Deletion of all registry keys associated with the extraction of the SFX RAR Deletion of the User Assist Key entries related to applications that have been recently executed Deletion of all registry keys relating to services that have recently run  Clearly the attacker using this PlugX is paranoid about it being detected on disk, both in the registry and the file system