Windows 10: My system got compromised recently and a weird file reovery.dat is being created in desktop

Hello, Recently i installed a cracked software fromcanva app by mistake instead of legit one and after that all my accounts got compromised including google and all associated account. I checked windows defender a file exclusion was automatically made and which probably gave access to the the hacker guy to my pc. I scanned and uninstalled most suspicious apps with windows defender and Malwarebytes both but the other day someone again logged in my gmail despite having 2fa enabled and changing password. now a weird file recovery.dat is being made in desktop and i have no clue if my system is

:)

 

Recent File List

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file1

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file2
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file3
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file4
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file5
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file6
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file7
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file8
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file9
...

you get the idea. ( too lazy to put it in a for loop and test it.

or just open regedit and remove all the fileX from that key.

 

Recent File List

that's all off already dude lol, I'm really surprised there is no fix for the recent files list/MRU in the file menu of programs haha

I appreciate the help, MS really needs to implement a Group Policy or a string that can do that for all programs installed

 

Changing a DAT file back to jpeg.

@ jer 1
In your post #16 the 2nd pic is showing an "Unsupported Audio" message.
That suggests to me that your .dat files may be video files.
The zip file you uploaded further suggests they are segments from a video file.
SM player plays the files with a message they were " Created with Nero"
Dennis