CustomCLSID: HKU\S-1-5-21-3358080756-2256953880-1246183812-1001_Classes\CLSID\{D5C4136A-93E5-4678-A6F8-0B2D9BB10999}\localserver32 -> C:\Windows\System32\RunDll32.exe "D:\Reg Organizer\Notifications.dll",Activate -ToastActivated => No File
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Помощник по обновлению до Windows 10.lnk -> C:\Windows10Upgrade\Windows10UpgraderApp.exe (No File) <==== Cyrillic
AlternateDataStreams: C:\ProgramData\TEMP:58A5270D [376]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:58A5270D [376]
FirewallRules: [{D2D836C9-7082-4E6A-94EB-78CDE37D40F4}] => (Block) C:\Windows\explorer.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{C732DD1C-8205-45E9-8813-215B13A415F5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File
FirewallRules: [{EAC9D8D8-324F-4A73-AD07-794EE0383128}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File
FirewallRules: [TCP Query User{F8BFEE91-FB4D-4846-B624-15B163C7474B}D:\vk\vk.exe] => (Allow) D:\vk\vk.exe => No File
FirewallRules: [UDP Query User{D77E033B-F540-428F-BC0F-37A259DFD3DA}D:\vk\vk.exe] => (Allow) D:\vk\vk.exe => No File
FirewallRules: [TCP Query User{056EA941-1200-4C0A-844C-05497278367C}C:\users\fqvd69z0r\appdata\roaming\fusion\native\d3.exe] => (Allow) C:\users\fqvd69z0r\appdata\roaming\fusion\native\d3.exe => No File
FirewallRules: [UDP Query User{D5923F52-F377-4047-8770-EBD35D250223}C:\users\fqvd69z0r\appdata\roaming\fusion\native\d3.exe] => (Allow) C:\users\fqvd69z0r\appdata\roaming\fusion\native\d3.exe => No File
FirewallRules: [{E8F4D5C5-F81F-44EE-92DD-404B0FAB37BA}] => (Block) LPort=445
FirewallRules: [{7D14E384-AF99-4B94-810F-A7E572DDEDFD}] => (Block) LPort=445
FirewallRules: [{9EC83C18-AFDF-4918-B4AB-40EDF12BA25A}] => (Block) LPort=139
FirewallRules: [{B369270B-96D0-44BA-950D-88FDE14A4BF8}] => (Block) LPort=139
FirewallRules: [{1036C8D2-D0A7-473D-898F-BAC42FEA48FB}] => (Allow) LPort=3389
FirewallRules: [TCP Query User{FB912851-5220-452F-B3C0-F8782F40184B}D:\windscribe\wsappcontrol.exe] => (Allow) D:\windscribe\wsappcontrol.exe => No File
FirewallRules: [UDP Query User{652E1907-2F83-4CB0-8119-9D88DD242C4D}D:\windscribe\wsappcontrol.exe] => (Allow) D:\windscribe\wsappcontrol.exe => No File
FirewallRules: [{8827E498-3C72-4B6B-A437-645EF6E187F9}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe => No File
FirewallRules: [TCP Query User{12B41691-4885-47EF-8877-06A31D6B7282}D:\wargaming.net\gamecenter\wgc.exe] => (Allow) D:\wargaming.net\gamecenter\wgc.exe => No File
FirewallRules: [UDP Query User{CEEC4C42-29B7-4E1D-BCC8-57FE45DD8538}D:\wargaming.net\gamecenter\wgc.exe] => (Allow) D:\wargaming.net\gamecenter\wgc.exe => No File
FirewallRules: [TCP Query User{D026C437-FC9C-44CE-A8AD-AD36085D051A}D:\world_of_tanks_ru\win64\worldoftanks.exe] => (Allow) D:\world_of_tanks_ru\win64\worldoftanks.exe => No File
FirewallRules: [UDP Query User{6B0E3D88-D6B7-4352-B520-F1E6DE165FD4}D:\world_of_tanks_ru\win64\worldoftanks.exe] => (Allow) D:\world_of_tanks_ru\win64\worldoftanks.exe => No File
FirewallRules: [{39854C90-F4B1-4E30-B657-66FBBB7F9BC0}] => (Allow) C:\Users\fqvd69z0r\AppData\Local\Programs\Opera\70.0.3728.106\opera.exe => No File
FirewallRules: [{8487FD98-3EC9-4D30-A8D1-D12514CAE708}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe => No File
FirewallRules: [{2A18844F-521A-4040-93AA-2DDE7F41A704}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe => No File
FirewallRules: [TCP Query User{FDB9A6E7-6957-49DB-AD65-E582751D1442}F:\the sims 4\game\bin\ts4_x64.exe] => (Allow) F:\the sims 4\game\bin\ts4_x64.exe => No File
FirewallRules: [UDP Query User{030A6478-9ED9-49D3-8F06-A4F9261C9F30}F:\the sims 4\game\bin\ts4_x64.exe] => (Allow) F:\the sims 4\game\bin\ts4_x64.exe => No File
FirewallRules: [{BD1CC4D6-0BBF-437B-8D93-E05AC77E84E4}] => (Allow) F:\steam\steamapps\common\Mordhau\Mordhau.exe => No File
FirewallRules: [{FFA785BA-9980-4D9B-A757-4C7654524403}] => (Allow) F:\steam\steamapps\common\Mordhau\Mordhau.exe => No File
FirewallRules: [{56CA52F9-FE01-4A6B-B137-F5A0C7B5C207}] => (Allow) D:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe => No File
FirewallRules: [{F2F2F30B-5DA2-4971-8078-C482D53FFADE}] => (Allow) D:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe => No File
FirewallRules: [{21409351-E32A-4CEA-859A-B32222615130}] => (Allow) D:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe => No File
FirewallRules: [{79DADDE7-9F95-4229-94F4-6B9EC790265B}] => (Allow) D:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe => No File
FirewallRules: [{99862E77-544F-4945-85A6-27887F16E369}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe => No File
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [1] eav_trial_rus.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [2] avast_free_antivirus_setup_online.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [3] eis_trial_rus.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [4] essf_trial_rus.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [5] hitmanpro_x64.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [6] ESETOnlineScanner_UKR.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [7] ESETOnlineScanner_RUS.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [8] HitmanPro.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [9] 360TS_Setup_Mini.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [10] Cezurity_Scanner_Pro_Free.exe
HKU\S-1-5-21-3358080756-2256953880-1246183812-1001\...\Policies\Explorer\DisallowRun: [11] Cube.exe
CHR HKLM-x32\...\Chrome\Extension: [makcojoppodhcgmmchohadhpkicoafka]
S2 TermService; C:\Windows\System32\svchost.exe [48688 2017-09-29] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL) <==== ATTENTION (no ServiceDLL)
S2 TermService; C:\Windows\SysWOW64\svchost.exe [44520 2017-09-29] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL) <==== ATTENTION (no ServiceDLL)
S3 FACEITService; "C:\Program Files\FACEIT AC\faceitservice.exe" [X]
S3 GoogleChromeElevationService; "C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\elevation_service.exe" [X]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S4 HitmanProScheduler; "C:\Program Files\HitmanPro\hmpsched.exe" [X]
S3 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
S3 amdkmdap; \SystemRoot\System32\DriverStore\FileRepository\u0355311.inf_amd64_183b8d63847c90cf\B355199\atikmpag.sys [X]
2020-11-25 22:37 - 2020-11-25 22:37 - 016267776 _____ C:\Users\fqvd69z0r\Downloads\a5dfbcc18d9699f079d2.exe

EmptyTemp:
Reboot: