563cf8f78fd34391dbe6f8a64e23c8785efa2a61fb9bdc4942a9f0aa83871431

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ud.bat
Size 1.4MB
Sample260720-sq76csgs5s
SHA256 563cf8f78fd34391dbe6f8a64e23c8785efa2a61fb9bdc4942a9f0aa83871431
MD5 f852c8e596e07b4441827009ed5098bb
SHA1 95f7eb5002311e4c2293fc4827ef1e6a14a0c395
SHA512 6f2306e9706b5efda5450476627b52e1adabb4e64936e1ffca6bd31d39c64a6cebf00460db6e35bc203d3c117f027b18c3dc97c64f7191516a1c081300b4c36b
SSDEEP 12288:pcFSOojunYATI9sMrPkuipWvDIkORU14n7:qFSOojunYATI9sMrPkuipWvDIkORV7
TLSH
T137657400A2259272D4A321C8D3DF991D39BCD18732A07B9352E56E4DDC8E83C557FEEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\ed6dc0edcfa40be3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx	Process not Found
File created	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\ed6dc0edcfa40be3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val	Process not Found
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	Process not Found
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\ed6dc0edcfa40be3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\READYB~1\READYB~1.ETL	cmd.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4864	sc.exe
5000	sc.exe
5988	sc.exe
6092	sc.exe
3756	sc.exe
968	sc.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3412	cmd.exe
4416	cmd.exe
5780	cmd.exe
2160	Process not Found
5788	Process not Found
3436	Process not Found

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5988	sc.exe
6092	sc.exe
3756	sc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6060	Process not Found
2568	Process not Found

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\4	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier	Process not Found
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Update Status	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Update Status	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\2	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\	Process not Found
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Previous Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Previous Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\VendorIdentifier	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Previous Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Update Status	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Update Status	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Update Revision	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\5	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\7	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Previous Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Update Status	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\3	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Previous Update Revision	Process not Found

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\P8Dph	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\HLfhM	Process not Found
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\QVSYrBhYbFTc	Process not Found

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
1488	taskkill.exe
5460	taskkill.exe
6112	taskkill.exe
5700	taskkill.exe
6020	taskkill.exe
1292	taskkill.exe
3100	taskkill.exe
5688	taskkill.exe
5772	taskkill.exe
260	taskkill.exe
2544	taskkill.exe
5968	taskkill.exe
5068	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	Process not Found
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	Process not Found
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	Process not Found
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	Process not Found
Key created	\REGISTRY\USER\S-1-5-19	Process not Found
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	Process not Found

Runs net.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	5700	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	3100	taskkill.exe
Token: SeDebugPrivilege	5688	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	5460	taskkill.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeDebugPrivilege	6112	taskkill.exe
Token: SeShutdownPrivilege	368	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5648	3412	cmd.exe	89
PID 3412 wrote to memory of 368	3412	cmd.exe	90
PID 3412 wrote to memory of 260	3412	cmd.exe	91
PID 3412 wrote to memory of 2544	3412	cmd.exe	93
PID 3412 wrote to memory of 5700	3412	cmd.exe	94
PID 3412 wrote to memory of 6020	3412	cmd.exe	96
PID 3412 wrote to memory of 5968	3412	cmd.exe	97
PID 3412 wrote to memory of 5068	3412	cmd.exe	98
PID 3412 wrote to memory of 1292	3412	cmd.exe	99
PID 3412 wrote to memory of 5000	3412	cmd.exe	100
PID 3412 wrote to memory of 5988	3412	cmd.exe	101
PID 3412 wrote to memory of 6092	3412	cmd.exe	102
PID 3412 wrote to memory of 3756	3412	cmd.exe	103
PID 3412 wrote to memory of 968	3412	cmd.exe	104
PID 3412 wrote to memory of 4864	3412	cmd.exe	105
PID 3412 wrote to memory of 3100	3412	cmd.exe	106
PID 3412 wrote to memory of 5688	3412	cmd.exe	107
PID 3412 wrote to memory of 1488	3412	cmd.exe	108
PID 3412 wrote to memory of 5460	3412	cmd.exe	109
PID 3412 wrote to memory of 5772	3412	cmd.exe	110
PID 3412 wrote to memory of 6112	3412	cmd.exe	111
PID 3412 wrote to memory of 2136	3412	cmd.exe	112
PID 3412 wrote to memory of 4848	3412	cmd.exe	113
PID 3412 wrote to memory of 5692	3412	cmd.exe	114
PID 3412 wrote to memory of 4508	3412	cmd.exe	115
PID 3412 wrote to memory of 5432	3412	cmd.exe	116
PID 3412 wrote to memory of 1600	3412	cmd.exe	117
PID 3412 wrote to memory of 4416	3412	cmd.exe	118
PID 3412 wrote to memory of 1548	3412	cmd.exe	119
PID 3412 wrote to memory of 5780	3412	cmd.exe	120
PID 3412 wrote to memory of 1980	3412	cmd.exe	121
PID 3412 wrote to memory of 5036	3412	cmd.exe	122
PID 3412 wrote to memory of 2724	3412	cmd.exe	123
PID 3412 wrote to memory of 5712	3412	cmd.exe	124
PID 3412 wrote to memory of 4620	3412	cmd.exe	125
PID 3412 wrote to memory of 3140	3412	cmd.exe	126
PID 3412 wrote to memory of 4476	3412	cmd.exe	127
PID 3412 wrote to memory of 1464	3412	cmd.exe	335
PID 3412 wrote to memory of 3088	3412	cmd.exe	129
PID 3412 wrote to memory of 1732	3412	cmd.exe	130
PID 3412 wrote to memory of 5420	3412	cmd.exe	131
PID 3412 wrote to memory of 2560	3412	cmd.exe	132
PID 3412 wrote to memory of 1156	3412	cmd.exe	133
PID 3412 wrote to memory of 2312	3412	cmd.exe	134
PID 3412 wrote to memory of 5604	3412	cmd.exe	135
PID 3412 wrote to memory of 5676	3412	cmd.exe	136
PID 3412 wrote to memory of 5932	3412	cmd.exe	137
PID 3412 wrote to memory of 5584	3412	cmd.exe	138
PID 3412 wrote to memory of 4268	3412	cmd.exe	139
PID 3412 wrote to memory of 4940	3412	cmd.exe	140
PID 3412 wrote to memory of 4360	3412	cmd.exe	141
PID 3412 wrote to memory of 4596	3412	cmd.exe	142
PID 3412 wrote to memory of 4600	3412	cmd.exe	143
PID 3412 wrote to memory of 1916	3412	cmd.exe	144
PID 3412 wrote to memory of 2144	3412	cmd.exe	145
PID 3412 wrote to memory of 5588	3412	cmd.exe	146
PID 3412 wrote to memory of 5372	3412	cmd.exe	147
PID 3412 wrote to memory of 1516	3412	cmd.exe	148
PID 3412 wrote to memory of 2620	3412	cmd.exe	149
PID 3412 wrote to memory of 2684	3412	cmd.exe	150
PID 3412 wrote to memory of 2188	3412	cmd.exe	151
PID 3412 wrote to memory of 916	3412	cmd.exe	152
PID 3412 wrote to memory of 5884	3412	cmd.exe	153
PID 3412 wrote to memory of 5324	3412	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ud.bat"
1⤵
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f"
  2⤵
  PID:5648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f"
  2⤵
  PID:368
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC_EOS.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC_EOS
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5988
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6092
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_BE
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3756
- C:\Windows\system32\sc.exe
  sc stop NvContainerLocalSystem
  2⤵
  - Launches sc.exe
  PID:968
- C:\Windows\system32\sc.exe
  sc stop NVDisplay.ContainerLocalSystem
  2⤵
  - Launches sc.exe
  PID:4864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im nvcontainer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im NVDisplay.Container.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5688
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "NVIDIA Web Helper.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "NVIDIA Share.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im nvsphelper64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6112
- C:\Windows\system32\reg.exe
  REG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_TrackProgs /t REG_DWORD /d 0 /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f
  2⤵
  PID:4508
- C:\Windows\system32\cmd.exe
  cmd /C del /s /f /q "C:\Windows\INF\*.*"
  2⤵
  PID:5432
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Windows\temp"
  2⤵
  PID:1600
- C:\Windows\system32\cmd.exe
  cmd /C mkdir "C:\Windows\temp"
  2⤵
  - Executes a command shell one-liner
  PID:4416
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Windows\Prefetch"
  2⤵
  PID:1548
- C:\Windows\system32\cmd.exe
  cmd /C mkdir "C:\Windows\Prefetch"
  2⤵
  - Executes a command shell one-liner
  PID:5780
- C:\Windows\system32\cmd.exe
  cmd /C del /s /f /q "C:\Users\Admin\AppData\Local\IconCache.db"
  2⤵
  PID:1980
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache"
  2⤵
  PID:5036
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches"
  2⤵
  PID:2724
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\History"
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache"
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache"
  2⤵
  PID:3140
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache"
  2⤵
  PID:4476
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content"
  2⤵
  PID:1464
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData"
  2⤵
  PID:3088
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\ProgramData\NVIDIA Corporation\Drs"
  2⤵
  PID:1732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count" /f
  2⤵
  PID:5420
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}" /f
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
  2⤵
  PID:1156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}" /f
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count" /f
  2⤵
  PID:5604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}" /f
  2⤵
  PID:5676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
  2⤵
  PID:5932
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}" /f
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count" /f
  2⤵
  PID:4268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}" /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count" /f
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}" /f
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count" /f
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}" /f
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count" /f
  2⤵
  PID:2144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}" /f
  2⤵
  PID:5588
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count" /f
  2⤵
  PID:5372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}" /f
  2⤵
  PID:1516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /f
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /f
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\EOS" /f
  2⤵
  PID:5884
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
  2⤵
  PID:5324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
  2⤵
  PID:3840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{f840bc35-59a8-4818-98dd-f637809d719e}" /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b4b931e9-956a-4dda-81a0-0852d33b94fc}" /f
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{8cf84386-1c42-49b0-b5d4-e3627b54df13}" /f
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
  2⤵
  PID:1352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" /f
  2⤵
  PID:712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open\command" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open" /f
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell" /f
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\DefaultIcon" /f
  2⤵
  PID:972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
  2⤵
  PID:5088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SYSTEM\ControlSet001\Services\ClipSVC\Parameters" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b4b931e9-956a-4dda-81a0-0852d33b94fc}" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Admin\Desktop" /v "loader.exe" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\20900" /v "rAQBc8Wsa1xVP" /f
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\469751801" /v "DNhm3" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\92978" /v "IDCdJOyapnxr" /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Activision" /v "JBdT3hVOfoaM" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Activision\Call Of Duty" /v "ZYFYZ5B6kzMCk" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\appdatalow" /v "fRyilOYGxlSXP" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\appdatalow\software" /v "Rblsaqv" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Bytedance" /v "CmZFOv" /f
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Bytedance\CapCut" /v "ZpzRiKYpZgnSOK" /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\CapCut" /v "g5Ayy61" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Caphyon" /v "9rklPGtfUR2I" /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Caphyon\Advanced Updater" /v "ciQTqVaAUnJv" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\ChangeTracker" /v "y4KjsfSX" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium" /v "2u8qvJP3B6Uiu1g" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\BLBeacon" /v "oDUTOX7NY" /f
  2⤵
  PID:2780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\PreferenceMACs" /v "lvBndn4" /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\StabilityMetrics" /v "gr881" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Chromium\ThirdParty" /v "L1Q4G" /f
  2⤵
  PID:3920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Clients" /v "uTlCH9WpIYaPH" /f
  2⤵
  PID:1204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Clients\Mail" /v "ds7HX27KbNC" /f
  2⤵
  PID:3172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Clients\StartMenuInternet" /v "pqiwdo3Hrdt6z3" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\DeviceInfo" /v "DtmvWvN20" /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\DeviceInfo\MacAddr" /v "0OSa9" /f
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Discord" /v "cKwhz" /f
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Discord\Modules" /v "PYlapdvx" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\e0b05d7f-6bca-50e8-b129-1157af44ea69" /v "OwWR2uaAtZV" /f
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /v "nZSCe8nPQH" /f
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\EOS" /v "jHkpC99I" /f
  2⤵
  PID:1912
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /v "li9Mk6pyZdA" /f
  2⤵
  PID:444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Facepunch Studios LTD" /v "zchUSmJqhT" /f
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Facepunch Studios LTD\Rust" /v "kdKB9Ppfr6Sk" /f
  2⤵
  PID:6028
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google" /v "lyLUl" /f
  2⤵
  PID:2568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\Chrome" /v "08n8Y" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\GECommonSettings" /v "sSXvy" /f
  2⤵
  PID:5524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\Google Earth Pro" /v "A1KG3aMSFgDmn" /f
  2⤵
  PID:3716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\No Chrome Offer Until" /v "4mMxkcNZ" /f
  2⤵
  PID:1308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Google\Update" /v "VlvkI3S1W" /f
  2⤵
  PID:2772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\GU" /v "5P1fJX" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\GU\GearUPBooster" /v "LJwWy0vNK" /f
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Hakita" /v "YKbBkp7iE8TL" /f
  2⤵
  PID:1400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Hakita\ULTRAKILL" /v "zKFZdSKQc" /f
  2⤵
  PID:3420
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Innersloth" /v "tYFpEFl" /f
  2⤵
  PID:5328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Innersloth\Among Us" /v "WkhVYO3dJfBuCov" /f
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\JustPlay.LOL" /v "IkbSUz2k4X" /f
  2⤵
  PID:5280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\JustPlay.LOL\1v1.LOL" /v "SLUcbCkFeXVwVQ" /f
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Khronos" /v "dtm9WgMa" /f
  2⤵
  PID:4772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Khronos\Vulkan" /v "TDHqyzKXoJ" /f
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\LogiShrd" /v "fRWIz" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\LogiShrd\DownloadAssistant" /v "CmfLf8hgMcV" /f
  2⤵
  PID:3548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Logitech" /v "9GUa8m6xqqEZ1EN" /f
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Logitech\LGHUB" /v "gMnn79" /f
  2⤵
  PID:564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft" /v "iU1b6GvS1TiZ" /f
  2⤵
  PID:2280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Accessibility" /v "F3YxVeBJK" /f
  2⤵
  PID:852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\AccountHealth" /v "I6BDvjwRgw6eX3a" /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup" /v "qOpaZDAqyR" /f
  2⤵
  PID:5312
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie" /v "tBHYf2FpMSsvHgo" /f
  2⤵
  PID:5600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ActiveSync" /v "DFDHnZw3L1" /f
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Assistance" /v "XjmxEHys" /f
  2⤵
  PID:5648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\AuthCookies" /v "PJe5AhAz" /f
  2⤵
  PID:368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Avalon.Graphics" /v "cxwTJIK38D" /f
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Clipboard" /v "l9nTdejMgZ" /f
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Common" /v "ACuTi9DM5uXp9f" /f
  2⤵
  PID:252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\CommsAPHost" /v "ZWwjV3" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Connection Manager" /v "00ZEPd" /f
  2⤵
  PID:6108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\CTF" /v "T9cZ93mG" /f
  2⤵
  PID:3024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Device Association Framework" /v "vFnijwndit6Bb" /f
  2⤵
  PID:2544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\DeviceDirectory" /v "ptnzsTGlZHvojW" /f
  2⤵
  PID:2216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v "a2vQfNw0Kkib" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\DirectX" /v "CN8tTeV" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\DirectX Diagnostic Tool" /v "HQNTkRuv0Hc" /f
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Edge" /v "xfkPrCtcI90Gp" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate" /v "mPW6Yl2M9LhIU3F" /f
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\EdgeWebView" /v "BXCBZ37CFjIy9" /f
  2⤵
  PID:3952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\EventSystem" /v "MvfoH1VDKMYcf" /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\F12" /v "VSgoKEV" /f
  2⤵
  PID:5968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Fax" /v "uOR03" /f
  2⤵
  PID:1900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Feeds" /v "QFt7EeMp9cd" /f
  2⤵
  PID:1852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\FTP" /v "XoJil2J" /f
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "ZIwWsOrk" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\GameBarApi" /v "aTgyKnutVL7pd" /f
  2⤵
  PID:2412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\GamingServices" /v "jFkhMJ9N1" /f
  2⤵
  PID:4876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL" /v "rfwmOZGylOWSP" /f
  2⤵
  PID:5796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\IME" /v "sRaUwIQjMDtCJ" /f
  2⤵
  PID:5488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\input" /v "BawfSWL3TtuQP2t" /f
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\InputMethod" /v "6Q5IJB1U" /f
  2⤵
  PID:6092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization" /v "WCDz06yo4opxOK" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Installer" /v "5YOvt" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Connection Wizard" /v "GR3su0Hx" /f
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer" /v "GjxoXjAG" /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Keyboard" /v "c1H1JyHa" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\LanguageOverlay" /v "Tn3iS" /f
  2⤵
  PID:2896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Lighting" /v "9exXT5" /f
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\LiveCaptions" /v "ARVZR0" /f
  2⤵
  PID:920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer" /v "t1fm1jomYqLM" /f
  2⤵
  PID:4548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Microsoft Management Console" /v "M8oTPRr0e6FAzwz" /f
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\MSF" /v "iLwRDfosp" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Multimedia" /v "vGkmY5kinZ" /f
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Narrator" /v "9wGTC2s6a" /f
  2⤵
  PID:3028
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Notepad" /v "dPedIo" /f
  2⤵
  PID:6000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Nucleus" /v "OTJcJwef0hg0A" /f
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office" /v "9PBkwzFeaKQ" /f
  2⤵
  PID:1576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\OneDrive" /v "kSP3msI6XZMEwGu" /f
  2⤵
  PID:1096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Osk" /v "XSOiiZqTo9VxlS" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\PeerNet" /v "QwN3gcifOpKg0" /f
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Personalization" /v "60OvE" /f
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Phone" /v "zXoaswtGzU6wy9" /f
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Pim" /v "XC9nuPUABJkOmf" /f
  2⤵
  PID:1792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Poom" /v "O6aMx3QRb0xN" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Print" /v "KwO76uAIr" /f
  2⤵
  PID:3524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\RAS AutoDial" /v "M08iYfRYDL" /f
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Registration" /v "sE9f6ebsOTWb" /f
  2⤵
  PID:1768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Remote Assistance" /v "aw4Ee2fgW" /f
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ResKit" /v "5F6wvy" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\ScreenMagnifier" /v "wYsVx5W0yG8" /f
  2⤵
  PID:572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Sensors" /v "dSIiwEtLHXVZsOb" /f
  2⤵
  PID:5544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\SkyDrive" /v "pNpLPnVhxSPRW" /f
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Speech" /v "VaDXA" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Speech Virtual" /v "4bWozXys0Q" /f
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore" /v "U5Qe8dZhX63" /f
  2⤵
  PID:4708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Spelling" /v "Y20H08Xwi0at2j" /f
  2⤵
  PID:1992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\SQMClient" /v "ixWgo" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\StigRegKey" /v "58Tp9dlF4BG5xML" /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\StorageLibrary" /v "0dLL7FNP3EehjT" /f
  2⤵
  PID:3160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates" /v "BtHa9qrMZEYnTQ" /f
  2⤵
  PID:5840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\TabletTip" /v "JgNakyOO9TJXQX" /f
  2⤵
  PID:5936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Touchpad" /v "aTG2C7Qia3eeM" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\TPG" /v "Pm2YQ" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Unified Store" /v "pMXD22rqy" /f
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Unistore" /v "jkOCjQJ0c" /f
  2⤵
  PID:1636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\UserData" /v "tZ8rqYI0jH" /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\WAB" /v "OqjGagEu75Im" /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\WcmSvc" /v "Tp0KVDibIRx" /f
  2⤵
  PID:1040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\wfs" /v "o8LXY4dLywY" /f
  2⤵
  PID:3136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows" /v "q5Tx60luda1x" /f
  2⤵
  PID:2528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Defender Security Center" /v "dX1KlWXtq" /f
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT" /v "95SzkXT8ZpDQj" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Script" /v "bJXpgSkSjB" /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host" /v "mdPcNj711hz" /f
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Search" /v "4yfm8dE4WK2" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows Security Health" /v "1JOkib5I5qY2lF" /f
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\WindowsAppRuntimeApplications" /v "0GIsFTnTZSg06VD" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Wisp" /v "jBRZVStd" /f
  2⤵
  PID:4376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Xbox" /v "kG1BZU" /f
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\XboxLive" /v "m7raLU" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Mojang" /v "5ieeI8tYWmFGzu" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Mojang\Minecraft Launcher" /v "UFl0XjDq" /f
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software" /v "4JSgVS0q" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software\Components" /v "gaixwB9dyC" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software\Debut" /v "1o6yALK" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Software\Suite" /v "x6mMA0N7j" /f
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Swift Sound" /v "PEPp1ZNxGFFh" /f
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NCH Swift Sound\Components" /v "8VVWnEzSJ" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation" /v "owgmHlpblyDw" /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation\Ansel" /v "5PlbWG9mVUhDpT" /f
  2⤵
  PID:1372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation\Global" /v "HuylQvPuof" /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\NVIDIA Corporation\NvBackend" /v "WaDDx47Sf" /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Opera Software" /v "9YDQSYwvle" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Opera Software\511efacfc496876407ae0db1e76d9dd1" /v "8B9EZ" /f
  2⤵
  PID:5212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Opera Software\5959b5a69bec362f0f879aeba1d1edeb" /v "cPG0rNljM2zbn" /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\OverwolfElectron" /v "T0P5A2R8GpaaiW" /f
  2⤵
  PID:712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\OverwolfElectron\lpdhkekimgfofngpompbcpndlbkmaoejkpodjbcb" /v "1SH4aSk6eX" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\OverwolfPersist" /v "WDPotZIWI7qF4" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\PDFEditor" /v "FxR6NBB3m" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Policies" /v "VBLAljp" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Policies\Microsoft" /v "OIb5anh2CV" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Policies\Power" /v "nLjBsORXtJTrPEv" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Realtek" /v "Z8pHG8v" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Realtek\Audio" /v "P2Hfo" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\RegisteredApplications" /v "oH1PmUbEzvO2D" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\RegisteredApplications\PackagedApps" /v "qQfhtdHTwRWUvJ" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Rockstar Games" /v "jqhEfxVJ" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\SyncEngines" /v "8fszd" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\SyncEngines\Providers" /v "6SiqR" /f
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Sysinternals" /v "vDgj5ogq" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor" /v "iKDG0mzm" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\SystemInformation" /v "tXhWmqf" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft" /v "hZFaBp" /f
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft\Launcher" /v "HW2rLc6A" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft\Rainbow Six - Siege" /v "W0uxd" /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Ubisoft\Uplay" /v "jMaKXwNEFX" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Valve" /v "uHR3U" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Valve\Steam" /v "Sz24DSpKSKQ" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR" /v "meRpfwY3Rb07" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\ArcHistory" /v "IZLk4" /f
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory" /v "BuF9sP2we" /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\FileList" /v "6klv47" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\General" /v "DQn19BblM" /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\Interface" /v "NUVpy2I03lOJjOp" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\Profiles" /v "lvPsLsT7iz" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR\Setup" /v "CBktRrvxr08" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\WinRAR SFX" /v "xTft0d7gh" /f
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Wow6432Node" /v "ehAZ8Ki063ra5" /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft" /v "DxaARWG" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes" /v "ue9CHBn2TeW" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\*" /v "ojL6BYOXXsqwbl" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3fr" /v "LWrHd5" /f
  2⤵
  PID:2252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3g2" /v "WMLzbV9NINARb" /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp" /v "JVMzP0MMHqz" /f
  2⤵
  PID:2900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp2" /v "wg6TacFe8b" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gpp" /v "JOAY0Q0nty9AGV3" /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3mf" /v "sTAMG6DFeM58Z" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.aac" /v "EhtGZw2HsSka" /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ac3" /v "2jDOyQ" /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adt" /v "OZtiaW19db" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adts" /v "zgDoz" /f
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.agent" /v "RWZ4KGnR4ZcC" /f
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.aiff" /v "nb6hFmvUR6NZo9" /f
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.all" /v "89CmH" /f
  2⤵
  PID:836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.amr" /v "tmzqU5sNZ8KXP" /f
  2⤵
  PID:3060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ape" /v "KotgKDM" /f
  2⤵
  PID:3944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.apj" /v "YfJ9zyHTbCT79" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appinstaller" /v "rGsRiYKLXdQrqTD" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appx" /v "b2j4xTLI" /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appxbundle" /v "Na0vyQmHMHv" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ari" /v "X4nopK0o5" /f
  2⤵
  PID:3364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.arw" /v "1Va9BBBj" /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.asf" /v "Er4uis42nxhW" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avci" /v "hD6Z6bj8qIiwmZr" /f
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avi" /v "yRzUVBu" /f
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avif" /v "1o0AagGwTPE" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bay" /v "DXvhyeUzfKtepC" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bmp" /v "By6oisO" /f
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.c5e2524a-ea46-4f67-841f-6a9465d9d515" /v "stJKiya5" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.caf" /v "QebqDwFfmv" /f
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cap" /v "zxaOIRk6uTeNuY" /f
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cda" /v "tvXptI" /f
  2⤵
  PID:724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cdo" /v "ELFsUD" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.copilot" /v "57ohfe8pVS51y" /f
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr2" /v "xqfaMeu3B5syb" /f
  2⤵
  PID:5308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr3" /v "6rBfgiuujLnk9w1" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.crw" /v "kEd59kUeriQvdO" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcr" /v "jfAtIJLQZ" /f
  2⤵
  PID:52
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcs" /v "vrQoDTciQ1E" /f
  2⤵
  PID:264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dct" /v "LM1dtVjhna5fc39" /f
  2⤵
  PID:1208
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ddp" /v "gYMsX0ldgDYOoXG" /f
  2⤵
  PID:2372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.deproj" /v "UoLVx6d96DO" /f
  2⤵
  PID:248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dfx" /v "1ZsARy" /f
  2⤵
  PID:124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dib" /v "Tfr3WnGp1F3l0Zg" /f
  2⤵
  PID:5136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.divx" /v "gnUvzwgQJOVOp6E" /f
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dng" /v "wA60YgUoj75Lrn8" /f
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.doc" /v "T7DkWk" /f
  2⤵
  PID:2844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.docx" /v "1dDqC" /f
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.drf" /v "aYJGlJJQ5" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.drp" /v "EU05Di1" /f
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ds2" /v "WCKVjd1" /f
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dss" /v "M7YVG" /f
  2⤵
  PID:864
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dv" /v "HnO6J3WSgsAv" /f
  2⤵
  PID:5540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ec3" /v "ofi3jZFZpay8" /f
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.eip" /v "md9Xt3L" /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.emf" /v "7dAjhfZRk0" /f
  2⤵
  PID:4488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.eml" /v "hp4AxqrMrhGWKV" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.erf" /v "z3jJqwRbsxA" /f
  2⤵
  PID:5756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.exr" /v "mhXDR4oZndj" /f
  2⤵
  PID:5896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.f4a" /v "pCqvJRIlDeLSbT" /f
  2⤵
  PID:5044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.f4v" /v "hrqAx" /f
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fbx" /v "qmAcap" /f
  2⤵
  PID:3592
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fff" /v "OOxPVtJTpunw" /f
  2⤵
  PID:1440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fh" /v "pWfcoaEnphSwOCm" /f
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.flac" /v "acrsr" /f
  2⤵
  PID:5368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fluid" /v "pT0NLnfF82RpE4" /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.flv" /v "ArzLZ8oo75Z0" /f
  2⤵
  PID:3756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gif" /v "Gt404c" /f
  2⤵
  PID:968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.glb" /v "MkSx0GiXrHRl" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gltf" /v "0IVr0WZ" /f
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gsm" /v "0a8Na1Czu2zzye6" /f
  2⤵
  PID:3628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gxanimations" /v "L9oTr" /f
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.heic" /v "fTDntxeNsXhNyhR" /f
  2⤵
  PID:5336
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.heif" /v "DIag95oikAosBS" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.hif" /v "bYLRqA" /f
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.htm" /v "Tmvk9VjDGKO3y" /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.html" /v "IxxC4qZp" /f
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ico" /v "UzI0M" /f
  2⤵
  PID:1488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ics" /v "tdI0QMVC" /f
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.iiq" /v "7DwNoV" /f
  2⤵
  PID:2760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.inf" /v "nfFHwv" /f
  2⤵
  PID:4560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ini" /v "fBatCfz" /f
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jfif" /v "N3C6XPWw35bxE" /f
  2⤵
  PID:6088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jp2" /v "zRBumJa2qu" /f
  2⤵
  PID:1712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpe" /v "kvcVVmsAqZ8XCKa" /f
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpeg" /v "DKcbd2" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpg" /v "tNle7p95" /f
  2⤵
  PID:6112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jxl" /v "3iOUK4rfF" /f
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jxr" /v "1F1lGKI9" /f
  2⤵
  PID:1952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.k25" /v "qbH0tZLyB" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.kdc" /v "9Qgft" /f
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.log" /v "qH42KmHtja2TkwC" /f
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.loop" /v "r6G8stI" /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m1v" /v "vDbbTnTXY" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2t" /v "4QuLYUNXT" /f
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2ts" /v "aLgvecOOxmDnwyM" /f
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2v" /v "pOhePXs" /f
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m3u" /v "aewOPCNVY" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m3u8" /v "sjJZDGji7Fg7RiG" /f
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4a" /v "rOxAx" /f
  2⤵
  PID:3596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4r" /v "Q5MzOciSq" /f
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4v" /v "jrc1Szv4" /f
  2⤵
  PID:5712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCADDON" /v "yaR27KICp3LH" /f
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCEDITORADDON" /v "IzihD0tLkN4" /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCPACK" /v "KMrJnHhMDgo" /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCPERF" /v "KCy4L" /f
  2⤵
  PID:6132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCPROJECT" /v "n1SHDLML0tdlmy" /f
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCSHORTCUT" /v "ux2rezt" /f
  2⤵
  PID:3576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCTEMPLATE" /v "48nVZhR4Srq" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.MCWORLD" /v "KkKQtGTObJFGb" /f
  2⤵
  PID:3112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mdc" /v "JUY0rHp2" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mef" /v "A8GRb33ukY" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mk3d" /v "HX2RFy" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mka" /v "oN8qK" /f
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mkv" /v "MrJ4FxiaQDKL894" /f
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mod" /v "JxI2qDuEgRiSQSl" /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mos" /v "YIdfKbFmpa" /f
  2⤵
  PID:3608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mov" /v "hN0tQf" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp2" /v "BWGNoS" /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp2v" /v "jM3PhtOg3asEoX" /f
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp3" /v "DitBL" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp4" /v "1iXZL" /f
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp4v" /v "0r1Hy55zODt" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpa" /v "EtuGah" /f
  2⤵
  PID:4376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpdp" /v "1EaJt43KRBuPM" /f
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpe" /v "47KCo8o7tru" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpeg" /v "znRscLXNP3" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpeg2" /v "hG4uEAcyp" /f
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpg" /v "alz9FHZGaFIWh" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpg4" /v "aKvmfGN" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpv" /v "zFCCw" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpv2" /v "ji5rXgWipVLkwZQ" /f
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mrw" /v "ndNkGxHlY4w" /f
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ms-lockscreencomponent-primary" /v "gUkEDDz" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msg" /v "EyT2kOtSTo6" /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msix" /v "wxZnBR" /f
  2⤵
  PID:1372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msixbundle" /v "OAV8o" /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mts" /v "G8mtBqPyTmio5P" /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mxf" /v "1BtvN2a" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.nef" /v "VIfLUzW0vCL" /f
  2⤵
  PID:5212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.note" /v "wVuBl" /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.npp" /v "BnScbIFVU" /f
  2⤵
  PID:712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.nrw" /v "di0rRdeuJB9Ob" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.obj" /v "ZsWhuaWQjBlm" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.odt" /v "qionZa" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oft" /v "HyuMe8Mg" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oga" /v "Yqu5Y" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogg" /v "9aHSfT4CWQQpXjs" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogm" /v "gIsU5c" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogv" /v "3MCRWpbHFGm4F" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogx" /v "aO88h22ADBjH3LR" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.one" /v "66hCashmz" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.onetoc2" /v "d8O8hkht0" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.opdownload" /v "dvD94W" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.opus" /v "nsqN6mNV3aP4k" /f
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.orf" /v "gmAaIdt" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ori" /v "YU91Wc" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oxps" /v "o1G4DncX" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pcx" /v "5BhEo6wCiskehrF" /f
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pdf" /v "8IRCFi7HIsKs" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pef" /v "IZM40tjg4" /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pgf" /v "O8Q3P9p" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ply" /v "sPFOtIqk" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.PML" /v "kQgabTVnlEPtY" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.png" /v "UjNovh" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ps1" /v "DNOhw8tF1iMXO" /f
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.psd" /v "kV40D7" /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.psd1" /v "auCGW8YtzZAP" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.psm1" /v "YZc0BhWRmm7x4R" /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.qt" /v "cORx9b0Ky" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.R3D" /v "6zuBphIn" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.raf" /v "2lWzLPpS5y" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ras" /v "nMGhVNrqGUKFmh" /f
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.raw" /v "aLz8RK" /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rle" /v "Hl7SZM8XD8W" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rm" /v "wrK48ORYeUjCAU8" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rmv" /v "ZaA6L3Zz" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rmvb" /v "vVaYFXrYDc" /f
  2⤵
  PID:2252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rtf" /v "uVSxUhTXhYD" /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rw2" /v "V4UCok05SD6s5" /f
  2⤵
  PID:2900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rwl" /v "ra59W1paYLaq" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rwz" /v "gJ0GS" /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.scp" /v "rxgSnlQy54" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.shn" /v "OPXtq5aQOLvr" /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.shtml" /v "KA09nM" /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.solitairetheme8" /v "gZadbjw" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.spj" /v "HHHeta" /f
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.sr2" /v "OHzc46SEcOVh1XK" /f
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.srf" /v "SCjjgTPxV8cd40" /f
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.srw" /v "CRkPwDOMj8k5" /f
  2⤵
  PID:836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.stl" /v "bOxZkeLZhK" /f
  2⤵
  PID:3060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tar.gz" /v "VK7EoDu8UU" /f
  2⤵
  PID:3944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tga" /v "4RXWvLMfJVaWHfJ" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.thumb" /v "KE3FZK76" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tif" /v "eiN3QdLydir" /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tiff" /v "YVUGA7KdNXy5KS" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tod" /v "WUWI7npas" /f
  2⤵
  PID:3364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ts" /v "KfYvxfFlf" /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tts" /v "fQl5hMccL" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.txt" /v "SdfcA0FJHIB" /f
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.txt0" /v "e6trwu" /f
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.txt1" /v "1kQ2eKw66" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vcf" /v "P14n6" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vob" /v "dYgZ2STy3uYN3P" /f
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.voc" /v "GEbYBHOIsXI" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vox" /v "fhoDAY" /f
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vpj" /v "nFoiFcxbVHuC" /f
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wav" /v "W89th3JtMN3" /f
  2⤵
  PID:724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wdp" /v "6bWY5oxyIRM9EZ" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.webm" /v "DUTtZ" /f
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.webp" /v "RyNutbNXarHNh" /f
  2⤵
  PID:5312
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.whiteboard" /v "7yUSJZPdR3dI3" /f
  2⤵
  PID:5600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.winget" /v "nl9PDrPv" /f
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wm" /v "c5QnPiXD" /f
  2⤵
  PID:5648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wma" /v "yeGfk69" /f
  2⤵
  PID:368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wmf" /v "iaJOLGPCyJs" /f
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wmv" /v "9ynRpxPDT" /f
  2⤵
  PID:120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wp" /v "bysHDMHZN" /f
  2⤵
  PID:252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wpd" /v "3JBHfu8W" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wpl" /v "77j3Vo" /f
  2⤵
  PID:6108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wps" /v "EkzRuWZHHp" /f
  2⤵
  PID:4688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wsb" /v "aDEIBZmX" /f
  2⤵
  PID:2544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wtx" /v "YE1Gz9LeCHw7" /f
  2⤵
  PID:2216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.x3f" /v "eJKeQg0mb" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xht" /v "p8nlNiuc1" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xhtml" /v "buZLt4gAUsGUPuJ" /f
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xps" /v "k9vprFlc7a9bZQ" /f
  2⤵
  PID:6020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xvid" /v "8zkXSU9CePswDh" /f
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.yuv" /v "IHYdagMBstm5t" /f
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.zpl" /v "e5pmyol0MB2o" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ActivatableClasses" /v "JHHSYL" /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\amongus" /v "21KXy" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\apefile" /v "iVfT9d0KwsXLxP" /f
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\apjfile" /v "Svcnmog" /f
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\App.34d23e337344b7f.Protocol" /v "tJt34cNS" /f
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppID" /v "UrXMBg7aWIx" /f
  2⤵
  PID:1292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Applications" /v "4cKAWXsKJTpAHt" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppUserModelId" /v "U4XiT1yTXqeFqM" /f
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0resaq7r5ermbh4b96ke39yqc1atfhjr" /v "0XiKoS" /f
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0t69n30jztar4a12pv0h1xh91e8jsacr" /v "VkmBAVvq9" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0yfn1fhybwjxhemdkvvy841hdgqqy4y4" /v "dbCS7SYPZG7kAZ" /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX18q1gk8kdws5gt2g5c62cxc6qydq7tsw" /v "bgRHuAcXYST113" /f
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1akbsnxkswph8hkx1pb4f1s3d2rfbnyb" /v "kAzXv" /f
  2⤵
  PID:5880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1b0e9ytcwx0wcmvkdey0h6af04t1ta3z" /v "Wv0jMfs7KQqh" /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1np6bckd8pzgmy0k7rjk4xshe55bac6q" /v "7u1pD1d" /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1scw7cgxcz9hmq03sd8qajzg3s9t7901" /v "vzN6qPIXG3" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1sy7rwrc20ggq97a6x1mgmjat0rthy51" /v "S9NZxZ" /f
  2⤵
  PID:3100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1yprbth8spa55n2rc6zbh6tc1kr1tf5h" /v "MUhty0bQHK6k" /f
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX333jbhpaq2hjpyd097614409g4kz15cw" /v "CLvxok7s8m" /f
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX3v6hct5w0szn0pd06ekse0yqavf2e8r3" /v "Hy0AzyuEv8QeRqq" /f
  2⤵
  PID:5688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" /v "k25dGrBWRI5d" /f
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4mntx4h978m1v9gtzv0ewksfd6pmwsre" /v "494N8bXtlTc7a" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4ra53nzs9xcdyxf1wgcp31xefscv1jnk" /v "mIuBPAFZG4F" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4vt5c8cbxd42btbp6br6zs9v25a1kh5j" /v "9Y3Jvon3S" /f
  2⤵
  PID:1120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4ztfk9wxr86nxmzzq47px0nh0e58b8fw" /v "TO4JBMPVotWJbt" /f
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5nebv0xjaxafmmr3cnptgjg9pdpqcg0h" /v "HydKN" /f
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5y9g1y8x8cthhd1nd9gyrmyz0xztge18" /v "kfuv6M" /f
  2⤵
  PID:1576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6365235j7azx11tebzeay2a9hd0ngfk5" /v "QuK3dJS" /f
  2⤵
  PID:3328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6ae6b9t9aj303935n8rmz42zdtq3fe6r" /v "G7zOnXBXFIibfDT" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" /v "vTU8t" /f
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6hptmm8avg1gnv71j8jda9340qk79w89" /v "RY420" /f
  2⤵
  PID:2656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6pwygraeddkpp6m3wt43c7mpk6xm5tr2" /v "oyQfL" /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6w6n4f8xch1s3vzwf3af6bfe88qhxbza" /v "zF4ZYD" /f
  2⤵
  PID:6112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX70hz8geay8nefwg2887gffr7tmedrrh2" /v "kbtL2xtrwj" /f
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX756ty62ph7h2hpw422178spnwb89fdhs" /v "nRrjbj1" /f
  2⤵
  PID:1952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX77a4xf1ynjnhecq6pjngc07j31r3q912" /v "7dyAoQL" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX77zsthmbxzqveyvr5gqhcfpnd7mfnd5j" /v "MbucSqRu6" /f
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX7tycjjv3satx1c8myac3gpn9ktrwns6b" /v "Y5zRC8" /f
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8mg1ky09gvfdexfmk8e77463mz4j1xcp" /v "yiTNMLx6U1w" /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8zw7xct41bx2wrswqekb78rm243h02yh" /v "U3c4g2AtmXsPb" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9ppf2dj9szwwzyq4vhesygf8a7hf5pc9" /v "jBXRMkO4hJh" /f
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9qvny8kg50f4n257nt763xzjrjphn7jm" /v "jSXZoeq0zOL" /f
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h" /v "00QoBQG2nl5" /f
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9vwggs9kbe3mn0w816545e7zs1x6vegr" /v "mBZJQRU" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXa4x21t18evxksm0kbe6znaz8jjrjvs9e" /v "lLnwot3" /f
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXaf0097ws4bwb0wre67gmp7pc9fjr8en6" /v "stoK0GApeLYQtn" /f
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp" /v "p3d6G5" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXamwwyj1f3ktjcdfctg7kctrcrvqd3z8p" /v "MVoSvC5" /f
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXarc6g37bjvf299edhhmjx991tz75tcx9" /v "PDUSzC" /f
  2⤵
  PID:5712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXassm2k5er21ec9tqj99raa72bqdy59n1" /v "2XYpAzi" /f
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXatmm9sengvzx4rehd29pf7cfqen9knc8" /v "lC27PMRSmDoKtrH" /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXb5yxv86nkhp530y0y50yxe69c1qwad1x" /v "Mu9jxoAH" /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbfem27ddbf6ebrx72mc6gnaw2e3nkpza" /v "lzqwtrXOpSiC8" /f
  2⤵
  PID:6132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbqrd7zg39s227k5zy1mah67hhk0wgmw4" /v "X1L26l" /f
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbtxh7p534mcndn2b6d1ypwaf0hhbf5ap" /v "alBuEx4YUlMS" /f
  2⤵
  PID:3576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbx2ce4vcxjdhff3d1ms66qqzk12zn827" /v "kzVehaO" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbyq8sebsp9xh069xkxaaystpjztdp9h3" /v "LmkNyO9CFjxR56" /f
  2⤵
  PID:3112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbzdzkhgs0b1gj36jbm528tvp1fnha54j" /v "8U7xp" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXc9vj55m1n3559gcjff0scsqeket80zp7" /v "GWde4ta" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcdh38jxzbcberv50vxg2tg4k84kfnewn" /v "qPqHq2j" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcesbfs704v2mjbts9dkr42s9vmrhxbkj" /v "az1yPatmCqY" /f
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcezf6bjsrpbyaqwyjdehhb46y5e5mm3a" /v "acI32" /f
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcr7ve1e6y7nx8n3y5qv7m7s9kzz18jx5" /v "yHBORqjnDwKKE" /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXctx73kz58pypptjf6jydwz2pgcks5mzk" /v "16aHA0JcAxJ97Vp" /f
  2⤵
  PID:3608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdce4qczew6swqw0t4hf88yfjwehkyv5t" /v "0ZB8VQ" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdv25x4ndb8r51pbdf6srsknmbkfnkpaq" /v "1KqvsDTDh2iwpJ5" /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdyw2j75xqd0y008p4bvtxhnxp3py2t2g" /v "qncoenb9nakZ" /f
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXegssybx65447k2q6prgacs1t5gzge8at" /v "5tCFm6lkz" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXejqz5dpvfxzdkq7rwbwmnn4gyqk3hhb9" /v "0YBVqOg9bVO93" /f
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXewfz11nnnd1v7scbs4vmxpc1svxc4r90" /v "udrd25" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXf0gv96f6b0d4mpph15j15n30wrwxk172" /v "SU1ENhV1C" /f
  2⤵
  PID:4376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXf1qkdkw713dwwyym75mwhtyrm0vexpzf" /v "BA2XP" /f
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXfeq5vwnakrw6cy02kzhq8ekhhsremh62" /v "QVSYrBhYbFTc" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXfp6kkvw8823ptbxvr2be691hzfyrsazt" /v "HLfhM" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXft68t6vrz4bhvpeccdeg2trg3g10vj54" /v "E2KQKo" /f
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXg280tzrpxnd0t559h02gpd27tgrma246" /v "ZEP6EzQ0" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXg2ew71cpjznkcwmfttfpxzc075gc7c80" /v "qzviCl" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXghkdhgdax7j57pvsen8nhq2ngq8ny7e2" /v "Q4gVRDZcSBn" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXgtz62cfp9761w8h33sbaykyt1vkbm4vj" /v "qevfWMIxoLju" /f
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXgwsb7drvvkp7jxvqdqst0ajpq6107yzv" /v "n2KQHAA0tykmx" /f
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXhk4des8gf2xat3wtyzc5q06ny78jhkqx" /v "oSGPyFrO3Wo5" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXhw73fxxd4pf1p5pm5r13y4m3vezj4v1b" /v "eCmuFghuzbE7vt1" /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjf4aqz2sx7y9mp1x29d4rbshzmz12hw9" /v "G897bQGf" /f
  2⤵
  PID:1372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjsdsf5vqjpck4w72a3ve2zmnsb3qfec1" /v "X93k16mCu" /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXk0g4vb8gvt7b93tg50ybcy892pge6jmt" /v "qjvspEtn1awf" /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkcg7y8nhftqvy2sxh5grnx46hbybnk39" /v "eTdyz3lPMUo" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXke6eh8a1ew0cqjwpdgcvg9rj36gxfss1" /v "7hCcpg6" /f
  2⤵
  PID:5212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkmt99ynn1qvez84cxh13grbeahewhrx2" /v "HPym1Ll7u" /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkv2jqn1pq8ajm0p5dhgqde7aafykkrrn" /v "bt2pLYbQSzkNrKG" /f
  2⤵
  PID:712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkytm3hnq0vzg49fdp50v6n482apdb470" /v "hv5eikCqef2" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXm4fjth7rfv9b2vppk3w1gcpsf4gy9r3n" /v "AEBg6nDRXyeZMx" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXm8fs0gj5h36ynw4kq0x3gqnz6ecr1kvy" /v "KfWKNK27xCyvj4W" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k" /v "afVGVr0awiEe" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmrzewgswm3y60fdz9attr7pr39wrb9dt" /v "BhLWwKvnQxsVu" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmv6rk8z9kbjr10t0fhrvkggh6psk9vm0" /v "9OILC" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmwwyhgdj6npeeqe0bxkbr07wkr2mxjah" /v "xQlSb" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn1scph4yxkh5tvym038c6zjjfpmdg2fg" /v "jrrbiTjG" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn4h72dhxtarn3p3zmz4r3q8b55q4qaq6" /v "1H8fW9FHPHXI" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn8vagw663cz9m3j0rmkddxpbq9x0716k" /v "xdmbXy2e" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn9ye6e6n1gjh4z5wxtr6x3fvreb2w0ta" /v "60xXSxFX" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnjayypjpx6dtabtjqtt76hhmg5nsz5nm" /v "inMN4k4DC" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnzh5v9w1s9pv2y889efv7t8bg0msmhca" /v "eApBP3CV" /f
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp18ym4xr204kvw1e76kcwpeev3fsaqgb" /v "utyG0WbRy3v" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp5fzsrbzrrckawyxaw2mk2xpxbeqct67" /v "da6vZ" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp8e2ntvbtget7f2fw6qec3j54vhd14m4" /v "CCv19xXLu1ix" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp9gkwccvk6fa6yyfq3tmsk8ws2nprk1p" /v "xI4O7CCX" /f
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpb1vntage8kvnwpyg40aqz34j851h4p1" /v "F43RJw" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpdgeqrp7ntm74ffgr878trgvezwcc21n" /v "6FvcJM" /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpjdwy3ckj5c1dr53c5epmrpbex5tg2g4" /v "YpUEaDNu4LG" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpjsxda6f84877c5f65bm4q3g4qep2rxn" /v "TtpeIrzIuIV" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXq8btj36kvahvgqpj75d9n4510vjppa26" /v "gkGFeuRiqIRU" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqg3xs3h3sbq285086k5jcab5aawtt9zw" /v "R34el6L2cX2tV" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs" /v "h4v2MC3Fu47weDH" /f
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqjyfmc5mk3hmghyt3yynbcb2jsdyp4fs" /v "Ovr8ygN7oZ8" /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqqxzfw12he3h63rdesxs3a7r2cs9sj4w" /v "mASIzapg4V" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXr012b1h6210sz3stcs8x9nn2j4rfa1fc" /v "xo0HM3khMO2w" /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXr0k5v4yctd1tys9hmqksf0t2zqb0fqs4" /v "K9V7a0FPSIylzL" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXreyvazcs64j2pgtpwyt49g6ce85mwrwg" /v "Tqqc1" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXrpqnz37s7938xjfwvmrs7gr5befk6fbh" /v "4i9PtL4eNaV1o" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsbz2fdbdmn6pz7xyd3zc95j9syhcnyc2" /v "twKyR8N" /f
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsej0ym0z9bfhd049b1d9e60p08gss40d" /v "UmROxSaYfw" /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsh31e62qrrqa6htpvvw6p5f80q48athh" /v "tMNXOl3tLc61" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsr2355wnmpt66c2rh3s461vmsmqhe6r2" /v "aAkhq6MMQ" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXstagsrybc2dkesq85qj0xdqq4dbn3k6a" /v "V7u94SbsSd" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsywsp6kb3dx2vqg7qaqkbc26sn1pbd28" /v "fb3D0OmcEv9FZg8" /f
  2⤵
  PID:2252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsz2w8kr3vqa5h0xgxy7bdt9816yyqntm" /v "hyitHrkKVrDn" /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtcqqar3xwa7yjf9crdf72pvf0tjvq2ww" /v "iPvmGxlRFVvzI5" /f
  2⤵
  PID:2900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtggqqtcfspt6ks3fjzyfppwc05yxwtwy" /v "gnvw2uIYC4" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtked0qbwdp1v44z1p7ts8bc7kkwea1mh" /v "75j1gJoX3" /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtmyvd154r75whynphdjyax5d711yvn0s" /v "j3FVR9ff" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtsmg3v4j4x76mctp0h8w9ykwqt07rr43" /v "QjgYxnOZ7b2n" /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXve2j6k0pfr77f4q8penh0d5pgejsy932" /v "qG2AAgUT" /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvks94gjj6kqyt3mdm6gdkn78zngpytfd" /v "quGql20nD1NhG7" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvqhb9dhb3dg0mpfydfbz4qp875kpspza" /v "xAjPPbV" /f
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvsqkg1th80rv6s2rkh5m1hjp3hxryydd" /v "Eh4Cwew4Hs" /f
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvvr0sjtc34r6nk4mhn2e608s2xp2tezg" /v "Z1pJZC0CaOV" /f
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvvwq6wxamf7qhxd0vn6wm1wwehyxrdd6" /v "9CqY4u7kX1LeRJ" /f
  2⤵
  PID:836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwkwctjzwtre31cm4f91h5extbhywmp1w" /v "1gO7TupSYGgv" /f
  2⤵
  PID:3060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwwaj365vh56qsq113kc3zrs1rvk43s1k" /v "DdH08NT9F" /f
  2⤵
  PID:3944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxccb9186h1jcjtq5zf1a0mydqxz3dpgf" /v "iXMUwmu" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxf01pj590w7z9mxmyv3nx0a9ewj3e51g" /v "yfdcJOdus84" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxfctf2rqj6c7b4wrvys6zq1bskprrn19" /v "TmfwgU2SzCBNqi" /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXybm0hz3h6qr4z6wdaaefvpq136awdq2e" /v "SqmPk5kbPq" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXyhj8780c19x3fmfxz91fzp1yzmr5wae0" /v "EsBFlQO" /f
  2⤵
  PID:3364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXyte1agk1gt765291prervr3pvygjqp1d" /v "i4P7pG" /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXz2d7qm1dmekjyt1p721ccpt9mfr1a0p2" /v "qXJYXefUTYaM6iW" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzakfgeejsmwhgzp8fdnp87dyfh9kb9m2" /v "kGfyamGqsZpKlBG" /f
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzc8ajeke9yt5s0y88h6hvwqd556b4bma" /v "O2hjs3f7ILW5G" /f
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzcmrn7q3gmakk1ffkbr4s3d27qwjdtbt" /v "1YtCSvPCv" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzg6fdzp57dpmt1dqardd3y48kkx0qb78" /v "X9FsrQYMF0N" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXztymbw55c24qp3qfb1jac0r6a8w3rtfq" /v "fixr5Lk06yE2" /f
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzwr976v2e060wada4gabrk1x69h2dbwy" /v "22QWzryqJ" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzych6jbn7p3xzarpfwgxas39g87myyjf" /v "K7tTKIZ" /f
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzzr7tspjvevcy65rzzvw5kdmv270eghm" /v "nIU4h" /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\armodelviewing" /v "FDkZAxbg3QL" /f
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\BannerNotificationHandler.BannerNotificationHandler" /v "e0TS5o8" /f
  2⤵
  PID:5264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\BannerNotificationHandler.BannerNotificationHandler.1" /v "beslOvuCd" /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingmaps" /v "sQJbeDE3SSWkMYK" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingnews" /v "IV9Sfu3B2" /f
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingweather" /v "tTlYpwcZs" /f
  2⤵
  PID:412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\caffile" /v "jLmuMWx5pIKdN" /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\calculator" /v "CnxCl" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\callto" /v "2uePfHU4" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\capcut" /v "Pz5pm6lbb" /f
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\cdofile" /v "bd8WBvgK" /f
  2⤵
  PID:260
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\CLSID" /v "GCLJd2e2044Cy6" /f
  2⤵
  PID:2664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\com.clipchamp.app" /v "7lxxCBD" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\com.microsoft.3dviewer" /v "ntP0M67qjyYfF" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\csgo" /v "RpbouBya" /f
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dctfile" /v "OSxsAN" /f
  2⤵
  PID:6020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ddpfile" /v "0phQKW" /f
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ddsfile" /v "7fRM2" /f
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\deprojfile" /v "1NpQGYR7" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dfxfile" /v "Bmu7xYnGBac" /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Directory" /v "TWjFF" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Discord" /v "B63kBC9OlFGZ" /f
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-1288512934112264234" /v "IxyD4yF" /f
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-432980957394370572" /v "b57qMbU" /f
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-445956193924546560" /v "DYDpWAAo1L44h" /f
  2⤵
  PID:1292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-477175586805252107" /v "v8XL8ww92a" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\docfile" /v "vHWAemL" /f
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\docxfile" /v "Q6Vj1YlV" /f
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\drpfile" /v "T5R8m" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ds2file" /v "uFcmdq3cSy" /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dssfile" /v "74tLmcR2CCwtbHj" /f
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\dvfile" /v "ikqG9G" /f
  2⤵
  PID:5880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\exrfile" /v "LTpBy3OANNF" /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Extensions" /v "2FpIDC" /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\feathermc" /v "j6l41XBT3A6JtY" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\feedback-hub" /v "1tLBrr" /f
  2⤵
  PID:3100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.AutoPlayHandler" /v "xvmm70Y" /f
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.AutoPlayHandler.1" /v "40r7Da" /f
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.FileSyncClient" /v "7FpT2zTN45GzFue" /f
  2⤵
  PID:5688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.FileSyncClient.1" /v "GPW0Tfv4KOo7BHx" /f
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Folder" /v "xBy5KOtvk4" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gaming-tcui" /v "Wgf5UCVPwYjNOZ" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gamingservicesui" /v "e4wxpSSo" /f
  2⤵
  PID:1120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\grvopen" /v "chJHEZYLn8" /f
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gsmfile" /v "1d4wZt2xjX0e" /f
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\heiffile" /v "4ujh1F" /f
  2⤵
  PID:1576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL" /v "G8Cl3ZBTMwXt" /f
  2⤵
  PID:3328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\im" /v "ZaFm0N0LU" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\insiderhub" /v "tTVnSA" /f
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Installer" /v "MF9OQX1X" /f
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Interface" /v "vEdtfEaXV" /f
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\jp2file" /v "2JVAzs8NHQSVx" /f
  2⤵
  PID:1792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\lghubapp" /v "4YbDfxe" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\lnkfile" /v "lQ7r3toKiT1Tf0" /f
  2⤵
  PID:3524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings" /v "r89H7W" /f
  2⤵
  PID:4508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mailto" /v "xTtgJi0Q2Xr" /f
  2⤵
  PID:1768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft-edge" /v "E6Y24sszv7qBtW" /f
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft-edge-holographic" /v "RuZMRTLX3xz" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera" /v "yBcUXyJuy" /f
  2⤵
  PID:572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera.multipicker" /v "3B2QyARbqxPxRY" /f
  2⤵
  PID:5544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera.picker" /v "o4jVjzKp" /f
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.crop" /v "U42g4" /f
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.picker" /v "te15fOj8yJHq9b" /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.videoedit" /v "AMqfogyjduDQ96" /f
  2⤵
  PID:3276
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftmusic" /v "gMKfYrqj2hPFdGJ" /f
  2⤵
  PID:3596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftsolitairecollection" /v "HLOZdovpXgxG5H6" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftvideo" /v "CHN3G" /f
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\MIME" /v "pRBnHqPXu3L5" /f
  2⤵
  PID:5712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mpdpfile" /v "jwwmKtD0gQ" /f
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mpeg2file" /v "x7mc7rAPpb" /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-advancedsettings" /v "j2oweQ5Nyt" /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-appinstaller" /v "zIjj8mNCoBjCHjy" /f
  2⤵
  PID:6132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-calculator" /v "JECKP" /f
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-clipchamp" /v "tK3reRTqqjU" /f
  2⤵
  PID:3576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-clock" /v "G6SaLE" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-contact-support" /v "6dIidNDc9l" /f
  2⤵
  PID:3112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-copilot" /v "1INENb5" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-crossdevice-files" /v "i1WVAk" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-crossdevice-settings" /v "XWzC1r7sLnJ" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-default-location" /v "hLDbibX35L6Av" /f
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-drive-to" /v "6ITrh" /f
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-family" /v "qSb4I0CCx0Y" /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamebar" /v "PlIpj9sV" /f
  2⤵
  PID:3608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamebarservices" /v "MjfxoUma" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamingoverlay" /v "mmL6dCU4" /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-getoffice" /v "wjqsb2gXu8GPQ" /f
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-holographicfirstrun" /v "Y4voGydI4ME" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-ipmessaging" /v "7VTDfQ7iMXuKmXl" /f
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-media-player" /v "pIDLmlWvmt" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-notepad" /v "CDDFHv" /f
  2⤵
  PID:4376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-officeapp" /v "gmfDxsmYO" /f
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-officecmd" /v "LGB8HmPPuyVhz" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-outlook" /v "B8odY" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-paint" /v "WxLfAyqQAu" /f
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-people" /v "yHXJTx5IGrfhZfh" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-phone" /v "dChQVHrG" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-photos" /v "4PrfsBnP3y16" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-playto-audio" /v "fncPAq" /f
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-powerautomate" /v "9q3UqiHnadkNfHx" /f
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-quick-assist" /v "igJYFbF8" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-screenclip" /v "mUMy2miA6" /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-screensketch" /v "QArJxhLTo" /f
  2⤵
  PID:1372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-sttoverlay" /v "m77kKjBNmgkq" /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-to-do" /v "lMpiEI5" /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-todo" /v "8AzZm0si" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-unistore-email" /v "1gP7PR254vH" /f
  2⤵
  PID:5212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-voip-call" /v "u2XermSRzNDn" /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-voip-video" /v "uJUI4i2VxWV63y" /f
  2⤵
  PID:712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-walk-to" /v "XjonrXH4E" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wcrv" /v "FCpvdZdNW7D" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-widgetboard" /v "8tH6KX86T" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-widgets" /v "nPQy1y" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store" /v "QZFQI" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store-deskext" /v "DhQN5U3ts0W" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store2" /v "2gSyX8" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wpdrmv" /v "fgBsOmKDR9fj" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbet-survey" /v "QOh28" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbl-3d8b930f" /v "lJVaOL" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbl-6af6e7cc" /v "ulNxe4" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamelaunch" /v "NCxLRME" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamepass" /v "VixAjz" /f
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamingapp" /v "wKdC9eo6ZkP1cZz" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnews" /v "sPM7JSgW" /f
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnnews" /v "BK3DC0ZZ9" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnweather" /v "MLb5rrteUhE" /f
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mssharepointclient" /v "2oAj09" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msteams" /v "u0qOh9bOstNAnD" /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msteamscanary" /v "Ke5TJi2C4Gf" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mswindowsmusic" /v "C6U9Y5Lyg1O" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mswindowsvideo" /v "JjXuz9" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msxbox" /v "rRu5nFGCXnPL6" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NotificationData" /v "dgb30RH2noC" /f
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\nppfile" /v "1gfb36biy" /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusNativeMessaging.NucleusNativeMessaging" /v "XAw1ga8RuA4Nt" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusNativeMessaging.NucleusNativeMessaging.1" /v "ARVE1wQKbPD" /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusToastActivator.NucleusToastActivator" /v "ClzJLCIqgIhg5U" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusToastActivator.NucleusToastActivator.1" /v "C9OjJ" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\odopen" /v "DgLRN8lolp" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\odtfile" /v "Nhgjz8" /f
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\oggfile" /v "CNedqLyjHBq4M" /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OneDrive.CameraRoll.Import" /v "H5rvDU5" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote" /v "CCBnMcoyPn" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote-cmd" /v "3NmX5aonlFW9UGW" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote-uwp" /v "GRRmSLxP" /f
  2⤵
  PID:2252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OOBERequestHandler.OOBERequestHandler" /v "LSJ2a1iKLE" /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OOBERequestHandler.OOBERequestHandler.1" /v "DwXlHcirT8" /f
  2⤵
  PID:2900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Opera GXStable" /v "D2nAo8ZC" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OperaStable" /v "icTZiIuWb" /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookaccounts" /v "TTEcsC" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookcal" /v "nt9LDVYR1" /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookmail" /v "WCtyIHIph" /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\PackagedCom" /v "5gheER27K2hTKPW" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Paint.Picture" /v "P72FNgMp5HN" /f
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\PBrush" /v "clu4zrcwo" /f
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\pcxfile" /v "TiFpM7r9qZ9i" /f
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\pdffile" /v "FfH8pUJsOK1b" /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\pgffile" /v "8Y1WDI3QzloKe" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ProcMon.Logfile.1" /v "EyquMEjtE00" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\proton-inbox" /v "wfsseFlmy3Tte9I" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\proton-vpn" /v "9S8JG" /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ProtonMail.Url.mailto" /v "PQ9Kp9oKnx0r" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\protonvpn" /v "kY0Zoy23pdh8Qhn" /f
  2⤵
  PID:3364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\psdfile" /v "6WGRwqNg6c" /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\rasfile" /v "tGX3iNv5" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\read" /v "1AHDTt8E" /f
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\roblox" /v "hDZxt6Hw1aQX" /f
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\rtffile" /v "q6P2DZtW" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\rtkuwp" /v "p6q1ayyWw" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\shnfile" /v "k6yWYlDNSod" /f
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sip" /v "OHVtmgZ1Id0cwL" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sips" /v "1XezIqY6K" /f
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skype" /v "DG9zd7g3l" /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skype-meetnow" /v "q1lVenhmhW6lHQ" /f
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skypewin" /v "Sb53wu1voMMUOQ" /f
  2⤵
  PID:5264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sms" /v "U4HIiWHQ3GpMEuD" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\spjfile" /v "KPkYgXf" /f
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\spotify" /v "d6TdmcgH6o" /f
  2⤵
  PID:412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ssgg" /v "pxXyOct71" /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\steam" /v "tpLU4KaCcD4d7C" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\steamlink" /v "bvC5GM6QV5kyT" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider" /v "HKDqM" /f
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider.1" /v "DzFoUwermg" /f
  2⤵
  PID:5136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider" /v "cZlN5wjre" /f
  2⤵
  PID:5744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1" /v "YsXbl69" /f
  2⤵
  PID:5380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy" /v "CtBNOrIcciy" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1" /v "L8V505VYvZT2yat" /f
  2⤵
  PID:2696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tar.gzfile" /v "tsT39lK" /f
  2⤵
  PID:3952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tel" /v "Qe4iuhoR0g" /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tgafile" /v "ape3eZBWjP" /f
  2⤵
  PID:204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\TypeLib" /v "NP7LZflKG1lC" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\vobfile" /v "lgEQ3V7D" /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\vocfile" /v "FuZGSs783pIgUo" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\voxfile" /v "rTu4rfUIp3IH1" /f
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\vpjfile" /v "2ZqZgZFyjLt" /f
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wdpfile" /v "OhkOfZ6tT6zPY" /f
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webcal" /v "kCI4XXTrz" /f
  2⤵
  PID:1292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webcals" /v "TfPStFq" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webmfile" /v "YR6GZ1lZ7CCd" /f
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\webpfile" /v "amnzfLh78t" /f
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\windows-feedback" /v "c26vmpur4uv" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\windowsdefender" /v "182h6HM0A3q8Q" /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\WOW6432Node" /v "idaS3ZZLlt8u" /f
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wp-autoplay" /v "OGs4mvigCcIs" /f
  2⤵
  PID:5880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wpdfile" /v "8x3GJ" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wpfile" /v "3BmzjoE5ow7" /f
  2⤵
  PID:2896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wpsfile" /v "TAv4I" /f
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbls" /v "TuoWc2Hb4D" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox" /v "ZOwFQVAhuHs" /f
  2⤵
  PID:4548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-arena" /v "OZsGdV" /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-captures" /v "OcAxXDz" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-friendfinder" /v "mQGRYa2tCUG2h" /f
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-gamehub" /v "vIFmwzf2" /f
  2⤵
  PID:3028
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-lfg" /v "J8OuWOY3POf" /f
  2⤵
  PID:2760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-network" /v "GrDC6gOvA" /f
  2⤵
  PID:5460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-profile" /v "5dysKIthIg" /f
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-settings" /v "gBzYVLpeo8H" /f
  2⤵
  PID:1096
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-store" /v "qUSpwm" /f
  2⤵
  PID:3328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxgames" /v "uKeDj7b" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxidp" /v "iv5OxIBX" /f
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxliveapp-1297287741" /v "epkdb2WDmEmS0D" /f
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxmusic" /v "YYwRx4QRVaSP4x" /f
  2⤵
  PID:1972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\zune" /v "j2eCrZvmt8" /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI" /v "S1qjkKUwThrjGAK" /f
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT" /v "kV96ELPWBjkKP" /f
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FACS" /v "hcSwOhlWO6VlXzM" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FADT" /v "L0SCMaF40c7js" /f
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\RSDT" /v "NF9aISqhet" /f
  2⤵
  PID:5432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD1" /v "kIKeE6qQqAO" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD2" /v "ToDmvlhXBn" /f
  2⤵
  PID:1600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD3" /v "Fn8JyD" /f
  2⤵
  PID:2100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD4" /v "dqa6Y4WLd524y" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD5" /v "PXkXrTUqzxEE" /f
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD6" /v "hPEvVvnGbDxy7V" /f
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD7" /v "YWzYDwR" /f
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD8" /v "Y5usJL7GK6w" /f
  2⤵
  PID:4916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD9" /v "LiEn8rjNL3" /f
  2⤵
  PID:5184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDA" /v "Mr1njy" /f
  2⤵
  PID:5436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDB" /v "NWb3i" /f
  2⤵
  PID:5036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDC" /v "jVGnUlPp" /f
  2⤵
  PID:912
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDT" /v "Z8AXxZtX7s" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION" /v "TX8xv0d" /f
  2⤵
  PID:1732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System" /v "P8Dph" /f
  2⤵
  - Enumerates system info in registry
  PID:5420
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP" /v "mk1cMbqb" /f
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\KeyboardClass" /v "xCqW8QbhS" /f
  2⤵
  PID:1156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PointerClass" /v "h4KD1Q" /f
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO" /v "UsbOyx" /f
  2⤵
  PID:1040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi" /v "vx04Yg" /f
  2⤵
  PID:5676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\UEFI" /v "eMD59FCQT" /f
  2⤵
  PID:2528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\UEFI\ESRT" /v "VbBsU5VZXyomvk" /f
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP" /v "1XRXdjqt" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer" /v "GJgPNa" /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\PnP Manager" /v "QVud5fODwQu5" /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\System Resources" /v "DZGRqKpoHjNdTkp" /f
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Interface" /v "ClsidStore" /f
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc" /v "CMPOL" /f
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\nvlddmkm\Enum" /v "0" /f
  2⤵
  PID:5588
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput" /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count" /f
  2⤵
  PID:3348
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}" /f
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count" /f
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}" /f
  2⤵
  PID:5928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}" /f
  2⤵
  PID:5824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count" /f
  2⤵
  PID:1884
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}" /f
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count" /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}" /f
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count" /f
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count" /f
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}" /f
  2⤵
  PID:4052
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count" /f
  2⤵
  PID:608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}" /f
  2⤵
  PID:6004
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine\Hardware Survey" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f214d5eb-7631-11f0-afd0-c77475afdf31}" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{97bb8eb6-4096-447f-be7e-669d523481d3}" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{749716d5-2798-4f9f-b699-e3eacb43641c}" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{17a825e4-4885-47cb-8322-65c5324cd2be}" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC" /f
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f
  2⤵
  PID:2452
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\Settings" /f
  2⤵
  PID:6036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo" /f
  2⤵
  PID:5784
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel" /f
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\UserHelper" /f
  2⤵
  PID:2132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\UIHelper" /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\RegisteredProducts" /f
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\MainService" /f
  2⤵
  PID:5592
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\InstallHelper" /f
  2⤵
  PID:4392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
  2⤵
  PID:640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{749716d5-2798-4f9f-b699-e3eacb43641c}" /f
  2⤵
  PID:4884
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" /f
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games\Unreal Engine" /f
  2⤵
  PID:1204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games" /f
  2⤵
  PID:3172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet\Home" /f
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet" /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f
  2⤵
  PID:4568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Admin\Downloads" /v "spf.exe" /f
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\a48e850cca939315" /v "rAQBc8Wsa1xVP" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow" /v "DNhm3" /f
  2⤵
  PID:5224
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Software" /v "IDCdJOyapnxr" /f
  2⤵
  PID:5748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium" /v "JBdT3hVOfoaM" /f
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\BLBeacon" /v "ZYFYZ5B6kzMCk" /f
  2⤵
  PID:1236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord" /v "fRyilOYGxlSXP" /f
  2⤵
  PID:4472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord\Modules" /v "Rblsaqv" /f
  2⤵
  PID:2568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /v "CmZFOv" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /v "ZpzRiKYpZgnSOK" /f
  2⤵
  PID:5524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /v "g5Ayy61" /f
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google" /v "9rklPGtfUR2I" /f
  2⤵
  PID:1308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Chrome" /v "ciQTqVaAUnJv" /f
  2⤵
  PID:2772
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Update" /v "y4KjsfSX" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos" /v "2u8qvJP3B6Uiu1g" /f
  2⤵
  PID:1760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos\Vulkan" /v "oDUTOX7NY" /f
  2⤵
  PID:5568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft" /v "lvBndn4" /f
  2⤵
  PID:2764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Accessibility" /v "gr881" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup" /v "L1Q4G" /f
  2⤵
  PID:5280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie" /v "uTlCH9WpIYaPH" /f
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveSync" /v "ds7HX27KbNC" /f
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Assistance" /v "pqiwdo3Hrdt6z3" /f
  2⤵
  PID:1124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies" /v "DtmvWvN20" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Avalon.Graphics" /v "0OSa9" /f
  2⤵
  PID:3548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Clipboard" /v "cKwhz" /f
  2⤵
  PID:4832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CommsAPHost" /v "PYlapdvx" /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF" /v "OwWR2uaAtZV" /f
  2⤵
  PID:564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Direct3D" /v "nZSCe8nPQH" /f
  2⤵
  PID:2280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge" /v "jHkpC99I" /f
  2⤵
  PID:852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate" /v "li9Mk6pyZdA" /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EventSystem" /v "zchUSmJqhT" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\F12" /v "kdKB9Ppfr6Sk" /f
  2⤵
  PID:52
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fax" /v "lyLUl" /f
  2⤵
  PID:264
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Feeds" /v "08n8Y" /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\FTP" /v "sSXvy" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBar" /v "A1KG3aMSFgDmn" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBarApi" /v "4mMxkcNZ" /f
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL" /v "VlvkI3S1W" /f
  2⤵
  PID:5136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IME" /v "5P1fJX" /f
  2⤵
  PID:5744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Input" /v "LJwWy0vNK" /f
  2⤵
  PID:5380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputMethod" /v "YKbBkp7iE8TL" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputPersonalization" /v "zKFZdSKQc" /f
  2⤵
  PID:2696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Connection Wizard" /v "tYFpEFl" /f
  2⤵
  PID:3952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer" /v "WkhVYO3dJfBuCov" /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Keyboard" /v "IkbSUz2k4X" /f
  2⤵
  PID:204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer" /v "SLUcbCkFeXVwVQ" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MSF" /v "dtm9WgMa" /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Multimedia" /v "TDHqyzKXoJ" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Narrator" /v "fRWIz" /f
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive" /v "CmfLf8hgMcV" /f
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Osk" /v "9GUa8m6xqqEZ1EN" /f
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\PeerNet" /v "gMnn79" /f
  2⤵
  PID:1292