Malware Log Analysis

Start:: CreateRestorePoint: CloseProcesses: File: C:\Windows\System32\drivers\gunetfilter.sys;C:\Users\aorus\AppData\Roaming\StarSEA_STEAM.exe Folder: C:\Users\aorus\AppData\Roaming\{73A5C467-AD53-4C86-A16D-BE24B7A74E9C} Folder: C:\Users\aorus\AppData\Roaming\Upgrade Folder: C:\Users\aorus\AppData\Roaming\Devices Folder: C:\Users\aorus\AppData\Roaming\pnsdk C:\Users\aorus\AppData\Roaming\RenPy GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?fr=mcafee&type=E210US91215G0&p={searchTerms} CHR DefaultSearchKeyword: Default -> mcafee CHR DefaultSuggestURL: Default -> hxxps://us.search.yahoo.com/sugg/gossip/gossip-us-partner?output=fxjson&appid=mca&source=yahoo_mcafee_searchassist&command={searchTerms} CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] CHR HKLM\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] CHR HKLM-x32\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] CHR HKU\S-1-5-21-2026779433-2403359633-3059324774-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] CustomCLSID: HKU\S-1-5-21-2026779433-2403359633-3059324774-1002_Classes\CLSID\{1092D759-338E-4473-B429-75C50C61BC38}\InprocServer32 -> C:\Users\aorus\AppData\Roaming\D5 Render\framework\d5a_thumbnail_provider.dll => No File CustomCLSID: HKU\S-1-5-21-2026779433-2403359633-3059324774-1002_Classes\CLSID\{50726f74-6f6e-2e56-504e-000000000000}\localserver32 -> "C:\Program Files\Proton\VPN\v3.2.11\ProtonVPN.exe" -ToastActivated => No File AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\ProgramData\D5_CLIENT.mem:6BE740138B [3442] AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442] AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`20hfm [0] AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`29hfm [0] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Darmoshark Mouse.lnk:E09E5E2F8C [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechPowerUp GPU-Z.lnk:718E15FDE8 [3442] AlternateDataStreams: C:\Users\aorus\Application Data:e544b77f725e4e36f962a435d8206045 [394] AlternateDataStreams: C:\Users\aorus\AppData\Roaming:e544b77f725e4e36f962a435d8206045 [394] FirewallRules: [{8FE457D3-124B-40EF-9CA8-AB082FF1C22C}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{780EBA9B-27BD-4C74-8936-4610B331BCC6}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{46FC68A1-47C3-49D1-A37F-96126D8A9F36}C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [UDP Query User{805DD8A5-EC50-4506-819F-3160BF8A5F7A}C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [TCP Query User{FB6A0AFD-4017-462A-9D76-9E3EB8633628}C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor-cmd.exe] => (Allow) C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor-cmd.exe => No File FirewallRules: [UDP Query User{AAB39E74-A622-47BC-9F61-BA4492F4B6D0}C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor-cmd.exe] => (Allow) C:\program files\epic games\ue_5.1\engine\binaries\win64\unrealeditor-cmd.exe => No File FirewallRules: [TCP Query User{320EEEA0-B6FB-4173-AED4-E98DF1C707E4}C:\users\aorus\appdata\local\discord\app-1.0.9010\discord.exe] => (Allow) C:\users\aorus\appdata\local\discord\app-1.0.9010\discord.exe => No File FirewallRules: [UDP Query User{D8DDFF60-DD34-46CE-BBD4-512985BD1A70}C:\users\aorus\appdata\local\discord\app-1.0.9010\discord.exe] => (Allow) C:\users\aorus\appdata\local\discord\app-1.0.9010\discord.exe => No File FirewallRules: [{C93419BD-93A3-4D24-9DCC-A3C344DB1620}] => (Allow) C:\Users\aorus\AppData\Local\Temp\utorrent\utorrent.exe => No File FirewallRules: [{42C41312-D6BC-4E87-998A-3903D6DE8F8F}] => (Allow) C:\Users\aorus\AppData\Local\Temp\utorrent\utorrent.exe => No File FirewallRules: [{400A01F9-0453-4593-9DE6-477DAB33ACDC}] => (Allow) C:\Users\aorus\AppData\Roaming\D5 Render\d5_launcher.exe => No File FirewallRules: [TCP Query User{30941B2E-5A5F-4749-A7DC-DDCF77094761}C:\program files\epic games\forhonor\forhonor.exe] => (Allow) C:\program files\epic games\forhonor\forhonor.exe => No File FirewallRules: [UDP Query User{DAC63CEC-268A-4ECD-8E4E-1F8BECC46026}C:\program files\epic games\forhonor\forhonor.exe] => (Allow) C:\program files\epic games\forhonor\forhonor.exe => No File FirewallRules: [TCP Query User{53EE1F53-C818-458A-A7D3-4E7493698CE2}C:\program files (x86)\steam\steamapps\common\arma 3\arma3_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arma 3\arma3_x64.exe => No File FirewallRules: [UDP Query User{06B13DF8-B91B-43CE-A532-87D8C38834FD}C:\program files (x86)\steam\steamapps\common\arma 3\arma3_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arma 3\arma3_x64.exe => No File FirewallRules: [TCP Query User{6AB031F9-ABBB-48C4-A35C-63BB543466B5}C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe => No File FirewallRules: [UDP Query User{1E30D567-BA30-483D-83CA-632B746112D7}C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe => No File FirewallRules: [{0B38D6BB-8C6E-4B0B-9BA6-D11CF8F416BD}] => (Allow) C:\Users\aorus\AppData\Local\Programs\Opera\opera.exe => No File FirewallRules: [{AE70647F-A78E-4E36-866F-B1A940AE503B}] => (Allow) E:\SteamLibrary\steamapps\common\NBA 2K25\NBA2K25.exe => No File FirewallRules: [{26D99553-3680-4034-8596-223630C3A8A9}] => (Allow) E:\SteamLibrary\steamapps\common\NBA 2K25\NBA2K25.exe => No File FirewallRules: [{AD25D76C-6AE2-48E4-A97E-4AD6194984C6}] => (Allow) C:\Program Files (x86)\NCSOFT\Purple\2.24.1104.16\cefsharp.browsersubprocess.exe => No File FirewallRules: [{4A4AA03D-50A4-4BF2-B950-9A24F9FB181D}] => (Allow) C:\Program Files\Elgato\CameraHub\Camera Hub.exe => No File FirewallRules: [{D7731465-0A2D-4E67-9F04-5ED6BE3CEC49}] => (Allow) C:\Program Files\TikTok LIVE Studio\0.74.2\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{50CAB327-18BF-4D07-84C4-55DFA301FFAB}] => (Allow) C:\Program Files\TikTok LIVE Studio\0.74.2\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{26294A20-07DA-4816-856A-8650B34FA1A7}] => (Allow) D:\Program Files\TikTok LIVE Studio\0.74.4\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{2958E9B6-87FF-4B66-9DA0-40C153C2F068}] => (Allow) D:\Program Files\TikTok LIVE Studio\0.74.4\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{6D1FFF33-0A05-415D-BF55-2F0766373B08}] => (Allow) C:\Program Files\TikTok LIVE Studio\0.74.4\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{5764BBA1-034C-4440-A26C-2D20E9FD4E53}] => (Allow) C:\Program Files\TikTok LIVE Studio\0.74.4\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{04733159-6067-4AA4-AD97-D6A08AC4F427}] => (Allow) D:\SteamLibrary\steamapps\common\Total War THREE KINGDOMS\launcher\launcher.exe => No File FirewallRules: [{6E3749A3-E899-4260-B04C-EA3DC53894B8}] => (Allow) D:\SteamLibrary\steamapps\common\Total War THREE KINGDOMS\launcher\launcher.exe => No File FirewallRules: [{12FD00E6-04C4-48B0-9292-452BA627ECFD}] => (Allow) C:\Program Files\TikTok LIVE Studio\0.75.2\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{5FA131A5-D9CF-42B0-90B3-F3E375216E4D}] => (Allow) C:\Program Files\TikTok LIVE Studio\0.75.2\resources\app\electron\sdk\lib\MediaSDK_Server.exe => No File FirewallRules: [{553BE858-EEB7-4CC2-A7EE-4622FC02723E}] => (Allow) C:\Program Files\Elgato\CameraHub\Camera Hub.exe => No File FirewallRules: [TCP Query User{4CCCE415-89D3-4618-9F2B-0650C18F868E}C:\program files (x86)\zoiper5\zoiper5.exe] => (Allow) C:\program files (x86)\zoiper5\zoiper5.exe => No File FirewallRules: [UDP Query User{30832B26-B89A-498C-8135-B61B514E156F}C:\program files (x86)\zoiper5\zoiper5.exe] => (Allow) C:\program files (x86)\zoiper5\zoiper5.exe => No File FirewallRules: [TCP Query User{4E9DE7EB-4054-448F-85F7-FC11DD340828}C:\program files (x86)\counterpath\bria enterprise\briaenterprise.exe] => (Allow) C:\program files (x86)\counterpath\bria enterprise\briaenterprise.exe => No File FirewallRules: [UDP Query User{FAE99FDE-09A5-4CF4-B5D6-F645414B8B99}C:\program files (x86)\counterpath\bria enterprise\briaenterprise.exe] => (Allow) C:\program files (x86)\counterpath\bria enterprise\briaenterprise.exe => No File FirewallRules: [TCP Query User{A50EECDD-F498-4C14-AEC9-E8388E9403B5}D:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe] => (Allow) D:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [UDP Query User{BB2A5D43-7BA8-412E-9E1F-E949B335C612}D:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe] => (Allow) D:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [TCP Query User{73E50567-4E10-4C75-8C0E-EC6DE18E0BF4}D:\ubisoft\forhonor\forhonor.exe] => (Allow) D:\ubisoft\forhonor\forhonor.exe => No File FirewallRules: [UDP Query User{EE727C3B-D364-4107-AA8A-6D3FDFF229FF}D:\ubisoft\forhonor\forhonor.exe] => (Allow) D:\ubisoft\forhonor\forhonor.exe => No File FirewallRules: [{8CBEB835-E871-45FE-A75C-3192EAF3C401}] => (Allow) D:\SteamLibrary\steamapps\common\Mount & Blade II Bannerlord\bin\Win64_Shipping_Client\TaleWorlds.MountAndBlade.Launcher.exe => No File FirewallRules: [{C8F470EA-D155-4299-8B7B-D67426F3A75E}] => (Allow) D:\SteamLibrary\steamapps\common\Mount & Blade II Bannerlord\bin\Win64_Shipping_Client\TaleWorlds.MountAndBlade.Launcher.exe => No File FirewallRules: [TCP Query User{6F1AC87B-128C-494B-9718-75EEC1F80798}D:\steamlibrary\steamapps\common\glacier events\bf6event.exe] => (Allow) D:\steamlibrary\steamapps\common\glacier events\bf6event.exe => No File FirewallRules: [UDP Query User{7C99B6AF-2FAB-4A52-8C12-39427A020140}D:\steamlibrary\steamapps\common\glacier events\bf6event.exe] => (Allow) D:\steamlibrary\steamapps\common\glacier events\bf6event.exe => No File FirewallRules: [TCP Query User{04CCCA5C-8CD6-4F0A-82B9-136664D33EFF}D:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe] => (Allow) D:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [UDP Query User{55D8A1C2-738D-4C83-826B-CB1D703659F0}D:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe] => (Allow) D:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [TCP Query User{E5CCF796-97E5-4EA3-A364-400D8D750731}D:\steamlibrary\steamapps\common\dragon age inquisition\dragonageinquisition.exe] => (Allow) D:\steamlibrary\steamapps\common\dragon age inquisition\dragonageinquisition.exe => No File FirewallRules: [UDP Query User{15165E77-CDE9-4290-A6DE-D1AE67FA9D8D}D:\steamlibrary\steamapps\common\dragon age inquisition\dragonageinquisition.exe] => (Allow) D:\steamlibrary\steamapps\common\dragon age inquisition\dragonageinquisition.exe => No File FirewallRules: [{5AC8CB0B-3A30-44A0-9B9A-752DF8A3B2FC}] => (Allow) D:\SteamLibrary\steamapps\common\Crimson Desert\bin64\CrimsonDesert.exe => No File FirewallRules: [{38EBA738-27E5-4554-97C8-6F76EC4726F9}] => (Allow) D:\SteamLibrary\steamapps\common\Crimson Desert\bin64\CrimsonDesert.exe => No File HKU\S-1-5-21-2026779433-2403359633-3059324774-1002\...\Run: [ProtonVPN] => C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe (No File) HKU\S-1-5-21-2026779433-2403359633-3059324774-1002\...\Run: [Camera Hub] => "C:\Program Files\Elgato\CameraHub\Camera Hub.exe" /b (No File) HKU\S-1-5-21-2026779433-2403359633-3059324774-1002\...\Run: [Toolkit] => "C:\Program Files (x86)\Toolkit\Toolkit.exe" /WinStart**릻ꘫက耀\??\C:\Program Files (x86)\Toolkit\Service\Toolkit (No File) Task: {50338B90-F8BD-4A92-9158-81D637A8C3D1} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe (No File) Task: {E6B0846C-E4C9-4838-A99B-078BFEF4F1FC} - System32\Tasks\OneDrive Standalone Update Task v2 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (No File) S3 ace-game; \SystemRoot\System32\drivers\ace-game.sys (No File) S3 ACE-SSC-DRV64; \??\C:\Program Files\AntiCheatExpert\SGuard\x64\plugins\ACE-SSC-DRV64.sys (No File) S2 AMDRyzenMasterDriverV19; \??\C:\Program Files\AMD\Performance Profile Client\AMDRyzenMasterDriver.sys (No File) S1 EneTechIo; \??\C:\Windows\system32\drivers\ene.sys (No File) S4 NvModuleTracker; \SystemRoot\System32\DriverStore\FileRepository\nvmoduletracker.inf_amd64_ea6cec41fc5b2a8b\NvModuleTracker.sys (No File) S3 rsDwf; \SystemRoot\system32\DRIVERS\rsDwf.sys (No File) 2025-12-04 10:36 - 2025-12-04 10:36 - 000000048 ____R () C:\Users\aorus\AppData\Local\2B43E1F41E0421EFA7A03B8447BF09DE Comment: AdwCleaner scan + clean StartPowerShell: New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: Comment: HitmanPro scan StartPowershell: $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Comment: Verify Windows activation CMD: cscript c:\windows\system32\slmgr.vbs /xpr & cscript c:\windows\system32\slmgr.vbs /dlv Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy Comment: Reset Hosts file Hosts: Comment: Network reset commands CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winsock reset catalog Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.¨ C:\ProgramData\*.csproj C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.csproj C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.csproj C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.csproj C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* EmptyTemp: End::