I'd do a full scan in Windows Defender again. Maybe something you've done has killed it enough and prevented it from reinstalling itself. If you're still getting the registry keys in particular then it's still installing itself again and therefore not completely gone.

Have you looked at the actual file it's installed in "C:\windows\system32...". It appears it's creating new folders with a new GUID each time (GUID is the globally unique identifier - basically a big random hex number) with the file in them. The file name probably changes each time too.

I'd also try a few other online scanners (i.e. download and run an scanner directly) and preferably also at least one that you run offline from a bootdisk.

Unfortunately I'd be somewhat untrusting of that Windows installation unless I really knew what the malware did to install and where it installed itself.

In your case I would believe the positive hits before I believed the negative hits like your second screenshot.
_________________________
Christian
#40104192 120Gb (no longer in my E36 M3, won't fit the E46 M3)