswindowsvideo" /v "JjXuz9" /f
  2⤵
  PID:5456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msxbox" /v "rRu5nFGCXnPL6" /f
  2⤵
  PID:3952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NotificationData" /v "dgb30RH2noC" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\nppfile" /v "1gfb36biy" /f
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusNativeMessaging.NucleusNativeMessaging" /v "XAw1ga8RuA4Nt" /f
  2⤵
  PID:2844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusNativeMessaging.NucleusNativeMessaging.1" /v "ARVE1wQKbPD" /f
  2⤵
  PID:5100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusToastActivator.NucleusToastActivator" /v "ClzJLCIqgIhg5U" /f
  2⤵
  PID:5448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusToastActivator.NucleusToastActivator.1" /v "C9OjJ" /f
  2⤵
  PID:3612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\odopen" /v "DgLRN8lolp" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\odtfile" /v "Nhgjz8" /f
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\oggfile" /v "CNedqLyjHBq4M" /f
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OneDrive.CameraRoll.Import" /v "H5rvDU5" /f
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote" /v "CCBnMcoyPn" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote-cmd" /v "3NmX5aonlFW9UGW" /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote-uwp" /v "GRRmSLxP" /f
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OOBERequestHandler.OOBERequestHandler" /v "LSJ2a1iKLE" /f
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OOBERequestHandler.OOBERequestHandler.1" /v "DwXlHcirT8" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Opera GXStable" /v "D2nAo8ZC" /f
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OperaStable" /v "icTZiIuWb" /f
  2⤵
  PID:3168
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookaccounts" /v "TTEcsC" /f
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookcal" /v "nt9LDVYR1" /f
  2⤵
  PID:6056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookmail" /v "WCtyIHIph" /f
  2⤵
  PID:5288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\PackagedCom" /v "5gheER27K2hTKPW" /f
  2⤵
  PID:3804
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Paint.Picture" /v "P72FNgMp5HN" /f
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\PBrush" /v "clu4zrcwo" /f
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\pcxfile" /v "TiFpM7r9qZ9i" /f
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\pdffile" /v "FfH8pUJsOK1b" /f
  2⤵
  PID:4608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\pgffile" /v "8Y1WDI3QzloKe" /f
  2⤵
  PID:1632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ProcMon.Logfile.1" /v "EyquMEjtE00" /f
  2⤵
  PID:4752
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\proton-inbox" /v "wfsseFlmy3Tte9I" /f
  2⤵
  PID:4560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\proton-vpn" /v "9S8JG" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ProtonMail.Url.mailto" /v "PQ9Kp9oKnx0r" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\protonvpn" /v "kY0Zoy23pdh8Qhn" /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\psdfile" /v "6WGRwqNg6c" /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\rasfile" /v "tGX3iNv5" /f
  2⤵
  PID:4664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\read" /v "1AHDTt8E" /f
  2⤵
  PID:5468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\roblox" /v "hDZxt6Hw1aQX" /f
  2⤵
  PID:3652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\rtffile" /v "q6P2DZtW" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\rtkuwp" /v "p6q1ayyWw" /f
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\shnfile" /v "k6yWYlDNSod" /f
  2⤵
  PID:4916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sip" /v "OHVtmgZ1Id0cwL" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sips" /v "1XezIqY6K" /f
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skype" /v "DG9zd7g3l" /f
  2⤵
  PID:4480
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skype-meetnow" /v "q1lVenhmhW6lHQ" /f
  2⤵
  PID:544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skypewin" /v "Sb53wu1voMMUOQ" /f
  2⤵
  PID:4412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sms" /v "U4HIiWHQ3GpMEuD" /f
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\spjfile" /v "KPkYgXf" /f
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\spotify" /v "d6TdmcgH6o" /f
  2⤵
  PID:5616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ssgg" /v "pxXyOct71" /f
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\steam" /v "tpLU4KaCcD4d7C" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\steamlink" /v "bvC5GM6QV5kyT" /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider" /v "HKDqM" /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider.1" /v "DzFoUwermg" /f
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider" /v "cZlN5wjre" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1" /v "YsXbl69" /f
  2⤵
  PID:880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy" /v "CtBNOrIcciy" /f
  2⤵
  PID:4228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1" /v "L8V505VYvZT2yat" /f
  2⤵
  PID:1060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tar.gzfile" /v "tsT39lK" /f
  2⤵
  PID:2516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tel" /v "Qe4iuhoR0g" /f
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tgafile" /v "ape3eZBWjP" /f
  2⤵
  PID:820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\TypeLib" /v "NP7LZflKG1lC" /f
  2⤵
  PID:904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\vobfile" /v "lgEQ3V7D" /f
  2⤵
  PID:932
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\vocfile" /v "FuZGSs783pIgUo" /f
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\voxfile" /v "rTu4rfUIp3IH1" /f
  2⤵
  PID:5524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\vpjfile" /v "2ZqZgZFyjLt" /f
  2⤵
  PID:5936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wdpfile" /v "OhkOfZ6tT6zPY" /f
  2⤵
  PID:3524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webcal" /v "kCI4XXTrz" /f
  2⤵
  PID:1564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webcals" /v "TfPStFq" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webmfile" /v "YR6GZ1lZ7CCd" /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webpfile" /v "amnzfLh78t" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\windows-feedback" /v "c26vmpur4uv" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\windowsdefender" /v "182h6HM0A3q8Q" /f
  2⤵
  PID:972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\WOW6432Node" /v "idaS3ZZLlt8u" /f
  2⤵
  PID:4064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wp-autoplay" /v "OGs4mvigCcIs" /f
  2⤵
  PID:3400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wpdfile" /v "8x3GJ" /f
  2⤵
  PID:3772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wpfile" /v "3BmzjoE5ow7" /f
  2⤵
  PID:640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wpsfile" /v "TAv4I" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbls" /v "TuoWc2Hb4D" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox" /v "ZOwFQVAhuHs" /f
  2⤵
  PID:632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-arena" /v "OZsGdV" /f
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-captures" /v "OcAxXDz" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-friendfinder" /v "mQGRYa2tCUG2h" /f
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-gamehub" /v "vIFmwzf2" /f
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-lfg" /v "J8OuWOY3POf" /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-network" /v "GrDC6gOvA" /f
  2⤵
  PID:4004
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-profile" /v "5dysKIthIg" /f
  2⤵
  PID:3076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-settings" /v "gBzYVLpeo8H" /f
  2⤵
  PID:5352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-store" /v "qUSpwm" /f
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxgames" /v "uKeDj7b" /f
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxidp" /v "iv5OxIBX" /f
  2⤵
  PID:652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxliveapp-1297287741" /v "epkdb2WDmEmS0D" /f
  2⤵
  PID:1876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxmusic" /v "YYwRx4QRVaSP4x" /f
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\zune" /v "j2eCrZvmt8" /f
  2⤵
  PID:944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI" /v "S1qjkKUwThrjGAK" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT" /v "kV96ELPWBjkKP" /f
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FACS" /v "hcSwOhlWO6VlXzM" /f
  2⤵
  PID:3920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FADT" /v "L0SCMaF40c7js" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\RSDT" /v "NF9aISqhet" /f
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD1" /v "kIKeE6qQqAO" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD2" /v "ToDmvlhXBn" /f
  2⤵
  PID:5716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD3" /v "Fn8JyD" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD4" /v "dqa6Y4WLd524y" /f
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD5" /v "PXkXrTUqzxEE" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD6" /v "hPEvVvnGbDxy7V" /f
  2⤵
  PID:5280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD7" /v "YWzYDwR" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD8" /v "Y5usJL7GK6w" /f
  2⤵
  PID:4452
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD9" /v "LiEn8rjNL3" /f
  2⤵
  PID:5160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDA" /v "Mr1njy" /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDB" /v "NWb3i" /f
  2⤵
  PID:5520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDC" /v "jVGnUlPp" /f
  2⤵
  PID:5608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDT" /v "Z8AXxZtX7s" /f
  2⤵
  PID:2828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION" /v "TX8xv0d" /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System" /v "P8Dph" /f
  2⤵
  - Enumerates system info in registry
  PID:2616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP" /v "mk1cMbqb" /f
  2⤵
  PID:5684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\KeyboardClass" /v "xCqW8QbhS" /f
  2⤵
  PID:6116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PointerClass" /v "h4KD1Q" /f
  2⤵
  PID:3664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO" /v "UsbOyx" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi" /v "vx04Yg" /f
  2⤵
  PID:116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\UEFI" /v "eMD59FCQT" /f
  2⤵
  PID:6108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\UEFI\ESRT" /v "VbBsU5VZXyomvk" /f
  2⤵
  PID:5296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP" /v "1XRXdjqt" /f
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer" /v "GJgPNa" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\PnP Manager" /v "QVud5fODwQu5" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\System Resources" /v "DZGRqKpoHjNdTkp" /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Interface" /v "ClsidStore" /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc" /v "CMPOL" /f
  2⤵
  PID:4912
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\nvlddmkm\Enum" /v "0" /f
  2⤵
  PID:2872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count" /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}" /f
  2⤵
  PID:2084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
  2⤵
  PID:2340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count" /f
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}" /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}" /f
  2⤵
  PID:64
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count" /f
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}" /f
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count" /f
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count" /f
  2⤵
  PID:5568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}" /f
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count" /f
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine\Hardware Survey" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /f
  2⤵
  PID:3204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /f
  2⤵
  PID:5732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /f
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f214d5eb-7631-11f0-afd0-c77475afdf31}" /f
  2⤵
  PID:3724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{97bb8eb6-4096-447f-be7e-669d523481d3}" /f
  2⤵
  PID:464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{749716d5-2798-4f9f-b699-e3eacb43641c}" /f
  2⤵
  PID:5464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{17a825e4-4885-47cb-8322-65c5324cd2be}" /f
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" /f
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC" /f
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\Settings" /f
  2⤵
  PID:3768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo" /f
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel" /f
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\UserHelper" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\UIHelper" /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\RegisteredProducts" /f
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\MainService" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\InstallHelper" /f
  2⤵
  PID:4688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS" /f
  2⤵
  PID:1172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{749716d5-2798-4f9f-b699-e3eacb43641c}" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket" /f
  2⤵
  PID:4708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games\Unreal Engine" /f
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games" /f
  2⤵
  PID:3372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet\Home" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet" /f
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Admin\Downloads" /v "spf.exe" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\a48e850cca939315" /v "rAQBc8Wsa1xVP" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow" /v "DNhm3" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Software" /v "IDCdJOyapnxr" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium" /v "JBdT3hVOfoaM" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\BLBeacon" /v "ZYFYZ5B6kzMCk" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord" /v "fRyilOYGxlSXP" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord\Modules" /v "Rblsaqv" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /v "CmZFOv" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /v "ZpzRiKYpZgnSOK" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /v "g5Ayy61" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google" /v "9rklPGtfUR2I" /f
  2⤵
  PID:5636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Chrome" /v "ciQTqVaAUnJv" /f
  2⤵
  PID:5904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Update" /v "y4KjsfSX" /f
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos" /v "2u8qvJP3B6Uiu1g" /f
  2⤵
  PID:5516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos\Vulkan" /v "oDUTOX7NY" /f
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft" /v "lvBndn4" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Accessibility" /v "gr881" /f
  2⤵
  PID:5176
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup" /v "L1Q4G" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie" /v "uTlCH9WpIYaPH" /f
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveSync" /v "ds7HX27KbNC" /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Assistance" /v "pqiwdo3Hrdt6z3" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies" /v "DtmvWvN20" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Avalon.Graphics" /v "0OSa9" /f
  2⤵
  PID:1892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Clipboard" /v "cKwhz" /f
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CommsAPHost" /v "PYlapdvx" /f
  2⤵
  PID:5700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF" /v "OwWR2uaAtZV" /f
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Direct3D" /v "nZSCe8nPQH" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge" /v "jHkpC99I" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate" /v "li9Mk6pyZdA" /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EventSystem" /v "zchUSmJqhT" /f
  2⤵
  PID:1584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\F12" /v "kdKB9Ppfr6Sk" /f
  2⤵
  PID:1960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fax" /v "lyLUl" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Feeds" /v "08n8Y" /f
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\FTP" /v "sSXvy" /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBar" /v "A1KG3aMSFgDmn" /f
  2⤵
  PID:5892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBarApi" /v "4mMxkcNZ" /f
  2⤵
  PID:5252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL" /v "VlvkI3S1W" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IME" /v "5P1fJX" /f
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Input" /v "LJwWy0vNK" /f
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputMethod" /v "YKbBkp7iE8TL" /f
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputPersonalization" /v "zKFZdSKQc" /f
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Connection Wizard" /v "tYFpEFl" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer" /v "WkhVYO3dJfBuCov" /f
  2⤵
  PID:1924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Keyboard" /v "IkbSUz2k4X" /f
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer" /v "SLUcbCkFeXVwVQ" /f
  2⤵
  PID:1704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MSF" /v "dtm9WgMa" /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Multimedia" /v "TDHqyzKXoJ" /f
  2⤵
  PID:4548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Narrator" /v "fRWIz" /f
  2⤵
  PID:5240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive" /v "CmfLf8hgMcV" /f
  2⤵
  PID:368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Osk" /v "9GUa8m6xqqEZ1EN" /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\PeerNet" /v "gMnn79" /f
  2⤵
  PID:4260