Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:

FirewallRules: [{70D016E6-FF8A-4732-B99A-EE0023334401}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{04CBDCA7-09B0-4606-8499-FDFF2588F587}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{3B9FF542-1041-42DB-B430-4C450BD52964}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{9586AE9E-16CA-4DBE-AAC2-00BEBD31C9F3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
CustomCLSID: HKU\S-1-5-21-1787771925-2575633184-3858954954-1001_Classes\CLSID\{89b2b650-c4dd-d68b-46e7-3176f1973c8b}\localserver32 -> "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" -ToastActivated => No File
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [6792]
AlternateDataStreams: C:\Users\user\Application Data:18adeef6ac3a2efac06bdc700a16e9d6 [394]
AlternateDataStreams: C:\Users\user\Application Data:5a7a7919109c97d615ad7581cd492710 [394]
AlternateDataStreams: C:\Users\user\AppData\Roaming:18adeef6ac3a2efac06bdc700a16e9d6 [394]
AlternateDataStreams: C:\Users\user\AppData\Roaming:5a7a7919109c97d615ad7581cd492710 [394]
AlternateDataStreams: C:\Users\user\AppData\Local\Temp:{67AD6FA5-2A7D-47de-A0C4-F04C8F26F841} [0]
FirewallRules: [{448E4009-591C-4AC0-B288-AA1F7C31FEF6}] => (Allow) C:\Program Files\FlashIntegro\VideoEditor\VideoEditor.exe => No File
FirewallRules: [{9F3F59CC-170C-4E90-8509-147A2B4AA83D}] => (Allow) C:\Program Files\FlashIntegro\VideoEditor\VideoEditor.exe => No File
FirewallRules: [{A0D51CE9-0516-4F82-9338-62C385730946}] => (Allow) C:\Program Files\FlashIntegro\VideoEditor\Activation.exe => No File
FirewallRules: [{46E56BAF-A1CA-4E52-A6CC-06BDC6C5EB1B}] => (Allow) C:\Program Files\FlashIntegro\VideoEditor\Activation.exe => No File
FirewallRules: [{05A91701-ECBD-4E3C-A50C-0B42DD4B0B74}] => (Allow) C:\Program Files\FlashIntegro\VideoEditor\Updater.exe => No File
FirewallRules: [{4BC746EE-51F9-4EC4-8905-9EBBDE26822D}] => (Allow) C:\Program Files\FlashIntegro\VideoEditor\Updater.exe => No File
FirewallRules: [{3899BF75-D05C-45BA-9B8D-766D74B9E5A9}] => (Allow) C:\ProgramData\Nexon\NGM\NGM.exe => No File
FirewallRules: [{5B4868AB-B2B5-41E5-BF0E-4D2B5840A6BF}] => (Allow) C:\ProgramData\Nexon\NGM\NGM.exe => No File
FirewallRules: [{E37DA2C6-F594-41BD-98D4-C1C4D0649107}] => (Allow) C:\ProgramData\Nexon\Common\NMService.exe => No File
FirewallRules: [{F360093E-C681-4A96-BC20-A30219D95AAB}] => (Allow) C:\ProgramData\Nexon\Common\NMService.exe => No File
FirewallRules: [{1B125845-A5A6-4241-8BDF-AA876B2E3E61}] => (Allow) C:\ProgramData\Nexon\NGM\NGM64.exe => No File
FirewallRules: [{A076646B-DE1B-47D5-855C-51747584D4D3}] => (Allow) C:\ProgramData\Nexon\NGM\NGM64.exe => No File
FirewallRules: [{69A30F48-1E28-485C-8B16-7DEBEBEC0544}] => (Allow) C:\ProgramData\Nexon\Common\NexonMessenger.exe => No File
FirewallRules: [{6FA3BDF5-A63B-4297-945B-0057D85E222A}] => (Allow) C:\ProgramData\Nexon\Common\NexonMessenger.exe => No File
FirewallRules: [{F6CB8A58-AD28-4DD9-B85D-30F5626173EC}] => (Allow) C:\ProgramData\Nexon\Common\NexonMessenger.exe => No File
FirewallRules: [{4B21A418-4ACF-4112-B877-D6614A552AC4}] => (Allow) C:\ProgramData\Nexon\Common\NexonMessenger.exe => No File
FirewallRules: [{1EBB2C9D-9AC5-4D60-A147-C70E5AC0CB4B}] => (Allow) C:\Program Files (x86)\LetsView\LetsView\LetsView.exe => No File
FirewallRules: [{2028F3A3-07FC-4843-98F0-8AA768B52EEB}] => (Allow) C:\Program Files (x86)\LetsView\LetsView\LetsView.exe => No File
FirewallRules: [{FF3A2F20-8D6B-4A1B-A1AE-929449CC5FB3}] => (Allow) C:\Users\user\AppData\Roaming\Streamlabs\Streamlabs Chatbot\Streamlabs Chatbot.exe => No File
FirewallRules: [{DA97E8F9-9220-49A3-927D-2ACF3EDD68C7}] => (Allow) C:\Users\user\AppData\Roaming\Streamlabs\Streamlabs Chatbot\Streamlabs Chatbot.exe => No File
FirewallRules: [{4BB23042-3CAA-47C2-8B88-442031F8EF7C}] => (Allow) C:\Users\user\AppData\Roaming\Streamlabs\Streamlabs Chatbot\Streamlabs Chatbot.exe => No File
FirewallRules: [{DB9D0388-756C-40DC-901D-B149A91A2C44}] => (Allow) C:\Users\user\AppData\Roaming\Streamlabs\Streamlabs Chatbot\Streamlabs Chatbot.exe => No File
FirewallRules: [TCP Query User{3506F224-D33A-4079-B235-6C1842EEC118}C:\users\user\appdata\local\vysor\app-3.1.4\vysor.exe] => (Allow) C:\users\user\appdata\local\vysor\app-3.1.4\vysor.exe => No File
FirewallRules: [UDP Query User{89A5643D-F9A2-4C3E-A10A-40425DF4E311}C:\users\user\appdata\local\vysor\app-3.1.4\vysor.exe] => (Allow) C:\users\user\appdata\local\vysor\app-3.1.4\vysor.exe => No File
FirewallRules: [TCP Query User{783A3185-D7CF-4D00-9B04-9AF3BFFAF36D}C:\users\user\appdata\local\roblox\versions\version-0ffd0cc0630345e3\robloxstudiobeta.exe] => (Allow) C:\users\user\appdata\local\roblox\versions\version-0ffd0cc0630345e3\robloxstudiobeta.exe => No File
FirewallRules: [UDP Query User{C325DAA9-D9AD-46F0-8833-578BF049A0CE}C:\users\user\appdata\local\roblox\versions\version-0ffd0cc0630345e3\robloxstudiobeta.exe] => (Allow) C:\users\user\appdata\local\roblox\versions\version-0ffd0cc0630345e3\robloxstudiobeta.exe => No File
FirewallRules: [TCP Query User{A8A0FEE7-7A15-4F7B-8DEE-367BB672B583}C:\users\user\desktop\a.dance.of.fire.and.ice.build.5305294\a dance of fire and ice\a dance of fire and ice.exe] => (Allow) C:\users\user\desktop\a.dance.of.fire.and.ice.build.5305294\a dance of fire and ice\a dance of fire and ice.exe => No File
FirewallRules: [UDP Query User{EBBDEE00-F5CD-4904-B8F1-6CAB27379787}C:\users\user\desktop\a.dance.of.fire.and.ice.build.5305294\a dance of fire and ice\a dance of fire and ice.exe] => (Allow) C:\users\user\desktop\a.dance.of.fire.and.ice.build.5305294\a dance of fire and ice\a dance of fire and ice.exe => No File
FirewallRules: [{0087C332-E36B-4E62-A5FA-50AE998D7DE2}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File
FirewallRules: [{821D8043-57D8-40E6-9E3B-224720F307FB}] => (Allow) C:\Program Files\Nox\bin\Nox.exe => No File
FirewallRules: [{F77963B8-533C-4258-859B-574A1611BF1A}] => (Allow) C:\Program Files (x86)\Bignox\BigNoxVM\RT\NoxVMHandle.exe => No File
FirewallRules: [{3E125C33-80EF-4AAA-8EE2-38B4069C0E1F}] => (Allow) C:\Users\user\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => No File
FirewallRules: [{B88BFC90-8928-4F1B-B042-83AE9CF61DA6}] => (Allow) C:\Users\user\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => No File
FirewallRules: [TCP Query User{8B930EFA-D244-46DB-82F6-7FBEBCE78C3A}C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.7b\phoenixminer.exe] => (Allow) C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.7b\phoenixminer.exe => No File
FirewallRules: [UDP Query User{1246DE25-0733-467F-9B0C-8B96CA49B2E3}C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.7b\phoenixminer.exe] => (Allow) C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.7b\phoenixminer.exe => No File
FirewallRules: [{20950B18-6F6D-439D-A658-B721533B8812}] => (Block) C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.7b\phoenixminer.exe => No File
FirewallRules: [{9583D16A-7183-4724-BD85-E23DF684A6A1}] => (Block) C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.7b\phoenixminer.exe => No File
FirewallRules: [TCP Query User{854B7A37-A4BF-4901-B4F4-4A726A06BC5D}C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.5c\phoenixminer.exe] => (Block) C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.5c\phoenixminer.exe => No File
FirewallRules: [UDP Query User{CFACFC40-6198-4DD5-B48B-DCAF70D61EE6}C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.5c\phoenixminer.exe] => (Block) C:\users\user\appdata\roaming\salad\plugin-bin\phoenixminer-5.5c\phoenixminer.exe => No File
FirewallRules: [TCP Query User{6331F8DF-C350-4386-8AE4-74AAAFC3DFA3}C:\users\user\appdata\local\discord\app-1.0.9003\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9003\discord.exe => No File
FirewallRules: [UDP Query User{C3B5F52C-15FA-4FB2-8CEF-C2C087087F47}C:\users\user\appdata\local\discord\app-1.0.9003\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9003\discord.exe => No File
FirewallRules: [{92DAB8A9-3471-4F98-A149-568F3CA4028C}] => (Block) C:\users\user\appdata\local\discord\app-1.0.9003\discord.exe => No File
FirewallRules: [{03E12D17-D98A-4A63-A416-B44FA7364DDF}] => (Block) C:\users\user\appdata\local\discord\app-1.0.9003\discord.exe => No File
FirewallRules: [TCP Query User{876E58DC-2C95-4914-8698-F8BB60EFD15B}C:\users\user\appdata\local\discord\app-1.0.9004\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9004\discord.exe => No File
FirewallRules: [UDP Query User{79831B38-CB36-485C-AF60-F62D03B32AE1}C:\users\user\appdata\local\discord\app-1.0.9004\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9004\discord.exe => No File
FirewallRules: [{EA934A59-6AE2-432C-9C49-DE0C595C6478}] => (Block) C:\users\user\appdata\local\discord\app-1.0.9004\discord.exe => No File
FirewallRules: [{63CA374D-D503-4B4C-81AD-973F0B08D4CC}] => (Block) C:\users\user\appdata\local\discord\app-1.0.9004\discord.exe => No File
FirewallRules: [TCP Query User{84FC750E-190F-4549-8EAD-73CBFA6F1EA7}C:\users\user\appdata\local\programs\badpanda-react\gif your game.exe] => (Allow) C:\users\user\appdata\local\programs\badpanda-react\gif your game.exe => No File
FirewallRules: [UDP Query User{22970947-5181-4A93-82F6-C37818A97F61}C:\users\user\appdata\local\programs\badpanda-react\gif your game.exe] => (Allow) C:\users\user\appdata\local\programs\badpanda-react\gif your game.exe => No File
FirewallRules: [TCP Query User{3607BF65-893B-47FE-8532-072EE15F6C45}C:\users\user\appdata\local\vortxengine\app-2.2.25\signal-x64\signalrgb.exe] => (Allow) C:\users\user\appdata\local\vortxengine\app-2.2.25\signal-x64\signalrgb.exe => No File
FirewallRules: [UDP Query User{929D1BB3-D1B2-4B48-9F42-F674F3304DE8}C:\users\user\appdata\local\vortxengine\app-2.2.25\signal-x64\signalrgb.exe] => (Allow) C:\users\user\appdata\local\vortxengine\app-2.2.25\signal-x64\signalrgb.exe => No File
FirewallRules: [{FF3AF3B5-512E-4E5D-8D09-324D403B48B6}] => (Block) C:\users\user\appdata\local\vortxengine\app-2.2.25\signal-x64\signalrgb.exe => No File
FirewallRules: [{22613985-72FD-4AC9-BEF7-C5CFB992495E}] => (Block) C:\users\user\appdata\local\vortxengine\app-2.2.25\signal-x64\signalrgb.exe => No File
FirewallRules: [TCP Query User{D30E2F00-4477-4D38-B70B-B0255B17352B}C:\users\user\appdata\local\discord\app-1.0.9007\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9007\discord.exe => No File
FirewallRules: [UDP Query User{956928CA-4401-4440-AF3B-4AECC9DC7B11}C:\users\user\appdata\local\discord\app-1.0.9007\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9007\discord.exe => No File
FirewallRules: [TCP Query User{B37EC87D-A4BC-40B2-8CB1-69776452877D}C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe => No File
FirewallRules: [UDP Query User{ECF7FFEC-D809-46B3-901C-4579D8D641D0}C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe => No File
FirewallRules: [{430BBA79-EC96-40C6-844C-479B942D6521}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent Web\btweb.exe => No File
FirewallRules: [{B93379A9-B596-474C-821C-A229DFC46C49}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent Web\btweb.exe => No File
FirewallRules: [{90C71C44-2E4F-4232-ABDB-73ECDF79E15E}] => (Allow) C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe => No File
FirewallRules: [TCP Query User{9ABDFBCA-3785-43D9-BB8A-2DEA2410A6E6}C:\program files\resanance\resanance.exe] => (Allow) C:\program files\resanance\resanance.exe => No File
FirewallRules: [UDP Query User{9818F4A7-1FFA-4F39-95B1-797384E90AD4}C:\program files\resanance\resanance.exe] => (Allow) C:\program files\resanance\resanance.exe => No File
FirewallRules: [TCP Query User{81E4E657-31D9-416B-8E3E-962072BC95CC}C:\program files (x86)\overwatch\_retail_\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\_retail_\overwatch.exe => No File
FirewallRules: [UDP Query User{149D707A-147F-4526-BB7E-2DFC6B88FFC9}C:\program files (x86)\overwatch\_retail_\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\_retail_\overwatch.exe => No File
FirewallRules: [TCP Query User{D467E720-8004-4D7B-A6BD-97839DE89DB4}C:\users\user\desktop\geometry.dash.v07.24.2021\geometry.dash.v07.24.2021\geometrydash.exe] => (Allow) C:\users\user\desktop\geometry.dash.v07.24.2021\geometry.dash.v07.24.2021\geometrydash.exe => No File
FirewallRules: [UDP Query User{FCAF6829-1922-42F9-B23A-0E4834E1273F}C:\users\user\desktop\geometry.dash.v07.24.2021\geometry.dash.v07.24.2021\geometrydash.exe] => (Allow) C:\users\user\desktop\geometry.dash.v07.24.2021\geometry.dash.v07.24.2021\geometrydash.exe => No File
FirewallRules: [{6F06D4A9-95EA-49DF-9F78-7EA87E8A638A}] => (Block) C:\users\user\desktop\geometry.dash.v07.24.2021\geometry.dash.v07.24.2021\geometrydash.exe => No File
FirewallRules: [{BBBBA662-1A0B-44CF-BBEC-6E362143DE8A}] => (Block) C:\users\user\desktop\geometry.dash.v07.24.2021\geometry.dash.v07.24.2021\geometrydash.exe => No File
FirewallRules: [TCP Query User{2CA1C211-3144-4CCA-A579-20A01472AD7A}C:\program files\epic games\fallguys\fallguys_client_game.exe] => (Allow) C:\program files\epic games\fallguys\fallguys_client_game.exe => No File
FirewallRules: [UDP Query User{D714AB96-0CEF-4D9B-B011-B016928108DD}C:\program files\epic games\fallguys\fallguys_client_game.exe] => (Allow) C:\program files\epic games\fallguys\fallguys_client_game.exe => No File
FirewallRules: [TCP Query User{370F5786-B8FD-4512-8F97-E0947ACD5128}C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe => No File
FirewallRules: [UDP Query User{3527A6CC-0E0B-49E9-B655-0D2B7B97B77D}C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\fps chess\fpschess\binaries\win64\fpschess-win64-shipping.exe => No File
FirewallRules: [{AE2CD2E2-417F-47DB-896B-FF2748278139}] => (Allow) C:\Windows\System32\DriverStore\FileRepository\asussci2.inf_amd64_4fc38a913e0f2ea5\ASUSLinkRemote\AsusLinkRemoteAgent.exe => No File
FirewallRules: [{B3B33CDD-FDD5-427E-AA29-B66558D1CA48}] => (Allow) C:\Windows\System32\DriverStore\FileRepository\asussci2.inf_amd64_4fc38a913e0f2ea5\ASUSLinkRemote\AsusLinkRemoteAgent.exe => No File
FirewallRules: [TCP Query User{0C228A05-BA19-46FA-AEEE-33B0995D6D56}C:\users\user\appdata\local\programs\nicehash miner\miner_plugins\eb75e920-94eb-11ea-a64d-17be303ea466\bins\22.0\1.76a\lolminer.exe] => (Allow) C:\users\user\appdata\local\programs\nicehash miner\miner_plugins\eb75e920-94eb-11ea-a64d-17be303ea466\bins\22.0\1.76a\lolminer.exe => No File
FirewallRules: [UDP Query User{A4CCCDA9-3521-485E-AC2B-3B7D11D62977}C:\users\user\appdata\local\programs\nicehash miner\miner_plugins\eb75e920-94eb-11ea-a64d-17be303ea466\bins\22.0\1.76a\lolminer.exe] => (Allow) C:\users\user\appdata\local\programs\nicehash miner\miner_plugins\eb75e920-94eb-11ea-a64d-17be303ea466\bins\22.0\1.76a\lolminer.exe => No File
FirewallRules: [TCP Query User{BD46852E-676F-450F-B348-66C5BB10F34A}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [UDP Query User{20DFE1B2-720B-477F-AEF7-9AA09CB41748}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (No File)
HKLM\...\Run: [UniConverterUpdateHelper] => C:\Program Files (x86)\Wondershare\Wondershare UniConverter 14 for Windows (CPC)\WSVCUUpdateHelper.exe (No File)
HKU\S-1-5-21-1787771925-2575633184-3858954954-1001\...\Run: [SignalRgb] => "C:\Users\user\AppData\Local\VortxEngine\SignalRgbLauncher.exe" --silent (No File)
HKU\S-1-5-21-1787771925-2575633184-3858954954-1001\...\Run: [btweb] => "C:\Users\user\AppData\Roaming\BitTorrent Web\btweb.exe" /MINIMIZED (No File)
Task: {F14FAF03-0C17-4DED-89D9-A9B4F1D9DDE5} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe  (No File)
FF Plugin: @videolan.org/vlc,version=3.0.16 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @nexon.com/NxGame -> C:\ProgramData\Nexon\NGM\npNxGame.dll [No File]
U3 aswbdisk; no ImagePath
S2 speedfan; \??\C:\Windows\SysWOW64\speedfan.sys (No File)
S3 VOICEMOD_Driver; \SystemRoot\system32\drivers\mvvad.sys (No File)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

StartPowerShell:
# This snippet uses Sysinternals Sigcheck to upload file on VirusTotal.
# Change the line containing the string "INSERTFILEPATHHERE" to the desired filepath
# ---
# It displays the following: entropy, file hashes, catalog name & signing chain, VirusTotal scan results and link to it.
# It is also able to traverse symbolic links and directory junctions.
# ---
# NOTE: If the file is not known prior, it gets uploaded to VirusTotal and the result will be available in a few minutes. 
#       You can search up the report by visiting the URL "https://www.virustotal.com/gui/file/<SHA256>"
$TempDir = [System.IO.Path]::GetTempPath()
$ZipPath = Join-Path $TempDir "SigcheckFRST.zip"
$ExtractPath = Join-Path $TempDir "SigcheckFRST"
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Sigcheck.zip" -OutFile $ZipPath -UseBasicParsing
if (Test-Path $ExtractPath) { Remove-Item $ExtractPath -Recurse -Force }
Expand-Archive -Path $ZipPath -DestinationPath $ExtractPath -Force
$SigcheckExe = Join-Path $ExtractPath "sigcheck.exe"
if (Test-Path $SigcheckExe) {
    $psi = New-Object System.Diagnostics.ProcessStartInfo
    $psi.FileName = $SigcheckExe
    $psi.Arguments = '-accepteula -a -h -i -m -l -vt -vs -nobanner "C:\Windows\SysWOW64\TUCTLSystem.exe"'
    $psi.RedirectStandardOutput = $true
    $psi.StandardOutputEncoding = [System.Text.Encoding]::Unicode
    $psi.UseShellExecute = $false
    $psi.CreateNoWindow = $true
    $p = [System.Diagnostics.Process]::Start($psi)
    $output = $p.StandardOutput.ReadToEnd()
    $p.WaitForExit()
    Write-Output $output
} else {
    Write-Host "Error: Sigcheck does not exist"
}
Remove-Item $ZipPath -Force
EndPowerShell:

R2 TUCtlSystem; C:\Windows\SysWOW64\TUCTLSystem.exe [383856 2021-10-27] (Teruten, Inc. -> Teruten.inc) <==== ATTENTION
C:\Windows\SysWOW64\TUCTLSystem.exe

StartPowershell:
# This snippet removes all Windows Defender exclusions
Try {
    $Paths=(Get-MpPreference).ExclusionPath
    $Extensions=(Get-MpPreference).ExclusionExtension
    $Processes=(Get-MpPreference).ExclusionProcess
    
    foreach ($Path in $Paths) { 
        Remove-MpPreference -ExclusionPath $Path -force -ErrorAction Stop
    }
    foreach ($Extension in $Extensions) { 
        Remove-MpPreference -ExclusionExtension $Extension -force -ErrorAction Stop
    }
    foreach ($Process in $Processes) { 
        Remove-MpPreference -ExclusionProcess $Process -force -ErrorAction Stop
    }
}
Catch {
    Write-Error "Error occurred while removing Windows Defender exclusions: $_"
}
EndPowershell:

Comment: This snippet reverts User Account Control to default
StartRegedit:
Windows Registry Editor Version 5.00
    
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableLUA"=dword:00000001

EndRegedit:

Folder: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62

IFEO\WINDOWS10UPGRADERAPP.EXE: [Debugger] *
IFEO\Windows10Upgrade.exe: [Debugger] *
IFEO\WaasMedicAgent.exe: [Debugger] *
IFEO\WaaSMedic.exe: [Debugger] *
IFEO\UsoClient.exe: [Debugger] *
IFEO\UPFC.EXE: [Debugger] *
IFEO\UpdateAssistant.exe: [Debugger] *
IFEO\SIHClient.exe: [Debugger] *
IFEO\remsh.exe: [Debugger] *
IFEO\MUSNOTIFICATIONUX.EXE: [Debugger] *
IFEO\MusNotification.exe: [Debugger] *
IFEO\InstallAgent.exe: [Debugger] *
IFEO\EOSNOTIFY.EXE: [Debugger] *
IFEO\dismHost.exe: [Debugger] *

2021-10-03 03:57 - 2019-12-07 11:10 - 000065440 _____ (Microsoft Corporation) C:\Users\user\AppData\Roaming\RegAsm.exe
2021-10-03 03:56 - 2021-10-03 03:56 - 000893608 _____ (AutoIt Team) C:\Users\user\AppData\Roaming\Irrequieto.exe.com
2021-10-03 02:56 - 2021-10-03 09:01 - 000000203 _____ () C:\Users\user\AppData\Roaming\jjv5conf.json

StartPowerShell:
# This snippet downloads Emsisoft Emergency Kit (EEK) from the Emsisoft's official site, updates it, scans with it.
# Do note that the executable is 300MB and may take some time to download.
# ---
# This will scan for malware and PUP's in 1) system memory 2) important folders as documentation says
# It will scan in compressed archives, in mail archives, in NTFS alternate data streams and use cloud requests
# ---
# You can use argument "/delete" to delete found objects including references but this is permanent and irreversible.
# You can remove the "/quick" argument to do a full scan but that may take longer than what FRST can handle.
# You can use argument "/quarantine="[folder]"" to put found malware into quarantine, but I personally prefer first verifying the detections.
$downloadUrl = "https://dl.emsisoft.com/EmsisoftEmergencyKit.exe"
$systemDrive = $env:SystemDrive
$frstPath = "$systemDrive\FRST"
$savePath = "$frstPath\EEK.exe"
$extractPath = "$frstPath\EEK"
if (-not (Test-Path $frstPath)) {
    New-Item -Path $frstPath -ItemType Directory -Force | Out-Null
}
if (-not (Test-Path $extractPath)) {
    New-Item -Path $extractPath -ItemType Directory -Force | Out-Null
}
Invoke-WebRequest -Uri $downloadUrl -OutFile $savePath -UseBasicParsing
$proc = Start-Process -FilePath $savePath -ArgumentList "-s -d`"$extractPath`"" -PassThru
while (-not (Test-Path "$extractPath\bin64\a2cmd.exe")) { Start-Sleep -Milliseconds 1000 }
Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
if ([Environment]::Is64BitOperatingSystem) {
    $a2cmdPath = Join-Path $extractPath "bin64\a2cmd.exe"
} else {
    $a2cmdPath = Join-Path $extractPath "bin32\a2cmd.exe"
}
Start-Process -FilePath $a2cmdPath -ArgumentList "/update" -Wait -NoNewWindow
Start-Process -FilePath $a2cmdPath -ArgumentList "/malware /quick /m /t /pup /a /am /cloud=1 /la=`"$frstPath\EEK_scan.log`"" -Wait -NoNewWindow
Get-Content "$frstPath\EEK_scan.log"
exit
EndPowerShell:


StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

StartPowerShell:
# Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console
# Does not clean preinstalled objects, only PUP/Adware
# If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument
# If you would like to only scan with it, change the argument from /clean to /scan
# NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software.
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:

Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z

Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy

Comment: Network reset commands
CMD: netsh int ip reset
CMD: netsh int ipv6 reset
CMD: ipconfig /flushDNS
CMD: netsh winsock reset catalog

Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Users\CurrentUserName\AppData\Local\Temp\*
C:\Windows\Temp\*
C:\Windows\SystemTemp\*

EmptyTemp:
End::