Start::
CloseProcesses:

DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5C3080FA-3025-4557-82CF-6CB6BE4F8023}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2876080489-3539902638-2428979005-1001\Products\AF0803C55203755428FCC66BEBF40832
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\EC82A6A70D625B34FB9528C48E7988C7
C:\Windows\Installer\e618b99.msi

2026-09-03 22:01 - 2026-09-03 22:01 - 000002671 _____ C:\Users\Alesya\AppData\LocalLow\8236bb758eddd26d9044584b1416fbc8d46224c3ce543c7ad6911e239e0eb46e
2026-09-03 22:00 - 2026-09-03 22:02 - 000298529 _____ C:\Users\Alesya\AppData\LocalLow\ac32cc841128ef2380132355a6f941f25e9afb83c03e9812659b18d35e892e5a
2026-09-03 22:00 - 2026-09-03 22:00 - 000044231 _____ C:\Users\Alesya\AppData\LocalLow\ed8b7e4b70c4b17772c3fb0ab7aa74c037b10453df3697e78a448cecf3cc1d97
2026-09-03 21:41 - 2026-09-03 21:41 - 000019299 _____ C:\Users\Alesya\AppData\LocalLow\3e5be57079df60f61843bcdc5533c21c06047b025dc7579ef5297b619b20571b
2026-09-03 21:35 - 2026-09-03 22:00 - 000052660 _____ C:\Users\Alesya\AppData\LocalLow\ef6a0fd7581a55f0adaf312f91f52d80692b0d74c03e90b73a2c67b408a75f2f
CustomCLSID: HKU\S-1-5-21-2876080489-3539902638-2428979005-1001_Classes\CLSID\{C24CF5F9-8800-4DDF-8730-16F925A88A1B}\localserver32 -> C:\Users\Alesya\AppData\Local\Temp\odis_download_dest\7872930049787659888\Setup\ui-launcher\AdskAccessUIHost.exe => No File
FirewallRules: [{00CE56D9-9490-4EA0-B447-E00FC57B875F}] => (Allow) C:\Users\Alesya\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe => No File
FirewallRules: [TCP Query User{38C813DE-64AF-4FCD-AFDA-7B245EB96011}C:\users\alesya\appdata\local\medal\app-2616.122.1\medal.exe] => (Allow) C:\users\alesya\appdata\local\medal\app-2616.122.1\medal.exe => No File
FirewallRules: [UDP Query User{E54DD746-6B5D-4C39-A5BF-ABCB2C8CE482}C:\users\alesya\appdata\local\medal\app-2616.122.1\medal.exe] => (Allow) C:\users\alesya\appdata\local\medal\app-2616.122.1\medal.exe => No File
FirewallRules: [{3DB52020-8607-4B6D-952B-911D1CB804E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Yume Nikki\yumenikki\RPG_RT.exe => No File
FirewallRules: [{2284E1B1-2FF3-4DCC-8219-11E4AE1D53E0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Yume Nikki\yumenikki\RPG_RT.exe => No File
FirewallRules: [{98B73A5B-EFA1-4AC8-8311-3FBDD3BCF280}] => (Allow) C:\Program Files\Cakewalk\Shared Utilities\StartPage\CakewalkStartScreen.exe => No File
FirewallRules: [{5C38359E-BC89-45F1-9240-65622AEC29FC}] => (Allow) C:\Program Files\Cakewalk\Shared Utilities\StartPage\CakewalkStartScreen.exe => No File
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION

StartPowerShell:
# This snippet uses Sysinternals Sigcheck to upload file on VirusTotal.
# Change the line containing the string "INSERTFILEPATHHERE" to the desired filepath
# ---
# It displays the following: entropy, file hashes, catalog name & signing chain, VirusTotal scan results and link to it.
# It is also able to traverse symbolic links and directory junctions.
# ---
# NOTE: If the file is not known prior, it gets uploaded to VirusTotal and the result will be available in a few minutes. 
#       You can search up the report by visiting the URL "https://www.virustotal.com/gui/file/<SHA256>"
$TempDir = [System.IO.Path]::GetTempPath()
$ZipPath = Join-Path $TempDir "SigcheckFRST.zip"
$ExtractPath = Join-Path $TempDir "SigcheckFRST"
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Sigcheck.zip" -OutFile $ZipPath -UseBasicParsing
if (Test-Path $ExtractPath) { Remove-Item $ExtractPath -Recurse -Force }
Expand-Archive -Path $ZipPath -DestinationPath $ExtractPath -Force
$SigcheckExe = Join-Path $ExtractPath "sigcheck.exe"
if (Test-Path $SigcheckExe) {
    $psi = New-Object System.Diagnostics.ProcessStartInfo
    $psi.FileName = $SigcheckExe
    $psi.Arguments = '-accepteula -a -h -i -m -l -vt -vs -nobanner "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe
"'
    $psi.RedirectStandardOutput = $true
    $psi.StandardOutputEncoding = [System.Text.Encoding]::Unicode
    $psi.UseShellExecute = $false
    $psi.CreateNoWindow = $true
    $p = [System.Diagnostics.Process]::Start($psi)
    $output = $p.StandardOutput.ReadToEnd()
    $p.WaitForExit()
    Write-Output $output
} else {
    Write-Host "Error: Sigcheck does not exist"
}
Remove-Item $ZipPath -Force
EndPowerShell:


EmptyTemp:

End::