GootloaderCyberChef-Stage1.recipie

Comment('This recipe takes a .reg export file (HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Phone\\%username%0) as input.\n\n\nRemove unnecessary characters')
Remove_null_bytes()
Find_/_Replace({'option':'Regex','string':'(.*Windows Registry Editor.*)|(.*HKEY_CURRENT_USER.*)'},'',true,true,false,false)
Comment('Get only the reg data (assumes that the export is in alphabetical order[it should be by default])')
Find_/_Replace({'option':'Regex','string':'"\\d{1,3}"\\="(.*)"'},'$1',true,false,true,false)
Remove_whitespace(true,true,true,true,true,false)
Comment('Replace text per obfuscation script')
Find_/_Replace({'option':'Simple string','string':'#'},'1000',true,false,true,false)
Comment('Output from hex + optional MD5')
From_Hex('Auto')
MD5(/disabled)