Start::
CloseProcesses:

Comment: Minecraft1.7.7

2026-08-21 21:20 - 2026-08-21 21:20 - 000000000 ____D C:\Users\Ema\AppData\Local\Yandex
2026-08-21 21:05 - 2026-08-22 18:32 - 000000000 ____D C:\ProgramData\storage_analyzer_v3_0
2026-08-21 21:05 - 2026-08-21 21:05 - 000000000 ____D C:\Users\Ema\AppData\Roaming\storage_analyzer_v3_0
HKU\S-1-5-21-427408945-1014152505-613106573-1001\...\Run: [MicrosoftEdgeAutoLaunch_AF3BA6E465FE3EC1761C0B890D8E7DB2] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --win-session-start [5018440 2026-08-20] (Microsoft Corporation -> Microsoft Corporation)
2026-08-21 21:03 - 2026-08-21 21:03 - 000000000 ____D C:\Users\Ema\AppData\Roaming\RenPy
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_431\bin\ssv.dll [2024-09-30] (Oracle America, Inc. -> Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_431\bin\jp2ssv.dll [2024-09-30] (Oracle America, Inc. -> Oracle Corporation)
IE trusted site: HKU\S-1-5-21-427408945-1014152505-613106573-1001\...\webcompanion.com -> hxxp://webcompanion.com
PowerShell: Remove-MpPreference -ExclusionPath "C:\Program Files\Rockstar Games"
HKU\S-1-5-21-427408945-1014152505-613106573-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_AF3BA6E465FE3EC1761C0B890D8E7DB2"
HKU\S-1-5-21-427408945-1014152505-613106573-1001\...\StartupApproved\Run: => "Web Companion"
Task: {8D0BF0EE-0F37-4396-9457-4858F56711D6} - System32\Tasks\ASUS\AcPowerNotification => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AcPowerNotification\AcPowerNotification.exe  (No File)
Task: {B8A27D80-E630-4694-8BB6-A6C728A298B3} - System32\Tasks\ASUS\ArmourySocketServer => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\TaskSchedulerTool_ArmourySocketServer.exe  (No File)
Task: {F36AFD5D-5F07-4C6D-B484-399A5D29ACB0} - System32\Tasks\ASUS\Framework Service => C:\Program Files (x86)\ASUS\ArmouryDevice\TaskSchedulerTool_asus_framework.exe  --delay (No File)
Task: {C6CEED3F-5AC8-4545-8D44-9A18003D4AA5} - System32\Tasks\ASUS\NoiseCancelingEngine => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\MBLedSDK\NoiseCancelingEngine.exe  (No File)
Task: {6D3B974A-E596-4127-A1E7-6F5BCBACD496} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe  (No File)
Task: {726E0291-D8CD-45ED-8ED8-4704CE930D89} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem142.0.7416.0{6E699316-C214-4E6A-BD14-D3DA9D4ECCD6} => "C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0\updater.exe"  --wake --system (No File)
Task: {D6CAC83C-F7A2-4017-A5A1-A4953195F171} - System32\Tasks\Microsoft\Windows\Clip\ClipESU => %SystemRoot%\system32\clipesu.exe  (No File)
Task: {8C121AE6-BC8A-4C7C-B600-318AC06A937A} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumer => %SystemRoot%\system32\ClipESUConsumer.exe  -evaluateEligibility (No File)
Task: {3258CC39-EC17-41B0-9973-20C5A85E3363} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumerProcessECUpdate => %SystemRoot%\system32\ClipESUConsumer.exe  -persistEligibilityStatus (No File)
Task: {4594BAB3-A5B8-4051-BFEF-119F004157CC} - System32\Tasks\Microsoft\Windows\Clip\ClipEsuConsumerProcessPreOrder => %SystemRoot%\system32\ClipESUConsumer.exe  -postProcessPreOrder (No File)
Task: {CB58C020-5F9F-4CEC-B07F-BBC6E64F0039} - System32\Tasks\Microsoft\Windows\Clip\ClipEsuConsumerProcessRefund => %SystemRoot%\system32\ClipESUConsumer.exe  -processRefund (No File)
Task: {9F94F225-864F-4227-8DE4-5E12510B57ED} - System32\Tasks\Microsoft\Windows\Clip\EnableClipESU => %SystemRoot%\system32\clipesu.exe  -e (No File)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {65DBF248-5339-46D5-9C6E-CAEB80E56590} - System32\Tasks\Microsoft\Windows\Setup\SnapshotCleanupTask => C:\Windows\System32\OOBE\SetupPlatform\SetupPlatform.exe  -removesnapshot (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {A0F6A1FF-8755-415B-A9B8-36225C8C4718} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval => %systemroot%\system32\MusNotification.exe  Display (No File)
Task: {B665C626-0C89-4442-A537-3321E7B19D6B} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {BE3524C6-C59E-4C8D-BD42-D21C237DEE40} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {BFE47E48-1E3B-4DE8-9724-78254E53EA20} - System32\Tasks\Opera scheduled Autoupdate 1692645542 => C:\Users\Ema\AppData\Local\Programs\Opera\launcher.exe  --scheduledautoupdate $(Arg0) (No File)
FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll [No File]
FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll [No File]
S3 BEDaisy; \??\C:\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys (No File)
S3 EAAntiCheat; system32\drivers\eaanticheat.sys (No File)
S3 HWiNFO_215; \??\C:\Users\Ema\AppData\Local\Temp\HWiNFO_x64_215.sys (No File) <==== ATTENTION
S3 ORingDrv; \??\C:\Users\Ema\AppData\Local\Temp\OCCT\ORing\ORingDrv.sys (No File) <==== ATTENTION
2026-08-20 16:31 - 2026-08-20 16:31 - 000000048 ____R C:\Users\Ema\AppData\Local\AB94542F5FADE6F8B81D4B79C11311EF
2026-05-22 17:36 - 2026-05-22 17:36 - 000000048 ____R () C:\Users\Ema\AppData\Local\0119AC2FC90D95AC063B177717B7B3B6
2026-08-20 16:31 - 2026-08-20 16:31 - 000000048 ____R () C:\Users\Ema\AppData\Local\AB94542F5FADE6F8B81D4B79C11311EF
CustomCLSID: HKU\S-1-5-21-427408945-1014152505-613106573-1001_Classes\CLSID\{1dcb280c-9699-aefe-803c-2007c35cbb5a}\localserver32 -> "C:\Program Files\Proton\Drive\ProtonDrive.exe" -ToastActivated => No File
ContextMenuHandlers3-x32: [FAExt] -> {05672D66-9736-42F5-8BEB-FA1DD3CA51C4} => C:\PROGRA~2\FILEAS~1\FILEAS~1.DLL -> No File
FirewallRules: [{1FC3516E-97D5-456E-8670-B36D966F8D53}] => (Allow) C:\Users\Ema\AppData\Local\Packages\B9ECED6F.ArmouryCrate_qmba6cd70vzyy\LocalState\GridUpdateFile\ASUSGCDriverUpdateClient.exe => No File
FirewallRules: [{D12A6FF5-72DB-46C8-98CF-6AC4651C0B3E}] => (Allow) C:\Users\Ema\AppData\Local\Programs\Opera\101.0.4843.58\opera.exe => No File
FirewallRules: [{790F80D9-8BCD-41C1-93CC-EDA7B52E4729}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{0F9FAE52-9073-40E9-A0A2-13A80AB80E91}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [TCP Query User{E24A371A-37F9-45FF-A4BE-57C066D7D9D9}C:\program files\ea games\star wars squadrons\starwarssquadrons.exe] => (Allow) C:\program files\ea games\star wars squadrons\starwarssquadrons.exe => No File
FirewallRules: [UDP Query User{608C1F64-E2C8-412D-B64A-82D8524B7ACE}C:\program files\ea games\star wars squadrons\starwarssquadrons.exe] => (Allow) C:\program files\ea games\star wars squadrons\starwarssquadrons.exe => No File
FirewallRules: [TCP Query User{AD95DBC2-EE3E-4BD4-925C-99C1F89189DA}C:\users\ema\downloads\cyberpunk.2077.v1.63.hotfix.1\cyberpunk.2077.v1.63.hotfix.1\game\bin\x64\cyberpunk2077.exe] => (Allow) C:\users\ema\downloads\cyberpunk.2077.v1.63.hotfix.1\cyberpunk.2077.v1.63.hotfix.1\game\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [UDP Query User{FB2F2034-A591-4CB7-89CC-5A34CB9A4B7C}C:\users\ema\downloads\cyberpunk.2077.v1.63.hotfix.1\cyberpunk.2077.v1.63.hotfix.1\game\bin\x64\cyberpunk2077.exe] => (Allow) C:\users\ema\downloads\cyberpunk.2077.v1.63.hotfix.1\cyberpunk.2077.v1.63.hotfix.1\game\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [{A1094255-F760-4997-9782-E63E5D2005DF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wallpaper Alive\wallpaper_service\WallpaperAlive.exe => No File
FirewallRules: [{433C1B91-8B37-441C-A500-7A45805A9C31}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wallpaper Alive\wallpaper_service\WallpaperAlive.exe => No File
FirewallRules: [{813BB7ED-69D3-468F-A1BF-2857B64F69D9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wallpaper Alive\config_service\WallpaperAliveMenu.exe => No File
FirewallRules: [{D24F4470-5AF5-46D7-BB89-08EA9EF317DE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wallpaper Alive\config_service\WallpaperAliveMenu.exe => No File
FirewallRules: [{DB44BFB8-E1E4-408B-AFB1-45C1FBD6DF61}] => (Allow) C:\Program Files (x86)\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe => No File
FirewallRules: [{955FA89F-E4A3-4C9C-A2A5-3E171946B4DA}] => (Allow) C:\Program Files (x86)\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe => No File
FirewallRules: [TCP Query User{9E029885-C48A-42C8-9A55-3CCCB74B2F89}C:\program files\java\jre-1.8\bin\javaw.exe] => (Allow) C:\program files\java\jre-1.8\bin\javaw.exe => No File
FirewallRules: [UDP Query User{46497759-0BE5-4825-B7E2-0E95C25594CA}C:\program files\java\jre-1.8\bin\javaw.exe] => (Allow) C:\program files\java\jre-1.8\bin\javaw.exe => No File
FirewallRules: [TCP Query User{C8B2439A-B3FD-43E4-AB8F-894C67C27308}C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [UDP Query User{EF3E1E01-91ED-49E7-A1FA-8E551974BEF6}C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [TCP Query User{003CAE8B-296A-4024-859B-584396718E46}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe => No File
FirewallRules: [UDP Query User{CA812E03-D38A-4A00-A712-A823FC2D93C4}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe => No File
FirewallRules: [TCP Query User{7E6E5B16-4712-4CAF-A152-038B135A7D76}C:\games\world_of_tanks_eu\win64\worldoftanks.exe] => (Allow) C:\games\world_of_tanks_eu\win64\worldoftanks.exe => No File
FirewallRules: [UDP Query User{5DA8C3C7-43E8-4888-BE35-28171B3135E2}C:\games\world_of_tanks_eu\win64\worldoftanks.exe] => (Allow) C:\games\world_of_tanks_eu\win64\worldoftanks.exe => No File
FirewallRules: [{E13202E9-C291-4BAB-81F7-2762266B17ED}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe => No File
FirewallRules: [{D36ADBF9-0097-4464-888D-072DAD731ADF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe => No File
FirewallRules: [{61E423D0-BC66-4BAD-882D-3265678BAF3F}] => (Allow) C:\Program Files\Easeware\DriverEasy\DriverEasy.exe => No File
FirewallRules: [TCP Query User{68850029-9E16-44B9-B9E1-3CBD9671895A}C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [UDP Query User{501E8332-7914-4F9E-B995-F74CA14E0B76}C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [TCP Query User{A98DC779-DD01-4954-AAF2-C26DEC19EB9C}C:\gog games\cult of the lamb\cult of the lamb.exe] => (Allow) C:\gog games\cult of the lamb\cult of the lamb.exe => No File
FirewallRules: [UDP Query User{C4F1014A-85DB-4F28-8A7F-8D1A2DFC2C5A}C:\gog games\cult of the lamb\cult of the lamb.exe] => (Allow) C:\gog games\cult of the lamb\cult of the lamb.exe => No File
FirewallRules: [TCP Query User{F1F5E5CC-84AE-459C-9628-0AA5CC27D65B}C:\users\ema\downloads\microsoft flight simulator 2020 premium deluxe\flightsimulator.exe] => (Allow) C:\users\ema\downloads\microsoft flight simulator 2020 premium deluxe\flightsimulator.exe => No File
FirewallRules: [UDP Query User{2A338755-C2B0-4523-92C1-6786A37FAB63}C:\users\ema\downloads\microsoft flight simulator 2020 premium deluxe\flightsimulator.exe] => (Allow) C:\users\ema\downloads\microsoft flight simulator 2020 premium deluxe\flightsimulator.exe => No File
FirewallRules: [TCP Query User{53470B2C-3D2F-4731-B4BD-8CB1DAC4D5F1}C:\games\microsoft flight simulator 2020\flightsimulator.exe] => (Allow) C:\games\microsoft flight simulator 2020\flightsimulator.exe => No File
FirewallRules: [UDP Query User{878CAD3D-67E2-4716-99FE-E21F15210206}C:\games\microsoft flight simulator 2020\flightsimulator.exe] => (Allow) C:\games\microsoft flight simulator 2020\flightsimulator.exe => No File
FirewallRules: [TCP Query User{E4F05335-F87E-4BD4-B8D6-6293245D7B97}C:\program files (x86)\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\grand theft auto v\gta5.exe => No File
FirewallRules: [UDP Query User{4A752121-F795-4811-BEA5-E9D7FE065330}C:\program files (x86)\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\grand theft auto v\gta5.exe => No File
FirewallRules: [{5A4D9D8F-494E-4F4C-8124-152476ABB635}] => (Allow) C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe => No File
FirewallRules: [{14D34270-84F9-4463-A0BB-932476F5F38A}] => (Allow) C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe => No File
FirewallRules: [{629810EA-3B82-4EF3-B709-0EE4CEF80444}] => (Allow) C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe => No File
FirewallRules: [{29373CF9-F170-47DF-B5C7-654A96E688E0}] => (Allow) C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe => No File
FirewallRules: [TCP Query User{8EC64DD3-808B-426C-9ECF-32F12804A926}C:\users\ema\documents\grand theft auto v\gta5.exe] => (Allow) C:\users\ema\documents\grand theft auto v\gta5.exe => No File
FirewallRules: [UDP Query User{C58635C3-EEA7-4172-A85C-CB8C3725DF16}C:\users\ema\documents\grand theft auto v\gta5.exe] => (Allow) C:\users\ema\documents\grand theft auto v\gta5.exe => No File
FirewallRules: [TCP Query User{5CA788B8-0DEF-4A93-B4C7-E5E204A9A712}C:\program files (x86)\rockstar games\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\rockstar games\grand theft auto v\gta5.exe => No File
FirewallRules: [UDP Query User{237F195A-C684-42C4-A61E-08A5B17A8693}C:\program files (x86)\rockstar games\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\rockstar games\grand theft auto v\gta5.exe => No File
FirewallRules: [TCP Query User{A9936850-1893-4342-8B59-85886B06882E}C:\users\ema\downloads\red.dead.redemption.2.ultimate.edition.rgl.rip-insaneramzes\red dead redemption 2\rdr2.exe] => (Allow) C:\users\ema\downloads\red.dead.redemption.2.ultimate.edition.rgl.rip-insaneramzes\red dead redemption 2\rdr2.exe => No File
FirewallRules: [UDP Query User{4F5E107A-0D57-4B9C-AFCF-D5DD11C3D6C3}C:\users\ema\downloads\red.dead.redemption.2.ultimate.edition.rgl.rip-insaneramzes\red dead redemption 2\rdr2.exe] => (Allow) C:\users\ema\downloads\red.dead.redemption.2.ultimate.edition.rgl.rip-insaneramzes\red dead redemption 2\rdr2.exe => No File
FirewallRules: [TCP Query User{CF09C572-8D26-4506-9B77-09F60A7A360A}C:\program files (x86)\dodi-repacks\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\dodi-repacks\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [UDP Query User{736B1DB8-0F55-4883-BA5A-330DF50A5542}C:\program files (x86)\dodi-repacks\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\dodi-repacks\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [TCP Query User{A34CE3D9-E2CA-45EA-B21E-80E0DA2620F2}C:\games\kovaaks\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe] => (Allow) C:\games\kovaaks\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe => No File
FirewallRules: [UDP Query User{1D501A9D-6113-438C-B3F0-F81F02013789}C:\games\kovaaks\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe] => (Allow) C:\games\kovaaks\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe => No File
FirewallRules: [{E369F28B-0298-48B1-AE96-C87556F6DC7A}] => (Allow) C:\Games\KovaaKs\FPSAimTrainer\Binaries\Win64\FPSAimTrainer-Win64-Shipping.exe => No File
FirewallRules: [{7BB2D6A2-67ED-41D1-B56C-3A47DFA09189}] => (Allow) C:\Games\KovaaKs\FPSAimTrainer\Binaries\Win64\FPSAimTrainer-Win64-Shipping.exe => No File
FirewallRules: [{0BE5813E-F01E-4E13-9AA5-97CEA3AB7DB9}] => (Allow) C:\Program Files\WindowsApps\DuckDuckGo.DesktopBrowser_0.68.0.0_x64__ya2fgkz3nks94\WindowsBrowser\WebView2\msedgewebview2.exe => No File
FirewallRules: [{1DA1CF0F-C54C-4214-A6DB-D455597CF0B3}] => (Allow) C:\Program Files\WindowsApps\DuckDuckGo.DesktopBrowser_0.68.0.0_x64__ya2fgkz3nks94\WindowsBrowser\WebView2\msedgewebview2.exe => No File
FirewallRules: [{850A3F92-D436-4A27-9B40-DE978746B71D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Apex Legends\EasyAntiCheat_launcher.exe => No File
FirewallRules: [{F0D81A6C-1789-4A02-9A79-6F5999F7F537}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Apex Legends\EasyAntiCheat_launcher.exe => No File
FirewallRules: [{EF1967AD-C1AC-4850-90A1-8FCEF49161E0}] => (Allow) C:\Program Files (x86)\DBSCG FW[JP]\launcher.exe => No File
FirewallRules: [{84515F78-CD26-4A16-801F-849B0364CF0B}] => (Allow) C:\Program Files (x86)\DBSCG FW[JP]\resources\app.asar.unpacked\node_modules\@xsolla\launcher-core-win\bin\LauncherElectron.exe => No File
FirewallRules: [TCP Query User{DCDEE71D-295C-4900-92B1-D2CC4359DFBE}C:\users\ema\appdata\roaming\utorrent\updates\utorrent.exe] => (Block) C:\users\ema\appdata\roaming\utorrent\updates\utorrent.exe => No File
FirewallRules: [UDP Query User{CAC4DFE9-72D4-4247-8E9E-71F740031F24}C:\users\ema\appdata\roaming\utorrent\updates\utorrent.exe] => (Block) C:\users\ema\appdata\roaming\utorrent\updates\utorrent.exe => No File
FirewallRules: [{0CF36FCC-897C-4AAA-A844-5FAF18F289F4}] => (Allow) C:\Program Files\Netmarble\Netmarble Launcher\Netmarble Launcher.exe => No File
FirewallRules: [TCP Query User{2440EF50-7C8B-464B-8739-672C5D1FF2FB}C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [UDP Query User{96036A1A-3C18-4BA2-AB08-8D89B172C130}C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) C:\program files (x86)\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [TCP Query User{9D4F6197-6E77-49BC-B667-B38EFDFABE55}C:\games\assassin's creed 3 - remastered\aciii.exe] => (Allow) C:\games\assassin's creed 3 - remastered\aciii.exe => No File
FirewallRules: [UDP Query User{405E9D10-6EA8-43D5-8E3A-9F387283C6D8}C:\games\assassin's creed 3 - remastered\aciii.exe] => (Allow) C:\games\assassin's creed 3 - remastered\aciii.exe => No File
FirewallRules: [TCP Query User{D0F97CD6-62EA-40EC-93D4-58C85ADF2067}C:\games\assassin's creed 3 - remastered\aciii.exe] => (Allow) C:\games\assassin's creed 3 - remastered\aciii.exe => No File
FirewallRules: [UDP Query User{08EEC45F-38EF-47E6-9634-B358FF3E1D8D}C:\games\assassin's creed 3 - remastered\aciii.exe] => (Allow) C:\games\assassin's creed 3 - remastered\aciii.exe => No File
FirewallRules: [TCP Query User{D2DCA534-D1C2-4F14-9D53-ABC70F329356}C:\users\ema\downloads\age.of.history.3.v1.01\game\jre\bin\javaw.exe] => (Block) C:\users\ema\downloads\age.of.history.3.v1.01\game\jre\bin\javaw.exe => No File
FirewallRules: [UDP Query User{BFE95278-F66E-4279-9783-45E398E70838}C:\users\ema\downloads\age.of.history.3.v1.01\game\jre\bin\javaw.exe] => (Block) C:\users\ema\downloads\age.of.history.3.v1.01\game\jre\bin\javaw.exe => No File
FirewallRules: [TCP Query User{317AFF0F-A602-420F-AF4E-0D3B4E9C2F87}C:\users\ema\documents\age.of.history.3.v1.01\game\jre\bin\javaw.exe] => (Block) C:\users\ema\documents\age.of.history.3.v1.01\game\jre\bin\javaw.exe => No File
FirewallRules: [UDP Query User{5ACDE348-452E-4F3E-9AE5-957168376676}C:\users\ema\documents\age.of.history.3.v1.01\game\jre\bin\javaw.exe] => (Block) C:\users\ema\documents\age.of.history.3.v1.01\game\jre\bin\javaw.exe => No File
FirewallRules: [TCP Query User{6CB59615-E647-4787-A0E4-7C4005FC19C4}C:\games\age of empires ii - definitive edition\aoe2de_s.exe] => (Allow) C:\games\age of empires ii - definitive edition\aoe2de_s.exe => No File
FirewallRules: [UDP Query User{95F710F5-6485-47F8-90B6-4C88127ACB2D}C:\games\age of empires ii - definitive edition\aoe2de_s.exe] => (Allow) C:\games\age of empires ii - definitive edition\aoe2de_s.exe => No File
FirewallRules: [TCP Query User{AEBE6B6D-9CAF-440F-8535-685957C9259E}C:\games\age of empires ii - definitive edition\battleserver\battleserver.exe] => (Allow) C:\games\age of empires ii - definitive edition\battleserver\battleserver.exe => No File
FirewallRules: [UDP Query User{97B11D18-8BB0-4722-A130-ABE5D4AA5794}C:\games\age of empires ii - definitive edition\battleserver\battleserver.exe] => (Allow) C:\games\age of empires ii - definitive edition\battleserver\battleserver.exe => No File
FirewallRules: [TCP Query User{6196E43C-241F-43E1-A2C4-22003E826568}C:\xboxgames\call of duty\content\cod.exe] => (Allow) C:\xboxgames\call of duty\content\cod.exe => No File
FirewallRules: [UDP Query User{7D2F177E-042A-4F90-87A7-89527F9AC7B2}C:\xboxgames\call of duty\content\cod.exe] => (Allow) C:\xboxgames\call of duty\content\cod.exe => No File
FirewallRules: [TCP Query User{780D8D7F-5947-456A-89C0-A029EDAC59B7}C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe] => (Allow) C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe => No File
FirewallRules: [UDP Query User{2C9342FE-4189-457C-A3E4-22219A1728FD}C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe] => (Allow) C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe => No File
FirewallRules: [{DF462F7B-0EEF-4292-9B59-2BD44C6863E2}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File
FirewallRules: [{D9A92614-0870-4597-8056-7D172A387EA7}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File
FirewallRules: [{7A829D6D-308E-49C7-A9AD-1864945D1DB1}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File
FirewallRules: [{DA3BD3AE-A74D-4440-8FBD-2CA23CA401A1}] => (Allow) C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe => No File
FirewallRules: [TCP Query User{812BB7FA-DB14-47D2-8E4E-57870A6E64DF}C:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe] => (Allow) C:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe => No File
FirewallRules: [UDP Query User{CF9C086D-06BF-4046-81A3-482CD1B4B11C}C:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe] => (Allow) C:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe => No File
FirewallRules: [TCP Query User{2FFCDAD1-225C-4E7A-BA61-CAC3AE63519F}C:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe] => (Allow) C:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe => No File
FirewallRules: [UDP Query User{33BBDD97-F6F6-4F01-9BD3-FA56552A6DFD}C:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe] => (Allow) C:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe => No File
FirewallRules: [TCP Query User{D215E23D-7FDA-4E91-AEDA-CA71C137C546}C:\program files\ea games\battlefield v\bfv.exe] => (Allow) C:\program files\ea games\battlefield v\bfv.exe => No File
FirewallRules: [UDP Query User{9AA742B4-463D-4419-9F0D-23ECE38AAA3E}C:\program files\ea games\battlefield v\bfv.exe] => (Allow) C:\program files\ea games\battlefield v\bfv.exe => No File
FirewallRules: [{B6ED2EDD-6D0C-4469-AC0F-A22CDEEAD8FE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Enlisted\bpreport.exe => No File
FirewallRules: [{764D4546-ADDD-4E12-B344-1DD80FC9854F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Enlisted\bpreport.exe => No File
FirewallRules: [{A6211D5A-745E-4122-98F7-0BEC23CAA775}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Enlisted\enlisted_eac_launcher.exe => No File
FirewallRules: [{43E6D119-5B8E-41AE-B22B-4BBB91D58B23}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Enlisted\enlisted_eac_launcher.exe => No File
FirewallRules: [TCP Query User{581B8427-21D4-425A-AA43-CCD3F4B2541E}C:\program files (x86)\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File
FirewallRules: [UDP Query User{E4A685DC-46B4-4691-B777-6833FD7C9203}C:\program files (x86)\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File
FirewallRules: [TCP Query User{A5F46FEB-EEA6-46E1-9BA7-2914ED07DC36}C:\program files (x86)\steam\steamapps\common\glacier events\bf6event.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\glacier events\bf6event.exe => No File
FirewallRules: [UDP Query User{AFDD3EBE-7A3A-44BC-AC66-8EF56C7AF47F}C:\program files (x86)\steam\steamapps\common\glacier events\bf6event.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\glacier events\bf6event.exe => No File
FirewallRules: [TCP Query User{5C8CC760-2803-4C28-82B2-3BD5FD73A836}C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe => No File
FirewallRules: [UDP Query User{FFBEFBF2-971D-47FE-BC17-5DE34F665AD3}C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe => No File
FirewallRules: [TCP Query User{81135CFA-5292-4430-AFBF-E4AA0103F88B}C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe => No File
FirewallRules: [UDP Query User{B21DCF79-525C-44A7-ABA4-864A54B002BD}C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\world of tanks\eu\win64\worldoftanks.exe => No File
FirewallRules: [{F9144944-0D75-4B55-8C34-52655CE49673}] => (Allow) C:\Users\Ema\AppData\Local\Temp\ACFL20250922232005\ACSetup\ACSetup.exe => No File
FirewallRules: [{8112C891-D65C-4752-93A4-5FA28CF5CA99}] => (Allow) C:\Users\Ema\AppData\Local\Temp\ACFL20250922232005\ACSetup\ACSetup.exe => No File
FirewallRules: [{437614C4-30FC-4E4A-8839-FA38DDD42A10}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe => No File
FirewallRules: [{15B7255F-BD55-4D9A-96AB-007BCC8B431E}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe => No File
FirewallRules: [{C3EA9C1C-AB6B-4E59-AD47-CFDE732DC207}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmouryHtmlDebugServer.exe => No File
FirewallRules: [TCP Query User{103C38BE-5A72-42C4-AA0E-2DB268162A89}C:\program files (x86)\steam\steamapps\common\palia\palia\binaries\win64\paliaclientsteam-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\palia\palia\binaries\win64\paliaclientsteam-win64-shipping.exe => No File
FirewallRules: [UDP Query User{0EC917E7-CEB4-4759-86A3-47F718A90687}C:\program files (x86)\steam\steamapps\common\palia\palia\binaries\win64\paliaclientsteam-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\palia\palia\binaries\win64\paliaclientsteam-win64-shipping.exe => No File
FirewallRules: [TCP Query User{BCA4C3A7-7A28-41CB-8B83-1E018626E2E7}C:\users\ema\desktop\nuova cartella\megabonk-steamrip.com\megabonk\megabonk.exe] => (Allow) C:\users\ema\desktop\nuova cartella\megabonk-steamrip.com\megabonk\megabonk.exe => No File
FirewallRules: [UDP Query User{29DEA00B-78D2-4C8C-8382-D19503FEAD09}C:\users\ema\desktop\nuova cartella\megabonk-steamrip.com\megabonk\megabonk.exe] => (Allow) C:\users\ema\desktop\nuova cartella\megabonk-steamrip.com\megabonk\megabonk.exe => No File
FirewallRules: [TCP Query User{1E127FA6-FF1D-45EB-B4BB-D9EE39A4A6AB}C:\program files (x86)\dodi-repacks\windrose\r5\binaries\win64\windrose-win64-shipping.exe] => (Allow) C:\program files (x86)\dodi-repacks\windrose\r5\binaries\win64\windrose-win64-shipping.exe => No File
FirewallRules: [UDP Query User{42F7D399-2B68-48D5-B6C1-5034F8C86682}C:\program files (x86)\dodi-repacks\windrose\r5\binaries\win64\windrose-win64-shipping.exe] => (Allow) C:\program files (x86)\dodi-repacks\windrose\r5\binaries\win64\windrose-win64-shipping.exe => No File

File: C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.25\AsSysCtrlService.exe
File: C:\WINDOWS\System32\DriverStore\FileRepository\brbtusb_60.inf_amd64_931bf5f8110ef32f\brbtusb_60.sys
Folder: C:\Users\Ema\AppData\Roaming\CC




Comment: Service / Driver Status (thanks to AdvancedSetup)
Comment: 0 = Boot
Comment: 1 = System
Comment: 2 = Automatic
Comment: 3 = Manual / Demand
Comment: 4 = Disabled

Comment: R = Running
Comment: S = Stopped
Comment: U = Unknown / unable to determine service state cleanly

Comment: === rifteyy's default non-intrusive fixlist template === 
Comment: The following are done automatically with this fixlist:
Comment: Hardens Windows Defender (for maximum efficiency DISABLE TAMPER PROTECTION)
Comment: Checks and corrects the default Windows PATH environmental variable
Comment: Checks for internet connection, valid DNS
Comment: Checks for Windows RE status
Comment: Checks and repairs WMI repository
Comment: Checks Windows activation status
Comment: Checks if TPM, Secure Boot are available and their status
Comment: Restores original Windows services configuration
Comment: Restores PowerShell execution policy
Comment: Rebuilds performance counter library values
Comment: Resynchronizes performance counter library values to WMI
Comment: Enables file extensions
Comment: Enables recovery environment
Comment: Scans with HitmanPro from Sophos
Comment: Scans and cleans with AdwCleaner from Malwarebytes
Comment: Lists environment variables
Comment: Lists Windows Defender properties, settings
Comment: Lists drive info, identify possible damaged drives from Event Logs
Comment: Lists Discord's "index.js" files that are often targeted by malware (to store and execute malicious code)
Comment: Lists recent BSOD's
Comment: Lists all installed applications, folder contents along with SHA256 for purposes of identifying installed app malware
Comment: Lists 30 recent scheduled tasks
Comment: Lists recent Run (Windows + R) executed commands, can identify ClickFix attacks
Comment: Removes unwanted files (e.g. .exe, .com, .dll) from common folders (e.g. C:\ProgramData, AppData\Roaming) - these are not supposed to store any executable file types
Comment: Removes generic filetypes associated with RenPyLoader from common folders
Comment: Removes cache from Chrome, Firefox, Opera, Opera GX, Brave, Vivaldi, LibreWolf, Mullvad Browser, Zen and from Roblox, Fortnite, Discord, OBS Studio
Comment: Removes policies
Comment: Removes active BITS tasks
Comment: Resets network
Comment: Removes proxy servers
Comment: Removes temporary files
Comment: Repairs system files

Comment: List environment variables
StartPowerShell:
$key = Get-Item -Path "HKCU:\Environment" -ErrorAction SilentlyContinue
if ($key) {
    $path = "HKCU\Environment"
    foreach ($name in $key.GetValueNames()) {
        $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
        "$path|$name=$value"
    }
}
$key = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -ErrorAction SilentlyContinue
if ($key) {
    $path = "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
    foreach ($name in $key.GetValueNames()) {
        $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
        "$path|$name=$value"
    }
}
Get-ChildItem Env: | Sort-Object Name | ForEach-Object {
    "SET|$($_.Name)=$($_.Value)"
}
Get-ChildItem Registry::HKEY_USERS | Where-Object {
    $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$'
} | ForEach-Object {
    $sid = $_.PSChildName
    $envPath = "Registry::HKEY_USERS\$sid\Environment"
    
    if (Test-Path $envPath) {
        $key = Get-Item -Path $envPath
        foreach ($name in $key.GetValueNames()) {
            $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
            "HKEY_USERS\$sid\Environment|$name=$value"
        }
    }
}
EndPowerShell:

StartPowerShell:
# Checks default Windows PATH entries and repairs missing ones.
$ErrorActionPreference = 'Continue'

function Expand-PlainPath {
    param([string]$Entry)
    return [Environment]::ExpandEnvironmentVariables($Entry).TrimEnd('\')
}

# Templates expanded once to plain paths (C:\Windows\..., C:\Users\...)
$systemDefaults = @(
    (Expand-PlainPath '%SystemRoot%\system32')
    (Expand-PlainPath '%SystemRoot%')
    (Expand-PlainPath '%SystemRoot%\System32\Wbem')
    (Expand-PlainPath '%SystemRoot%\System32\WindowsPowerShell\v1.0')
    (Expand-PlainPath '%SystemRoot%\System32\OpenSSH')
)

$userDefaults = @(
    (Expand-PlainPath '%USERPROFILE%\AppData\Local\Microsoft\WindowsApps')
)

function Get-NormalizedPathEntries {
    param([string]$Raw)
    if ([string]::IsNullOrWhiteSpace($Raw)) { return @() }
    return @(
        $Raw -split ';' |
            Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
            ForEach-Object {
                [Environment]::ExpandEnvironmentVariables($_.Trim().TrimEnd('\')).ToLowerInvariant()
            }
    )
}

function Get-CombinedPathEntries {
    $machineRaw = [Environment]::GetEnvironmentVariable('Path', 'Machine')
    $userRaw    = [Environment]::GetEnvironmentVariable('Path', 'User')
    return Get-NormalizedPathEntries -Raw ($machineRaw + ';' + $userRaw)
}

function Test-InPath {
    param(
        [string]$PlainPath,
        [string[]]$NormalizedEntries
    )
    $key = $PlainPath.TrimEnd('\').ToLowerInvariant()
    return $NormalizedEntries -contains $key
}

function Add-ToPath {
    param(
        [string]$PlainPath,
        [ValidateSet('Machine', 'User')]
        [string]$Scope
    )
    # always store plain path, never %VAR% form
    $toAdd = $PlainPath.TrimEnd('\')
    $current = [Environment]::GetEnvironmentVariable('Path', $Scope)

    if ([string]::IsNullOrWhiteSpace($current)) {
        [Environment]::SetEnvironmentVariable('Path', $toAdd, $Scope)
        return
    }

    $normalized = Get-NormalizedPathEntries -Raw $current
    $key = $toAdd.ToLowerInvariant()
    if ($normalized -contains $key) { return }

    $newPath = $current.TrimEnd(';') + ';' + $toAdd
    [Environment]::SetEnvironmentVariable('Path', $newPath, $Scope)
}

function Write-Result {
    param(
        [string]$Entry,
        [string]$Status
    )
    $label = $Entry.PadRight(58)
    Write-Output ("{0}  {1}" -f $label, $Status)
}

function Repair-AndVerify {
    param(
        [string]$PlainPath,
        [ValidateSet('Machine', 'User')]
        [string]$Scope
    )

    if (-not (Test-Path -LiteralPath $PlainPath)) {
        Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING  (no folder, cannot repair)'
        return 'failed'
    }

    if ($Scope -eq 'Machine') {
        $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).
            IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
        if (-not $isAdmin) {
            Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING  (need Admin to repair)'
            return 'failed'
        }
    }

    try {
        Add-ToPath -PlainPath $PlainPath -Scope $Scope
    }
    catch {
        Write-Result -Entry $PlainPath -Status "ATTENTION !!! MISSING  (repair failed: $_)"
        return 'failed'
    }

    # re-query PATH from registry and verify plain path is present
    $after = Get-CombinedPathEntries
    if (Test-InPath -PlainPath $PlainPath -NormalizedEntries $after) {
        Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING  -> repaired (verified)'
        return 'repaired'
    }

    Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING  (repair ran, still missing after re-check)'
    return 'failed'
}

$combined = Get-CombinedPathEntries

$hadMissing = $false
$repairFailed = $false
$repairedList = [System.Collections.Generic.List[string]]::new()

Write-Output 'PATH CHECK'
Write-Output ('-' * 72)

foreach ($entry in $systemDefaults) {
    if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) {
        Write-Result -Entry $entry -Status 'OK'
        continue
    }

    $hadMissing = $true
    $result = Repair-AndVerify -PlainPath $entry -Scope Machine
    if ($result -eq 'repaired') {
        [void]$repairedList.Add($entry)
        $combined = Get-CombinedPathEntries
    }
    else {
        $repairFailed = $true
    }
}

foreach ($entry in $userDefaults) {
    if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) {
        Write-Result -Entry $entry -Status 'OK'
        continue
    }

    $hadMissing = $true
    $result = Repair-AndVerify -PlainPath $entry -Scope User
    if ($result -eq 'repaired') {
        [void]$repairedList.Add($entry)
        $combined = Get-CombinedPathEntries
    }
    else {
        $repairFailed = $true
    }
}

Write-Output ('-' * 72)
if (-not $hadMissing) {
    Write-Output 'RESULT: all default PATH entries present'
}
elseif ($repairedList.Count -gt 0 -and -not $repairFailed) {
    Write-Output "RESULT: $($repairedList.Count) missing entry/entries repaired and verified - open a new terminal"
}
elseif ($repairedList.Count -gt 0 -and $repairFailed) {
    Write-Output "RESULT: $($repairedList.Count) verified, some still missing - open a new terminal / run as Admin"
}
else {
    Write-Output 'RESULT: missing entries not repaired (run as Admin for System PATH)'
}

if ($repairedList.Count -gt 0) {
    Write-Output ''
    Write-Output 'REPAIRED:'
    foreach ($item in $repairedList) {
        Write-Output "  $item"
    }
}

if ($hadMissing -or $repairFailed) {
    exit 1
}

exit 0
EndPowerShell:

Comment: Verify Windows activation
CMD: cscript c:\windows\system32\slmgr.vbs /xpr & cscript c:\windows\system32\slmgr.vbs /dlv

Comment: Check TPM and Secure Boot status
StartPowershell:
[PSCustomObject]@{ "TPM Detected" = (Get-Tpm).TpmPresent; "TPM Enabled" = (Get-Tpm).TpmEnabled; "Secure Boot On" = (Confirm-SecureBootUEFI) }
EndPowershell:

StartPowerShell:
# Check for internet connection
$ErrorActionPreference = 'Continue'

$dnsServers = @(
    '1.1.1.1'
    '8.8.8.8'
)

$hosts = @(
    'google.com'
    'cloudflare.com'
    'malwarebytes.com'
)

function Write-Result {
    param(
        [string]$Label,
        [string]$Status
    )
    Write-Output ("{0}  {1}" -f $Label.PadRight(42), $Status)
}

function Test-DnsServer {
    param([string]$Server)

    $pingOk = $false
    try {
        $pingOk = Test-Connection -ComputerName $Server -Count 1 -Quiet -ErrorAction SilentlyContinue
    }
    catch { }

    $resolveOk = $false
    try {
        $result = Resolve-DnsName -Name 'google.com' -Server $Server -Type A -DnsOnly -ErrorAction Stop
        $ip = ($result | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress
        if ($ip) { $resolveOk = $true }
    }
    catch { }

    # resolve is what matters; ping may be blocked
    if ($resolveOk) { return 'OK' }
    if ($pingOk) { return 'FAIL' }
    return 'FAIL'
}

function Test-HostReachable {
    param([string]$HostName)

    try {
        $dns = Resolve-DnsName -Name $HostName -Type A -ErrorAction Stop
        $resolvedIp = ($dns | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress
        if (-not $resolvedIp) { return 'FAIL' }
    }
    catch {
        return 'FAIL'
    }

    try {
        $null = Invoke-WebRequest -Uri "https://$HostName" -UseBasicParsing -TimeoutSec 10 -MaximumRedirection 5 -ErrorAction Stop
        return 'OK'
    }
    catch {
        if ($_.Exception.Response) { return 'OK' }
        return 'FAIL'
    }
}

$failed = 0

Write-Output 'INTERNET CHECK'
Write-Output ('-' * 72)

Write-Output 'DNS SERVERS'
foreach ($server in $dnsServers) {
    $status = Test-DnsServer -Server $server
    Write-Result -Label $server -Status $status
    if ($status -eq 'FAIL') { $failed++ }
}

Write-Output ''
Write-Output 'HOSTS'
foreach ($h in $hosts) {
    $status = Test-HostReachable -HostName $h
    Write-Result -Label $h -Status $status
    if ($status -eq 'FAIL') { $failed++ }
}

Write-Output ('-' * 72)
if ($failed -eq 0) {
    Write-Output 'RESULT: all checks passed'
    exit 0
}

Write-Output "RESULT: $failed check(s) failed"
exit 1
EndPowerShell:

StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

StartPowerShell:
# Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console
# Does not clean preinstalled objects, only PUP/Adware
# If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument
# If you would like to only scan with it, change the argument from /clean to /scan
# NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software.
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:

Comment: List drive info, identify possible damaged drives (thanks to AdvancedSetup from Malwarebytes for parts of these)
StartPowerShell:
param(
    [int]$MaxEvents = 5000
)
$GPTTypeMap = @{
    'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7' = 'Microsoft Basic Data'
    'E3C9E316-0B5C-4DB8-817D-F92DF00215AE' = 'Microsoft Reserved (MSR)'
    'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC' = 'Windows Recovery Environment (WinRE)'
    'C12A7328-F81F-11D2-BA4B-00A0C93EC93B' = 'EFI System Partition'
    '21686148-6449-6E6F-744E-656564454649' = 'BIOS Boot Partition'
    'A19D880F-05FC-4D3B-A006-743F0F84911E' = 'OEM Partition'
    '5808C8AA-7E8F-42E0-85D2-E1E90434CFB3' = 'Cluster Metadata Partition'
    '48465300-0000-11AA-AA11-00306543ECAC' = 'Apple HFS/HFS+'
    '7C3457EF-0000-11AA-AA11-00306543ECAC' = 'Apple APFS'
    '0FC63DAF-8483-4772-8E79-3D69D8477DE4' = 'Linux Filesystem'
    '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F' = 'Linux Swap'
    'E6D6D379-F507-44C2-A23C-238F2A3DF928' = 'Linux LVM'
}
$MBRTypeMap = @{
    '01'='FAT12';'04'='FAT16 <32M';'05'='Extended';'06'='FAT16';'07'='IFS/NTFS/exFAT/HPFS';'0B'='FAT32 CHS';'0C'='FAT32 LBA';'0E'='FAT16 LBA'
    '0F'='Extended LBA';'82'='Linux Swap';'83'='Linux Native';'8E'='Linux LVM';'A5'='FreeBSD';'A6'='OpenBSD';'A8'='Mac OS X';'AB'='Mac OS X Boot'
    'AF'='Mac OS X HFS';'EE'='EFI GPT Protective';'EF'='EFI System Partition'
}
function Get-PartitionTypeInfo {
    param($Partition)

    $guid = $null
    if ($Partition.GptType) {
        $guid = ($Partition.GptType -replace '[{}]', '').ToUpper()
    }
    if ([string]::IsNullOrWhiteSpace($guid) -or $guid -eq '00000000-0000-0000-0000-000000000000') {
        $guid = switch ($Partition.Type) {
            "System"   { "C12A7328-F81F-11D2-BA4B-00A0C93EC93B" }
            "Reserved" { "E3C9E316-0B5C-4DB8-817D-F92DF00215AE" }
            "Basic"    { "EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" }
            "Recovery" { "DE94BBA4-06D1-4D40-A16A-BFD50179D6AC" }
            default    { $null }
        }
    }

    if ($guid) {
        $name = $GPTTypeMap[$guid]
        if ($name) { return "$name (GPT GUID: $($guid.ToLower()))" }
        else { return "Unknown/Custom (GPT GUID: $($guid.ToLower()))" }
    }

    if ($Partition.MbrType) {
        $code = ($Partition.MbrType.ToString() -replace '^0x', '').PadLeft(2, '0').ToUpper()
        $name = $MBRTypeMap[$code]
        if ($name) { return "$name (MBR code: 0x$code)" }
        else { return "Unknown/Custom (MBR code: $($Partition.MbrType))" }
    }

    return $Partition.Type
}
function Get-DrMapping {
    param([int]$MaxEvents)
    $map = @{}
    try {
        $events = Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'disk' } -MaxEvents $MaxEvents -ErrorAction Stop
    } catch {
        return $map
    }
    foreach ($e in $events) {
        if ($e.Message -match 'Harddisk(\d+)\\DR(\d+)') {
            $n  = [int]$Matches[1]
            $dr = [int]$Matches[2]
            if (-not $map.ContainsKey($n)) { $map[$n] = $dr }
        }
    }
    return $map
}
$drMap = Get-DrMapping -MaxEvents $MaxEvents
$physicalDisks = Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, SerialNumber, MediaType, @{N='SizeGB';E={[math]::Round($_.Size / 1GB,2)}}
foreach ($pd in $physicalDisks) {
    $devId = [int]$pd.DeviceId
    $drSuffix = if ($drMap.ContainsKey($devId)) { "\DR$($drMap[$devId])" } else { '\DR? (no event seen yet)' }

    Write-Host ""
    Write-Host "<=== \Device\Harddisk$devId$drSuffix ($($pd.FriendlyName)) ===>"
    Write-Host "  DeviceId: $devId | Serial: $($pd.SerialNumber) | Media: $($pd.MediaType) | Size: $($pd.SizeGB) GB"

    try {
        $partitions = Get-Partition -DiskNumber $devId -ErrorAction Stop
        if (-not $partitions) {
            Write-Host "  (no partitions found)"
            continue
        }
        foreach ($part in $partitions) {
            $driveLetter = if ($part.DriveLetter) { "$($part.DriveLetter):" } else { 'no letter' }
            $sizeGB = [math]::Round($part.Size / 1GB, 2)
            $typeInfo = Get-PartitionTypeInfo -Partition $part
            Write-Host "  [PARTITION $($part.PartitionNumber)] Drive: $driveLetter - $sizeGB GB - $typeInfo"
        }
    } catch {
        Write-Host "  [ERROR] cannot read partitions for disk $devId"
    }
}

if ($drMap.Count -eq 0) {
    Write-Host ""
    Write-Host "Note: no \Device\HarddiskN\DRx entries found in the last $MaxEvents System log events. Increase -MaxEvents, or the DR number will only appear once Windows actually logs a disk event for that drive (e.g. a bad block warning)."
}
EndPowerShell:

Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code.
Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) }

StartPowerShell:
# Basic BSOD listings
$ccKey = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"
$cfg = Get-ItemProperty $ccKey -ErrorAction SilentlyContinue
$dumpTypeMap = @{0='None';1='Complete';2='Kernel';3='Minidump';7='Automatic'}
Write-Output "--- Configuration ---"
Write-Output ("Dump Type: {0} ({1})" -f $cfg.CrashDumpEnabled, $dumpTypeMap[$cfg.CrashDumpEnabled])
Write-Output ("Full Dump Path: {0}" -f $(if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"}))
Write-Output ("Minidump Folder: {0}" -f $(if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"}))
Write-Output ("Auto Reboot: {0}" -f $(if($cfg.AutoReboot -eq 0){'Disabled'}else{'Enabled'}))
Write-Output "--- Found Dump Files ---"
$full = if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"}
if (Test-Path $full) { Get-Item $full | Select Name,Length,LastWriteTime | Format-Table -AutoSize }
$mini = if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"}
if (Test-Path $mini) { Get-ChildItem $mini -Filter *.dmp | Select Name,Length,LastWriteTime | Format-Table -AutoSize }
Write-Output "--- BugCheck Reasoning (recent events) ---"
$map = @{
'0x0000000A'='IRQL_NOT_LESS_OR_EQUAL - faulty/outdated driver accessed memory at high IRQL'
'0x0000001E'='KMODE_EXCEPTION_NOT_HANDLED - unhandled kernel exception, often driver/hardware'
'0x0000002E'='DATA_BUS_ERROR - typically bad RAM or hardware fault'
'0x0000003B'='SYSTEM_SERVICE_EXCEPTION - exception in a system service, often driver-related'
'0x00000050'='PAGE_FAULT_IN_NONPAGED_AREA - bad RAM or faulty driver/antivirus'
'0x0000007A'='KERNEL_DATA_INPAGE_ERROR - disk-related problem'
'0x0000007B'='INACCESSIBLE_BOOT_DEVICE - system could not find/access the boot device'
'0x0000007E'='SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - almost always a faulty driver'
'0x0000007F'='UNEXPECTED_KERNEL_MODE_TRAP - hardware issue (CPU/RAM/overclocking)'
'0x0000009F'='DRIVER_POWER_STATE_FAILURE - driver failed to respond to a power state change'
'0x000000C2'='BAD_POOL_CALLER - driver mishandling memory (pool corruption)'
'0x000000D1'='DRIVER_IRQL_NOT_LESS_OR_EQUAL - typically a network or GPU driver'
'0x000000EF'='CRITICAL_PROCESS_DIED - a critical system process died, often malware/system corruption'
'0x00000116'='VIDEO_TDR_FAILURE - GPU driver failed to respond in time (timeout)'
'0x00000124'='WHEA_UNCORRECTABLE_ERROR - hardware fault (CPU/RAM/PSU/overclocking)'
'0x00000133'='DPC_WATCHDOG_VIOLATION - faulty driver or storage subsystem issue'
'0x00000139'='KERNEL_SECURITY_CHECK_FAILURE - corrupted kernel structure, possibly malware'
}
$events = Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} -MaxEvents 100 -ErrorAction SilentlyContinue |
    Where-Object { $_.ProviderName -match 'WER-SystemErrorReporting' } | Select-Object -First 5

if (-not $events) { Write-Output "No BugCheck events found in the log." }
foreach ($ev in $events) {
    $code = if ($ev.Message -match 'bugcheck was:\s*(0x[0-9A-Fa-f]+)') { $matches[1] } else { $null }
    Write-Output ("Time: {0}" -f $ev.TimeCreated)
    Write-Output ("Code: {0}" -f $(if($code){$code}else{'not recognized'}))
    if ($code -and $map.ContainsKey($code.ToUpper())) {
        Write-Output ("Meaning: {0}" -f $map[$code.ToUpper()])
    } elseif ($code) {
        Write-Output "Meaning: unknown code, look up at learn.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2"
    }
    Write-Output ""
}
EndPowerShell:

StartPowerShell:
# This snippet lists all installed apps and their folder contents along with SHA256 hashes. Useful for troubleshooting malware abusing installed app entry.
param(
    [switch]$Recurse,
    [int]$MaxFilesPerApp = [int]::MaxValue
)

$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$script:msiInstaller = $null
function Get-MsiInstallLocation {
    param([string]$ProductCode)
    if (-not $script:msiInstaller) {
        try { $script:msiInstaller = New-Object -ComObject WindowsInstaller.Installer } catch { return $null }
    }
    try {
        $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallLocation')
        if ([string]::IsNullOrWhiteSpace($loc)) { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallSource') }
        if ([string]::IsNullOrWhiteSpace($loc)) { return $null }
        return $loc
    } catch { return $null }
}

function Get-CleanPath {
    param([string]$RawValue)
    if ([string]::IsNullOrWhiteSpace($RawValue)) { return $null }
    $s = $RawValue.Trim()
    if ($s.StartsWith('"')) {
        $endQuote = $s.IndexOf('"', 1)
        if ($endQuote -gt 0) { return $s.Substring(1, $endQuote - 1) }
    }
    if ($s -match '^(.*?\.exe)\b') { return $Matches[1] }
    return $s
}

function Format-FileSize {
    param([long]$Bytes)
    if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) }
    if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) }
    if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) }
    return "$Bytes B"
}

$script:PeExtensions = @('.exe', '.dll', '.sys', '.ocx', '.cpl', '.scr', '.drv', '.efi', '.msi', '.msp', '.msu')
function Test-IsPeFile {
    param([string]$Extension)
    return $script:PeExtensions -contains $Extension.ToLower()
}

function Get-SignatureInfo {
    param([string]$Path, [string]$Extension)
    if (-not (Test-IsPeFile -Extension $Extension)) {
        return [PSCustomObject]@{ Signer = 'N/A (not PE)'; Status = 'NotApplicable'; Valid = $false }
    }
    $result = [PSCustomObject]@{ Signer = 'Unsigned'; Status = 'NotSigned'; Valid = $false }
    try {
        $sig = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop
        $result.Status = $sig.Status.ToString()
        $result.Valid  = ($sig.Status -eq 'Valid')
        if ($sig.SignerCertificate) {
            if ($sig.SignerCertificate.Subject -match 'CN=([^,]+)') { $result.Signer = $Matches[1].Trim('"') }
            else { $result.Signer = $sig.SignerCertificate.Subject }
            if (-not $result.Valid) { $result.Signer += " [INVALID: $($result.Status)]" }
        } elseif ($sig.Status -eq 'NotSigned') {
            $result.Signer = 'Unsigned'
        } else {
            $result.Signer = "Unknown [$($result.Status)]"
        }
    } catch {
        $result.Signer = 'Verification error'
        $result.Status = 'Error'
        $result.Valid  = $false
    }
    return $result
}

$rawApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -and $_.DisplayName.Trim() -ne '' } |
    Select-Object @{Name = 'Name'; Expression = { $_.DisplayName } },
                  @{Name = 'Version'; Expression = { $_.DisplayVersion } },
                  @{Name = 'Publisher'; Expression = { $_.Publisher } },
                  @{Name = 'InstallFolder'; Expression = {
                        if ($_.InstallLocation -and $_.InstallLocation.Trim() -ne '') { $_.InstallLocation }
                        elseif ($_.UninstallString -match 'MsiExec\.exe.*?(\{[0-9A-Fa-f\-]{36}\})') {
                            $productCode = $Matches[1]
                            $msiLoc = Get-MsiInstallLocation -ProductCode $productCode
                            if ($msiLoc) { $msiLoc } else { "MSI: $productCode (location not found)" }
                        }
                        elseif ($_.UninstallString) { $_.UninstallString }
                        else { 'N/A' }
                    } } |
    Sort-Object Name -Unique

foreach ($app in $rawApps) {
    $versionText   = if ($app.Version) { $app.Version } else { '?' }
    $publisherText = if ($app.Publisher) { $app.Publisher } else { '?' }
    Write-Host ""
    Write-Host "<=== $($app.Name) [$versionText] ($publisherText) ===>"

    if ($app.InstallFolder -eq 'N/A' -or $app.InstallFolder -match '^MSI: .* \(location not found\)$') {
        Write-Host "  Path: $($app.InstallFolder)"
        continue
    }

    $cleanPath = Get-CleanPath -RawValue $app.InstallFolder

    $exists = $false
    try {
        $exists = Test-Path -LiteralPath $cleanPath -ErrorAction Stop
    } catch [System.UnauthorizedAccessException] {
        Write-Host "  Path: $cleanPath"
        Write-Host "  [ACCESS DENIED]"
        continue
    } catch {
        Write-Host "  Path: $cleanPath"
        Write-Host "  [ERROR] cannot access"
        continue
    }

    if (-not $exists) {
        Write-Host "  Path: $cleanPath"
        Write-Host "  [NOT FOUND]"
        continue
    }

    $rootItem = Get-Item -LiteralPath $cleanPath -Force
    $created  = $rootItem.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
    $modified = $rootItem.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')

    if ($rootItem.PSIsContainer) {
        $subFolders = Get-ChildItem -LiteralPath $cleanPath -Directory -Force -ErrorAction SilentlyContinue
        $gciParams  = @{ LiteralPath = $cleanPath; File = $true; Force = $true; ErrorAction = 'SilentlyContinue' }
        if ($Recurse) { $gciParams['Recurse'] = $true }
        $allFiles = Get-ChildItem @gciParams

        Write-Host "  Path: $cleanPath | Created: $created | Modified: $modified | Files: $($allFiles.Count) | Folders: $($subFolders.Count)"

        foreach ($dir in $subFolders) {
            $dCreated  = $dir.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
            $dModified = $dir.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
            $dFileCount = (Get-ChildItem -LiteralPath $dir.FullName -File -Force -ErrorAction SilentlyContinue).Count
            Write-Host ("  [DIR] {0} - {1} - {2,10} - {3}" -f $dCreated, $dModified, "$dFileCount files", $dir.FullName)
        }
    } else {
        $allFiles = @($rootItem)
        Write-Host "  Path: $cleanPath | Created: $created | Modified: $modified | Files: 1"
    }

    if ($allFiles.Count -eq 0) { continue }

    $shown = $allFiles | Select-Object -First $MaxFilesPerApp
    foreach ($f in $shown) {
        $hash = 'N/A'
        try { $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction Stop).Hash } catch { $hash = 'HASH-ERROR' }
        $size     = Format-FileSize -Bytes $f.Length
        $fcreated = $f.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
        $fmod     = $f.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
        $sigInfo  = Get-SignatureInfo -Path $f.FullName -Extension $f.Extension
        Write-Host ("  [{0}] {1} - {2} - {3,10} - Signer: {4} - {5}" -f $hash, $fcreated, $fmod, $size, $sigInfo.Signer, $f.FullName)
    }
}
EndPowerShell:

Comment: List 30 recent scheduled tasks
Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo

Comment: List recent Run (Windows + R) executed commands, useful for identifying ClickFix attacks
Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" }

Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.csproj
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.csproj
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.csproj
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.csproj
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z

Comment: RenPyLoader hollowed installed app generic removal
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.props
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.targets
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.tmp
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.csproj
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.user
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cache
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.config
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.bat
C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cfg
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.props
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.targets
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.tmp
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.csproj
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.user
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cmd
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cache
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.config
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.bat
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cfg
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.props
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.targets
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.tmp
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.csproj
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.user
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cmd
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cache
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.config
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.bat
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cfg
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.props
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.targets
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.tmp
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.csproj
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.user
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cmd
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cache
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.config
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.bat
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cfg
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.props
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.targets
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.tmp
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.csproj
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.user
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cmd
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cache
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.config
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.bat
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cfg
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.props
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.targets
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.csproj
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.user
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cache
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.config
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.bat
C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cfg
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.props
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.targets
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.tmp
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.csproj
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cmd
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.user
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cache
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.config
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.bat
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cfg

Comment: Remove cache
C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\
C:\Users\CurrentUserName\AppData\Local\Roblox\UniversalApp\WebView2\EBWebView\Default\Cache\Cache_Data\
C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache\
C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4147\
C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4430\
C:\Users\CurrentUserName\AppData\Roaming\discord\Cache\Cache_Data\
C:\Users\CurrentUserName\AppData\Roaming\obs-studio\plugin_config\obs-browser\Cache\Cache_Data\
StartPowerShell:
$ProfilesDirectory = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').ProfilesDirectory
$DisplayNames = @{
    "chrome"    = "Chrome"
    "firefox"   = "Firefox"
    "opera"     = "Opera"
    "operagx"   = "Opera GX"
    "brave"     = "Brave"
    "msedge"    = "Edge"
    "vivaldi"   = "Vivaldi"
    "librewolf" = "LibreWolf"
    "mullvad"   = "Mullvad Browser"
    "zen"       = "Zen"
}
$ProcessNameMap = @{
    "operagx" = "opera"
    "mullvad" = "mullvadbrowser"
}
$trueCacheNames = @("Cache", "Code Cache", "DawnCache", "GPUCache", "GrShaderCache", "ShaderCache", "Shared Dictionary\cache")
function Get-CacheDirs {
    param([string]$BrowserName, [string]$ProfilesDirectory)
    switch ($BrowserName) {
        "chrome" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Google\Chrome\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "firefox" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Mozilla\Firefox\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
        "opera" {
            $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software"
            $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software"
            $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $r1 + $r2
        }
        "operagx" {
            $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software\Opera GX Stable"
            $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software\Opera GX Stable"
            $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $r1 + $r2
        }
        "brave" {
            $dir = "$ProfilesDirectory\*\AppData\Local\BraveSoftware\Brave-Browser\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "msedge" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Microsoft\Edge\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "vivaldi" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Vivaldi\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "librewolf" {
            $dir = "$ProfilesDirectory\*\AppData\Local\LibreWolf\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
        "mullvad" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Mullvad\MullvadBrowser\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
        "zen" {
            $dir = "$ProfilesDirectory\*\AppData\Local\zen\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
    }
}
function Format-Size {
    param([long]$Bytes)
    if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) }
    if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) }
    if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) }
    return "$Bytes B"
}
$BrowserKeys = @('chrome', 'firefox', 'opera', 'operagx', 'brave', 'msedge', 'vivaldi', 'librewolf', 'mullvad', 'zen')
foreach ($key in $BrowserKeys) {
    $procName = if ($ProcessNameMap.ContainsKey($key)) { $ProcessNameMap[$key] } else { $key }
    Get-Process -Name $procName -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
}
Start-Sleep -Seconds 5
$grandBytes = 0L
$grandFiles = 0
$anyFound = $false
foreach ($key in $BrowserKeys) {
    $cacheDirs = Get-CacheDirs -BrowserName $key -ProfilesDirectory $ProfilesDirectory
    if (-not $cacheDirs -or $cacheDirs.Count -eq 0) { continue }
    $anyFound = $true
    $displayName = $DisplayNames[$key]
    $browserBytes = 0L
    $browserFiles = 0
    foreach ($cacheDir in $cacheDirs) {
        if (-not (Test-Path $cacheDir)) { continue }
        $items = Get-ChildItem -Path $cacheDir -Force -Recurse -ErrorAction SilentlyContinue
        $files = $items | Where-Object { -not $_.PSIsContainer }
        $bytes = ($files | Measure-Object -Property Length -Sum).Sum
        if (-not $bytes) { $bytes = 0 }
        $browserFiles += $files.Count
        $browserBytes += $bytes
        Get-ChildItem -Path "$cacheDir\*" -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
    }
    $grandBytes += $browserBytes
    $grandFiles += $browserFiles
    Write-Host ("{0,-16} freed {1,10} ({2} files)" -f $displayName, (Format-Size $browserBytes), $browserFiles)
}
if (-not $anyFound) {
    Write-Host "No cache found for any installed browser."
}
Write-Host ""
Write-Host ("Total freed: {0} ({1} files)" -f (Format-Size $grandBytes), $grandFiles)
EndPowerShell:

Comment: Windows Recovery Environment (Windows RE) status and enable
CMD: reagentc.exe /info
CMD: reagentc.exe /enable

Comment: Disable hidden file extensions
cmd: reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
cmd: reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt" /v "CheckedValue" /t REG_DWORD /d 0 /f

Comment: Verify WMI repository, repair & verify again
CMD: winmgmt.exe /verifyrepository
CMD: winmgmt.exe /salvagerepository
CMD: winmgmt.exe /verifyrepository

Comment: To rebuild the performance counter library values
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"

Comment: Resync performance counter library values to WMI as well
CMD: winmgmt.exe /resyncperf

Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy
CMD: gpupdate.exe /force


Comment: Restores and hardens selected Microsoft Defender Antivirus preferences.
Comment: Tamper Protection must be temporarily disabled before applying these settings.
Comment: Thanks to AdvancedSetup from Malwarebytes
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender|DisableAntiSpyware
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender|DisableAntiVirus
StartPowerShell:
# Enable real-time and behavioral protection
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false

# Enable potentially unwanted application blocking
Set-MpPreference -PUAProtection Enabled

# Enable cloud-delivered protection and automatic safe-sample submission
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendSafeSamples

# Use Microsoft's recommended high cloud-blocking level
Set-MpPreference -CloudBlockLevel High

# Allow additional time for cloud analysis of suspicious files
Set-MpPreference -CloudExtendedTimeout 30

# Block connections to known malicious or untrusted network destinations
Set-MpPreference -EnableNetworkProtection Enabled

# Enable Block at First Sight
Set-MpPreference -DisableBlockAtFirstSeen $false

# Enable archive, removable-drive, network-file, download, and script scanning
Set-MpPreference -DisableArchiveScanning $false
Set-MpPreference -DisableRemovableDriveScanning $false
Set-MpPreference -DisableScanningNetworkFiles $false
Set-MpPreference -DisableIOAVProtection $false
Set-MpPreference -DisableScriptScanning $false

# Check for current security intelligence before starting a scan
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true

# Enable supported DNS attack inspection and sinkholing when available
if ((Get-Command Set-MpPreference).Parameters.ContainsKey('EnableDnsSinkhole')) {
    Set-MpPreference -EnableDnsSinkhole $true
}
# Sets signature update interval to 12 hours (default 24 hours)
Set-MpPreference -SignatureUpdateInterval 12

# Update Microsoft Defender security intelligence
Update-MpSignature
EndPowerShell:

Comment: List Windows Defender properties, settings
StartPowerShell:
function Write-Section {
    param([string]$Title)
    Write-Host ""
    Write-Host "<=== $Title ===>"
}
Write-Section "Protection Status"
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, RealTimeProtectionEnabled, IsTamperProtected, NetworkProtectionStatus | Format-List
Write-Section "Signature / Engine Versions"
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntispywareSignatureVersion | Format-List
Write-Section "Preferences / Configuration"
Get-MpPreference | Select-Object PUAProtection, MAPSReporting, SubmitSamplesConsent, CheckForSignaturesBeforeRunningScan, CloudBlockLevel, EnableNetworkProtection, DisableScriptScanning, DisableArchiveScanning, DisableRemovableDriveScanning, DisableScanningNetworkFiles, DisableScanningMappedNetworkDrivesForFullScan, DisableBlockAtFirstSeen, DisableHeuristics, DisableAutoExclusions | Format-List
Write-Section "Threat Detections"
$threats = Get-MpThreatDetection
if ($threats) {
    $threats | Format-Table -AutoSize
} else {
    Write-Host "  (no threat detections found)"
}
EndPowerShell:

Comment: Enable recovery environment
CMD: bcdedit.exe /set {default} recoveryenabled yes

Comment: Restore original Windows services configuration
StartPowerShell:
Set-Service -Name "Netlogon" -StartupType Manual
Set-Service -Name "BITS" -StartupType Manual
Set-Service -Name "Dhcp" -StartupType Automatic
Set-Service -Name "EventLog" -StartupType Automatic
Set-Service -Name "EventSystem" -StartupType Automatic
Set-Service -Name "nsi" -StartupType Automatic
Set-Service -Name "RasMan" -StartupType Manual
Set-Service -Name "SDRSVC" -StartupType Manual
Set-Service -Name "SstpSvc" -StartupType Manual
Set-Service -Name "TrustedInstaller" -StartupType Manual
Set-Service -Name "VSS" -StartupType Manual
Set-Service -Name "Winmgmt" -StartupType Automatic
Set-Service -Name "wuauserv" -StartupType Manual
EndPowerShell:

Comment: Reset the Windows Update download cache and update catalog database
CMD: net.exe stop bits
CMD: net.exe stop wuauserv
CMD: net.exe stop cryptsvc
CMD: net.exe stop msiserver
CMD: rd /s /q "%SystemRoot%\SoftwareDistribution"
CMD: rd /s /q "%SystemRoot%\System32\catroot2"
CMD: net.exe start msiserver
CMD: net.exe start cryptsvc
CMD: net.exe start wuauserv
CMD: net.exe start bits

Comment: Enable automatic restart after a crash, enable automatic updates
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"AutoReboot"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate"=-

EndRegedit:

Comment: Reset PowerShell execution policy
Powershell: Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force

Comment: Fully reset the Windows network stack, WinHTTP proxy settings, DNS cache, and BITS transfer queue.
Comment: Thanks to AdvancedSetup from Malwarebytes
StartBatch:
ipconfig.exe /flushdns
ipconfig.exe /release
netsh.exe winsock reset catalog
netsh.exe int ip reset
netsh.exe winhttp reset proxy
netsh.exe winhttp reset autoproxy
netsh.exe winhttp reset tracing
EndBatch:

Comment: BITS reset
Startbatch:
@echo off
net.exe stop BITS
ipconfig.exe /flushdns
ren "%programdata%\Microsoft\Network\Downloader\qmgr*.*" qmgr*.*.old
net.exe start BITS
Endbatch:
cmd: bitsadmin.exe /reset /allusers

Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Users\CurrentUserName\AppData\Local\Temp\*
C:\Windows\Temp\*
C:\Windows\SystemTemp\*
C:\Windows\Prefetch\*

Comment: System repair commands
CMD: SFC.exe /scannow
CMD: DISM.exe /Online /Cleanup-image /Restorehealth

Comment: Remove set proxy servers
RemoveProxy:

Comment: Remove temporary files via FRST
EmptyTemp:

End::