Using OSForensics again,
I found it here:
mrxsmb.22.sys 57 KB
I then tracked it thru Manic Time to the exact time in seconds and found what happened at that time as confirmed adw, installer wnd.
What this was is a fake Cedrick Collomb Portable. Unlocker is only an Install.
Would not delete manua...