Start::
CreateRestorePoint:
CloseProcesses:

CustomCLSID: HKU\S-1-5-21-1070632220-2695763294-3121136582-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File
ShellIconOverlayIdentifiers: [      .WorkspaceExt0] -> {C568C78A-652C-425B-8E6B-FFA73043302D} =>  -> No File
ShellIconOverlayIdentifiers: [      .WorkspaceExt1] -> {2A6FE247-5DA3-4732-9626-77820518FD77} =>  -> No File
ShellIconOverlayIdentifiers: [      .WorkspaceExt2] -> {FF895810-293B-464A-93F2-82D11E07EEC8} =>  -> No File
AlternateDataStreams: C:\WINDOWS\tracing:? [16]
AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442]
AlternateDataStreams: C:\ProgramData\system.conf:0F57F3FDE6 [3442]
AlternateDataStreams: C:\ProgramData\system.conf:422D4106AB [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk:075A04AA92 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2022.lnk:638138415C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publish or Perish 8.lnk:FE1FDDE9FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zotero.lnk:3FAA705B12 [3442]
AlternateDataStreams: C:\Users\Public\Documents\rsEngine.config.backup:AC0747FD1A [3442]
AlternateDataStreams: C:\Users\Rifky Fauzan\Desktop\FRST64.exe:MBAM.Zone.Identifier [450]
FirewallRules: [{5CF33C7C-9C4B-4D88-91F8-B9B0A32A15E9}] => (Allow) C:\Program Files\ASUS\ARMOURY CRATE Service\MobilePlugin\AutoConnectHelper.exe => No File
FirewallRules: [UDP Query User{3F1AE855-F431-4393-8E46-C49729F4D476}C:\programdata\sony interactive entertainment inc\pspc_sdk\s22\2.50.00.10\webview2runtime\msedgewebview2.exe] => (Allow) C:\programdata\sony interactive entertainment inc\pspc_sdk\s22\2.50.00.10\webview2runtime\msedgewebview2.exe => No File
FirewallRules: [TCP Query User{54DB7925-A4EC-45F0-8632-A945A8B723D9}C:\programdata\sony interactive entertainment inc\pspc_sdk\s22\2.50.00.10\webview2runtime\msedgewebview2.exe] => (Allow) C:\programdata\sony interactive entertainment inc\pspc_sdk\s22\2.50.00.10\webview2runtime\msedgewebview2.exe => No File
FirewallRules: [UDP Query User{ECD5E675-829F-413D-B27D-12C933B05D4D}D:\game steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) D:\game steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [TCP Query User{889B115C-E55E-4B50-9822-4BB7D30F1026}D:\game steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) D:\game steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [UDP Query User{940F5700-1D2B-4589-8175-3AACD46FB157}C:\program files (x86)\folder baru\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [TCP Query User{BD6E96E4-3217-43D5-99F2-3F8131DDD58D}C:\program files (x86)\folder baru\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [UDP Query User{445BE85C-A77E-4391-BA35-EF7307F6F525}C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe => No File
FirewallRules: [TCP Query User{4161C662-A62A-4EDE-97B1-790EB99A8005}C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe => No File
FirewallRules: [{4340252b-18ee-4443-aac6-778ad3ab8082}] => (Allow) D:\LDPlayer\LDPlayer9\dnplayer.exe => No File
FirewallRules: [UDP Query User{F708FF28-B402-412E-8EE3-919C17B487B0}D:\game xbox\world war z\content\wwzretail.exe] => (Allow) D:\game xbox\world war z\content\wwzretail.exe => No File
FirewallRules: [TCP Query User{B5ECDF31-3AE5-4F07-AB40-AAE4317FFA04}D:\game xbox\world war z\content\wwzretail.exe] => (Allow) D:\game xbox\world war z\content\wwzretail.exe => No File
FirewallRules: [UDP Query User{1146AD65-D285-4F24-85C5-60CFDEEEC157}D:\game bajakan\pico park\pico_park.exe] => (Allow) D:\game bajakan\pico park\pico_park.exe => No File
FirewallRules: [TCP Query User{26119B60-B9DF-4B8B-B061-28A13D9FC32C}D:\game bajakan\pico park\pico_park.exe] => (Allow) D:\game bajakan\pico park\pico_park.exe => No File
FirewallRules: [UDP Query User{4C0D1EFE-ECB2-470E-BB08-20647E333E2E}D:\game epic\redout2\redout2\binaries\win64\redout2-win64-shipping.exe] => (Allow) D:\game epic\redout2\redout2\binaries\win64\redout2-win64-shipping.exe => No File
FirewallRules: [TCP Query User{990B1525-3467-4319-9723-7B1506B39F08}D:\game epic\redout2\redout2\binaries\win64\redout2-win64-shipping.exe] => (Allow) D:\game epic\redout2\redout2\binaries\win64\redout2-win64-shipping.exe => No File
FirewallRules: [UDP Query User{C921B8B4-4356-4CCB-8D7B-355F2C1B480A}C:\users\rifky fauzan\appdata\local\discord\app-1.0.9147\discord.exe] => (Allow) C:\users\rifky fauzan\appdata\local\discord\app-1.0.9147\discord.exe => No File
FirewallRules: [TCP Query User{C41EE502-8670-4561-9C53-44652E48BD67}C:\users\rifky fauzan\appdata\local\discord\app-1.0.9147\discord.exe] => (Allow) C:\users\rifky fauzan\appdata\local\discord\app-1.0.9147\discord.exe => No File
FirewallRules: [UDP Query User{1FD0FB0B-21D5-4A55-B66F-DF1753779758}D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File
FirewallRules: [TCP Query User{39738E79-3815-4DF5-A7A6-DF2C78482272}D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) D:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File
FirewallRules: [UDP Query User{99B9877D-C885-438A-8893-B803A9D91117}D:\game bajakan\pummel party\pummelparty.exe] => (Allow) D:\game bajakan\pummel party\pummelparty.exe => No File
FirewallRules: [TCP Query User{36AF805F-5FED-431F-9361-8EC964630665}D:\game bajakan\pummel party\pummelparty.exe] => (Allow) D:\game bajakan\pummel party\pummelparty.exe => No File
FirewallRules: [{B5414662-D5A3-4954-B21C-E116DB2217AB}] => (Allow) C:\Program Files (x86)\360\Total Security\360TsLiveUpd.exe => No File
FirewallRules: [{C21D619A-75EF-4BF8-87D3-6B2C9FDB9CDD}] => (Allow) C:\Program Files (x86)\360\Total Security\360TsLiveUpd.exe => No File
FirewallRules: [{3D0645C8-15F1-49B0-9651-2594E26DF931}] => (Allow) C:\Users\Rifky Fauzan\AppData\Roaming\BitTorrent\BitTorrent.exe => No File
FirewallRules: [{E71B8812-A841-4143-A80A-DD5B58B1B223}] => (Allow) C:\Users\Rifky Fauzan\AppData\Roaming\BitTorrent\BitTorrent.exe => No File
FirewallRules: [UDP Query User{88197C24-CC8E-418F-A522-43E43D48183E}D:\game bajakan\ready or not\readyornot\binaries\win64\readyornot-win64-shipping.exe] => (Allow) D:\game bajakan\ready or not\readyornot\binaries\win64\readyornot-win64-shipping.exe => No File
FirewallRules: [TCP Query User{410D2F41-FEF6-4B89-A64B-98FC7471774A}D:\game bajakan\ready or not\readyornot\binaries\win64\readyornot-win64-shipping.exe] => (Allow) D:\game bajakan\ready or not\readyornot\binaries\win64\readyornot-win64-shipping.exe => No File
FirewallRules: [UDP Query User{626DC06D-4AAC-445A-82FC-B7F40315017F}D:\game epic\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\game epic\rocketleague\binaries\win64\rocketleague.exe => No File
FirewallRules: [TCP Query User{4D2A4A34-47E0-48E8-9E33-4EE988F21E26}D:\game epic\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\game epic\rocketleague\binaries\win64\rocketleague.exe => No File
FirewallRules: [UDP Query User{7E97962A-FB3C-4DB2-864D-87B74E111E80}D:\game steam\steamapps\common\need for speed heat\needforspeedheat.exe] => (Allow) D:\game steam\steamapps\common\need for speed heat\needforspeedheat.exe => No File
FirewallRules: [TCP Query User{BB2E0DDD-C3E3-44B3-B664-FF3AC0CFDC63}D:\game steam\steamapps\common\need for speed heat\needforspeedheat.exe] => (Allow) D:\game steam\steamapps\common\need for speed heat\needforspeedheat.exe => No File
FirewallRules: [UDP Query User{FE29DF77-8771-4331-8A22-BEB70E764B84}C:\users\rifky fauzan\appdata\local\programs\rave-desktop\rave.exe] => (Allow) C:\users\rifky fauzan\appdata\local\programs\rave-desktop\rave.exe => No File
FirewallRules: [TCP Query User{BF4C7075-556A-4D64-99C8-33B829AADF81}C:\users\rifky fauzan\appdata\local\programs\rave-desktop\rave.exe] => (Allow) C:\users\rifky fauzan\appdata\local\programs\rave-desktop\rave.exe => No File
FirewallRules: [UDP Query User{6FAAD2D4-37D1-413C-9FE5-3F2654BD45AC}D:\game steam\steamapps\common\kartrider drift\kartdrift\binaries\win64\kartdrift-win64-shipping.exe] => (Allow) D:\game steam\steamapps\common\kartrider drift\kartdrift\binaries\win64\kartdrift-win64-shipping.exe => No File
FirewallRules: [TCP Query User{44E7FC2B-2F57-48B4-AAD8-B23F9BB521EC}D:\game steam\steamapps\common\kartrider drift\kartdrift\binaries\win64\kartdrift-win64-shipping.exe] => (Allow) D:\game steam\steamapps\common\kartrider drift\kartdrift\binaries\win64\kartdrift-win64-shipping.exe => No File
FirewallRules: [{8D1AB8AB-102F-4B9D-8091-B79D8C8D15E6}] => (Allow) C:\Windows\System32\DriverStore\FileRepository\asussci2.inf_amd64_4fc38a913e0f2ea5\ASUSLinkRemote\AsusLinkRemoteAgent.exe => No File
FirewallRules: [{C91839F8-8D29-4F1C-9EFF-AD5E55060390}] => (Allow) C:\Windows\System32\DriverStore\FileRepository\asussci2.inf_amd64_4fc38a913e0f2ea5\ASUSLinkRemote\AsusLinkRemoteAgent.exe => No File
FirewallRules: [{94B62FEA-6C8B-4B2A-8F36-BF2EC591A365}] => (Allow) D:\game steam\steamapps\common\raceroom racing experience\Game\RRRE.exe => No File
FirewallRules: [{776984E7-DE94-4ADB-ACBA-7ED9A4642898}] => (Allow) D:\game steam\steamapps\common\raceroom racing experience\Game\RRRE.exe => No File
FirewallRules: [{2BE24D4F-809B-49B2-A759-9BF51C53105B}] => (Allow) D:\game steam\steamapps\common\raceroom racing experience\Game\x64\RRRE64.exe => No File
FirewallRules: [{621D9A06-EBB6-486A-AA16-21AE26F297E2}] => (Allow) D:\game steam\steamapps\common\raceroom racing experience\Game\x64\RRRE64.exe => No File
FirewallRules: [UDP Query User{BD34AC60-1749-43C2-B690-7C59FAFBAB14}D:\game steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) D:\game steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File
FirewallRules: [TCP Query User{B8B0C420-6920-4196-84B1-E1020D1D4457}D:\game steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) D:\game steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File
FirewallRules: [UDP Query User{87D98ED1-43DE-4580-8130-2B95BCB56F82}D:\game steam\steamapps\common\battlefield 2042\bf2042.exe] => (Allow) D:\game steam\steamapps\common\battlefield 2042\bf2042.exe => No File
FirewallRules: [TCP Query User{EFA8158F-4A93-4C08-BF6B-CF9C722FFEC5}D:\game steam\steamapps\common\battlefield 2042\bf2042.exe] => (Allow) D:\game steam\steamapps\common\battlefield 2042\bf2042.exe => No File
FirewallRules: [UDP Query User{8DEC17F0-3A48-454E-AC39-05F4709B86BB}C:\program files (x86)\overwatch\_retail_\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\_retail_\overwatch.exe => No File
FirewallRules: [TCP Query User{2E9B09AD-8FC2-4CFE-8A98-3C9F7B59CAF7}C:\program files (x86)\overwatch\_retail_\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\_retail_\overwatch.exe => No File
FirewallRules: [UDP Query User{345B0E6E-E1A8-44AD-9C39-AFEA3BAD41DE}C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe => No File
FirewallRules: [TCP Query User{97E57F5A-15B3-47C5-B693-CD0AC4EBE56C}C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe => No File
FirewallRules: [UDP Query User{0ED77822-E4B7-4ABE-8B36-FD0B9790F321}C:\program files (x86)\folder baru\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [TCP Query User{E6170B60-61F0-4864-AB72-1D1CB050D8F7}C:\program files (x86)\folder baru\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [UDP Query User{0C7F6D07-06B8-4F05-AFF9-B1BB19BBB6A5}C:\program files (x86)\folder baru\steam\steamapps\common\need for speed heat\needforspeedheat.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\need for speed heat\needforspeedheat.exe => No File
FirewallRules: [TCP Query User{250D9F0B-445A-4902-8654-BD7E6F41E487}C:\program files (x86)\folder baru\steam\steamapps\common\need for speed heat\needforspeedheat.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\need for speed heat\needforspeedheat.exe => No File
FirewallRules: [{1ECBA98F-43B7-4890-85C7-697DFCB09FE6}] => (Allow) C:\Program Files (x86)\Folder Baru\steam\steamapps\common\Apex Legends\EasyAntiCheat_launcher.exe => No File
FirewallRules: [{52CCB2CB-C7D5-4547-9009-62F4FD0CBEBE}] => (Allow) C:\Program Files (x86)\Folder Baru\steam\steamapps\common\Apex Legends\EasyAntiCheat_launcher.exe => No File
FirewallRules: [{6847C997-DCEF-4F31-97F7-5006D219F0FD}] => (Allow) C:\Program Files (x86)\Folder Baru\steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{AD2BB4F5-0753-4045-BF7F-20AC9C271675}] => (Allow) C:\Program Files (x86)\Folder Baru\steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{900047A5-CE77-4071-A0DF-557AD30496FC}] => (Allow) D:\steam\Steam.exe => No File
FirewallRules: [{829F5EAB-D7F2-4796-A662-4A3A6F32598F}] => (Allow) D:\steam\Steam.exe => No File
FirewallRules: [TCP Query User{B585681C-6783-4E4A-86A2-94ADF50CAF94}D:\game epic\worldwarz\en_us\client\bin\pc\wwzretailegs.exe] => (Allow) D:\game epic\worldwarz\en_us\client\bin\pc\wwzretailegs.exe => No File
FirewallRules: [UDP Query User{F47817C2-4368-499A-B835-3A82D6EB5990}D:\game epic\worldwarz\en_us\client\bin\pc\wwzretailegs.exe] => (Allow) D:\game epic\worldwarz\en_us\client\bin\pc\wwzretailegs.exe => No File
FirewallRules: [TCP Query User{C9929816-2B4D-46A4-B8A2-E6301C496E1F}D:\game steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe] => (Allow) D:\game steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe => No File
FirewallRules: [UDP Query User{604B8C5F-33A4-4756-8F79-88DDF41542C8}D:\game steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe] => (Allow) D:\game steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe => No File
FirewallRules: [TCP Query User{01A9F218-9FDC-45EB-8C31-C7D4142BE35F}D:\game bajakan\headbangers rhythm royale\headbangers.exe] => (Allow) D:\game bajakan\headbangers rhythm royale\headbangers.exe => No File
FirewallRules: [UDP Query User{40F84DBA-074E-42F2-90C4-6E07A06B1B84}D:\game bajakan\headbangers rhythm royale\headbangers.exe] => (Allow) D:\game bajakan\headbangers rhythm royale\headbangers.exe => No File
FirewallRules: [TCP Query User{52EBB557-329A-47B5-A50B-65B89FEE3918}D:\game bajakan\headbangers rhythm royale\unitycrashhandler64.exe] => (Allow) D:\game bajakan\headbangers rhythm royale\unitycrashhandler64.exe => No File
FirewallRules: [UDP Query User{292983ED-A345-4207-973A-BD88BF8AF565}D:\game bajakan\headbangers rhythm royale\unitycrashhandler64.exe] => (Allow) D:\game bajakan\headbangers rhythm royale\unitycrashhandler64.exe => No File
FirewallRules: [TCP Query User{00D44F79-0457-467D-BFF8-546CF6BC891F}C:\program files (x86)\folder baru\steam\steamapps\common\bloodstrike\engine\binaries\win64\bloodstrike.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\bloodstrike\engine\binaries\win64\bloodstrike.exe => No File
FirewallRules: [UDP Query User{06316466-8B3A-4DAA-A14E-13B93241CE1B}C:\program files (x86)\folder baru\steam\steamapps\common\bloodstrike\engine\binaries\win64\bloodstrike.exe] => (Allow) C:\program files (x86)\folder baru\steam\steamapps\common\bloodstrike\engine\binaries\win64\bloodstrike.exe => No File
FirewallRules: [TCP Query User{41F7DACC-8BAB-4338-9730-A8F819DDDEC9}D:\punishing gray raven\punishing gray raven game\pgr.exe] => (Allow) D:\punishing gray raven\punishing gray raven game\pgr.exe => No File
FirewallRules: [UDP Query User{AD8B4EF1-8880-40EA-9EF1-087A5D338011}D:\punishing gray raven\punishing gray raven game\pgr.exe] => (Allow) D:\punishing gray raven\punishing gray raven game\pgr.exe => No File
FirewallRules: [TCP Query User{87BB3253-A08D-4463-9014-353C13E905F2}D:\coaglobalgame\seria\binaries\win64\seria.exe] => (Allow) D:\coaglobalgame\seria\binaries\win64\seria.exe => No File
FirewallRules: [UDP Query User{2EA04480-34E7-46CF-8297-36BD2DB4B423}D:\coaglobalgame\seria\binaries\win64\seria.exe] => (Allow) D:\coaglobalgame\seria\binaries\win64\seria.exe => No File
FirewallRules: [TCP Query User{54555CA6-3F16-4A1B-9C49-A4E722F84AAB}D:\game bajakan\make way\make way.exe] => (Allow) D:\game bajakan\make way\make way.exe => No File
FirewallRules: [UDP Query User{85702DDE-C4D0-43F8-B672-240AE3BC69B8}D:\game bajakan\make way\make way.exe] => (Allow) D:\game bajakan\make way\make way.exe => No File
FirewallRules: [TCP Query User{D854AF06-0BDD-4048-8164-DF4DEA152CB2}D:\game bajakan\rematch\runtime\binaries\wingdk\runtimeclient-wingdk-shipping.exe] => (Allow) D:\game bajakan\rematch\runtime\binaries\wingdk\runtimeclient-wingdk-shipping.exe => No File
FirewallRules: [UDP Query User{21ABFA1B-2E22-4D81-83E6-9E02B2935BB8}D:\game bajakan\rematch\runtime\binaries\wingdk\runtimeclient-wingdk-shipping.exe] => (Allow) D:\game bajakan\rematch\runtime\binaries\wingdk\runtimeclient-wingdk-shipping.exe => No File
FirewallRules: [{4869E918-6FA2-4A49-BE54-AAD24B2ADDE8}] => (Allow) C:\Program Files\ASUS\ARMOURY CRATE Service\MobilePlugin\AutoConnectHelper.exe => No File
FirewallRules: [{A4E5143E-3EA9-4FFD-89B1-6C6C01CD4C71}] => (Allow) C:\Program Files\ASUS\ARMOURY CRATE Service\MobilePlugin\AutoConnectHelper.exe => No File
FirewallRules: [{CD1B492D-372F-4B75-9405-10B43C5B98A8}] => (Allow) C:\Users\Rifky Fauzan\AppData\Local\Temp\ACFL20250704071530\ACSetup\ACSetup.exe => No File
FirewallRules: [{A043ECB3-7E33-4234-93D6-12060D5FEA77}] => (Allow) C:\Users\Rifky Fauzan\AppData\Local\Temp\ACFL20250704071530\ACSetup\ACSetup.exe => No File
FirewallRules: [TCP Query User{61BCB877-975B-41E7-97FE-A0C1F9939C3C}D:\game bajakan\monsterhunterwilds\monsterhunterwilds.exe] => (Allow) D:\game bajakan\monsterhunterwilds\monsterhunterwilds.exe => No File
FirewallRules: [UDP Query User{C5A9A206-A627-4FA1-80F8-74CB954510F2}D:\game bajakan\monsterhunterwilds\monsterhunterwilds.exe] => (Allow) D:\game bajakan\monsterhunterwilds\monsterhunterwilds.exe => No File
FirewallRules: [TCP Query User{A46AF5AF-90E0-452F-A252-31B5E60FD40E}D:\game bajakan\cloudheim\protocat\binaries\win64\cloudheimsteam-win64-shipping.exe] => (Allow) D:\game bajakan\cloudheim\protocat\binaries\win64\cloudheimsteam-win64-shipping.exe => No File
FirewallRules: [UDP Query User{2D293B4E-CA0F-44AD-8AC5-3552BABC0572}D:\game bajakan\cloudheim\protocat\binaries\win64\cloudheimsteam-win64-shipping.exe] => (Allow) D:\game bajakan\cloudheim\protocat\binaries\win64\cloudheimsteam-win64-shipping.exe => No File
FirewallRules: [{E4C9F122-F9BB-4D3E-840B-72AE2F33C5F0}] => (Allow) C:\Program Files (x86)\Folder Baru\steam\steamapps\common\Apex Legends\start_protected_game.exe => No File
FirewallRules: [{6DA2273C-A1AE-4949-B673-6A552FC7C2F9}] => (Allow) C:\Program Files (x86)\Folder Baru\steam\steamapps\common\Apex Legends\start_protected_game.exe => No File
FirewallRules: [{87D3A10A-4045-4AC8-94FA-211AB58F003C}] => (Allow) C:\Users\Rifky Fauzan\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => No File
FirewallRules: [{E59191C0-6F08-44C6-BFA1-62C518DB942C}] => (Allow) C:\Users\Rifky Fauzan\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => No File
FirewallRules: [TCP Query User{8F959C4E-B10E-4A73-A705-C525FAF107D2}D:\game bajakan\vanguard\cardfight!! vanguard dear days 2\vgdd2.exe] => (Allow) D:\game bajakan\vanguard\cardfight!! vanguard dear days 2\vgdd2.exe => No File
FirewallRules: [UDP Query User{55B9A6F3-7CC0-4885-B423-BC240195069F}D:\game bajakan\vanguard\cardfight!! vanguard dear days 2\vgdd2.exe] => (Allow) D:\game bajakan\vanguard\cardfight!! vanguard dear days 2\vgdd2.exe => No File
HKU\S-1-5-21-1070632220-2695763294-3121136582-1001\...\Run: [Rave] => "C:\Users\Rifky Fauzan\AppData\Local\Programs\rave-desktop\Rave.exe" --hidden (No File)
HKU\S-1-5-21-1070632220-2695763294-3121136582-1001\...\Run: [AF_uuid_514912] => 53c25f9f-58bd-43f4-9a9e-25e64cf2b839**e*\***************f**|***€GOCSPX-s (No File)
HKU\S-1-5-21-1070632220-2695763294-3121136582-1001\...\Run: [AF_counter_514912] => 1 (No File)
HKU\S-1-5-21-1070632220-2695763294-3121136582-1001\...\MountPoints2: {77135f4d-7826-11ed-a95d-505a65063c64} - "E:\setup.exe"
Task: {58EF3C6E-D7B7-4A03-B443-6EF349D02164} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe  (No File)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
CHR HKU\S-1-5-21-1070632220-2695763294-3121136582-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dpadflhmiohjfhhaehelneimpllfbpcg] - C:\Users\Rifky Fauzan\AppData\Roam <not found>
S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys (No File)
S3 NEProtect; \??\C:\Program Files (x86)\Folder Baru\steam\steamapps\common\BLOODSTRIKE\Engine\Binaries\Win64\NEProtect.sys (No File)
2026-07-02 23:29 - 2026-07-14 00:33 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\0b5e9b57a31dad4854415695873a1ad8f46a3c20b88e48efb7b2a96771e65bd9
2026-07-02 23:29 - 2026-07-02 23:29 - 000000026 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\29c0fc0f474cba4b579efb637113ed0a327d65af2258e235e2348ee72c8a7759
2026-07-14 08:48 - 2024-06-19 22:40 - 000042147 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\e8b8c38bc0813bee691394e17cde8da390a0e65ee924b2b3ea21d7e1bf2281f6
2026-07-14 08:44 - 2024-06-18 03:17 - 003270114 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\48175e76c0ff4e749e851f1f852c4355d6296fb912d5143b0a98400c90511d05
2026-07-14 06:46 - 2024-06-28 16:43 - 000059481 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\7e9486d5a9a71bdc94996a35dc80ce734de68bcbcaf557324f29a0d44251a630
2026-07-14 06:43 - 2024-06-18 07:31 - 001915645 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\cce47a310a2b6b5eb724cd7e159b5e69a9bfbcdfa607a503016b50e97460decd
2026-07-14 06:38 - 2025-09-19 13:27 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\7e681db666f22e0881505caef1f2069b31a0c71723fa40ef97b010913bbb0dd3
2026-07-14 06:31 - 2024-06-18 03:12 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\fbfe924ddb0464555ab0c1c3d6102a5c9c9a52b2b7c64e410edea756513d4ae4
2026-07-14 06:26 - 2024-08-26 17:03 - 000235270 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\3fde5216d2193240953c50de719ec957029f8d481810cb6be21e28129c17e0ea
2026-07-14 06:26 - 2024-08-26 17:03 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\7a30513e4032e80317004bfdff927d304a9f6e33d1d4d0a20426d318a1097f65
2026-07-14 06:26 - 2024-06-18 03:17 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\8d9f96ac0c81c4e109d1cbc5c849f4f0dcb5608abc0b55fd1734084a9d98342f
2026-07-14 06:15 - 2025-12-19 09:11 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\ca54b7cb4433a88da9612a9640d081082330ea768a5b2060c150e2d8a4731849
2026-07-14 06:14 - 2025-12-19 09:11 - 000966645 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\a7f7d656671c63f1edaa9ea613e376df328a91ef84a4438781013710fdc99068
2026-07-14 06:13 - 2025-12-19 09:11 - 000162556 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\c4beba2be83db5339b4f4173ce80666ec40750869f30c769de436300b3d875f2
2026-07-14 06:09 - 2025-07-28 08:26 - 000011216 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\e69ac24fe51cbd89a2862988dc23a8cd7e018583b57ce57bc0e8def010b5a5ce
2026-07-14 06:09 - 2024-06-18 03:11 - 000011216 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\538164be095319c9b35dd4523563bb2c05ff19c435a7794a0a56839bf802f3f6
2026-07-13 02:42 - 2025-11-16 19:28 - 000218675 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\4d056e1e29ec3c97750cf4a824471911c81bb102e8ed5157bea4ae3c18d81f05
2026-07-11 07:06 - 2024-07-18 20:12 - 000451745 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\062e0a2c15d8c229ab7c0bd25f71169a5cd5708c9dc7e4e8b31ff22ac7cc4411
2026-07-10 13:42 - 2024-08-08 16:02 - 000026882 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\8fadcb6a0d2bde06c5228769a5e71700102081a7191b21c706f6f4cb7c181b5d
2026-07-10 13:42 - 2024-08-08 16:02 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\a94f18ec458804c64b885271466f36a2681a2a7db80a5f9c50026cdf591b4211
2026-07-10 12:47 - 2025-06-06 03:06 - 000011216 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\ef7d34d7619787f6d1f2dc9f3da47c2417d0e4beef68371dd16fc8a4dfd83d59
2026-07-10 05:03 - 2025-06-06 03:06 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\62d829d95bb90bf102b4c2c6c78a555faf5a11242184bddc20a7039cd326e62c
2026-06-28 07:00 - 2025-11-16 19:28 - 000000130 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\a5afe75980b197a4f53b602b005671be082663031a53a86b6fd08117daac4704
2025-02-27 22:42 - 2025-02-27 22:42 - 000000024 _____ () C:\Users\Rifky Fauzan\AppData\Roaming\C23W6Vk43XTwu662.dat
2024-12-10 16:55 - 2024-12-10 16:55 - 000000048 ____R () C:\Users\Rifky Fauzan\AppData\Local\289997B9FC4FEEDE6DEF9AA33BCCA370
2025-05-11 17:44 - 2025-05-11 17:44 - 000000036 _____ () C:\Users\Rifky Fauzan\AppData\Local\4051BDD0000f042.pyo
2025-11-16 19:35 - 2025-11-16 19:35 - 000000048 ____R () C:\Users\Rifky Fauzan\AppData\Local\62548010F1356EF5554868D4EB2F2A25
2025-03-10 02:42 - 2025-03-10 02:42 - 000000048 ____R () C:\Users\Rifky Fauzan\AppData\Local\7288E29716A5FF2D4E06A4EAF635BD33
2026-05-31 23:59 - 2026-05-31 23:59 - 000000048 ____R () C:\Users\Rifky Fauzan\AppData\Local\AB94542F5FADE6F8B81D4B79C11311EF
2025-05-11 17:32 - 2025-05-11 17:32 - 000000048 ____R () C:\Users\Rifky Fauzan\AppData\Local\F1DD43B9BE218E8E2550DBF370E02D28

Avast Update Helper (HKLM-x32\...\{19C3AB22-3718-4E4D-B203-242F5001565B}) (Version: 1.8.1653.5 - AVAST Software) Hidden
2026-07-14 06:13 - 2026-07-14 06:13 - 000114688 _____ () [File not signed] \\?\C:\Users\Rifky Fauzan\AppData\Local\Temp\35d1313a-5a14-4fb1-b411-7c9c5e596ab3.tmp.node

HKU\S-1-5-21-1070632220-2695763294-3121136582-1001\...\Run: [MicrosoftEdgeAutoLaunch_908D2254D8BEE7E1651F33060FC32228] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4970824 2026-07-09] (Microsoft Corporation -> Microsoft Corporation)

Task: {C51E5450-3A06-45C6-87C8-5A543AD57837} - System32\Tasks\BackgroundTask => C:\Windows\System32\cmd.exe [348160 2026-06-10] (Microsoft Windows -> Microsoft Corporation) -> /c "C:\Users\Rifky Fauzan\AppData\Local\Microsoft\Windows\WebCache\bootstrap_3b40.cmd"
C:\Users\Rifky Fauzan\AppData\Local\Microsoft\Windows\WebCache

CHR DefaultSuggestURL: Default -> hxxps://id.search.yahoo.com/sugg/gossip/gossip-id-partner?output=fxjson&appid=mca&source=yahoo_mcafee_searchassist&command={searchTerms}
CHR DefaultSearchURL: Default -> hxxps://id.search.yahoo.com/search?fr=mcafee&type=E210ID885G0&p={searchTerms}
Edge HKLM-x32\...\Edge\Extension: [fdhgeoginicibhagdmblfikbgbkahibd]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
2026-07-14 04:00 - 2026-07-14 04:00 - 000003524 _____ C:\WINDOWS\system32\Tasks\BackgroundTask
2026-07-14 06:15 - 2024-06-18 07:31 - 000002650 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\2ed50ab3386a4fc9cf53DcJHrrHSgvFpsYxqb6g97uaQTd2kE31rPUeDZTeDsjVq

2026-07-14 00:33 - 2024-11-29 01:41 - 000000000 ____D C:\temp
2026-07-11 07:33 - 2024-07-18 20:12 - 000000466 _____ C:\Users\Rifky Fauzan\AppData\LocalLow\d57efd2e9415e4a6500c4c130c77805d6dd5c319eWJh8J6Mx9DrGXKEv3ojKmqw8Cv9pscK

StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

StartPowerShell:
# Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console
# Does not clean preinstalled objects, only PUP/Adware
# If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument
# If you would like to only scan with it, change the argument from /clean to /scan
# NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software.
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:

Comment: List Windows Defender properties, settings
StartPowerShell:
function Write-Section {
    param([string]$Title)
    Write-Host ""
    Write-Host "<=== $Title ===>"
}
Write-Section "Protection Status"
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, RealTimeProtectionEnabled, IsTamperProtected, NetworkProtectionStatus | Format-List
Write-Section "Signature / Engine Versions"
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntispywareSignatureVersion | Format-List
Write-Section "Preferences / Configuration"
Get-MpPreference | Select-Object PUAProtection, MAPSReporting, SubmitSamplesConsent, CheckForSignaturesBeforeRunningScan, CloudBlockLevel, EnableNetworkProtection, DisableScriptScanning, DisableArchiveScanning, DisableRemovableDriveScanning, DisableScanningNetworkFiles, DisableScanningMappedNetworkDrivesForFullScan, DisableBlockAtFirstSeen, DisableHeuristics, DisableAutoExclusions | Format-List
Write-Section "Threat Detections"
$threats = Get-MpThreatDetection
if ($threats) {
    $threats | Format-Table -AutoSize
} else {
    Write-Host "  (no threat detections found)"
}
EndPowerShell:

Comment: List drive info, identify possible damaged drives (thanks to AdvancedSetup from Malwarebytes for parts of these)
StartPowerShell:
param(
    [int]$MaxEvents = 2000
)
$GPTTypeMap = @{
    'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7' = 'Microsoft Basic Data'
    'E3C9E316-0B5C-4DB8-817D-F92DF00215AE' = 'Microsoft Reserved (MSR)'
    'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC' = 'Windows Recovery Environment (WinRE)'
    'C12A7328-F81F-11D2-BA4B-00A0C93EC93B' = 'EFI System Partition'
    '21686148-6449-6E6F-744E-656564454649' = 'BIOS Boot Partition'
    'A19D880F-05FC-4D3B-A006-743F0F84911E' = 'OEM Partition'
    '5808C8AA-7E8F-42E0-85D2-E1E90434CFB3' = 'Cluster Metadata Partition'
    '48465300-0000-11AA-AA11-00306543ECAC' = 'Apple HFS/HFS+'
    '7C3457EF-0000-11AA-AA11-00306543ECAC' = 'Apple APFS'
    '0FC63DAF-8483-4772-8E79-3D69D8477DE4' = 'Linux Filesystem'
    '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F' = 'Linux Swap'
    'E6D6D379-F507-44C2-A23C-238F2A3DF928' = 'Linux LVM'
}
$MBRTypeMap = @{
    '01'='FAT12';'04'='FAT16 <32M';'05'='Extended';'06'='FAT16';'07'='IFS/NTFS/exFAT/HPFS';'0B'='FAT32 CHS';'0C'='FAT32 LBA';'0E'='FAT16 LBA'
    '0F'='Extended LBA';'82'='Linux Swap';'83'='Linux Native';'8E'='Linux LVM';'A5'='FreeBSD';'A6'='OpenBSD';'A8'='Mac OS X';'AB'='Mac OS X Boot'
    'AF'='Mac OS X HFS';'EE'='EFI GPT Protective';'EF'='EFI System Partition'
}
function Get-PartitionTypeInfo {
    param($Partition)

    $guid = $null
    if ($Partition.GptType) {
        $guid = ($Partition.GptType -replace '[{}]', '').ToUpper()
    }
    if ([string]::IsNullOrWhiteSpace($guid) -or $guid -eq '00000000-0000-0000-0000-000000000000') {
        $guid = switch ($Partition.Type) {
            "System"   { "C12A7328-F81F-11D2-BA4B-00A0C93EC93B" }
            "Reserved" { "E3C9E316-0B5C-4DB8-817D-F92DF00215AE" }
            "Basic"    { "EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" }
            "Recovery" { "DE94BBA4-06D1-4D40-A16A-BFD50179D6AC" }
            default    { $null }
        }
    }

    if ($guid) {
        $name = $GPTTypeMap[$guid]
        if ($name) { return "$name (GPT GUID: $($guid.ToLower()))" }
        else { return "Unknown/Custom (GPT GUID: $($guid.ToLower()))" }
    }

    if ($Partition.MbrType) {
        $code = ($Partition.MbrType.ToString() -replace '^0x', '').PadLeft(2, '0').ToUpper()
        $name = $MBRTypeMap[$code]
        if ($name) { return "$name (MBR code: 0x$code)" }
        else { return "Unknown/Custom (MBR code: $($Partition.MbrType))" }
    }

    return $Partition.Type
}
function Get-DrMapping {
    param([int]$MaxEvents)
    $map = @{}
    try {
        $events = Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'disk' } -MaxEvents $MaxEvents -ErrorAction Stop
    } catch {
        return $map
    }
    foreach ($e in $events) {
        if ($e.Message -match 'Harddisk(\d+)\\DR(\d+)') {
            $n  = [int]$Matches[1]
            $dr = [int]$Matches[2]
            if (-not $map.ContainsKey($n)) { $map[$n] = $dr }
        }
    }
    return $map
}
$drMap = Get-DrMapping -MaxEvents $MaxEvents
$physicalDisks = Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, SerialNumber, MediaType, @{N='SizeGB';E={[math]::Round($_.Size / 1GB,2)}}
foreach ($pd in $physicalDisks) {
    $devId = [int]$pd.DeviceId
    $drSuffix = if ($drMap.ContainsKey($devId)) { "\DR$($drMap[$devId])" } else { '\DR? (no event seen yet)' }

    Write-Host ""
    Write-Host "<=== \Device\Harddisk$devId$drSuffix ($($pd.FriendlyName)) ===>"
    Write-Host "  DeviceId: $devId | Serial: $($pd.SerialNumber) | Media: $($pd.MediaType) | Size: $($pd.SizeGB) GB"

    try {
        $partitions = Get-Partition -DiskNumber $devId -ErrorAction Stop
        if (-not $partitions) {
            Write-Host "  (no partitions found)"
            continue
        }
        foreach ($part in $partitions) {
            $driveLetter = if ($part.DriveLetter) { "$($part.DriveLetter):" } else { 'no letter' }
            $sizeGB = [math]::Round($part.Size / 1GB, 2)
            $typeInfo = Get-PartitionTypeInfo -Partition $part
            Write-Host "  [PARTITION $($part.PartitionNumber)] Drive: $driveLetter - $sizeGB GB - $typeInfo"
        }
    } catch {
        Write-Host "  [ERROR] cannot read partitions for disk $devId"
    }
}

if ($drMap.Count -eq 0) {
    Write-Host ""
    Write-Host "Note: no \Device\HarddiskN\DRx entries found in the last $MaxEvents System log events. Increase -MaxEvents, or the DR number will only appear once Windows actually logs a disk event for that drive (e.g. a bad block warning)."
}
EndPowerShell:

Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code.
Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) }

StartPowerShell:
# Basic BSOD listings
$ccKey = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"
$cfg = Get-ItemProperty $ccKey -ErrorAction SilentlyContinue
$dumpTypeMap = @{0='None';1='Complete';2='Kernel';3='Minidump';7='Automatic'}
Write-Output "--- Configuration ---"
Write-Output ("Dump Type: {0} ({1})" -f $cfg.CrashDumpEnabled, $dumpTypeMap[$cfg.CrashDumpEnabled])
Write-Output ("Full Dump Path: {0}" -f $(if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"}))
Write-Output ("Minidump Folder: {0}" -f $(if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"}))
Write-Output ("Auto Reboot: {0}" -f $(if($cfg.AutoReboot -eq 0){'Disabled'}else{'Enabled'}))
Write-Output "--- Found Dump Files ---"
$full = if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"}
if (Test-Path $full) { Get-Item $full | Select Name,Length,LastWriteTime | Format-Table -AutoSize }
$mini = if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"}
if (Test-Path $mini) { Get-ChildItem $mini -Filter *.dmp | Select Name,Length,LastWriteTime | Format-Table -AutoSize }
Write-Output "--- BugCheck Reasoning (recent events) ---"
$map = @{
'0x0000000A'='IRQL_NOT_LESS_OR_EQUAL - faulty/outdated driver accessed memory at high IRQL'
'0x0000001E'='KMODE_EXCEPTION_NOT_HANDLED - unhandled kernel exception, often driver/hardware'
'0x0000002E'='DATA_BUS_ERROR - typically bad RAM or hardware fault'
'0x0000003B'='SYSTEM_SERVICE_EXCEPTION - exception in a system service, often driver-related'
'0x00000050'='PAGE_FAULT_IN_NONPAGED_AREA - bad RAM or faulty driver/antivirus'
'0x0000007A'='KERNEL_DATA_INPAGE_ERROR - disk-related problem'
'0x0000007B'='INACCESSIBLE_BOOT_DEVICE - system could not find/access the boot device'
'0x0000007E'='SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - almost always a faulty driver'
'0x0000007F'='UNEXPECTED_KERNEL_MODE_TRAP - hardware issue (CPU/RAM/overclocking)'
'0x0000009F'='DRIVER_POWER_STATE_FAILURE - driver failed to respond to a power state change'
'0x000000C2'='BAD_POOL_CALLER - driver mishandling memory (pool corruption)'
'0x000000D1'='DRIVER_IRQL_NOT_LESS_OR_EQUAL - typically a network or GPU driver'
'0x000000EF'='CRITICAL_PROCESS_DIED - a critical system process died, often malware/system corruption'
'0x00000116'='VIDEO_TDR_FAILURE - GPU driver failed to respond in time (timeout)'
'0x00000124'='WHEA_UNCORRECTABLE_ERROR - hardware fault (CPU/RAM/PSU/overclocking)'
'0x00000133'='DPC_WATCHDOG_VIOLATION - faulty driver or storage subsystem issue'
'0x00000139'='KERNEL_SECURITY_CHECK_FAILURE - corrupted kernel structure, possibly malware'
}
$events = Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} -MaxEvents 100 -ErrorAction SilentlyContinue |
    Where-Object { $_.ProviderName -match 'WER-SystemErrorReporting' } | Select-Object -First 5

if (-not $events) { Write-Output "No BugCheck events found in the log." }
foreach ($ev in $events) {
    $code = if ($ev.Message -match 'bugcheck was:\s*(0x[0-9A-Fa-f]+)') { $matches[1] } else { $null }
    Write-Output ("Time: {0}" -f $ev.TimeCreated)
    Write-Output ("Code: {0}" -f $(if($code){$code}else{'not recognized'}))
    if ($code -and $map.ContainsKey($code.ToUpper())) {
        Write-Output ("Meaning: {0}" -f $map[$code.ToUpper()])
    } elseif ($code) {
        Write-Output "Meaning: unknown code, look up at learn.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2"
    }
    Write-Output ""
}
EndPowerShell:

StartPowerShell:
# This snippet lists all installed apps and their folder contents along with SHA256 hashes. Useful for troubleshooting malware abusing installed app entry.
param(
    [switch]$Recurse,
    [int]$MaxFilesPerApp = [int]::MaxValue
)

$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$script:msiInstaller = $null
function Get-MsiInstallLocation {
    param([string]$ProductCode)
    if (-not $script:msiInstaller) {
        try { $script:msiInstaller = New-Object -ComObject WindowsInstaller.Installer } catch { return $null }
    }
    try {
        $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallLocation')
        if ([string]::IsNullOrWhiteSpace($loc)) { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallSource') }
        if ([string]::IsNullOrWhiteSpace($loc)) { return $null }
        return $loc
    } catch { return $null }
}

function Get-CleanPath {
    param([string]$RawValue)
    if ([string]::IsNullOrWhiteSpace($RawValue)) { return $null }
    $s = $RawValue.Trim()
    if ($s.StartsWith('"')) {
        $endQuote = $s.IndexOf('"', 1)
        if ($endQuote -gt 0) { return $s.Substring(1, $endQuote - 1) }
    }
    if ($s -match '^(.*?\.exe)\b') { return $Matches[1] }
    return $s
}

function Format-FileSize {
    param([long]$Bytes)
    if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) }
    if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) }
    if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) }
    return "$Bytes B"
}

$script:PeExtensions = @('.exe', '.dll', '.sys', '.ocx', '.cpl', '.scr', '.drv', '.efi', '.msi', '.msp', '.msu')
function Test-IsPeFile {
    param([string]$Extension)
    return $script:PeExtensions -contains $Extension.ToLower()
}

function Get-SignatureInfo {
    param([string]$Path, [string]$Extension)
    if (-not (Test-IsPeFile -Extension $Extension)) {
        return [PSCustomObject]@{ Signer = 'N/A (not PE)'; Status = 'NotApplicable'; Valid = $false }
    }
    $result = [PSCustomObject]@{ Signer = 'Unsigned'; Status = 'NotSigned'; Valid = $false }
    try {
        $sig = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop
        $result.Status = $sig.Status.ToString()
        $result.Valid  = ($sig.Status -eq 'Valid')
        if ($sig.SignerCertificate) {
            if ($sig.SignerCertificate.Subject -match 'CN=([^,]+)') { $result.Signer = $Matches[1].Trim('"') }
            else { $result.Signer = $sig.SignerCertificate.Subject }
            if (-not $result.Valid) { $result.Signer += " [INVALID: $($result.Status)]" }
        } elseif ($sig.Status -eq 'NotSigned') {
            $result.Signer = 'Unsigned'
        } else {
            $result.Signer = "Unknown [$($result.Status)]"
        }
    } catch {
        $result.Signer = 'Verification error'
        $result.Status = 'Error'
        $result.Valid  = $false
    }
    return $result
}

$rawApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -and $_.DisplayName.Trim() -ne '' } |
    Select-Object @{Name = 'Name'; Expression = { $_.DisplayName } },
                  @{Name = 'Version'; Expression = { $_.DisplayVersion } },
                  @{Name = 'Publisher'; Expression = { $_.Publisher } },
                  @{Name = 'InstallFolder'; Expression = {
                        if ($_.InstallLocation -and $_.InstallLocation.Trim() -ne '') { $_.InstallLocation }
                        elseif ($_.UninstallString -match 'MsiExec\.exe.*?(\{[0-9A-Fa-f\-]{36}\})') {
                            $productCode = $Matches[1]
                            $msiLoc = Get-MsiInstallLocation -ProductCode $productCode
                            if ($msiLoc) { $msiLoc } else { "MSI: $productCode (location not found)" }
                        }
                        elseif ($_.UninstallString) { $_.UninstallString }
                        else { 'N/A' }
                    } } |
    Sort-Object Name -Unique

foreach ($app in $rawApps) {
    $versionText   = if ($app.Version) { $app.Version } else { '?' }
    $publisherText = if ($app.Publisher) { $app.Publisher } else { '?' }
    Write-Host ""
    Write-Host "<=== $($app.Name) [$versionText] ($publisherText) ===>"

    if ($app.InstallFolder -eq 'N/A' -or $app.InstallFolder -match '^MSI: .* \(location not found\)$') {
        Write-Host "  Path: $($app.InstallFolder)"
        continue
    }

    $cleanPath = Get-CleanPath -RawValue $app.InstallFolder

    $exists = $false
    try {
        $exists = Test-Path -LiteralPath $cleanPath -ErrorAction Stop
    } catch [System.UnauthorizedAccessException] {
        Write-Host "  Path: $cleanPath"
        Write-Host "  [ACCESS DENIED]"
        continue
    } catch {
        Write-Host "  Path: $cleanPath"
        Write-Host "  [ERROR] cannot access"
        continue
    }

    if (-not $exists) {
        Write-Host "  Path: $cleanPath"
        Write-Host "  [NOT FOUND]"
        continue
    }

    $rootItem = Get-Item -LiteralPath $cleanPath -Force
    $created  = $rootItem.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
    $modified = $rootItem.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')

    if ($rootItem.PSIsContainer) {
        $subFolders = Get-ChildItem -LiteralPath $cleanPath -Directory -Force -ErrorAction SilentlyContinue
        $gciParams  = @{ LiteralPath = $cleanPath; File = $true; Force = $true; ErrorAction = 'SilentlyContinue' }
        if ($Recurse) { $gciParams['Recurse'] = $true }
        $allFiles = Get-ChildItem @gciParams

        Write-Host "  Path: $cleanPath | Created: $created | Modified: $modified | Files: $($allFiles.Count) | Folders: $($subFolders.Count)"

        foreach ($dir in $subFolders) {
            $dCreated  = $dir.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
            $dModified = $dir.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
            $dFileCount = (Get-ChildItem -LiteralPath $dir.FullName -File -Force -ErrorAction SilentlyContinue).Count
            Write-Host ("  [DIR] {0} - {1} - {2,10} - {3}" -f $dCreated, $dModified, "$dFileCount files", $dir.FullName)
        }
    } else {
        $allFiles = @($rootItem)
        Write-Host "  Path: $cleanPath | Created: $created | Modified: $modified | Files: 1"
    }

    if ($allFiles.Count -eq 0) { continue }

    $shown = $allFiles | Select-Object -First $MaxFilesPerApp
    foreach ($f in $shown) {
        $hash = 'N/A'
        try { $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction Stop).Hash } catch { $hash = 'HASH-ERROR' }
        $size     = Format-FileSize -Bytes $f.Length
        $fcreated = $f.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
        $fmod     = $f.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
        $sigInfo  = Get-SignatureInfo -Path $f.FullName -Extension $f.Extension
        Write-Host ("  [{0}] {1} - {2} - {3,10} - Signer: {4} - {5}" -f $hash, $fcreated, $fmod, $size, $sigInfo.Signer, $f.FullName)
    }
}
EndPowerShell:

Comment: List 30 recent scheduled tasks (you know, just for the sake of it)
Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo

Comment: List recent Run (Windows + R) executed commands, useful for identifying ClickFix attacks
Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" }

Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.csproj
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.csproj
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.csproj
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.csproj
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z

Comment: Remove browser cache 
StartPowerShell:
$ProfilesDirectory = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').ProfilesDirectory
$DisplayNames = @{
    "chrome"    = "Chrome"
    "firefox"   = "Firefox"
    "opera"     = "Opera"
    "operagx"   = "Opera GX"
    "brave"     = "Brave"
    "msedge"    = "Edge"
    "vivaldi"   = "Vivaldi"
    "librewolf" = "LibreWolf"
    "mullvad"   = "Mullvad Browser"
    "zen"       = "Zen"
}
$ProcessNameMap = @{
    "operagx" = "opera"
    "mullvad" = "mullvadbrowser"
}
$trueCacheNames = @("Cache", "Code Cache", "DawnCache", "GPUCache", "GrShaderCache", "ShaderCache", "Shared Dictionary\cache")
function Get-CacheDirs {
    param([string]$BrowserName, [string]$ProfilesDirectory)
    switch ($BrowserName) {
        "chrome" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Google\Chrome\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "firefox" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Mozilla\Firefox\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
        "opera" {
            $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software"
            $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software"
            $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $r1 + $r2
        }
        "operagx" {
            $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software\Opera GX Stable"
            $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software\Opera GX Stable"
            $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
            $r1 + $r2
        }
        "brave" {
            $dir = "$ProfilesDirectory\*\AppData\Local\BraveSoftware\Brave-Browser\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "msedge" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Microsoft\Edge\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "vivaldi" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Vivaldi\User Data"
            Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }
        }
        "librewolf" {
            $dir = "$ProfilesDirectory\*\AppData\Local\LibreWolf\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
        "mullvad" {
            $dir = "$ProfilesDirectory\*\AppData\Local\Mullvad\MullvadBrowser\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
        "zen" {
            $dir = "$ProfilesDirectory\*\AppData\Local\zen\Profiles"
            Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' }
        }
    }
}
function Format-Size {
    param([long]$Bytes)
    if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) }
    if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) }
    if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) }
    return "$Bytes B"
}
$BrowserKeys = @('chrome', 'firefox', 'opera', 'operagx', 'brave', 'msedge', 'vivaldi', 'librewolf', 'mullvad', 'zen')
foreach ($key in $BrowserKeys) {
    $procName = if ($ProcessNameMap.ContainsKey($key)) { $ProcessNameMap[$key] } else { $key }
    Get-Process -Name $procName -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
}
Start-Sleep -Seconds 5
$grandBytes = 0L
$grandFiles = 0
$anyFound = $false
foreach ($key in $BrowserKeys) {
    $cacheDirs = Get-CacheDirs -BrowserName $key -ProfilesDirectory $ProfilesDirectory
    if (-not $cacheDirs -or $cacheDirs.Count -eq 0) { continue }
    $anyFound = $true
    $displayName = $DisplayNames[$key]
    $browserBytes = 0L
    $browserFiles = 0
    foreach ($cacheDir in $cacheDirs) {
        if (-not (Test-Path $cacheDir)) { continue }
        $items = Get-ChildItem -Path $cacheDir -Force -Recurse -ErrorAction SilentlyContinue
        $files = $items | Where-Object { -not $_.PSIsContainer }
        $bytes = ($files | Measure-Object -Property Length -Sum).Sum
        if (-not $bytes) { $bytes = 0 }
        $browserFiles += $files.Count
        $browserBytes += $bytes
        Get-ChildItem -Path "$cacheDir\*" -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
    }
    $grandBytes += $browserBytes
    $grandFiles += $browserFiles
    Write-Host ("{0,-16} freed {1,10} ({2} files)" -f $displayName, (Format-Size $browserBytes), $browserFiles)
}
if (-not $anyFound) {
    Write-Host "No cache found for any installed browser."
}
Write-Host ""
Write-Host ("Total freed: {0} ({1} files)" -f (Format-Size $grandBytes), $grandFiles)
EndPowerShell:

Comment: Verify WMI repository, repair & verify again
CMD: winmgmt.exe /verifyrepository
CMD: winmgmt.exe /salvagerepository
CMD: winmgmt.exe /verifyrepository

Comment: To rebuild the performance counter library values
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"

Comment: Resync performance counter library values to WMI as well
CMD: winmgmt.exe /resyncperf

Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy
CMD: gpupdate.exe /force

Comment: Reset PowerShell execution policy
Powershell: Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force

Comment: BITS reset
Startbatch:
@echo off
net.exe stop BITS
ipconfig.exe /flushdns
ren "%programdata%\Microsoft\Network\Downloader\qmgr*.*" qmgr*.*.old
net.exe start BITS
Endbatch:
cmd: bitsadmin.exe /reset /allusers

Comment: Network reset commands
CMD: netsh.exe int ip reset
CMD: netsh.exe int ipv6 reset
CMD: ipconfig.exe /flushDNS
CMD: netsh.exe winsock reset catalog

Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Users\CurrentUserName\AppData\Local\Temp\*
C:\Windows\Temp\*
C:\Windows\SystemTemp\*
C:\Windows\Prefetch\*

Comment: System repair commands
CMD: SFC.exe /scannow
CMD: DISM.exe /Online /Cleanup-image /Restorehealth

EmptyTemp:
End::