Start::
CloseProcesses:

2023-12-05 20:09 - 2023-12-05 20:09 - 000004398 _____ () C:\Users\enzom\AppData\Local\91503071769
2026-05-25 22:18 - 2026-05-25 22:18 - 000000000 ____D C:\Users\enzom\AppData\Roaming\RenPy
CustomCLSID: HKU\S-1-5-21-2875475434-3243608219-2956671516-1001_Classes\CLSID\{227C9E8F-71A1-4B23-9076-682A1A8EAAED}\localserver32 -> "c:\program files\macrium\common\reflectmonitor.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-2875475434-3243608219-2956671516-1001_Classes\CLSID\{9652f312-d16a-252c-2a90-115fc703b61f}\localserver32 -> "C:\Users\enzom\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe" -ToastActivated => No File
AlternateDataStreams: C:\ProgramData\sldh.dat:136096DD5B [4290]
AlternateDataStreams: C:\ProgramData\sldh.dat:F3D162C601 [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\HidHide Configuration Client.lnk:B7B9C8BD2D [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk:4E42ED6D31 [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk:5465085A2F [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk:1DC1525F34 [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk:104946E0EA [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk:7AD7FA8AB1 [4290]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zotero.lnk:3FAA705B12 [4290]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [8356]
FirewallRules: [UDP Query User{FED4DDCC-AA4B-4C2D-A9F7-9AABF4A4EF06}C:\users\enzom\appdata\local\viber\viber.exe] => (Allow) C:\users\enzom\appdata\local\viber\viber.exe => No File
FirewallRules: [TCP Query User{67B4E342-D738-4B92-A8C7-D0FDF7F95516}C:\users\enzom\appdata\local\viber\viber.exe] => (Allow) C:\users\enzom\appdata\local\viber\viber.exe => No File
FirewallRules: [UDP Query User{8149EBBA-42C8-4E87-B5CA-DAB6C5714E0E}C:\games\cyberpunk 2077\bin\x64\cyberpunk 2077.exe] => (Allow) C:\games\cyberpunk 2077\bin\x64\cyberpunk 2077.exe => No File
FirewallRules: [TCP Query User{F1929274-33C2-428E-8A37-93335724D45F}C:\games\cyberpunk 2077\bin\x64\cyberpunk 2077.exe] => (Allow) C:\games\cyberpunk 2077\bin\x64\cyberpunk 2077.exe => No File
FirewallRules: [{A5F291CF-9F97-48DF-998A-0DE54E62C986}] => (Allow) C:\Program Files\MiniTool ShadowMaker\AgentService.exe => No File
FirewallRules: [{378F702C-CFB7-48E9-B381-D05A26E208BF}] => (Allow) C:\Program Files\MiniTool ShadowMaker\AgentService.exe => No File
FirewallRules: [{A6E58478-AFD0-4665-8767-127F3E227364}] => (Allow) C:\Program Files\MiniTool ShadowMaker\AgentService.exe => No File
FirewallRules: [{A59DAB01-B94C-425D-A2F4-A0841587EAE3}] => (Allow) C:\Program Files\MiniTool ShadowMaker\AgentService.exe => No File
FirewallRules: [UDP Query User{92A19DE0-A1E9-4687-9507-7A369F5E1C79}C:\users\enzom\downloads\sdi_r2408\sdi_x64_r2408.exe] => (Allow) C:\users\enzom\downloads\sdi_r2408\sdi_x64_r2408.exe => No File
FirewallRules: [TCP Query User{578AF4D3-8FC5-4103-9D8C-4DF9899A6E35}C:\users\enzom\downloads\sdi_r2408\sdi_x64_r2408.exe] => (Allow) C:\users\enzom\downloads\sdi_r2408\sdi_x64_r2408.exe => No File
FirewallRules: [UDP Query User{0B2DAD1C-AD97-4EC5-9493-E31599107FDE}C:\users\enzom\downloads\sdi_r2408\sdi_r2408.exe] => (Allow) C:\users\enzom\downloads\sdi_r2408\sdi_r2408.exe => No File
FirewallRules: [TCP Query User{5D83E1A9-060E-45DB-8462-8B6D818163C0}C:\users\enzom\downloads\sdi_r2408\sdi_r2408.exe] => (Allow) C:\users\enzom\downloads\sdi_r2408\sdi_r2408.exe => No File
FirewallRules: [UDP Query User{1C350053-53F8-4387-86B9-B5564BD3CB02}C:\users\enzom\appdata\local\programs\vgn hub\vgn hub.exe] => (Allow) C:\users\enzom\appdata\local\programs\vgn hub\vgn hub.exe => No File
FirewallRules: [TCP Query User{67C804C9-17F3-4833-A08D-5C3E6F8958D1}C:\users\enzom\appdata\local\programs\vgn hub\vgn hub.exe] => (Allow) C:\users\enzom\appdata\local\programs\vgn hub\vgn hub.exe => No File
FirewallRules: [{B43D5392-2375-457D-9C34-92546F00A384}] => (Allow) D:\P5XSEA\client\pc\P5X.exe => No File
FirewallRules: [{B6D3BCC1-9C6F-4EEE-A649-669B49CFB6C5}] => (Allow) D:\P5XSEA\client\pc\P5X.exe => No File
FirewallRules: [{E728FB25-5076-4346-B7EC-D6BB6EA099C2}] => (Allow) D:\P5XSEA\P5XLaunch\P5XWebBooster.exe => No File
FirewallRules: [{91D95B33-A872-49AE-876D-54DB2E833AF6}] => (Allow) D:\P5XSEA\P5XLaunch\P5XWebBooster.exe => No File
FirewallRules: [{FD05C414-2471-471F-AF79-A018AE0DBE12}] => (Allow) D:\P5XSEA\P5XLaunch\P5XBrowser.exe => No File
FirewallRules: [{C07E62B7-1702-4BA7-93A5-51049C136110}] => (Allow) D:\P5XSEA\P5XLaunch\P5XBrowser.exe => No File
FirewallRules: [{8ACF7BAE-349B-4239-8D71-AA0E534A5E28}] => (Allow) D:\P5XSEA\P5XLaunch\P5XUpdate.exe => No File
FirewallRules: [{1D1EADAC-65F8-4BDB-8D32-3E0FAD93C6A9}] => (Allow) D:\P5XSEA\P5XLaunch\P5XUpdate.exe => No File
FirewallRules: [{C68DFE21-6A62-4072-8551-85F7B59741DA}] => (Allow) D:\P5XSEA\P5XLaunch\P5XGame.exe => No File
FirewallRules: [{A231AD2B-5B53-4CA1-BFA2-291E40CFEFD0}] => (Allow) D:\P5XSEA\P5XLaunch\P5XGame.exe => No File
FirewallRules: [{8C4BD9EA-8F57-40C5-B018-3558768F7B10}] => (Allow) D:\SteamLibrary\steamapps\common\Devil May Cry 5\DevilMayCry5.exe => No File
FirewallRules: [{9331A615-DEEF-45A4-BB2C-C502C2576428}] => (Allow) D:\SteamLibrary\steamapps\common\Devil May Cry 5\DevilMayCry5.exe => No File
FirewallRules: [UDP Query User{01284AA1-9C07-462F-BBE6-DF3DA86AC6B5}C:\program files\atk v hub\atk v hub.exe] => (Allow) C:\program files\atk v hub\atk v hub.exe => No File
FirewallRules: [TCP Query User{16C39BD2-9A7D-42D8-958A-EB5B7979CC70}C:\program files\atk v hub\atk v hub.exe] => (Allow) C:\program files\atk v hub\atk v hub.exe => No File
FirewallRules: [UDP Query User{04C0D52C-8A37-4E75-A63B-5BDF53063474}C:\users\enzom\downloads\vgn-hub_2.4.4\vgn hub.exe] => (Allow) C:\users\enzom\downloads\vgn-hub_2.4.4\vgn hub.exe => No File
FirewallRules: [TCP Query User{313035A4-B4D5-49FC-8749-34BE4AF4A5ED}C:\users\enzom\downloads\vgn-hub_2.4.4\vgn hub.exe] => (Allow) C:\users\enzom\downloads\vgn-hub_2.4.4\vgn hub.exe => No File
FirewallRules: [UDP Query User{076E5141-7399-40F2-8AC0-6F94842739B1}C:\users\enzom\appdata\local\temp\rar$exa14792.4002\vgn hub.exe] => (Block) C:\users\enzom\appdata\local\temp\rar$exa14792.4002\vgn hub.exe => No File
FirewallRules: [TCP Query User{19FE38DB-FA6C-4E59-8393-906293EB3BE0}C:\users\enzom\appdata\local\temp\rar$exa14792.4002\vgn hub.exe] => (Block) C:\users\enzom\appdata\local\temp\rar$exa14792.4002\vgn hub.exe => No File
FirewallRules: [UDP Query User{618F5885-688C-4ABF-805A-44C92DC72674}C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [TCP Query User{127D65C3-3613-4DFF-9D59-ACA14A78F1EB}C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [UDP Query User{99F03B4F-271C-4E56-BE1D-F045163A8869}D:\steamlibrary\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) D:\steamlibrary\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [TCP Query User{F137C13F-050D-4F04-8921-106DE29DCC2C}D:\steamlibrary\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) D:\steamlibrary\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [{FA59F162-6765-4A9D-9B7A-16BEE2598A9C}] => (Allow) D:\SteamLibrary\steamapps\common\MarvelRivals\MarvelRivals_Launcher.exe => No File
FirewallRules: [{22DBE584-6AF2-491B-8DB0-71D31D28E8D2}] => (Allow) D:\SteamLibrary\steamapps\common\MarvelRivals\MarvelRivals_Launcher.exe => No File
FirewallRules: [UDP Query User{56B44C77-5B27-456E-8EA4-2585E94E3817}D:\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) D:\fortnite\engine\binaries\win64\epicwebhelper.exe => No File
FirewallRules: [TCP Query User{4F0C038C-A2D2-4CCF-B18E-1C0779CC2F42}D:\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) D:\fortnite\engine\binaries\win64\epicwebhelper.exe => No File
FirewallRules: [UDP Query User{B80618A5-0C01-407C-BE77-4A57BF45B267}D:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) D:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [TCP Query User{6D33D272-1B15-43AE-B4A4-CB9705688077}D:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) D:\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [UDP Query User{7757A152-D554-4D42-9825-96114FE787E7}C:\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) C:\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File
FirewallRules: [TCP Query User{52C15621-1C40-451C-A1FB-6958FCCA9909}C:\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) C:\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File
FirewallRules: [UDP Query User{74716C28-F3E8-4256-A447-33F041170846}D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File
FirewallRules: [TCP Query User{6E1219C7-7FFF-452A-8647-7B16F715DF3F}D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File
FirewallRules: [UDP Query User{4C7EFF75-E7E6-4A42-855B-140076387AF6}D:\games\assassin's creed 3 - remastered\acliberation.exe] => (Block) D:\games\assassin's creed 3 - remastered\acliberation.exe => No File
FirewallRules: [TCP Query User{3F239DB1-1B14-4E14-94AE-F24A4C3C3E9E}D:\games\assassin's creed 3 - remastered\acliberation.exe] => (Block) D:\games\assassin's creed 3 - remastered\acliberation.exe => No File
FirewallRules: [UDP Query User{C3C60CAC-CD07-4E3F-AC0F-6119B6848B5D}C:\games\elden ring\advguide\elden ring adventure guide.exe] => (Allow) C:\games\elden ring\advguide\elden ring adventure guide.exe => No File
FirewallRules: [TCP Query User{319400EB-4B51-44A2-A341-1ECABA7F084E}C:\games\elden ring\advguide\elden ring adventure guide.exe] => (Allow) C:\games\elden ring\advguide\elden ring adventure guide.exe => No File
FirewallRules: [UDP Query User{D56265CE-117A-4E51-B325-23B16D86B194}D:\games\assassins creed iii\ac3sp.exe] => (Allow) D:\games\assassins creed iii\ac3sp.exe => No File
FirewallRules: [TCP Query User{F761CB71-1B8C-49A4-957E-F4657CF0774D}D:\games\assassins creed iii\ac3sp.exe] => (Allow) D:\games\assassins creed iii\ac3sp.exe => No File
FirewallRules: [UDP Query User{672BB134-7BAE-492E-B764-240F00F8D424}D:\games\assassin's creed 3 - remastered\aciii.exe] => (Allow) D:\games\assassin's creed 3 - remastered\aciii.exe => No File
FirewallRules: [TCP Query User{D54018E0-9F9F-4BD2-B8B0-992FC5B5F0CA}D:\games\assassin's creed 3 - remastered\aciii.exe] => (Allow) D:\games\assassin's creed 3 - remastered\aciii.exe => No File
FirewallRules: [UDP Query User{8A5D0F9B-DB9E-443E-877D-CB5546A5F3A3}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [TCP Query User{FBCB28FD-AC6B-4499-A823-4095C97657A5}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [{B6C7D129-04FC-4C1B-92CA-EE0402D42886}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe => No File
FirewallRules: [{E0536D9C-E5A4-4713-B307-D59BB1441CC3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe => No File
FirewallRules: [UDP Query User{39CCAB36-1B8A-4AA2-B2FD-2C53F902AD2E}C:\program files (x86)\steam\steamapps\common\tekken 8 demo\polaris\binaries\win64\polaris-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\tekken 8 demo\polaris\binaries\win64\polaris-win64-shipping.exe => No File
FirewallRules: [TCP Query User{4274A7E4-4479-4D04-AB98-7C03DCD2C74A}C:\program files (x86)\steam\steamapps\common\tekken 8 demo\polaris\binaries\win64\polaris-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\tekken 8 demo\polaris\binaries\win64\polaris-win64-shipping.exe => No File
FirewallRules: [UDP Query User{637A9923-A09C-4AC1-AD7B-220BB56D5C9B}D:\games\forza horizon 5\forzahorizon5.exe] => (Allow) D:\games\forza horizon 5\forzahorizon5.exe => No File
FirewallRules: [TCP Query User{5CA9EA09-7726-4116-8604-314CCFC5D96C}D:\games\forza horizon 5\forzahorizon5.exe] => (Allow) D:\games\forza horizon 5\forzahorizon5.exe => No File
FirewallRules: [UDP Query User{C11E7868-9F6C-498B-8C74-8E3F1771F22A}C:\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe] => (Allow) C:\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe => No File
FirewallRules: [TCP Query User{46A42D47-A6F7-4209-8E57-3A38C4F73832}C:\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe] => (Allow) C:\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe => No File
FirewallRules: [UDP Query User{CC06108F-B63B-4D34-A869-E516C6782A5B}C:\games\red dead redemption 2\rdr2.exe] => (Allow) C:\games\red dead redemption 2\rdr2.exe => No File
FirewallRules: [TCP Query User{EE0612CD-D75D-44BC-9FE7-2DB22B6ABC08}C:\games\red dead redemption 2\rdr2.exe] => (Allow) C:\games\red dead redemption 2\rdr2.exe => No File
FirewallRules: [{373B2D33-6C52-4EDD-9727-C68AA74B033C}] => (Allow) D:\Games\Red Dead Redemption 2\RDR2.exe => No File
FirewallRules: [{83A69087-6323-42E7-B157-32200A16BBCC}] => (Allow) D:\Games\Red Dead Redemption 2\RDR2.exe => No File
FirewallRules: [UDP Query User{ED20F72D-7453-47DB-9988-00AEFFB3CE71}C:\users\enzom\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe] => (Allow) C:\users\enzom\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe => No File
FirewallRules: [TCP Query User{3DA0BFB1-400D-4044-8963-13004BF85F31}C:\users\enzom\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe] => (Allow) C:\users\enzom\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe => No File
FirewallRules: [UDP Query User{45A1D740-2455-40F0-9D63-A0C8C324F6B7}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe => No File
FirewallRules: [TCP Query User{4BE2929F-4A65-4A22-8B51-9E101821ED21}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe => No File
FirewallRules: [UDP Query User{3D19A75F-5526-4588-B861-947936B8C19D}C:\users\enzom\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\users\enzom\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe => No File
FirewallRules: [TCP Query User{75FC4E42-9486-45D6-BB93-A1C3AA4E0DA3}C:\users\enzom\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\users\enzom\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe => No File
FirewallRules: [UDP Query User{9284C5E3-6229-4908-A488-DD17251B066A}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [TCP Query User{160F01C6-2E37-4D46-8563-1EF90CDD54D0}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [UDP Query User{2C1CAF17-0C84-42A7-B66E-949752936926}C:\users\enzom\appdata\local\packages\microsoft.4297127d64ec6_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Allow) C:\users\enzom\appdata\local\packages\microsoft.4297127d64ec6_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe => No File
FirewallRules: [TCP Query User{B71EA0E2-023B-40EC-B950-74478B7C0FFB}C:\users\enzom\appdata\local\packages\microsoft.4297127d64ec6_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Allow) C:\users\enzom\appdata\local\packages\microsoft.4297127d64ec6_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe => No File
FirewallRules: [UDP Query User{013D4D81-DD0B-4CAE-B9BD-C238663483EC}C:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [TCP Query User{390213C8-F00D-4A3F-A067-8810E6545F31}C:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [UDP Query User{B86938E0-97E1-4E10-82EA-FCF6ED7C35E9}D:\marvels spiderman remastered\spider-man.exe] => (Allow) D:\marvels spiderman remastered\spider-man.exe => No File
FirewallRules: [TCP Query User{F1C48355-3D22-4EBD-B29C-D39B0C8B5841}D:\marvels spiderman remastered\spider-man.exe] => (Allow) D:\marvels spiderman remastered\spider-man.exe => No File
FirewallRules: [UDP Query User{48C24BAC-9FE4-4863-A2FC-2460ECD9170B}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe => No File
FirewallRules: [TCP Query User{5A4D14B2-328C-4C9E-BDE0-EE3AF48A5C9B}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe => No File
FirewallRules: [{A2CDB7B3-3059-4545-8DD8-1DB92F8EA398}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{86DE6201-FAAC-4D4A-813F-D14B9E7A7430}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [TCP Query User{4B8D03DB-6CB3-4CDD-BD26-63C634D9484E}C:\users\enzom\downloads\persona-5-royal-steamrip.com\p5r\p5r.exe] => (Allow) C:\users\enzom\downloads\persona-5-royal-steamrip.com\p5r\p5r.exe => No File
FirewallRules: [UDP Query User{E3B08675-242A-4791-B25B-38A00F82C962}C:\users\enzom\downloads\persona-5-royal-steamrip.com\p5r\p5r.exe] => (Allow) C:\users\enzom\downloads\persona-5-royal-steamrip.com\p5r\p5r.exe => No File
HKU\S-1-5-21-2875475434-3243608219-2956671516-1001\...\Run: [RiotClient] => C:\Riot Games\Riot Client\RiotClientServices.exe --launch-background-mode (No File)
ShortcutTarget: DS4Windows.lnk -> C:\Users\enzom\Downloads\Compressed\DS4Windows\DS4Windows.exe (No File)
Task: {135B757D-CB04-4C9F-8F3A-462B6B7691FE} - System32\Tasks\AMDRyzenMasterSDKTask => "C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe"  (No File)
Task: {25FB6987-7D71-4858-952D-D05A852BA347} - System32\Tasks\Microsoft\Windows\Clip\ClipESU => %SystemRoot%\system32\clipesu.exe  (No File)
Task: {4E93BF22-4817-45EE-9480-BB5C0B9F23C9} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumer => %SystemRoot%\system32\ClipESUConsumer.exe  -evaluateEligibility (No File)
Task: {21127C1E-DD50-4C9C-8521-AF16CBA5082D} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumerProcessECUpdate => %SystemRoot%\system32\ClipESUConsumer.exe  -persistEligibilityStatus (No File)
Task: {0D98F582-717E-4F91-89F7-A652BF82C767} - System32\Tasks\Microsoft\Windows\Clip\ClipEsuConsumerProcessPreOrder => %SystemRoot%\system32\ClipESUConsumer.exe  -postProcessPreOrder (No File)
Task: {14791A29-D6FB-4313-A3B3-7246BD2FDA87} - System32\Tasks\Microsoft\Windows\Clip\ClipEsuConsumerProcessRefund => %SystemRoot%\system32\ClipESUConsumer.exe  -processRefund (No File)
Task: {9F39E070-FD22-4DFA-8EC8-D343DE372A04} - System32\Tasks\Microsoft\Windows\Clip\EnableClipESU => %SystemRoot%\system32\clipesu.exe  -e (No File)
Task: {E88D9B2C-DDEA-47B2-9582-085153004DB5} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {CAB76809-EDC0-40D2-A888-AD9BEDF4E88A} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {81E49996-EA7E-4A98-AD32-498045DC2BFD} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {9ED2E3BE-F946-4D69-8B36-506B521149FA} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
FF Plugin: @wanmei.com/npArcPlayNowPlugin ->  [No File]
2024-05-31 20:22 - 2024-06-28 12:47 - 000006366 _____ () C:\Users\enzom\AppData\Local\91089552503
2024-03-17 00:12 - 2024-03-17 00:12 - 000006366 _____ () C:\Users\enzom\AppData\Local\91477623837
2024-04-05 22:35 - 2024-04-13 00:03 - 000006366 _____ () C:\Users\enzom\AppData\Local\91810373224
2024-05-04 15:28 - 2024-05-16 00:30 - 000006366 _____ () C:\Users\enzom\AppData\Local\93292989270
2023-11-22 17:50 - 2023-11-22 17:50 - 000003998 _____ () C:\Users\enzom\AppData\Local\9630024665
2025-11-25 01:39 - 2025-11-25 01:39 - 000000048 ____R () C:\Users\enzom\AppData\Local\AC3F4554E3AA77A2488472F7BA146D2A
2024-12-09 17:33 - 2024-12-09 17:33 - 000000048 ____R () C:\Users\enzom\AppData\Local\BC0A7E8C3F4C0A792A1C2E9229F3DF3C
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKU\S-1-5-21-2875475434-3243608219-2956671516-1001\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {3C379660-87B3-41E1-96E4-0088E40F96EF} - System32\Tasks\Brook Divided 43394-516-1001 => C:\Users\enzom\AppData\Local\Advance\8BitDo_Ultimate_Software._Url_152wjlsgtksukab43d2hfrx0qeky3nfz\22f4895c101931b224531583bbebcaf0\pythonw.exe [104280 2026-05-25] (Python Software Foundation -> Python Software Foundation) -> "C:\Users\enzom\AppData\Local\Advance\8BitDo_Ultimate_Software._Url_152wjlsgtksukab43d2hfrx0qeky3nfz\22f4895c101931b224531583bbebcaf0\gamelan.py" <==== ATTENTION

File: C:\Program Files (x86)\IObit\Driver Booster\Pub\sumen.exe
C:\Users\enzom\AppData\Local\Advance\8BitDo_Ultimate_Software._Url_152wjlsgtksukab43d2hfrx0qeky3nfz\22f4895c101931b224531583bbebcaf0


Comment: This snippet reverts SmartScreen settings to default
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"SmartScreenEnabled"="Warn"

[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter]
"EnabledV9"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppHost]
"EnableWebContentEvaluation"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppHost]
"EnableWebContentEvaluation"=dword:00000001

EndRegedit:

Comment: This snippet reverts User Account Control to default
StartRegedit:
Windows Registry Editor Version 5.00
    
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableLUA"=dword:00000001

EndRegedit:

IFEO\SppExtComObj.exe: [VerifierDlls] SppExtComObjHook.dll
IFEO\osppsvc.exe: [VerifierDlls] SppExtComObjHook.dll
2026-05-25 22:22 - 2026-05-25 22:22 - 000003652 _____ C:\WINDOWS\system32\Tasks\Brook Divided 43394-516-1001

StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

StartPowerShell:
# Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console
# Does not clean preinstalled objects, only PUP/Adware
# If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument
# If you would like to only scan with it, change the argument from /clean to /scan
# NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software.
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:

Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code.
Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) }


Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z

Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy

Comment: System repair commands
CMD: DISM.exe /Online /Cleanup-image /Restorehealth
CMD: SFC.exe /scannow

Comment: Network reset commands
CMD: netsh int ip reset
CMD: netsh int ipv6 reset
CMD: ipconfig /flushDNS
CMD: netsh winsock reset catalog

Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Users\CurrentUserName\AppData\Local\Temp\*
C:\Windows\Temp\*
C:\Windows\SystemTemp\*

EmptyTemp:
End::