Start::
CloseProcesses:

CustomCLSID: HKU\S-1-5-21-699025938-3818395997-3756346237-1001_Classes\CLSID\{50726f74-6f6e-2e56-504e-000000000000}\localserver32 -> "C:\Program Files\Proton\VPN\v3.5.1\ProtonVPN.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-699025938-3818395997-3756346237-1001_Classes\CLSID\{5C4D8D77-5B87-40CA-884E-F56858227E5C}\localserver32 -> C:\Users\piper\AppData\Local\Programs\TeamSpeak\notification_helper.exe => No File
CustomCLSID: HKU\S-1-5-21-699025938-3818395997-3756346237-1001_Classes\CLSID\{8B1F50F0-32C9-4F30-A3DB-A813176C961D}\localserver32 -> "c:\program files\musehub\current\musehub.exe" ----AppNotificationActivated: => No File
AlternateDataStreams: C:\WINDOWS\tracing:? [16]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhjjiihq [0]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhjkiihj [0]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`pgyih [0]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`vovtfe.qpsu.obnfih [0]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`vovtfe.qpsu.obnfjhjjiihq [0]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`vovtfe.qpsu.obnfjhjkiihj [0]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NZXT CAM.lnk:AB04221C49 [3442]
AlternateDataStreams: C:\Users\piper\Application Data:a4f3a4460331e5db92483d18f7474c91 [394]
AlternateDataStreams: C:\Users\piper\AppData\Roaming:a4f3a4460331e5db92483d18f7474c91 [394]
FirewallRules: [{9AE40562-448B-4954-B574-19B3B1EE6E2F}] => (Allow) X:\SteamLibrary\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File
FirewallRules: [{39558BAF-9462-4E5C-8F70-8E03B1AEE368}] => (Allow) X:\SteamLibrary\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File
FirewallRules: [{1EBA3904-B23B-48A8-88DD-BB8311776B5D}] => (Allow) X:\SteamLibrary\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe => No File
FirewallRules: [{27EEE2EE-3F8C-453F-9B72-1E6975813F79}] => (Allow) X:\SteamLibrary\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe => No File
FirewallRules: [{399E78F8-5D4E-4D2D-A908-A35234D71BAB}] => (Allow) X:\SteamLibrary\steamapps\common\Rusty's Retirement\RustyLauncher.exe => No File
FirewallRules: [{A4F7CC6F-3B3E-4B35-A124-355C16B575B5}] => (Allow) X:\SteamLibrary\steamapps\common\Rusty's Retirement\RustyLauncher.exe => No File
FirewallRules: [{74FF180F-B007-4F7A-AB7C-884E3A3D9C9B}] => (Allow) X:\SteamLibrary\steamapps\common\Goose Goose Duck\GGDLauncher.exe => No File
FirewallRules: [{A7F7EE9F-BED9-4BFF-BBCA-10AF00F9D33E}] => (Allow) X:\SteamLibrary\steamapps\common\Goose Goose Duck\GGDLauncher.exe => No File
FirewallRules: [{B9F8E4B6-AD5D-4DE7-9FEB-098442B8E019}] => (Allow) X:\SteamLibrary\steamapps\common\Travellers Rest\Windows\TravellersRest.exe => No File
FirewallRules: [{436BFA3C-E42F-481B-BD77-FDD95ED13060}] => (Allow) X:\SteamLibrary\steamapps\common\Travellers Rest\Windows\TravellersRest.exe => No File
FirewallRules: [{018627A4-83D4-433F-90D0-9CFC6B9A668F}] => (Allow) X:\SteamLibrary\steamapps\common\Monster Hunter World\MonsterHunterWorld.exe => No File
FirewallRules: [{5E5650AC-7F8E-47A7-B5F7-529A12A96BC0}] => (Allow) X:\SteamLibrary\steamapps\common\Monster Hunter World\MonsterHunterWorld.exe => No File
FirewallRules: [{F9FEDB9F-BE1B-4162-AB42-4FFE26EAA69A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Car Mechanic Simulator 2021 Demo\playway-launcher-win32-ia32\playway-launcher.exe => No File
FirewallRules: [{22720A5A-9D88-4EAC-91C4-0BA7D871114C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Car Mechanic Simulator 2021 Demo\playway-launcher-win32-ia32\playway-launcher.exe => No File
FirewallRules: [{16005321-C04D-481D-906C-95A9FCC9A762}] => (Allow) C:\Program Files\Topaz Labs LLC\Topaz Video Enhance AI\Topaz Video Enhance AI.exe => No File
FirewallRules: [{86927E20-33D6-46E6-846A-601F5F7D47A4}] => (Allow) C:\Program Files\Topaz Labs LLC\Topaz Video Enhance AI\Topaz Video Enhance AI.exe => No File
FirewallRules: [{5E36B535-E2DD-44FE-AAB9-6B9E0A905202}] => (Allow) C:\Program Files\Topaz Labs LLC\Topaz Video Enhance AI\Topaz Video Enhance AI.exe => No File
FirewallRules: [{2B363A16-FA9A-4D35-9CB3-8C13C42C8F83}] => (Allow) C:\Program Files\Topaz Labs LLC\Topaz Video Enhance AI\Topaz Video Enhance AI.exe => No File
FirewallRules: [{424A1415-EDA0-423F-BEE0-FADEF689DA4E}] => (Allow) C:\Program Files\Audials\Audials 2024\Audials.exe => No File
FirewallRules: [{73486449-C292-4360-8A1B-759E75679D9C}] => (Allow) X:\SteamLibrary\steamapps\common\PlateUp\PlateUp\PlateUp.exe => No File
FirewallRules: [{93ECAC94-7773-4DEC-AD92-141416F1E877}] => (Allow) X:\SteamLibrary\steamapps\common\PlateUp\PlateUp\PlateUp.exe => No File
FirewallRules: [{AF183771-F901-4F45-96BB-B2AACA0526E5}] => (Allow) X:\SteamLibrary\steamapps\common\Enshrouded\enshrouded.exe => No File
FirewallRules: [{C02C03DF-20F9-46BD-8968-D8B498E3BEFA}] => (Allow) X:\SteamLibrary\steamapps\common\Enshrouded\enshrouded.exe => No File
FirewallRules: [{0B31576F-21AA-4955-A013-0B62A567061F}] => (Allow) X:\SteamLibrary\steamapps\common\Marvel's Spider-Man Remastered\Spider-Man.exe => No File
FirewallRules: [{6B2EC679-2F6E-4F57-812A-3417F07A2E9E}] => (Allow) X:\SteamLibrary\steamapps\common\Marvel's Spider-Man Remastered\Spider-Man.exe => No File
FirewallRules: [{077C592D-D5F9-44D0-A82B-904E18906BC4}] => (Allow) X:\SteamLibrary\steamapps\common\Mark of the Ninja Remastered\bin\Ninja.exe => No File
FirewallRules: [{0CD71D91-1E0A-4D66-8E0A-172BFA2757FA}] => (Allow) X:\SteamLibrary\steamapps\common\Mark of the Ninja Remastered\bin\Ninja.exe => No File
FirewallRules: [{A75DE0E3-39FB-4C45-8EDA-3582047B9D43}] => (Allow) C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe => No File
FirewallRules: [{4C87D24F-0839-4883-970A-FB17E0F80446}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File
FirewallRules: [{FE444656-9A0F-45E4-87FC-B3EFAA1243BD}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File
FirewallRules: [{8B58BAAF-E378-4013-9752-29104669783F}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File
FirewallRules: [{83245CB2-574C-43A2-975A-3A46D7031220}] => (Allow) X:\SteamLibrary\steamapps\common\dont_starve\bin\dontstarve_steam.exe => No File
FirewallRules: [{7AAAD85D-EDFF-4CC6-9CB6-45C579855D67}] => (Allow) X:\SteamLibrary\steamapps\common\dont_starve\bin\dontstarve_steam.exe => No File
FirewallRules: [{521E53BA-9460-4FFF-8817-A1DF9EA81F0C}] => (Allow) X:\SteamLibrary\steamapps\common\Magicka 2\engine\Magicka2.exe => No File
FirewallRules: [{7489381D-8C7D-486D-8569-A979873821B9}] => (Allow) X:\SteamLibrary\steamapps\common\Magicka 2\engine\Magicka2.exe => No File
FirewallRules: [{1BC8B8D0-F1A7-484F-B2A0-F107EF5EC0E7}] => (Allow) X:\SteamLibrary\steamapps\common\Rise of the Tomb Raider\ROTTR.exe => No File
FirewallRules: [{3BF37059-6D61-4B5F-9777-EB50502212D1}] => (Allow) X:\SteamLibrary\steamapps\common\Rise of the Tomb Raider\ROTTR.exe => No File
FirewallRules: [{86BE66DB-54AD-4AB4-8A19-1B8B05B82C77}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Settlement Survival\URP\Settlement SurvivalURP.exe => No File
FirewallRules: [{8D752894-E050-4E39-913F-BA3584A40BC6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Settlement Survival\URP\Settlement SurvivalURP.exe => No File
FirewallRules: [{B9E80D7A-E178-44C0-8965-884DA8F04499}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Settlement Survival\Settlement Survival.exe => No File
FirewallRules: [{58144653-677E-488A-AF09-A29B00106A75}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Settlement Survival\Settlement Survival.exe => No File
FirewallRules: [{838C6C72-D9DB-40F9-98A1-F46BC9100C77}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{65B12BA6-7FC9-4BA8-BAB4-2E88931C5A88}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{BDF99ED3-72C5-400E-AE6C-B0359C3A8996}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{2C9992EA-C691-4E94-8CD6-15B33619369C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{0AFFEA22-3A69-4D95-B9C4-438A586F9863}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{C52BB3FB-3E88-426A-BF70-EFE6E8518024}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{9B5956F1-0FB4-49DF-A346-23F28A0CEDCA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{2A85DAE7-88C5-4D81-A781-75B913DA330F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{EC1C1DA7-721B-4354-9C57-0FB388076605}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sons Of The Forest\SonsOfTheForest.exe => No File
FirewallRules: [{9CD672B6-95B7-48BD-AF90-BB71AEB29C4B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sons Of The Forest\SonsOfTheForest.exe => No File
FirewallRules: [{3FA43E58-CE70-4932-8CF0-8CC4669B4CD6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File
FirewallRules: [{B4676D72-9644-4920-A0D7-931AE304F462}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File
FirewallRules: [{A4ACAEB3-29EB-400F-AEF7-9EBC6599ABB6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe => No File
FirewallRules: [{7292CD83-70B9-4404-B89D-D2E54E738B26}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe => No File
FirewallRules: [{146605BD-CA6F-4CC0-A35B-02A188DF20B7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stardew Valley\Stardew Valley.exe => No File
FirewallRules: [{87CD28B6-00E8-4113-A775-53F26BCE8234}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stardew Valley\Stardew Valley.exe => No File
FirewallRules: [{0B2F1A44-6DD0-49B2-B173-1E18C2653754}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe => No File
FirewallRules: [{42F423D4-AB30-40DC-ACE6-6E6108578D6D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe => No File
FirewallRules: [{8038CEF5-DF31-49E3-8B39-57AEA31F0FED}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Red Dead Redemption 2\PlayRDR2.exe => No File
FirewallRules: [{A7977611-D214-4145-85C9-4C56567F559F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Red Dead Redemption 2\PlayRDR2.exe => No File
FirewallRules: [{7B89759A-2011-4F68-8428-523B625E0E8F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Satisfactory\FactoryGame.exe => No File
FirewallRules: [{61E61D3F-119A-4811-8855-6C8F652D70AC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Satisfactory\FactoryGame.exe => No File
FirewallRules: [{5F0B5C85-412C-48C8-86AB-B99D625F3C53}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Raft\Raft.exe => No File
FirewallRules: [{90E5681D-25EF-483C-B5AF-E8109EF97F18}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Raft\Raft.exe => No File
FirewallRules: [UDP Query User{53367687-0ECE-4274-899E-DB14A8256672}C:\program files (x86)\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe => No File
FirewallRules: [TCP Query User{8C6DC64D-C88D-4E57-B062-8B7B9BDA6263}C:\program files (x86)\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe => No File
FirewallRules: [{3B12B8F9-1DBA-45C7-BB8D-EF5E32D060D4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ASTRONEER\Astro.exe => No File
FirewallRules: [{1E8A708E-EFE6-4A09-A65C-AA71F6E3EE3B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ASTRONEER\Astro.exe => No File
FirewallRules: [{6FD87CA4-1EFF-456E-9CB4-4C1C313EFC8A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Craftopia\Craftopia.exe => No File
FirewallRules: [{3D7BCE68-2062-4103-9E55-C019FEEE1C01}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Craftopia\Craftopia.exe => No File
FirewallRules: [{6D95EB44-8A5D-4427-8420-91CF2D48BDFA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Planet Crafter\Planet Crafter.exe => No File
FirewallRules: [{89D249EF-F28F-4FED-BF31-836B1E4B8CC5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Planet Crafter\Planet Crafter.exe => No File
FirewallRules: [{46A8B1BF-75E8-4591-B0B2-D13C367488C1}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{2B9DA88C-99E7-45E2-970D-C3D2F880694B}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{1D957A88-A3B8-496F-B4B7-7010EC2529C7}] => (Allow) Z:\SteamLibrary\steamapps\common\Cities Skylines II\Launcher\dowser.exe => No File
FirewallRules: [{9BAB6DCF-C6B9-4F4C-ACE1-ED64DFEF3083}] => (Allow) Z:\SteamLibrary\steamapps\common\Cities Skylines II\Launcher\dowser.exe => No File
FirewallRules: [{E6ECE330-B36C-427C-B4ED-0057023EE691}] => (Allow) X:\SteamLibrary\steamapps\common\Viscera\Binaries\UDKLift.exe => No File
FirewallRules: [{039A01CB-865D-4FC0-81F1-1136F68FB81D}] => (Allow) X:\SteamLibrary\steamapps\common\Viscera\Binaries\UDKLift.exe => No File
FirewallRules: [{C512B137-D0C1-4B6B-B3D1-47A77F322E8C}] => (Allow) X:\SteamLibrary\steamapps\common\Leaf it Alone\Leaf it Alone.exe => No File
FirewallRules: [{5CF9266D-E4D8-4E1D-80F3-08AF8F84C99D}] => (Allow) X:\SteamLibrary\steamapps\common\Leaf it Alone\Leaf it Alone.exe => No File
FirewallRules: [{F11E8078-5F89-4B40-B8B9-9D5DFA114A2D}] => (Allow) X:\Hytale\install\pre-release\package\game\latest\Client\HytaleClient.exe => No File
FirewallRules: [{21D22A00-370B-413B-9C4E-0C9C2529963F}] => (Allow) X:\Hytale\install\pre-release\package\game\latest\Client\HytaleClient.exe => No File
FirewallRules: [{1C7344CF-0CB6-4589-9DB1-1C560B0E55F3}] => (Allow) X:\Hytale\install\pre-release\package\jre\latest\bin\java.exe => No File
FirewallRules: [{67AF9073-4496-478C-9408-9A984A06E56B}] => (Allow) X:\Hytale\install\pre-release\package\jre\latest\bin\java.exe => No File
FirewallRules: [{8FB81670-6EF8-4ED7-A9AB-0718266C7778}] => (Allow) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File
FirewallRules: [{134D1049-D086-45E9-A956-9D39BF9C49C9}] => (Allow) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File
FirewallRules: [{9B5548C2-0707-4453-9B17-E207C96A63E5}] => (Block) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File
FirewallRules: [{C268FDCD-6D10-4533-95A8-E1ED730D61FF}] => (Block) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
Task: {A7113C03-899F-4370-A437-AEC3D5DE2872} - \GoogleUpdate -> No File <==== ATTENTION
Task: {FD6F4E7B-F859-4025-A71C-17412B86EA95} - System32\Tasks\Microsoft\Office\Office Serviceability Manager => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\officesvcmgr.exe  /checkin (No File)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {D8AC8EFD-68F6-47C1-B498-784ED4B35A35} - System32\Tasks\Red Giant Link => "C:\Program Files\Red Giant Link\Red Giant Link.exe"  --silent (No File)
2026-05-14 12:36 - 2026-05-14 12:36 - 000000000 ____D C:\Users\piper\AppData\Local\22bfc34d90b64054809542014fc9eb32
2025-11-15 18:15 - 2025-11-15 18:15 - 000000048 ____R () C:\Users\piper\AppData\Local\41A8E72215BA6F875283828CEBD2661B

HKU\S-1-5-21-699025938-3818395997-3756346237-1001\...\Policies\system: [shell] explorer.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION

File: C:\WINDOWS\System32\drivers\webshieldfilter.sys
File: C:\WINDOWS\SysWOW64\muachost.exe

Folder: C:\Users\piper\AppData\Local\ServiceApp

Comment: This snippet reverts SmartScreen settings to default
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"SmartScreenEnabled"="Warn"

[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter]
"EnabledV9"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppHost]
"EnableWebContentEvaluation"=dword:00000001

[HKU\S-1-5-21-699025938-3818395997-3756346237-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost]
"EnableWebContentEvaluation"=dword:00000001

EndRegedit:

StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

StartPowerShell:
# Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console
# Does not clean preinstalled objects, only PUP/Adware
# If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument
# If you would like to only scan with it, change the argument from /clean to /scan
# NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software.
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:

Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code.
Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) }


Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z

Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy

Comment: System repair commands
CMD: DISM.exe /Online /Cleanup-image /Restorehealth
CMD: SFC.exe /scannow

Comment: Network reset commands
CMD: netsh int ip reset
CMD: netsh int ipv6 reset
CMD: ipconfig /flushDNS
CMD: netsh winsock reset catalog

Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Users\CurrentUserName\AppData\Local\Temp\*
C:\Windows\Temp\*
C:\Windows\SystemTemp\*

EmptyTemp:
End::