8747eac3a0996fe992a7ccd411eef5c5c803128fb16cfd6ed8339663eb9df9d0

Resubmissions

26/08/2026, 19:15

260826-xx84fsvdpg

26/08/2026, 19:13

260826-xw6a6ssset7

Analysis

user interaction
yes
max time kernel
13s
max time network
27s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ub.gg cleaner.bat
Size 203KB
Sample260826-xw6a6ssset
SHA256 8747eac3a0996fe992a7ccd411eef5c5c803128fb16cfd6ed8339663eb9df9d0
MD5 527bd5be28b92f084b73b95649e47b07
SHA1 c310cb6f54f777d4205113c2c57b367d25d11706
SHA512 0a27e8b514e6e6242cdaed3bf834734f1f8d84413a6aaf2f1d2121e48787cb272723c893228a73bb4e02b945c40bd2ab4482957b78b7b7050e9ce6ddba88bff4
SSDEEP 768:DDXR23x9XUq+KRQkc5a6HdaZt74PX+kEjVXv/dlnFEnlp52ZNGklA3Zc8erLBwpR:xakqqlag/+lJE9klA3Zc8fpwS2zV+rtB
TLSH
T10214E011AB3B2153CCD51341D14B5A070BFA93CA7BE383C557A9F948AD2B809879B2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5224	sc.exe
960	sc.exe
2104	sc.exe
4680	sc.exe
4300	sc.exe
1396	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
616	cmd.exe
5852	cmd.exe
5204	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
960	sc.exe
2104	sc.exe
4680	sc.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
5692	taskkill.exe
5520	taskkill.exe
1236	taskkill.exe
4512	taskkill.exe
1936	taskkill.exe
756	taskkill.exe
4848	taskkill.exe
936	taskkill.exe
6044	taskkill.exe
2736	taskkill.exe
5056	taskkill.exe
6068	taskkill.exe
1456	taskkill.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	6044	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	5520	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 3636	616	cmd.exe	90
PID 616 wrote to memory of 2636	616	cmd.exe	91
PID 616 wrote to memory of 936	616	cmd.exe	92
PID 616 wrote to memory of 6044	616	cmd.exe	94
PID 616 wrote to memory of 2736	616	cmd.exe	95
PID 616 wrote to memory of 5056	616	cmd.exe	96
PID 616 wrote to memory of 1236	616	cmd.exe	97
PID 616 wrote to memory of 4512	616	cmd.exe	98
PID 616 wrote to memory of 6068	616	cmd.exe	99
PID 616 wrote to memory of 5224	616	cmd.exe	100
PID 616 wrote to memory of 960	616	cmd.exe	101
PID 616 wrote to memory of 2104	616	cmd.exe	102
PID 616 wrote to memory of 4680	616	cmd.exe	103
PID 616 wrote to memory of 4300	616	cmd.exe	104
PID 616 wrote to memory of 1396	616	cmd.exe	105
PID 616 wrote to memory of 1456	616	cmd.exe	106
PID 616 wrote to memory of 5692	616	cmd.exe	107
PID 616 wrote to memory of 5520	616	cmd.exe	108
PID 616 wrote to memory of 1936	616	cmd.exe	109
PID 616 wrote to memory of 756	616	cmd.exe	110
PID 616 wrote to memory of 4848	616	cmd.exe	111
PID 616 wrote to memory of 260	616	cmd.exe	112
PID 616 wrote to memory of 4256	616	cmd.exe	113
PID 616 wrote to memory of 5060	616	cmd.exe	114
PID 616 wrote to memory of 1200	616	cmd.exe	115
PID 616 wrote to memory of 4712	616	cmd.exe	116
PID 616 wrote to memory of 2556	616	cmd.exe	283
PID 616 wrote to memory of 5852	616	cmd.exe	118
PID 616 wrote to memory of 5492	616	cmd.exe	119
PID 616 wrote to memory of 5204	616	cmd.exe	120
PID 616 wrote to memory of 4416	616	cmd.exe	121
PID 616 wrote to memory of 2420	616	cmd.exe	122
PID 616 wrote to memory of 1968	616	cmd.exe	123
PID 616 wrote to memory of 3484	616	cmd.exe	124
PID 616 wrote to memory of 5824	616	cmd.exe	125
PID 616 wrote to memory of 812	616	cmd.exe	126
PID 616 wrote to memory of 3740	616	cmd.exe	127
PID 616 wrote to memory of 1708	616	cmd.exe	128
PID 616 wrote to memory of 4436	616	cmd.exe	129
PID 616 wrote to memory of 5672	616	cmd.exe	130
PID 616 wrote to memory of 2040	616	cmd.exe	131
PID 616 wrote to memory of 5788	616	cmd.exe	132
PID 616 wrote to memory of 4636	616	cmd.exe	133
PID 616 wrote to memory of 1736	616	cmd.exe	134
PID 616 wrote to memory of 1744	616	cmd.exe	135
PID 616 wrote to memory of 2280	616	cmd.exe	136
PID 616 wrote to memory of 6128	616	cmd.exe	137
PID 616 wrote to memory of 3676	616	cmd.exe	138
PID 616 wrote to memory of 1816	616	cmd.exe	139
PID 616 wrote to memory of 1356	616	cmd.exe	140
PID 616 wrote to memory of 4088	616	cmd.exe	141
PID 616 wrote to memory of 4112	616	cmd.exe	142
PID 616 wrote to memory of 2308	616	cmd.exe	310
PID 616 wrote to memory of 2936	616	cmd.exe	311
PID 616 wrote to memory of 5180	616	cmd.exe	312
PID 616 wrote to memory of 2328	616	cmd.exe	313
PID 616 wrote to memory of 2240	616	cmd.exe	314
PID 616 wrote to memory of 1748	616	cmd.exe	148
PID 616 wrote to memory of 5236	616	cmd.exe	149
PID 616 wrote to memory of 5936	616	cmd.exe	150
PID 616 wrote to memory of 2532	616	cmd.exe	151
PID 616 wrote to memory of 2816	616	cmd.exe	152
PID 616 wrote to memory of 4208	616	cmd.exe	153
PID 616 wrote to memory of 1404	616	cmd.exe	154

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ub.gg cleaner.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f"
  2⤵
  PID:3636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f"
  2⤵
  PID:2636
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC_EOS.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:5224
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC_EOS
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:960
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2104
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_BE
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4680
- C:\Windows\system32\sc.exe
  sc stop NvContainerLocalSystem
  2⤵
  - Launches sc.exe
  PID:4300
- C:\Windows\system32\sc.exe
  sc stop NVDisplay.ContainerLocalSystem
  2⤵
  - Launches sc.exe
  PID:1396
- C:\Windows\system32\taskkill.exe
  taskkill /f /im nvcontainer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\system32\taskkill.exe
  taskkill /f /im NVDisplay.Container.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "NVIDIA Web Helper.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "NVIDIA Share.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\system32\taskkill.exe
  taskkill /f /im nvsphelper64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\reg.exe
  REG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f
  2⤵
  PID:260
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_TrackProgs /t REG_DWORD /d 0 /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents" /v DisabledComponents /t REG_DWORD /d 0xff /f
  2⤵
  PID:1200
- C:\Windows\system32\cmd.exe
  cmd /C del /s /f /q "C:\Windows\INF\*.*"
  2⤵
  PID:4712
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Windows\temp"
  2⤵
  PID:2556
- C:\Windows\system32\cmd.exe
  cmd /C mkdir "C:\Windows\temp"
  2⤵
  - Executes a command shell one-liner
  PID:5852
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Windows\Prefetch"
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  cmd /C mkdir "C:\Windows\Prefetch"
  2⤵
  - Executes a command shell one-liner
  PID:5204
- C:\Windows\system32\cmd.exe
  cmd /C del /s /f /q "C:\Users\Admin\AppData\Local\IconCache.db"
  2⤵
  PID:4416
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache"
  2⤵
  PID:2420
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache"
  2⤵
  PID:1968
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content"
  2⤵
  PID:3484
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData"
  2⤵
  PID:5824
- C:\Windows\system32\cmd.exe
  cmd /C rmdir /s /q "C:\ProgramData\NVIDIA Corporation\Drs"
  2⤵
  PID:812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\tqqMYSLxEtreJTNCMGEpNiFDMT" /f
  2⤵
  PID:3740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\yMhHfJchsflWgfsPKTQayGWtFwi" /f
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
  2⤵
  PID:2040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count" /f
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}" /f
  2⤵
  PID:1736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}" /f
  2⤵
  PID:2280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count" /f
  2⤵
  PID:6128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count" /f
  2⤵
  PID:1816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}" /f
  2⤵
  PID:1356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count" /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}" /f
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}" /f
  2⤵
  PID:2936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:1748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine\Hardware Survey" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /f
  2⤵
  PID:5936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EpicGamesLauncher" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /f
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\RAINBOWSIX.EXED5C6593B0580A8A0" /f
  2⤵
  PID:1404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\RAINBOWSIX.EXEACF73F79057BCAA0" /f
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\RAINBOWSIX.EXE8D97C7E106019018" /f
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\RAINBOWSIX.EXE4ED52BD9059054A0" /f
  2⤵
  PID:2516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\RAINBOWSIX.EXE4C8CC6BC05834E10" /f
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\RAINBOWSIX.EXE017E2C4C062FBA18" /f
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\OVERWOLFHELPER64.EXE67E9446900028D00" /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\OVERWOLFHELPER.EXE67E9446B00023B00" /f
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication" /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\FC25.EXE67F6CBD8228CEF18" /f
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\FC25.EXE67DE4B6521F63320" /f
  2⤵
  PID:4532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\DXDIAG.EXE214A433E00042800" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput" /f
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{931f3cf8-ac22-4e91-9cd3-19b12aee8c5f}" /f
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc64bff-158b-11f0-a11c-af55fb939413}" /f
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{931f3cf8-ac22-4e91-9cd3-19b12aee8c5f}" /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{6b209e49-f73d-48c1-8ec9-6d22dc2de93b}" /f
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{04ca6467-5c43-4426-861e-1268373a2cf6}" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\Settings" /f
  2⤵
  PID:6124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo" /f
  2⤵
  PID:6120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel" /f
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open\command" /f
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open" /f
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell" /f
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\DefaultIcon" /f
  2⤵
  PID:6140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EpicGamesLauncher" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\UserHelper" /f
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\UIHelper" /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\RegisteredProducts" /f
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\MainService" /f
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS\InstallHelper" /f
  2⤵
  PID:2608
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games\EOS" /f
  2⤵
  PID:5888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
  2⤵
  PID:2824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{931f3cf8-ac22-4e91-9cd3-19b12aee8c5f}" /f
  2⤵
  PID:2544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" /f
  2⤵
  PID:1920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket" /f
  2⤵
  PID:5632
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers" /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games\Unreal Engine" /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\.DEFAULT\Software\Epic Games" /f
  2⤵
  PID:5160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet\Home" /f
  2⤵
  PID:4756
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet" /f
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f
  2⤵
  PID:2692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Admin\Downloads" /v "spf.exe" /f
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow" /v "rAQBc8Wsa1xVP" /f
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Software" /v "DNhm3" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\BranchIO" /v "IDCdJOyapnxr" /f
  2⤵
  PID:1000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\BranchIO\key_live_pfaVQo61xda7Zq1zC1ca3igayxarnljw" /v "JBdT3hVOfoaM" /f
  2⤵
  PID:5840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium" /v "ZYFYZ5B6kzMCk" /f
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\BLBeacon" /v "fRyilOYGxlSXP" /f
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\PreferenceMACs" /v "Rblsaqv" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\StabilityMetrics" /v "CmZFOv" /f
  2⤵
  PID:1796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\ThirdParty" /v "ZpzRiKYpZgnSOK" /f
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord" /v "g5Ayy61" /f
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord\Modules" /v "9rklPGtfUR2I" /f
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Electronic Arts" /v "ciQTqVaAUnJv" /f
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Electronic Arts\EA Desktop" /v "y4KjsfSX" /f
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Electronic Arts\FC" /v "2u8qvJP3B6Uiu1g" /f
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /v "oDUTOX7NY" /f
  2⤵
  PID:1044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /v "lvBndn4" /f
  2⤵
  PID:1448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EpicGamesLauncher" /v "gr881" /f
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /v "L1Q4G" /f
  2⤵
  PID:1040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google" /v "uTlCH9WpIYaPH" /f
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Chrome" /v "ds7HX27KbNC" /f
  2⤵
  PID:2292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Common" /v "pqiwdo3Hrdt6z3" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Update" /v "DtmvWvN20" /f
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos" /v "0OSa9" /f
  2⤵
  PID:1944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos\Vulkan" /v "cKwhz" /f
  2⤵
  PID:832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft" /v "PYlapdvx" /f
  2⤵
  PID:5872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Accessibility" /v "OwWR2uaAtZV" /f
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup" /v "nZSCe8nPQH" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie" /v "jHkpC99I" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveSync" /v "li9Mk6pyZdA" /f
  2⤵
  PID:3636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Assistance" /v "zchUSmJqhT" /f
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies" /v "kdKB9Ppfr6Sk" /f
  2⤵
  PID:3136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Avalon.Graphics" /v "lyLUl" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Clipboard" /v "08n8Y" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CommsAPHost" /v "sSXvy" /f
  2⤵
  PID:1820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF" /v "A1KG3aMSFgDmn" /f
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Direct3D" /v "4mMxkcNZ" /f
  2⤵
  PID:568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool" /v "VlvkI3S1W" /f
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge" /v "5P1fJX" /f
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate" /v "LJwWy0vNK" /f
  2⤵
  PID:4400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView" /v "YKbBkp7iE8TL" /f
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EventSystem" /v "zKFZdSKQc" /f
  2⤵
  PID:2736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\F12" /v "tYFpEFl" /f
  2⤵
  PID:4092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fax" /v "WkhVYO3dJfBuCov" /f
  2⤵
  PID:1284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Feeds" /v "IkbSUz2k4X" /f
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\FTP" /v "SLUcbCkFeXVwVQ" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBar" /v "dtm9WgMa" /f
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBarApi" /v "TDHqyzKXoJ" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL" /v "fRWIz" /f
  2⤵
  PID:572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IME" /v "CmfLf8hgMcV" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Input" /v "9GUa8m6xqqEZ1EN" /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputMethod" /v "gMnn79" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputPersonalization" /v "iU1b6GvS1TiZ" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Connection Wizard" /v "F3YxVeBJK" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer" /v "I6BDvjwRgw6eX3a" /f
  2⤵
  PID:5624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Keyboard" /v "qOpaZDAqyR" /f
  2⤵
  PID:2616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\LanguageOverlay" /v "tBHYf2FpMSsvHgo" /f
  2⤵
  PID:1160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer" /v "DFDHnZw3L1" /f
  2⤵
  PID:5092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Microsoft Management Console" /v "XjmxEHys" /f
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MSF" /v "PJe5AhAz" /f
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Multimedia" /v "cxwTJIK38D" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Narrator" /v "l9nTdejMgZ" /f
  2⤵
  PID:1396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\NGC" /v "ACuTi9DM5uXp9f" /f
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad" /v "ZWwjV3" /f
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Nucleus" /v "00ZEPd" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive" /v "T9cZ93mG" /f
  2⤵
  PID:1280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Osk" /v "vFnijwndit6Bb" /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\PeerNet" /v "ptnzsTGlZHvojW" /f
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Personalization" /v "a2vQfNw0Kkib" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Phone" /v "CN8tTeV" /f
  2⤵
  PID:2908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Pim" /v "HQNTkRuv0Hc" /f
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Poom" /v "xfkPrCtcI90Gp" /f
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\RAS AutoDial" /v "mPW6Yl2M9LhIU3F" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\RAS Phonebook" /v "BXCBZ37CFjIy9" /f
  2⤵
  PID:1660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Remote Assistance" /v "MvfoH1VDKMYcf" /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ScreenMagnifier" /v "VSgoKEV" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Sensors" /v "uOR03" /f
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SkyDrive" /v "QFt7EeMp9cd" /f
  2⤵
  PID:1380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech" /v "XoJil2J" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech Virtual" /v "ZIwWsOrk" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore" /v "aTgyKnutVL7pd" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling" /v "jFkhMJ9N1" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SQMClient" /v "rfwmOZGylOWSP" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\StigRegKey" /v "sRaUwIQjMDtCJ" /f
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates" /v "BawfSWL3TtuQP2t" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\TabletTip" /v "6Q5IJB1U" /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\TPG" /v "WCDz06yo4opxOK" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Unified Store" /v "5YOvt" /f
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Unistore" /v "GR3su0Hx" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\UserData" /v "GjxoXjAG" /f
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\WAB" /v "c1H1JyHa" /f
  2⤵
  PID:2232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\WcmSvc" /v "Tn3iS" /f
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\wfs" /v "9exXT5" /f
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows" /v "ARVZR0" /f
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT" /v "t1fm1jomYqLM" /f
  2⤵
  PID:3524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script" /v "M8oTPRr0e6FAzwz" /f
  2⤵
  PID:5132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Search" /v "iLwRDfosp" /f
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Security Health" /v "vGkmY5kinZ" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Wisp" /v "9wGTC2s6a" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Xbox" /v "dPedIo" /f
  2⤵
  PID:2836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\XboxLive" /v "OTJcJwef0hg0A" /f
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation" /v "9PBkwzFeaKQ" /f
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\Global" /v "kSP3msI6XZMEwGu" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\NVControlPanel2" /v "XSOiiZqTo9VxlS" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Overwolf" /v "QwN3gcifOpKg0" /f
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Overwolf\CEF" /v "60OvE" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Overwolf\Overwolf" /v "zXoaswtGzU6wy9" /f
  2⤵
  PID:2432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\OverwolfPersist" /v "XC9nuPUABJkOmf" /f
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Policies" /v "O6aMx3QRb0xN" /f
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft" /v "KwO76uAIr" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Policies\Power" /v "M08iYfRYDL" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications" /v "sE9f6ebsOTWb" /f
  2⤵
  PID:2936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation" /v "aw4Ee2fgW" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Environments" /v "5F6wvy" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Settings" /v "wYsVx5W0yG8" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Spotify" /v "dSIiwEtLHXVZsOb" /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Spotify\Window Position" /v "pNpLPnVhxSPRW" /f
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Sysinternals" /v "VaDXA" /f
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Sysinternals\Process Monitor" /v "4bWozXys0Q" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Sysinternals\VolumeID" /v "U5Qe8dZhX63" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft" /v "Y20H08Xwi0at2j" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft\Launcher" /v "ixWgo" /f
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft\Rainbow Six - Siege" /v "58Tp9dlF4BG5xML" /f
  2⤵
  PID:244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft\Uplay" /v "0dLL7FNP3EehjT" /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Valve" /v "BtHa9qrMZEYnTQ" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Valve\Steam" /v "JgNakyOO9TJXQX" /f
  2⤵
  PID:3124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Verse" /v "aTG2C7Qia3eeM" /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Windscribe" /v "Pm2YQ" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Windscribe\Installer" /v "pMXD22rqy" /f
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Windscribe\Windscribe2" /v "jkOCjQJ0c" /f
  2⤵
  PID:5528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR" /v "tZ8rqYI0jH" /f
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory" /v "OqjGagEu75Im" /f
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory" /v "Tp0KVDibIRx" /f
  2⤵
  PID:3144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList" /v "o8LXY4dLywY" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\General" /v "q5Tx60luda1x" /f
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface" /v "dX1KlWXtq" /f
  2⤵
  PID:3472
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Profiles" /v "95SzkXT8ZpDQj" /f
  2⤵
  PID:3232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "bJXpgSkSjB" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX" /v "mdPcNj711hz" /f
  2⤵
  PID:1016
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Wow6432Node" /v "4yfm8dE4WK2" /f
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft" /v "1JOkib5I5qY2lF" /f
  2⤵
  PID:6100
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes" /v "0GIsFTnTZSg06VD" /f
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\*" /v "jBRZVStd" /f
  2⤵
  PID:4944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3fr" /v "kG1BZU" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3g2" /v "m7raLU" /f
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp" /v "5ieeI8tYWmFGzu" /f
  2⤵
  PID:5408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp2" /v "UFl0XjDq" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gpp" /v "4JSgVS0q" /f
  2⤵
  PID:4180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3mf" /v "gaixwB9dyC" /f
  2⤵
  PID:6116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.aac" /v "1o6yALK" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ac3" /v "x6mMA0N7j" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adt" /v "PEPp1ZNxGFFh" /f
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adts" /v "8VVWnEzSJ" /f
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.agent" /v "owgmHlpblyDw" /f
  2⤵
  PID:1804
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.all" /v "5PlbWG9mVUhDpT" /f
  2⤵
  PID:2456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.amr" /v "HuylQvPuof" /f
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appinstaller" /v "WaDDx47Sf" /f
  2⤵
  PID:3164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appx" /v "9YDQSYwvle" /f
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appxbundle" /v "8B9EZ" /f
  2⤵
  PID:3928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ari" /v "cPG0rNljM2zbn" /f
  2⤵
  PID:1244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.arw" /v "T0P5A2R8GpaaiW" /f
  2⤵
  PID:1920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.asf" /v "1SH4aSk6eX" /f
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avci" /v "WDPotZIWI7qF4" /f
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avi" /v "FxR6NBB3m" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avif" /v "VBLAljp" /f
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bay" /v "OIb5anh2CV" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bmp" /v "nLjBsORXtJTrPEv" /f
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.c5e2524a-ea46-4f67-841f-6a9465d9d515" /v "Z8pHG8v" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cap" /v "P2Hfo" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cda" /v "oH1PmUbEzvO2D" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.copilot" /v "qQfhtdHTwRWUvJ" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr2" /v "jqhEfxVJ" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr3" /v "8fszd" /f
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.crw" /v "6SiqR" /f
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcr" /v "vDgj5ogq" /f
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcs" /v "iKDG0mzm" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dib" /v "tXhWmqf" /f
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.divx" /v "hZFaBp" /f
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dng" /v "HW2rLc6A" /f
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.drf" /v "W0uxd" /f
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ec3" /v "jMaKXwNEFX" /f
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.eip" /v "uHR3U" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.eml" /v "Sz24DSpKSKQ" /f
  2⤵
  PID:1036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.erf" /v "meRpfwY3Rb07" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fbx" /v "IZLk4" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fff" /v "BuF9sP2we" /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fh" /v "6klv47" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.flac" /v "DQn19BblM" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.fluid" /v "NUVpy2I03lOJjOp" /f
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gif" /v "lvPsLsT7iz" /f
  2⤵
  PID:1944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.glb" /v "CBktRrvxr08" /f
  2⤵
  PID:832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.gltf" /v "xTft0d7gh" /f
  2⤵
  PID:5872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.heic" /v "ehAZ8Ki063ra5" /f
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.heif" /v "DxaARWG" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.hif" /v "ue9CHBn2TeW" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ico" /v "ojL6BYOXXsqwbl" /f
  2⤵
  PID:3636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ics" /v "LWrHd5" /f
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.iiq" /v "WMLzbV9NINARb" /f
  2⤵
  PID:3136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jfif" /v "JVMzP0MMHqz" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpe" /v "wg6TacFe8b" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpeg" /v "JOAY0Q0nty9AGV3" /f
  2⤵
  PID:1820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jpg" /v "sTAMG6DFeM58Z" /f
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.jxr" /v "EhtGZw2HsSka" /f
  2⤵
  PID:568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.k25" /v "2jDOyQ" /f
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.kdc" /v "OZtiaW19db" /f
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.loop" /v "zgDoz" /f
  2⤵
  PID:4400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m1v" /v "RWZ4KGnR4ZcC" /f
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2t" /v "nb6hFmvUR6NZo9" /f
  2⤵
  PID:2780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2ts" /v "89CmH" /f
  2⤵
  PID:364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m2v" /v "tmzqU5sNZ8KXP" /f
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m3u" /v "KotgKDM" /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m3u8" /v "YfJ9zyHTbCT79" /f
  2⤵
  PID:1236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4a" /v "rGsRiYKLXdQrqTD" /f
  2⤵
  PID:3944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4r" /v "b2j4xTLI" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.m4v" /v "Na0vyQmHMHv" /f
  2⤵
  PID:760
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mdc" /v "X4nopK0o5" /f
  2⤵
  PID:628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mef" /v "1Va9BBBj" /f
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mk3d" /v "Er4uis42nxhW" /f
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mka" /v "hD6Z6bj8qIiwmZr" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mkv" /v "yRzUVBu" /f
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mod" /v "1o0AagGwTPE" /f
  2⤵
  PID:1160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mos" /v "DXvhyeUzfKtepC" /f
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mov" /v "By6oisO" /f
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp2" /v "stJKiya5" /f
  2⤵
  PID:2812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp2v" /v "QebqDwFfmv" /f
  2⤵
  PID:2192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp3" /v "zxaOIRk6uTeNuY" /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp4" /v "tvXptI" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mp4v" /v "ELFsUD" /f
  2⤵
  PID:5676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpa" /v "57ohfe8pVS51y" /f
  2⤵
  PID:5420
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpe" /v "xqfaMeu3B5syb" /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpeg" /v "6rBfgiuujLnk9w1" /f
  2⤵
  PID:5456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpg" /v "kEd59kUeriQvdO" /f
  2⤵
  PID:3932
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpg4" /v "jfAtIJLQZ" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mpv2" /v "vrQoDTciQ1E" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mrw" /v "LM1dtVjhna5fc39" /f
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ms-lockscreencomponent-primary" /v "gYMsX0ldgDYOoXG" /f
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msix" /v "UoLVx6d96DO" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.msixbundle" /v "1ZsARy" /f
  2⤵
  PID:1660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.mts" /v "Tfr3WnGp1F3l0Zg" /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.nef" /v "gnUvzwgQJOVOp6E" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.note" /v "wA60YgUoj75Lrn8" /f
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.nrw" /v "T7DkWk" /f
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.obj" /v "1dDqC" /f
  2⤵
  PID:4184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oga" /v "aYJGlJJQ5" /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogg" /v "EU05Di1" /f
  2⤵
  PID:200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogm" /v "WCKVjd1" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogv" /v "M7YVG" /f
  2⤵
  PID:5720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ogx" /v "HnO6J3WSgsAv" /f
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.one" /v "ofi3jZFZpay8" /f
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.onetoc2" /v "md9Xt3L" /f
  2⤵
  PID:1848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.opus" /v "7dAjhfZRk0" /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.orf" /v "hp4AxqrMrhGWKV" /f
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ori" /v "z3jJqwRbsxA" /f
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.oxps" /v "mhXDR4oZndj" /f
  2⤵
  PID:812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pef" /v "pCqvJRIlDeLSbT" /f
  2⤵
  PID:3060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ply" /v "hrqAx" /f
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.PML" /v "qmAcap" /f
  2⤵
  PID:1408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.png" /v "OOxPVtJTpunw" /f
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.R3D" /v "pWfcoaEnphSwOCm" /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.raf" /v "acrsr" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.raw" /v "pT0NLnfF82RpE4" /f
  2⤵
  PID:3484
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rw2" /v "ArzLZ8oo75Z0" /f
  2⤵
  PID:1736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rwl" /v "Gt404c" /f
  2⤵
  PID:3596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.rwz" /v "MkSx0GiXrHRl" /f
  2⤵
  PID:2280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.solitairetheme8" /v "0IVr0WZ" /f
  2⤵
  PID:3076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.sr2" /v "0a8Na1Czu2zzye6" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.srf" /v "L9oTr" /f
  2⤵
  PID:1816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.srw" /v "fTDntxeNsXhNyhR" /f
  2⤵
  PID:1356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.stl" /v "DIag95oikAosBS" /f
  2⤵
  PID:1072
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.thumb" /v "bYLRqA" /f
  2⤵
  PID:2680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tif" /v "Tmvk9VjDGKO3y" /f
  2⤵
  PID:2032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tiff" /v "IxxC4qZp" /f
  2⤵
  PID:5688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tod" /v "UzI0M" /f
  2⤵
  PID:5440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ts" /v "tdI0QMVC" /f
  2⤵
  PID:6012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.tts" /v "7DwNoV" /f
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.vcf" /v "nfFHwv" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wav" /v "fBatCfz" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wdp" /v "N3C6XPWw35bxE" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.webm" /v "zRBumJa2qu" /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.webp" /v "kvcVVmsAqZ8XCKa" /f
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.whiteboard" /v "DKcbd2" /f
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.winget" /v "tNle7p95" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wm" /v "3iOUK4rfF" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wma" /v "1F1lGKI9" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wmv" /v "qbH0tZLyB" /f
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wpl" /v "9Qgft" /f
  2⤵
  PID:244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.wsb" /v "qH42KmHtja2TkwC" /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.x3f" /v "r6G8stI" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xps" /v "vDbbTnTXY" /f
  2⤵
  PID:3124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.xvid" /v "4QuLYUNXT" /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.zpl" /v "aLgvecOOxmDnwyM" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ActivatableClasses" /v "pOhePXs" /f
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppID" /v "aewOPCNVY" /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6" /v "sjJZDGji7Fg7RiG" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0jr688mrddhm2gsn5y1q8jpx5tfsxk7s" /v "rOxAx" /f
  2⤵
  PID:1952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0resaq7r5ermbh4b96ke39yqc1atfhjr" /v "Q5MzOciSq" /f
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0t69n30jztar4a12pv0h1xh91e8jsacr" /v "jrc1Szv4" /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX0yfn1fhybwjxhemdkvvy841hdgqqy4y4" /v "yaR27KICp3LH" /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1akbsnxkswph8hkx1pb4f1s3d2rfbnyb" /v "IzihD0tLkN4" /f
  2⤵
  PID:1572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675" /v "KMrJnHhMDgo" /f
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX1yprbth8spa55n2rc6zbh6tc1kr1tf5h" /v "KCy4L" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX2jm25qtmp2qxstv333wv5mne3k5bf4bm" /v "n1SHDLML0tdlmy" /f
  2⤵
  PID:4824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX333jbhpaq2hjpyd097614409g4kz15cw" /v "ux2rezt" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX3p914qnpgw4hwj856jw2y286v7d4qnzh" /v "48nVZhR4Srq" /f
  2⤵
  PID:2792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX3v6hct5w0szn0pd06ekse0yqavf2e8r3" /v "KkKQtGTObJFGb" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX40nx3azkcssh7ybcbzzjpgf1mg561cyz" /v "JUY0rHp2" /f
  2⤵
  PID:2528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4jbzrhvphxte25e0gxha6bq555nrgqzy" /v "A8GRb33ukY" /f
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4mntx4h978m1v9gtzv0ewksfd6pmwsre" /v "HX2RFy" /f
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX4ra53nzs9xcdyxf1wgcp31xefscv1jnk" /v "oN8qK" /f
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5c55tbqy8hgeyk21tx5ewf1mq82vg7jg" /v "MrJ4FxiaQDKL894" /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5mseefwz6s981bhyy79d4wwmcper2jyg" /v "JxI2qDuEgRiSQSl" /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5nebv0xjaxafmmr3cnptgjg9pdpqcg0h" /v "YIdfKbFmpa" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX5sy1gww9q4g2gt941cdxxd7s07xe5vph" /v "hN0tQf" /f
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6006hzyfsdm0v5mhzsyjgvyh29vvj9sp" /v "BWGNoS" /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6365235j7azx11tebzeay2a9hd0ngfk5" /v "jM3PhtOg3asEoX" /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX69r31t6nmawqr1gdamcsndphj2v4a6cx" /v "DitBL" /f
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6efkedsh4s4yrd49cf5nmjaza776n10d" /v "1iXZL" /f
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" /v "0r1Hy55zODt" /f
  2⤵
  PID:5888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6hptmm8avg1gnv71j8jda9340qk79w89" /v "EtuGah" /f
  2⤵
  PID:2824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX6w6n4f8xch1s3vzwf3af6bfe88qhxbza" /v "1EaJt43KRBuPM" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX70hz8geay8nefwg2887gffr7tmedrrh2" /v "47KCo8o7tru" /f
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX77ghgzrbzwe6djbdyty6hp5e3z1qryqx" /v "znRscLXNP3" /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX77zsthmbxzqveyvr5gqhcfpnd7mfnd5j" /v "hG4uEAcyp" /f
  2⤵
  PID:5616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX7tycjjv3satx1c8myac3gpn9ktrwns6b" /v "alz9FHZGaFIWh" /f
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8mg1ky09gvfdexfmk8e77463mz4j1xcp" /v "aKvmfGN" /f
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7" /v "zFCCw" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX8zw7xct41bx2wrswqekb78rm243h02yh" /v "ji5rXgWipVLkwZQ" /f
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9kvz3rdv8t7twanaezbwfcdgrbg3bck0" /v "ndNkGxHlY4w" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppX9vwggs9kbe3mn0w816545e7zs1x6vegr" /v "gUkEDDz" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXa4x21t18evxksm0kbe6znaz8jjrjvs9e" /v "EyT2kOtSTo6" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXaf0097ws4bwb0wre67gmp7pc9fjr8en6" /v "wxZnBR" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp" /v "OAV8o" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXak1hygz1tpjjnxhr1pwtcgnkpr24r5e7" /v "G8mtBqPyTmio5P" /f
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXarc6g37bjvf299edhhmjx991tz75tcx9" /v "1BtvN2a" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXarrs62hke6epkgs4hz21rc31k0p4gqqq" /v "VIfLUzW0vCL" /f
  2⤵
  PID:1796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXassm2k5er21ec9tqj99raa72bqdy59n1" /v "wVuBl" /f
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbemgape21yns3k5pd4ah40jz06yq6xrk" /v "BnScbIFVU" /f
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbfem27ddbf6ebrx72mc6gnaw2e3nkpza" /v "di0rRdeuJB9Ob" /f
  2⤵
  PID:5564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbhww3jf4qxawt50vjnfe7emd36rxsezh" /v "ZsWhuaWQjBlm" /f
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbtxh7p534mcndn2b6d1ypwaf0hhbf5ap" /v "qionZa" /f
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXbzdzkhgs0b1gj36jbm528tvp1fnha54j" /v "HyuMe8Mg" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXc9bt84rtp5qvmzkascgmn4pfe2g3hxeg" /v "Yqu5Y" /f
  2⤵
  PID:1036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcdh38jxzbcberv50vxg2tg4k84kfnewn" /v "9aHSfT4CWQQpXjs" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcezf6bjsrpbyaqwyjdehhb46y5e5mm3a" /v "gIsU5c" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXcr7ve1e6y7nx8n3y5qv7m7s9kzz18jx5" /v "3MCRWpbHFGm4F" /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXctx73kz58pypptjf6jydwz2pgcks5mzk" /v "aO88h22ADBjH3LR" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdv25x4ndb8r51pbdf6srsknmbkfnkpaq" /v "66hCashmz" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXdyw2j75xqd0y008p4bvtxhnxp3py2t2g" /v "d8O8hkht0" /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXe05qdnx2p14g0mw29139zqs9s5n3wcne" /v "dvD94W" /f
  2⤵
  PID:832
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXegssybx65447k2q6prgacs1t5gzge8at" /v "nsqN6mNV3aP4k" /f
  2⤵
  PID:5872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXejqz5dpvfxzdkq7rwbwmnn4gyqk3hhb9" /v "gmAaIdt" /f
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXf1qkdkw713dwwyym75mwhtyrm0vexpzf" /v "YU91Wc" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXfp6kkvw8823ptbxvr2be691hzfyrsazt" /v "o1G4DncX" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXg280tzrpxnd0t559h02gpd27tgrma246" /v "5BhEo6wCiskehrF" /f
  2⤵
  PID:3636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXg2ew71cpjznkcwmfttfpxzc075gc7c80" /v "8IRCFi7HIsKs" /f
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXgtz62cfp9761w8h33sbaykyt1vkbm4vj" /v "IZM40tjg4" /f
  2⤵
  PID:3136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXgwsb7drvvkp7jxvqdqst0ajpq6107yzv" /v "O8Q3P9p" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXhhkhyqrpsdn2kgtvr6qf6att22kmtadz" /v "sPFOtIqk" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXhw73fxxd4pf1p5pm5r13y4m3vezj4v1b" /v "kQgabTVnlEPtY" /f
  2⤵
  PID:1820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjf4aqz2sx7y9mp1x29d4rbshzmz12hw9" /v "UjNovh" /f
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjmgntwab0zvv6ga5dkkwc34b7s4r55e9" /v "DNOhw8tF1iMXO" /f
  2⤵
  PID:568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXjsdsf5vqjpck4w72a3ve2zmnsb3qfec1" /v "kV40D7" /f
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXke6eh8a1ew0cqjwpdgcvg9rj36gxfss1" /v "auCGW8YtzZAP" /f
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkmt99ynn1qvez84cxh13grbeahewhrx2" /v "YZc0BhWRmm7x4R" /f
  2⤵
  PID:4400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkn1qcbm5sq3zpckpgc0sr39rbdbentq3" /v "cORx9b0Ky" /f
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXkytm3hnq0vzg49fdp50v6n482apdb470" /v "6zuBphIn" /f
  2⤵
  PID:1284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXm4fjth7rfv9b2vppk3w1gcpsf4gy9r3n" /v "2lWzLPpS5y" /f
  2⤵
  PID:2600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXm8fs0gj5h36ynw4kq0x3gqnz6ecr1kvy" /v "nMGhVNrqGUKFmh" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k" /v "aLz8RK" /f
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmrzewgswm3y60fdz9attr7pr39wrb9dt" /v "Hl7SZM8XD8W" /f
  2⤵
  PID:1668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmv6rk8z9kbjr10t0fhrvkggh6psk9vm0" /v "wrK48ORYeUjCAU8" /f
  2⤵
  PID:3128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXmwwyhgdj6npeeqe0bxkbr07wkr2mxjah" /v "ZaA6L3Zz" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXn8vagw663cz9m3j0rmkddxpbq9x0716k" /v "vVaYFXrYDc" /f
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnjayypjpx6dtabtjqtt76hhmg5nsz5nm" /v "uVSxUhTXhYD" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnn90p29wc108haje7ahczjhc00h3p5sf" /v "V4UCok05SD6s5" /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXnzh5v9w1s9pv2y889efv7t8bg0msmhca" /v "ra59W1paYLaq" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp18ym4xr204kvw1e76kcwpeev3fsaqgb" /v "gJ0GS" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp8e2ntvbtget7f2fw6qec3j54vhd14m4" /v "rxgSnlQy54" /f
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXp9gkwccvk6fa6yyfq3tmsk8ws2nprk1p" /v "OPXtq5aQOLvr" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpb1vntage8kvnwpyg40aqz34j851h4p1" /v "KA09nM" /f
  2⤵
  PID:5092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpjdwy3ckj5c1dr53c5epmrpbex5tg2g4" /v "gZadbjw" /f
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpjsxda6f84877c5f65bm4q3g4qep2rxn" /v "HHHeta" /f
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXpzkxgsbx9mzsg8kedsrg63eqxykxrtcx" /v "OHzc46SEcOVh1XK" /f
  2⤵
  PID:2812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXq8btj36kvahvgqpj75d9n4510vjppa26" /v "SCjjgTPxV8cd40" /f
  2⤵
  PID:2192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs" /v "CRkPwDOMj8k5" /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqjyfmc5mk3hmghyt3yynbcb2jsdyp4fs" /v "bOxZkeLZhK" /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqmt9n48kdgabchqtfjw3a4n5as0gk0vt" /v "VK7EoDu8UU" /f
  2⤵
  PID:5676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXqqxzfw12he3h63rdesxs3a7r2cs9sj4w" /v "4RXWvLMfJVaWHfJ" /f
  2⤵
  PID:5420
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXreyvazcs64j2pgtpwyt49g6ce85mwrwg" /v "KE3FZK76" /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXrpqnz37s7938xjfwvmrs7gr5befk6fbh" /v "eiN3QdLydir" /f
  2⤵
  PID:5456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXrrebmngeb0a7ggdd6sec1cq49468v8qr" /v "YVUGA7KdNXy5KS" /f
  2⤵
  PID:3932
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsbz2fdbdmn6pz7xyd3zc95j9syhcnyc2" /v "WUWI7npas" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXstagsrybc2dkesq85qj0xdqq4dbn3k6a" /v "KfYvxfFlf" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXsywsp6kb3dx2vqg7qaqkbc26sn1pbd28" /v "fQl5hMccL" /f
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtggqqtcfspt6ks3fjzyfppwc05yxwtwy" /v "SdfcA0FJHIB" /f
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtkjk7ve8gcvsz7s2y4kkf56wrmb5edr7" /v "e6trwu" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtmyvd154r75whynphdjyax5d711yvn0s" /v "1kQ2eKw66" /f
  2⤵
  PID:1660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtpbjbzxapgktx1mx1am0tawh8wgb2q4z" /v "P14n6" /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXtsmg3v4j4x76mctp0h8w9ykwqt07rr43" /v "dYgZ2STy3uYN3P" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXve2j6k0pfr77f4q8penh0d5pgejsy932" /v "GEbYBHOIsXI" /f
  2⤵
  PID:1380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvk98z8gfdq7gdeydeh2zpvfaw8jqcm1f" /v "fhoDAY" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvqhb9dhb3dg0mpfydfbz4qp875kpspza" /v "nFoiFcxbVHuC" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXvvr0sjtc34r6nk4mhn2e608s2xp2tezg" /v "W89th3JtMN3" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXw3nvmqt363p060ea53qg33er1a0782a8" /v "6bWY5oxyIRM9EZ" /f
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwkwctjzwtre31cm4f91h5extbhywmp1w" /v "DUTtZ" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwrtp6eja8jnr0thb7w1880gazg9mewpx" /v "RyNutbNXarHNh" /f
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXwve7kb5ph6122q6b8rh71ajwvp146jmn" /v "7yUSJZPdR3dI3" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxfctf2rqj6c7b4wrvys6zq1bskprrn19" /v "nl9PDrPv" /f
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxfzmfpme06qpdmsvw8etc4vd5sb2fpth" /v "c5QnPiXD" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXxvnbvsna403aer8rg6v5h12z8c8te2rc" /v "yeGfk69" /f
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXybm0hz3h6qr4z6wdaaefvpq136awdq2e" /v "iaJOLGPCyJs" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXydk58wgm44se4b399557yyyj1w7mbmvd" /v "9ynRpxPDT" /f
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXyte1agk1gt765291prervr3pvygjqp1d" /v "bysHDMHZN" /f
  2⤵
  PID:2232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXz2d7qm1dmekjyt1p721ccpt9mfr1a0p2" /v "3JBHfu8W" /f
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzc8ajeke9yt5s0y88h6hvwqd556b4bma" /v "77j3Vo" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXzg6fdzp57dpmt1dqardd3y48kkx0qb78" /v "EkzRuWZHHp" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\AppXztymbw55c24qp3qfb1jac0r6a8w3rtfq" /v "aDEIBZmX" /f
  2⤵
  PID:2040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\armodelviewing" /v "YE1Gz9LeCHw7" /f
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\BannerNotificationHandler.BannerNotificationHandler" /v "eJKeQg0mb" /f
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\BannerNotificationHandler.BannerNotificationHandler.1" /v "p8nlNiuc1" /f
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingmaps" /v "buZLt4gAUsGUPuJ" /f
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\bingweather" /v "k9vprFlc7a9bZQ" /f
  2⤵
  PID:5432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\calculator" /v "8zkXSU9CePswDh" /f
  2⤵
  PID:6128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\callto" /v "IHYdagMBstm5t" /f
  2⤵
  PID:5980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\CLSID" /v "e5pmyol0MB2o" /f
  2⤵
  PID:2412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\com.microsoft.3dviewer" /v "JHHSYL" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Directory" /v "21KXy" /f
  2⤵
  PID:2892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Discord" /v "iVfT9d0KwsXLxP" /f
  2⤵
  PID:1012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-345229890980937739" /v "Svcnmog" /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-432980957394370572" /v "tJt34cNS" /f
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\discord-445956193924546560" /v "UrXMBg7aWIx" /f
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Extensions" /v "4cKAWXsKJTpAHt" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\feedback-hub" /v "U4XiT1yTXqeFqM" /f
  2⤵
  PID:4624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.AutoPlayHandler" /v "0XiKoS" /f
  2⤵
  PID:2904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.AutoPlayHandler.1" /v "VkmBAVvq9" /f
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.FileSyncClient" /v "dbCS7SYPZG7kAZ" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\FileSyncClient.FileSyncClient.1" /v "bgRHuAcXYST113" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gaming-tcui" /v "kAzXv" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\gamingservicesui" /v "Wv0jMfs7KQqh" /f
  2⤵
  PID:5128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\grvopen" /v "7u1pD1d" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL" /v "vzN6qPIXG3" /f
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\insiderhub" /v "S9NZxZ" /f
  2⤵
  PID:4292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Interface" /v "MUhty0bQHK6k" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\lnkfile" /v "CLvxok7s8m" /f
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings" /v "Hy0AzyuEv8QeRqq" /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mailto" /v "k25dGrBWRI5d" /f
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft-edge" /v "494N8bXtlTc7a" /f
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft-edge-holographic" /v "mIuBPAFZG4F" /f
  2⤵
  PID:2516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera" /v "9Y3Jvon3S" /f
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera.multipicker" /v "TO4JBMPVotWJbt" /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.camera.picker" /v "HydKN" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.crop" /v "kfuv6M" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.picker" /v "QuK3dJS" /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoft.windows.photos.videoedit" /v "G7zOnXBXFIibfDT" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftmusic" /v "vTU8t" /f
  2⤵
  PID:1952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftsolitairecollection" /v "RY420" /f
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\microsoftvideo" /v "oyQfL" /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\MIME" /v "zF4ZYD" /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-aad-brokerplugin" /v "kbtL2xtrwj" /f
  2⤵
  PID:1572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-actioncenter" /v "nRrjbj1" /f
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-appinstaller" /v "7dyAoQL" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-apprep" /v "MbucSqRu6" /f
  2⤵
  PID:4824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-calculator" /v "Y5zRC8" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-clock" /v "yiTNMLx6U1w" /f
  2⤵
  PID:2792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-contact-support" /v "U3c4g2AtmXsPb" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-copilot" /v "jBXRMkO4hJh" /f
  2⤵
  PID:2528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-cortana2" /v "jSXZoeq0zOL" /f
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-crossdevice-settings" /v "00QoBQG2nl5" /f
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-cxh" /v "mBZJQRU" /f
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-default-location" /v "lLnwot3" /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-devhome" /v "stoK0GApeLYQtn" /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-device-enrollment" /v "p3d6G5" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-drive-to" /v "MVoSvC5" /f
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-eyecontrolspeech" /v "PDUSzC" /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamebar" /v "2XYpAzi" /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamebarservices" /v "lC27PMRSmDoKtrH" /f
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-gamingoverlay" /v "Mu9jxoAH" /f
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-get-started" /v "lzqwtrXOpSiC8" /f
  2⤵
  PID:5888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-getoffice" /v "X1L26l" /f
  2⤵
  PID:2824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-holographicfirstrun" /v "alBuEx4YUlMS" /f
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-inputapp" /v "kzVehaO" /f
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-insights" /v "LmkNyO9CFjxR56" /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-ipmessaging" /v "8U7xp" /f
  2⤵
  PID:5616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-media-player" /v "GWde4ta" /f
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-meetnowflyout" /v "qPqHq2j" /f
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-newsandinterests" /v "az1yPatmCqY" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-officeapp" /v "acI32" /f
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-officecmd" /v "yHBORqjnDwKKE" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-oobenetwork" /v "16aHA0JcAxJ97Vp" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-paint" /v "0ZB8VQ" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-penworkspace" /v "1KqvsDTDh2iwpJ5" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-people" /v "qncoenb9nakZ" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-phone" /v "5tCFm6lkz" /f
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-photos" /v "0YBVqOg9bVO93" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-playto-audio" /v "udrd25" /f
  2⤵
  PID:1796
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-print-addprinter" /v "SU1ENhV1C" /f
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-print-printjobs" /v "BA2XP" /f
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-screenclip" /v "QVSYrBhYbFTc" /f
  2⤵
  PID:5564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-screensketch" /v "HLfhM" /f
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-search" /v "E2KQKo" /f
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-sttoverlay" /v "ZEP6EzQ0" /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-unistore-email" /v "qzviCl" /f
  2⤵
  PID:1036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-voip-call" /v "Q4gVRDZcSBn" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-voip-video" /v "qevfWMIxoLju" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-walk-to" /v "n2KQHAA0tykmx" /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wcrv" /v "oSGPyFrO3Wo5" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store" /v "eCmuFghuzbE7vt1" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store-deskext" /v "G897bQGf" /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windows-store2" /v "X93k16mCu" /f
  2⤵
  PID:5872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-windowsbackup" /v "qjvspEtn1awf" /f
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wpc" /v "eTdyz3lPMUo" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-wpdrmv" /v "7hCcpg6" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbet-survey" /v "HPym1Ll7u" /f
  2⤵
  PID:3636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xbl-3d8b930f" /v "bt2pLYbQSzkNrKG" /f
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-xgpueject" /v "hv5eikCqef2" /f
  2⤵
  PID:3136
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamelaunch" /v "AEBg6nDRXyeZMx" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamepass" /v "KfWKNK27xCyvj4W" /f
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msgamingapp" /v "afVGVr0awiEe" /f
  2⤵
  PID:1820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msnweather" /v "BhLWwKvnQxsVu" /f
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mssharepointclient" /v "9OILC" /f
  2⤵
  PID:568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mswindowsmusic" /v "xQlSb" /f
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\mswindowsvideo" /v "jrrbiTjG" /f
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\msxbox" /v "1H8fW9FHPHXI" /f
  2⤵
  PID:4400
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusNativeMessaging.NucleusNativeMessaging" /v "xdmbXy2e" /f
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusNativeMessaging.NucleusNativeMessaging.1" /v "60xXSxFX" /f
  2⤵
  PID:1284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusToastActivator.NucleusToastActivator" /v "inMN4k4DC" /f
  2⤵
  PID:2600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\NucleusToastActivator.NucleusToastActivator.1" /v "eApBP3CV" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\odopen" /v "utyG0WbRy3v" /f
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OneDrive.CameraRoll.Import" /v "da6vZ" /f
  2⤵
  PID:1668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote" /v "CCv19xXLu1ix" /f
  2⤵
  PID:3128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote-cmd" /v "xI4O7CCX" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\onenote-uwp" /v "F43RJw" /f
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OOBERequestHandler.OOBERequestHandler" /v "6FvcJM" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\OOBERequestHandler.OOBERequestHandler.1" /v "YpUEaDNu4LG" /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookaccounts" /v "TtpeIrzIuIV" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookcal" /v "gkGFeuRiqIRU" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\outlookmail" /v "R34el6L2cX2tV" /f
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\overwolf-extension-ekhcackbfanheaceicpfmhmmeojplojfgkmfnpjo" /v "h4v2MC3Fu47weDH" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\overwolf-support" /v "Ovr8ygN7oZ8" /f
  2⤵
  PID:5092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\overwolfstore" /v "mASIzapg4V" /f
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\PackagedCom" /v "xo0HM3khMO2w" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ProcMon.Logfile.1" /v "K9V7a0FPSIylzL" /f
  2⤵
  PID:4352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\read" /v "Tqqc1" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\roblox" /v "4i9PtL4eNaV1o" /f
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\roblox-player" /v "twKyR8N" /f
  2⤵
  PID:1280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\roblox-studio" /v "UmROxSaYfw" /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skype" /v "tMNXOl3tLc61" /f
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skype-meetnow" /v "aAkhq6MMQ" /f
  2⤵
  PID:5900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\skypewin" /v "V7u94SbsSd" /f
  2⤵
  PID:5520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\sms" /v "fb3D0OmcEv9FZg8" /f
  2⤵
  PID:4780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\spotify" /v "hyitHrkKVrDn" /f
  2⤵
  PID:1192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\steam" /v "iPvmGxlRFVvzI5" /f
  2⤵
  PID:4312
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\steamlink" /v "gnvw2uIYC4" /f
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider" /v "75j1gJoX3" /f
  2⤵
  PID:5956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider.1" /v "j3FVR9ff" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider" /v "QjgYxnOZ7b2n" /f
  2⤵
  PID:1660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1" /v "qG2AAgUT" /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy" /v "quGql20nD1NhG7" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1" /v "xAjPPbV" /f
  2⤵
  PID:1380
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\tel" /v "Eh4Cwew4Hs" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\TypeLib" /v "Z1pJZC0CaOV" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\windows-feedback" /v "9CqY4u7kX1LeRJ" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\windowsdefender" /v "1gO7TupSYGgv" /f
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\WOW6432Node" /v "DdH08NT9F" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\wp-autoplay" /v "iXMUwmu" /f
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbls" /v "yfdcJOdus84" /f
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox" /v "TmfwgU2SzCBNqi" /f
  2⤵
  PID:6084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-arena" /v "SqmPk5kbPq" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-captures" /v "EsBFlQO" /f
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-friendfinder" /v "i4P7pG" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-gamehub" /v "qXJYXefUTYaM6iW" /f
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-lfg" /v "kGfyamGqsZpKlBG" /f
  2⤵
  PID:2232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-network" /v "O2hjs3f7ILW5G" /f
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-profile" /v "1YtCSvPCv" /f
  2⤵
  PID:3524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-settings" /v "X9FsrQYMF0N" /f
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-store" /v "fixr5Lk06yE2" /f
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xbox-tcui" /v "22QWzryqJ" /f
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxgames" /v "K7tTKIZ" /f
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxidp" /v "nIU4h" /f
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxliveapp-1297287741" /v "FDkZAxbg3QL" /f
  2⤵
  PID:5432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\xboxmusic" /v "e0TS5o8" /f
  2⤵
  PID:6128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\zune" /v "beslOvuCd" /f
  2⤵
  PID:5980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI" /v "sQJbeDE3SSWkMYK" /f
  2⤵
  PID:2412
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT" /v "IV9Sfu3B2" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FACS" /v "tTlYpwcZs" /f
  2⤵
  PID:2892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FADT" /v "jLmuMWx5pIKdN" /f
  2⤵
  PID:1012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\RSDT" /v "CnxCl" /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD1" /v "2uePfHU4" /f
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD2" /v "Pz5pm6lbb" /f
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD3" /v "bd8WBvgK" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD4" /v "GCLJd2e2044Cy6" /f
  2⤵
  PID:4624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD5" /v "7lxxCBD" /f
  2⤵
  PID:2904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD6" /v "ntP0M67qjyYfF" /f
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSD7" /v "RpbouBya" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\SSDT" /v "OSxsAN" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION" /v "0phQKW" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System" /v "7fRM2" /f
  2⤵
  PID:5128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP" /v "1NpQGYR7" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\KeyboardClass" /v "Bmu7xYnGBac" /f
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PointerClass" /v "TWjFF" /f
  2⤵
  PID:4292
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO" /v "B63kBC9OlFGZ" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi" /v "IxyD4yF" /f
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\UEFI" /v "b57qMbU" /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\UEFI\ESRT" /v "DYDpWAAo1L44h" /f
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP" /v "v8XL8ww92a" /f
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer" /v "vHWAemL" /f
  2⤵
  PID:2516
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\PnP Manager" /v "Q6Vj1YlV" /f
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\System Resources" /v "T5R8m" /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow" /v "rAQBc8Wsa1xVP" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Software" /v "DNhm3" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\BranchIO" /v "IDCdJOyapnxr" /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\BranchIO\key_live_pfaVQo61xda7Zq1zC1ca3igayxarnljw" /v "JBdT3hVOfoaM" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium" /v "ZYFYZ5B6kzMCk" /f
  2⤵
  PID:1952
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\BLBeacon" /v "fRyilOYGxlSXP" /f
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\PreferenceMACs" /v "Rblsaqv" /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\StabilityMetrics" /v "CmZFOv" /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Chromium\ThirdParty" /v "ZpzRiKYpZgnSOK" /f
  2⤵
  PID:1572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord" /v "g5Ayy61" /f
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Discord\Modules" /v "9rklPGtfUR2I" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Electronic Arts" /v "ciQTqVaAUnJv" /f
  2⤵
  PID:4824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Electronic Arts\EA Desktop" /v "y4KjsfSX" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Electronic Arts\FC" /v "2u8qvJP3B6Uiu1g" /f
  2⤵
  PID:2792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /v "oDUTOX7NY" /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EOS" /v "lvBndn4" /f
  2⤵
  PID:2528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\EpicGamesLauncher" /v "gr881" /f
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games\Unreal Engine" /v "L1Q4G" /f
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google" /v "uTlCH9WpIYaPH" /f
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Chrome" /v "ds7HX27KbNC" /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Common" /v "pqiwdo3Hrdt6z3" /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Google\Update" /v "DtmvWvN20" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos" /v "0OSa9" /f
  2⤵
  PID:5328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Khronos\Vulkan" /v "cKwhz" /f
  2⤵
  PID:2456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft" /v "PYlapdvx" /f
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Accessibility" /v "OwWR2uaAtZV" /f
  2⤵
  PID:3164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup" /v "nZSCe8nPQH" /f
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie" /v "jHkpC99I" /f
  2⤵
  PID:2544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveSync" /v "li9Mk6pyZdA" /f
  2⤵
  PID:1244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Assistance" /v "zchUSmJqhT" /f
  2⤵
  PID:1896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies" /v "kdKB9Ppfr6Sk" /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Avalon.Graphics" /v "lyLUl" /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Clipboard" /v "08n8Y" /f
  2⤵
  PID:5616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CommsAPHost" /v "sSXvy" /f
  2⤵
  PID:972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF" /v "A1KG3aMSFgDmn" /f
  2⤵
  PID:4320
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Direct3D" /v "4mMxkcNZ" /f
  2⤵
  PID:4228
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool" /v "VlvkI3S1W" /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge" /v "5P1fJX" /f
  2⤵
  PID:1000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate" /v "LJwWy0vNK" /f
  2⤵
  PID:4036
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView" /v "YKbBkp7iE8TL" /f
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\EventSystem" /v "zKFZdSKQc" /f
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\F12" /v "tYFpEFl" /f
  2⤵
  PID:5896
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fax" /v "WkhVYO3dJfBuCov" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Feeds" /v "IkbSUz2k4X" /f
  2⤵
  PID:5476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\FTP" /v "SLUcbCkFeXVwVQ" /f
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBar" /v "dtm9WgMa" /f
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBarApi" /v "TDHqyzKXoJ" /f
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL" /v "fRWIz" /f
  2⤵
  PID:1044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\IME" /v "CmfLf8hgMcV" /f
  2⤵
  PID:1448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Input" /v "9GUa8m6xqqEZ1EN" /f
  2⤵
  PID:1724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputMethod" /v "gMnn79" /f
  2⤵
  PID:1672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\InputPersonalization" /v "iU1b6GvS1TiZ" /f
  2⤵
  PID:800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Connection Wizard" /v "F3YxVeBJK" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer" /v "I6BDvjwRgw6eX3a" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Keyboard" /v "qOpaZDAqyR" /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\LanguageOverlay" /v "tBHYf2FpMSsvHgo" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer" /v "DFDHnZw3L1" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Microsoft Management Console" /v "XjmxEHys" /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MSF" /v "PJe5AhAz" /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Multimedia" /v "cxwTJIK38D" /f
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Narrator" /v "l9nTdejMgZ" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\NGC" /v "ACuTi9DM5uXp9f" /f
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad" /v "ZWwjV3" /f
  2⤵
  PID:4664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Nucleus" /v "00ZEPd" /f
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive" /v "T9cZ93mG" /f
  2⤵
  PID:1080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Osk" /v "vFnijwndit6Bb" /f
  2⤵
  PID:4084
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\PeerNet" /v "ptnzsTGlZHvojW" /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Personalization" /v "a2vQfNw0Kkib" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Phone" /v "CN8tTeV" /f
  2⤵
  PID:1272
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Pim" /v "HQNTkRuv0Hc" /f
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Poom" /v "xfkPrCtcI90Gp" /f
  2⤵
  PID:2736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\RAS AutoDial" /v "mPW6Yl2M9LhIU3F" /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\RAS Phonebook" /v "BXCBZ37CFjIy9" /f
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Remote Assistance" /v "MvfoH1VDKMYcf" /f
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ScreenMagnifier" /v "VSgoKEV" /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Sensors" /v "uOR03" /f
  2⤵
  PID:572
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SkyDrive" /v "QFt7EeMp9cd" /f
  2⤵
  PID:3944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech" /v "XoJil2J" /f
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech Virtual" /v "ZIwWsOrk" /f
  2⤵
  PID:5920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore" /v "aTgyKnutVL7pd" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling" /v "jFkhMJ9N1" /f
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SQMClient" /v "rfwmOZGylOWSP" /f
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\StigRegKey" /v "sRaUwIQjMDtCJ" /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates" /v "BawfSWL3TtuQP2t" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\TabletTip" /v "6Q5IJB1U" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\TPG" /v "WCDz06yo4opxOK" /f
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Unified Store" /v "5YOvt" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Unistore" /v "GR3su0Hx" /f
  2⤵
  PID:5092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\UserData" /v "GjxoXjAG" /f
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\WAB" /v "c1H1JyHa" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\WcmSvc" /v "Tn3iS" /f
  2⤵
  PID:4352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\wfs" /v "9exXT5" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows" /v "ARVZR0" /f
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT" /v "t1fm1jomYqLM" /f
  2⤵
  PID:1280
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script" /v "M8oTPRr0e6FAzwz" /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Search" /v "iLwRDfosp" /f
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Security Health" /v "vGkmY5kinZ" /f
  2⤵
  PID:5456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Wisp" /v "9wGTC2s6a" /f
  2⤵
  PID:3932
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Xbox" /v "dPedIo" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\XboxLive" /v "OTJcJwef0hg0A" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation" /v "9PBkwzFeaKQ" /f
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\Global" /v "kSP3msI6XZMEwGu" /f
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\NVControlPanel2" /v "XSOiiZqTo9VxlS" /f
  2⤵
  PID:204
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Overwolf" /v "QwN3gcifOpKg0" /f
  2⤵
  PID:260
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Overwolf\CEF" /v "60OvE" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Overwolf\Overwolf" /v "zXoaswtGzU6wy9" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\OverwolfPersist" /v "XC9nuPUABJkOmf" /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Policies" /v "O6aMx3QRb0xN" /f
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft" /v "KwO76uAIr" /f
  2⤵
  PID:4184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Policies\Power" /v "M08iYfRYDL" /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications" /v "sE9f6ebsOTWb" /f
  2⤵
  PID:200
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation" /v "aw4Ee2fgW" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Environments" /v "5F6wvy" /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Settings" /v "wYsVx5W0yG8" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Spotify" /v "dSIiwEtLHXVZsOb" /f
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Spotify\Window Position" /v "pNpLPnVhxSPRW" /f
  2⤵
  PID:1848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Sysinternals" /v "VaDXA" /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Sysinternals\Process Monitor" /v "4bWozXys0Q" /f
  2⤵
  PID:5824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Sysinternals\VolumeID" /v "U5Qe8dZhX63" /f
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\SystemInformation" /v "Y20H08Xwi0at2j" /f
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft" /v "ixWgo" /f
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft\Launcher" /v "58Tp9dlF4BG5xML" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft\Rainbow Six - Siege" /v "0dLL7FNP3EehjT" /f
  2⤵
  PID:5132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Ubisoft\Uplay" /v "BtHa9qrMZEYnTQ" /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Valve" /v "JgNakyOO9TJXQX" /f
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Valve\Steam" /v "aTG2C7Qia3eeM" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Verse" /v "Pm2YQ" /f
  2⤵
  PID:2836
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Windscribe" /v "pMXD22rqy" /f
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Windscribe\Installer" /v "jkOCjQJ0c" /f
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Windscribe\Windscribe2" /v "tZ8rqYI0jH" /f
  2⤵
  PID:3076
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR" /v "OqjGagEu75Im" /f
  2⤵
  PID:5212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory" /v "Tp0KVDibIRx" /f
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory" /v "o8LXY4dLywY" /f
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList" /v "q5Tx60luda1x" /f
  2⤵
  PID:2432
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\General" /v "dX1KlWXtq" /f
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface" /v "95SzkXT8ZpDQj" /f
  2⤵
  PID:5648
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Profiles" /v "bJXpgSkSjB" /f
  2⤵
  PID:5688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "mdPcNj711hz" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX" /v "4yfm8dE4WK2" /f
  2⤵
  PID:5012
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Wow6432Node" /v "1JOkib5I5qY2lF" /f
  2⤵
  PID:3368
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft" /v "0GIsFTnTZSg06VD" /f
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes" /v "jBRZVStd" /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\*" /v "kG1BZU" /f
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3fr" /v "m7raLU" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3g2" /v "5ieeI8tYWmFGzu" /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp" /v "UFl0XjDq" /f
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gp2" /v "4JSgVS0q" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3gpp" /v "gaixwB9dyC" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.3mf" /v "1o6yALK" /f
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.aac" /v "x6mMA0N7j" /f
  2⤵
  PID:1404
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ac3" /v "PEPp1ZNxGFFh" /f
  2⤵
  PID:828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adt" /v "8VVWnEzSJ" /f
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.adts" /v "owgmHlpblyDw" /f
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.agent" /v "5PlbWG9mVUhDpT" /f
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.all" /v "HuylQvPuof" /f
  2⤵
  PID:3124
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.amr" /v "WaDDx47Sf" /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appinstaller" /v "9YDQSYwvle" /f
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appx" /v "8B9EZ" /f
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.appxbundle" /v "cPG0rNljM2zbn" /f
  2⤵
  PID:4532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.ari" /v "T0P5A2R8GpaaiW" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.arw" /v "1SH4aSk6eX" /f
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.asf" /v "WDPotZIWI7qF4" /f
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avci" /v "FxR6NBB3m" /f
  2⤵
  PID:3232
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avi" /v "VBLAljp" /f
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.avif" /v "OIb5anh2CV" /f
  2⤵
  PID:2464
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bay" /v "nLjBsORXtJTrPEv" /f
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.bmp" /v "Z8pHG8v" /f
  2⤵
  PID:6132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.c5e2524a-ea46-4f67-841f-6a9465d9d515" /v "P2Hfo" /f
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cap" /v "oH1PmUbEzvO2D" /f
  2⤵
  PID:4944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cda" /v "qQfhtdHTwRWUvJ" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.copilot" /v "jqhEfxVJ" /f
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr2" /v "8fszd" /f
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.cr3" /v "6SiqR" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.crw" /v "vDgj5ogq" /f
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcr" /v "iKDG0mzm" /f
  2⤵
  PID:6140
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.dcs" /v "tXhWmqf" /f
  2⤵
  PID:3900