Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: HKLM\...\Policies\Explorer: [NoWindowsUpdate] 1 C:\Users\diego\AppData\Roaming\Mozilla\Firefox\Profiles\vae7yv4k.default-release\Extensions\[email protected] 2026-06-23 22:35 - 2026-06-23 22:35 - 000000000 ____D C:\Users\diego\AppData\Roaming\RenPy PowerShell: Remove-MpPreference -ExclusionPath "C:\Games" PowerShell: Remove-MpPreference -ExclusionPath "D:\Games" PowerShell: Remove-MpPreference -ExclusionPath "C:\Windows\SystemTemp\JackettUpdate-v0.24.504-639020239082305230" PowerShell: Remove-MpPreference -ExclusionPath "C:\Windows\SystemTemp\JackettUpdate-v0.24.790-639035944633084627" PowerShell: Remove-MpPreference -ExclusionPath "C:\Windows\SystemTemp" PowerShell: Remove-MpPreference -ExclusionPath "C:\ProgramData\Jackett" Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) S2 NativePushService; "C:\Users\diego\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe" (No File) CustomCLSID: HKU\S-1-5-21-3942013402-3740469761-1670386497-1001_Classes\CLSID\{0e065295-40e5-fbff-a113-a775a5c84d70}\localserver32 -> "C:\Program Files (x86)\Steam\steamapps\common\DSX\Main\DSX.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-3942013402-3740469761-1670386497-1001_Classes\CLSID\{13be76c7-b3a6-9374-07a3-7b0ab4fc62fb}\localserver32 -> "C:\Users\diego\Downloads\Text-Grab-Self-Contained-2024-03-03\Text-Grab-Self-Contained\Text-Grab.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-3942013402-3740469761-1670386497-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\localserver32 -> "C:\Users\diego\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-3942013402-3740469761-1670386497-1001_Classes\CLSID\{c0f42af5-855f-f8f2-3cc9-c23f54cf00ec}\localserver32 -> "C:\Program Files\Nefarius Software Solutions\Nefarius VirtualPad Driver Runtime\NefariusVirtualPadDriverNotifications.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-3942013402-3740469761-1670386497-1001_Classes\CLSID\{ecfe587a-46b2-f985-810a-6cedfc2da168}\localserver32 -> "C:\Users\diego\Downloads\DSX\Main\DSX.exe" -ToastActivated => No File ContextMenuHandlers1: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => -> No File ContextMenuHandlers3: [HashCheck Shell Extension] -> {705977C7-86CB-4743-BFAF-6908BD19B7B0} => C:\Windows\system32\ShellExt\HashCheck.dll -> No File ContextMenuHandlers4: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => -> No File ContextMenuHandlers5: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => -> No File AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\NotAllowedUnattendedBugReports:5E1E912DBE [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\NotAllowedUnattendedBugReports:AC55BD64A0 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative App.lnk:C1E221B7EC [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navegación privada con Firefox.lnk:B9E392F4E7 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk:1DC1525F34 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RGBFusion.lnk:3BC5874B9C [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RGBFusion.lnk:F3508893EB [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk:7AD7FA8AB1 [3442] AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [6596] AlternateDataStreams: C:\Users\Public\Documents\install-log-admin.txt:20FCFC4171 [3442] FirewallRules: [UDP Query User{37739869-06AD-41A0-AFAB-F3802B959A0F}C:\program files (x86)\dodi-repacks\dragon ball fighterz\red\binaries\win64\red-win64-shipping.exe] => (Block) C:\program files (x86)\dodi-repacks\dragon ball fighterz\red\binaries\win64\red-win64-shipping.exe => No File FirewallRules: [TCP Query User{0CE914EF-A712-4F3D-89EA-D56B1443B5CD}C:\program files (x86)\dodi-repacks\dragon ball fighterz\red\binaries\win64\red-win64-shipping.exe] => (Block) C:\program files (x86)\dodi-repacks\dragon ball fighterz\red\binaries\win64\red-win64-shipping.exe => No File FirewallRules: [UDP Query User{97529252-3F48-4934-966A-AFFBE0FAFD26}D:\games\sonicracingcrossworlds\union\binaries\win64\sonicracingcrossworldssteam.exe] => (Block) D:\games\sonicracingcrossworlds\union\binaries\win64\sonicracingcrossworldssteam.exe => No File FirewallRules: [TCP Query User{EDF59BA6-154C-4168-8740-DFD0689672BC}D:\games\sonicracingcrossworlds\union\binaries\win64\sonicracingcrossworldssteam.exe] => (Block) D:\games\sonicracingcrossworlds\union\binaries\win64\sonicracingcrossworldssteam.exe => No File FirewallRules: [UDP Query User{CE47FC66-1AA3-4C87-A79D-DD6A9199AF72}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [TCP Query User{3CEB33D4-FB02-4F4D-A43A-D34667D6E8D9}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [UDP Query User{ADA98E11-AD53-4DF3-BB89-7044D0ACB661}C:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File FirewallRules: [TCP Query User{D724F169-7A51-4664-BDA0-B4BC48124A26}C:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File FirewallRules: [UDP Query User{38290A4A-3463-4318-8C12-801E511FC7AE}D:\games\keeper\keeper\binaries\win64\keeper-win64-shipping.exe] => (Block) D:\games\keeper\keeper\binaries\win64\keeper-win64-shipping.exe => No File FirewallRules: [TCP Query User{A2799249-D57D-4277-8DDE-504702AA727E}D:\games\keeper\keeper\binaries\win64\keeper-win64-shipping.exe] => (Block) D:\games\keeper\keeper\binaries\win64\keeper-win64-shipping.exe => No File FirewallRules: [UDP Query User{05D43AD7-CC2D-4150-AD3C-BBF8B91BB045}D:\games\mafia the old countryy\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe] => (Block) D:\games\mafia the old countryy\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe => No File FirewallRules: [TCP Query User{7448DDFC-3C1B-495D-804B-23AEAA6A592E}D:\games\mafia the old countryy\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe] => (Block) D:\games\mafia the old countryy\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe => No File FirewallRules: [UDP Query User{153389EA-D0DF-495D-A73E-859E663213BB}D:\games\mafia the old country\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe] => (Block) D:\games\mafia the old country\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe => No File FirewallRules: [TCP Query User{5EF99205-E0EF-462A-A98E-8BEE5EB907A5}D:\games\mafia the old country\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe] => (Block) D:\games\mafia the old country\mafiatheoldcountry\binaries\win64\mafiatheoldcountry.exe => No File FirewallRules: [UDP Query User{6B7AC087-FB2C-4C29-857C-E40F0BA9FE9E}D:\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{1B20CAAE-4D9A-4350-BB9B-DFB6AACB8953}D:\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{2FBE7AE3-A9CD-4D20-B740-D06599001E4F}D:\alice\american mcgee's alice\data\alice.exe] => (Block) D:\alice\american mcgee's alice\data\alice.exe => No File FirewallRules: [TCP Query User{6EB881EB-9F1E-4C37-BDC5-B84FB265DA92}D:\alice\american mcgee's alice\data\alice.exe] => (Block) D:\alice\american mcgee's alice\data\alice.exe => No File FirewallRules: [UDP Query User{5A82ACEB-A068-4B7B-BEC4-F2A5E753F98B}C:\games\assassin's creed shadows\acshadows.exe] => (Allow) C:\games\assassin's creed shadows\acshadows.exe => No File FirewallRules: [TCP Query User{D5337A92-BD49-475D-8D79-C09201DE3D96}C:\games\assassin's creed shadows\acshadows.exe] => (Allow) C:\games\assassin's creed shadows\acshadows.exe => No File FirewallRules: [UDP Query User{F1611A47-0C0F-4289-A9A8-7B53C6BE6E1D}C:\games\grand theft auto v enhanced\gta5_enhanced.exe] => (Block) C:\games\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [TCP Query User{D1DCBE26-7257-437F-8958-1A6E2082C2F1}C:\games\grand theft auto v enhanced\gta5_enhanced.exe] => (Block) C:\games\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [{283F973E-3A3B-471A-B246-6DDBB2527317}] => (Allow) C:\Program Files\Ablaze Floorp\floorp.exe => No File FirewallRules: [UDP Query User{3D29D794-C04B-45DF-B30C-5763D94A6CB1}C:\users\diego\downloads\anydesk.exe] => (Allow) C:\users\diego\downloads\anydesk.exe => No File FirewallRules: [TCP Query User{129A386E-5078-47DD-950B-38F7FD229136}C:\users\diego\downloads\anydesk.exe] => (Allow) C:\users\diego\downloads\anydesk.exe => No File FirewallRules: [UDP Query User{E5763629-17C9-4E4E-B751-7A56C3EAAB6C}C:\users\diego\downloads\pummel party\pummel party\pummelparty.exe] => (Allow) C:\users\diego\downloads\pummel party\pummel party\pummelparty.exe => No File FirewallRules: [TCP Query User{22623F4F-749D-42E6-BDEA-C3335DA455E9}C:\users\diego\downloads\pummel party\pummel party\pummelparty.exe] => (Allow) C:\users\diego\downloads\pummel party\pummel party\pummelparty.exe => No File FirewallRules: [UDP Query User{5E28692E-0D07-44E1-9A06-63ED4273EC73}C:\games\lifeisstrangedoubleexposure\chronos\binaries\win64\chronos-win64-shipping.exe] => (Allow) C:\games\lifeisstrangedoubleexposure\chronos\binaries\win64\chronos-win64-shipping.exe => No File FirewallRules: [TCP Query User{A396A746-996F-4E13-8707-1B36B805B7EF}C:\games\lifeisstrangedoubleexposure\chronos\binaries\win64\chronos-win64-shipping.exe] => (Allow) C:\games\lifeisstrangedoubleexposure\chronos\binaries\win64\chronos-win64-shipping.exe => No File FirewallRules: [UDP Query User{21099F56-480E-4720-8B4E-DEFC60C5FF69}C:\users\diego\downloads\d.h.s.z.ue.v2007.006.003.004.003.b16752936-gdz\game\dragon ball sparking! zero\sparkingzero\binaries\win64\sparkingzero-win64-shipping.exe] => (Allow) C:\users\diego\downloads\d.h.s.z.ue.v2007.006.003.004.003.b16752936-gdz\game\dragon ball sparking! zero\sparkingzero\binaries\win64\sparkingzero-win64-shipping.exe => No File FirewallRules: [TCP Query User{4B0600A4-E829-431C-83C8-318D68D96FCA}C:\users\diego\downloads\d.h.s.z.ue.v2007.006.003.004.003.b16752936-gdz\game\dragon ball sparking! zero\sparkingzero\binaries\win64\sparkingzero-win64-shipping.exe] => (Allow) C:\users\diego\downloads\d.h.s.z.ue.v2007.006.003.004.003.b16752936-gdz\game\dragon ball sparking! zero\sparkingzero\binaries\win64\sparkingzero-win64-shipping.exe => No File FirewallRules: [UDP Query User{49E57690-CADF-4A2C-9FF9-72EBF07824C0}C:\users\diego\downloads\platform-tools-latest-windows\platform-tools\adb.exe] => (Allow) C:\users\diego\downloads\platform-tools-latest-windows\platform-tools\adb.exe => No File FirewallRules: [TCP Query User{857ECFC0-B9F4-4216-A497-44A77A050A8D}C:\users\diego\downloads\platform-tools-latest-windows\platform-tools\adb.exe] => (Allow) C:\users\diego\downloads\platform-tools-latest-windows\platform-tools\adb.exe => No File FirewallRules: [UDP Query User{1C4C61FD-6B52-4405-9BF2-D53FAB9A5FE8}C:\games\gta san andreas definitive edition\gameface\binaries\win64\sanandreas.exe] => (Block) C:\games\gta san andreas definitive edition\gameface\binaries\win64\sanandreas.exe => No File FirewallRules: [TCP Query User{29E06DDB-5CB8-4AFD-B67E-75B1E7E37054}C:\games\gta san andreas definitive edition\gameface\binaries\win64\sanandreas.exe] => (Block) C:\games\gta san andreas definitive edition\gameface\binaries\win64\sanandreas.exe => No File FirewallRules: [UDP Query User{AC09147D-6B05-4D59-A50D-3508F5A83CB1}C:\games\gta vice city definitive edition\gameface\binaries\win64\vicecity.exe] => (Block) C:\games\gta vice city definitive edition\gameface\binaries\win64\vicecity.exe => No File FirewallRules: [TCP Query User{A907AA4D-F7EE-40C3-90C4-0C48E2C4E9A4}C:\games\gta vice city definitive edition\gameface\binaries\win64\vicecity.exe] => (Block) C:\games\gta vice city definitive edition\gameface\binaries\win64\vicecity.exe => No File FirewallRules: [UDP Query User{554C3E49-28C8-46A8-81A7-B33D02744948}C:\games\gta iii definitive edition\gameface\binaries\win64\libertycity.exe] => (Block) C:\games\gta iii definitive edition\gameface\binaries\win64\libertycity.exe => No File FirewallRules: [TCP Query User{D45CE5BA-78BA-4950-92E7-4C31718AD0D2}C:\games\gta iii definitive edition\gameface\binaries\win64\libertycity.exe] => (Block) C:\games\gta iii definitive edition\gameface\binaries\win64\libertycity.exe => No File FirewallRules: [UDP Query User{494AC611-ADD5-4FB0-BA60-A6CB23E873F8}C:\xboxgames\call of duty\content\sp24\sp24-cod.exe] => (Allow) C:\xboxgames\call of duty\content\sp24\sp24-cod.exe => No File FirewallRules: [TCP Query User{8751167A-8E2A-46B4-9A26-C9467AB08009}C:\xboxgames\call of duty\content\sp24\sp24-cod.exe] => (Allow) C:\xboxgames\call of duty\content\sp24\sp24-cod.exe => No File FirewallRules: [UDP Query User{D8F3B155-3BB7-42A1-BD87-C144E6ED673C}C:\games\god of war ragnarok\gowr.exe] => (Allow) C:\games\god of war ragnarok\gowr.exe => No File FirewallRules: [TCP Query User{9AA65343-F88B-4973-85B7-CA73660A61E4}C:\games\god of war ragnarok\gowr.exe] => (Allow) C:\games\god of war ragnarok\gowr.exe => No File FirewallRules: [UDP Query User{17464671-B858-4385-B4CF-1CEF9B5585CD}C:\program files (x86)\steam\steamapps\common\dsx\main\dsx.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dsx\main\dsx.exe => No File FirewallRules: [TCP Query User{7C65264E-D5EA-43D0-8342-B221982BACE3}C:\program files (x86)\steam\steamapps\common\dsx\main\dsx.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dsx\main\dsx.exe => No File FirewallRules: [UDP Query User{75D982DC-B598-40C0-A7E9-E60FAC86AD25}C:\xboxgames\the gunk\content\dust\binaries\wingdk\dust-wingdk-shipping.exe] => (Allow) C:\xboxgames\the gunk\content\dust\binaries\wingdk\dust-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{7DFDE4DC-D636-4438-9CE8-5B384BDD180C}C:\xboxgames\the gunk\content\dust\binaries\wingdk\dust-wingdk-shipping.exe] => (Allow) C:\xboxgames\the gunk\content\dust\binaries\wingdk\dust-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{DBDA5D91-93C4-4F58-95F9-C47F0DC7EE4D}C:\xboxgames\call of duty\content\cod.exe] => (Allow) C:\xboxgames\call of duty\content\cod.exe => No File FirewallRules: [TCP Query User{BA4107C3-4A10-4D30-9589-6ADCBE56EF5F}C:\xboxgames\call of duty\content\cod.exe] => (Allow) C:\xboxgames\call of duty\content\cod.exe => No File FirewallRules: [UDP Query User{C08845CF-9614-41E0-BF6A-DC2B12FB5988}C:\xboxgames\quake\content\bastet_winstore.exe] => (Allow) C:\xboxgames\quake\content\bastet_winstore.exe => No File FirewallRules: [TCP Query User{ABAC5C16-E3FE-4828-A194-799E14F933BA}C:\xboxgames\quake\content\bastet_winstore.exe] => (Allow) C:\xboxgames\quake\content\bastet_winstore.exe => No File FirewallRules: [UDP Query User{86250C7C-560B-4D59-954B-F54E7D41BE51}C:\xboxgames\senua-s saga- hellblade 2\content\hellblade2\binaries\wingdk\hellblade2-wingdk-shipping.exe] => (Allow) C:\xboxgames\senua-s saga- hellblade 2\content\hellblade2\binaries\wingdk\hellblade2-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{ECCD0E64-E851-4288-9A2F-832D5E9EE09F}C:\xboxgames\senua-s saga- hellblade 2\content\hellblade2\binaries\wingdk\hellblade2-wingdk-shipping.exe] => (Allow) C:\xboxgames\senua-s saga- hellblade 2\content\hellblade2\binaries\wingdk\hellblade2-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{30B21E61-F204-4399-87CE-ABC2EE02CF3F}C:\xboxgames\gang beasts\content\gang beasts.exe] => (Allow) C:\xboxgames\gang beasts\content\gang beasts.exe => No File FirewallRules: [TCP Query User{8C1C3B7C-D2E7-45C4-86EC-3A67233C7728}C:\xboxgames\gang beasts\content\gang beasts.exe] => (Allow) C:\xboxgames\gang beasts\content\gang beasts.exe => No File FirewallRules: [UDP Query User{44075A7F-EFAE-4C32-91BD-F9A59A4A0EDC}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [TCP Query User{6D95CDB3-7574-4EEF-88C3-A678B0E83AC7}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [UDP Query User{F547B9BA-DE4B-41F7-8B7A-C70EA53B12AB}C:\users\diego\downloads\dsx\main\dsx.exe] => (Allow) C:\users\diego\downloads\dsx\main\dsx.exe => No File FirewallRules: [TCP Query User{D7CAE005-58E0-4687-8D68-EDC83C5A2F34}C:\users\diego\downloads\dsx\main\dsx.exe] => (Allow) C:\users\diego\downloads\dsx\main\dsx.exe => No File FirewallRules: [UDP Query User{FB3B9FF2-C86E-48B5-B10C-58098679ED63}C:\games\god of war\gow.exe] => (Block) C:\games\god of war\gow.exe => No File FirewallRules: [TCP Query User{545924F9-74DC-4E69-B97C-013F5BFB1D93}C:\games\god of war\gow.exe] => (Block) C:\games\god of war\gow.exe => No File FirewallRules: [UDP Query User{862BED6B-6E20-4AA9-9DF0-D6A411E28486}C:\games\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe] => (Allow) C:\games\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe => No File FirewallRules: [TCP Query User{AC121CB6-5584-4E12-8F25-53B521C4ACB5}C:\games\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe] => (Allow) C:\games\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe => No File FirewallRules: [UDP Query User{E7C00ACB-A44C-4DE1-B5B1-87DBEE09D74E}C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe] => (Allow) C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{CF2CDC19-575B-489E-B543-2453B7C45844}C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe] => (Allow) C:\xboxgames\palworld\content\pal\binaries\wingdk\palworld-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{0FAB96D0-B5E5-4C34-84EE-A92EE65E91A3}C:\users\diego\appdata\local\programs\opera gx\opera.exe] => (Block) C:\users\diego\appdata\local\programs\opera gx\opera.exe => No File FirewallRules: [TCP Query User{6DB1C05B-25C6-45B6-A0F0-E0602CCA7EA4}C:\users\diego\appdata\local\programs\opera gx\opera.exe] => (Block) C:\users\diego\appdata\local\programs\opera gx\opera.exe => No File FirewallRules: [UDP Query User{9EBFCDBB-27F8-4989-B52D-CDBD48128E54}C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{9DB05DA8-A616-4E8A-9F69-604ADF53A769}C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{049D45DD-D3BB-4FD4-8F4E-F4651C7F2B6E}C:\games\uncharted legacy of thieves collection-insaneramzes\tll-l.exe] => (Block) C:\games\uncharted legacy of thieves collection-insaneramzes\tll-l.exe => No File FirewallRules: [TCP Query User{B262E9A7-022A-4E8E-8F3B-BB7103A0ACDE}C:\games\uncharted legacy of thieves collection-insaneramzes\tll-l.exe] => (Block) C:\games\uncharted legacy of thieves collection-insaneramzes\tll-l.exe => No File FirewallRules: [UDP Query User{92A5E1EC-5B6A-45D4-A97A-06A5B14C9217}C:\xboxgames\jusant\content\asc\binaries\wingdk\asc-wingdk-shipping.exe] => (Allow) C:\xboxgames\jusant\content\asc\binaries\wingdk\asc-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{AC127831-F894-4D87-9072-354E3FFEF080}C:\xboxgames\jusant\content\asc\binaries\wingdk\asc-wingdk-shipping.exe] => (Allow) C:\xboxgames\jusant\content\asc\binaries\wingdk\asc-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{4E66D16E-E748-4CD2-8A89-AA91B0A272DE}C:\games\uncharted legacy of thieves collection-insaneramzes\u4.exe] => (Allow) C:\games\uncharted legacy of thieves collection-insaneramzes\u4.exe => No File FirewallRules: [TCP Query User{F4FF62EB-3CA5-4291-88F1-F05E3A5C65EA}C:\games\uncharted legacy of thieves collection-insaneramzes\u4.exe] => (Allow) C:\games\uncharted legacy of thieves collection-insaneramzes\u4.exe => No File FirewallRules: [UDP Query User{32B7E7DE-6CA3-4B78-8410-9564A7980786}C:\games\uncharted legacy of thieves collection-insaneramzes\tll.exe] => (Allow) C:\games\uncharted legacy of thieves collection-insaneramzes\tll.exe => No File FirewallRules: [TCP Query User{1C33BA73-1A6B-46DA-89AB-0D4C29740DBE}C:\games\uncharted legacy of thieves collection-insaneramzes\tll.exe] => (Allow) C:\games\uncharted legacy of thieves collection-insaneramzes\tll.exe => No File FirewallRules: [UDP Query User{82E7DA00-EE29-4012-BBBA-15688EB4EE1F}C:\xboxgames\gotham knights\content\mercury\binaries\wingdk\gothamknights.exe] => (Allow) C:\xboxgames\gotham knights\content\mercury\binaries\wingdk\gothamknights.exe => No File FirewallRules: [TCP Query User{6893C960-B33C-4870-A64D-ACE1151245F7}C:\xboxgames\gotham knights\content\mercury\binaries\wingdk\gothamknights.exe] => (Allow) C:\xboxgames\gotham knights\content\mercury\binaries\wingdk\gothamknights.exe => No File FirewallRules: [{CC06A603-38AD-4008-8B30-5CC8F887405D}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File FirewallRules: [{F6581DF6-F3F4-4B65-A6B1-CA49B0019B63}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File FirewallRules: [UDP Query User{1373E386-075E-45D3-AB6B-FEC1EF610F0A}C:\xboxgames\ghostwire- tokyo\content\snowfall\binaries\wingdk\gwt.exe] => (Allow) C:\xboxgames\ghostwire- tokyo\content\snowfall\binaries\wingdk\gwt.exe => No File FirewallRules: [TCP Query User{E9909C36-B9C8-49DE-8909-F350EB71DFA3}C:\xboxgames\ghostwire- tokyo\content\snowfall\binaries\wingdk\gwt.exe] => (Allow) C:\xboxgames\ghostwire- tokyo\content\snowfall\binaries\wingdk\gwt.exe => No File FirewallRules: [UDP Query User{AA822E9C-EF78-4AA4-A99C-ED9FEE6BDD3A}C:\xboxgames\high on life\content\oregon\binaries\wingdk\oregon-wingdk-shipping.exe] => (Allow) C:\xboxgames\high on life\content\oregon\binaries\wingdk\oregon-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{E68704AB-8AD4-4C1B-ACAE-4CE066497764}C:\xboxgames\high on life\content\oregon\binaries\wingdk\oregon-wingdk-shipping.exe] => (Allow) C:\xboxgames\high on life\content\oregon\binaries\wingdk\oregon-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{5226E9F8-B275-4317-B90E-06B6F305F8BD}C:\users\diego\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\diego\appdata\roaming\spotify\spotify.exe => No File FirewallRules: [TCP Query User{4FFD8EB9-224F-4B80-B892-46F8C1CC6D74}C:\users\diego\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\diego\appdata\roaming\spotify\spotify.exe => No File FirewallRules: [UDP Query User{B39C177C-78FC-43B2-86D9-B6EE4995651E}C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{B3EFE1BC-90FA-4A2E-9F50-652528338621}C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\gog games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [{F1CAD067-7E97-4996-8E77-38AB1BC7013C}] => (Allow) C:\Program Files\Tailscale\tailscaled.exe => No File FirewallRules: [{A75C54A5-66AF-4D6B-811C-0AE9A1144F37}] => (Block) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File FirewallRules: [{2AADAA3B-392C-43B5-B52B-69CDAEA7EFCD}] => (Block) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File FirewallRules: [UDP Query User{D7B39D89-CC0C-4C62-A9A9-64FB4E6B05B6}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File FirewallRules: [TCP Query User{90736F61-C3B1-47AE-8390-6C5016C3E037}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File FirewallRules: [{E76F98E6-3C61-4782-91BA-AAA55FD2B8D3}] => (Block) C:\program files\epic games\dyinglight\dyinglightgame.exe => No File FirewallRules: [{DD12D601-389E-4D2B-8933-CDD2C727F708}] => (Block) C:\program files\epic games\dyinglight\dyinglightgame.exe => No File FirewallRules: [UDP Query User{54C7DC62-5D6F-4CB2-A1D5-201BEE0D4111}C:\program files\epic games\dyinglight\dyinglightgame.exe] => (Allow) C:\program files\epic games\dyinglight\dyinglightgame.exe => No File FirewallRules: [TCP Query User{F7E19106-E7CF-4DD8-8D90-212B4BB65CEE}C:\program files\epic games\dyinglight\dyinglightgame.exe] => (Allow) C:\program files\epic games\dyinglight\dyinglightgame.exe => No File FirewallRules: [{1FF75366-EE73-4B58-9B07-E2E54270B385}] => (Block) C:\xboxgames\atomic heart\content\atomicheart\binaries\wingdk\atomicheart-wingdk-shipping.exe => No File FirewallRules: [{395139F6-1B8D-4846-8FDB-2B8D81930F47}] => (Block) C:\xboxgames\atomic heart\content\atomicheart\binaries\wingdk\atomicheart-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{AABFF7B5-64AE-466E-A7F6-6B6924DC2240}C:\xboxgames\atomic heart\content\atomicheart\binaries\wingdk\atomicheart-wingdk-shipping.exe] => (Allow) C:\xboxgames\atomic heart\content\atomicheart\binaries\wingdk\atomicheart-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{EE2A928C-24F9-4B1A-98F4-EB0233FB62BB}C:\xboxgames\atomic heart\content\atomicheart\binaries\wingdk\atomicheart-wingdk-shipping.exe] => (Allow) C:\xboxgames\atomic heart\content\atomicheart\binaries\wingdk\atomicheart-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{5FF5C0E1-B777-4182-A510-8811B0B5558D}C:\xboxgames\hi-fi rush\content\hibiki\binaries\wingdk\hi-fi-rush.exe] => (Allow) C:\xboxgames\hi-fi rush\content\hibiki\binaries\wingdk\hi-fi-rush.exe => No File FirewallRules: [TCP Query User{7B11DE30-2AB7-47BE-88B0-F13CCEA27BAB}C:\xboxgames\hi-fi rush\content\hibiki\binaries\wingdk\hi-fi-rush.exe] => (Allow) C:\xboxgames\hi-fi rush\content\hibiki\binaries\wingdk\hi-fi-rush.exe => No File FirewallRules: [UDP Query User{7467CE11-5DB6-43BB-86CE-172B76C108A8}C:\games\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe] => (Block) C:\games\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe => No File FirewallRules: [TCP Query User{47A31C43-E760-4439-A552-EC41BA7F9152}C:\games\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe] => (Block) C:\games\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe => No File FirewallRules: [UDP Query User{1F05FF42-F3D5-495E-9686-8B56A439161F}C:\games\hot wheels unleashed\hotwheels\binaries\win64\hotwheels-win64-shipping.exe] => (Allow) C:\games\hot wheels unleashed\hotwheels\binaries\win64\hotwheels-win64-shipping.exe => No File FirewallRules: [TCP Query User{EC15CD3B-BEF9-49C1-9058-4E5449F3B805}C:\games\hot wheels unleashed\hotwheels\binaries\win64\hotwheels-win64-shipping.exe] => (Allow) C:\games\hot wheels unleashed\hotwheels\binaries\win64\hotwheels-win64-shipping.exe => No File FirewallRules: [UDP Query User{1516BB78-3623-48B5-B326-4EA31C32E8A9}C:\games\capcom fighting collection\capcomfightingcollection.exe] => (Allow) C:\games\capcom fighting collection\capcomfightingcollection.exe => No File FirewallRules: [TCP Query User{C53934C5-15C8-4CDF-81E7-5924AFDC851C}C:\games\capcom fighting collection\capcomfightingcollection.exe] => (Allow) C:\games\capcom fighting collection\capcomfightingcollection.exe => No File FirewallRules: [UDP Query User{F5654A10-C9D0-4B29-92F1-635354824C46}C:\users\diego\downloads\rpcs3-v0.0.26-14636-3202cc70_win64\rpcs3.exe] => (Allow) C:\users\diego\downloads\rpcs3-v0.0.26-14636-3202cc70_win64\rpcs3.exe => No File FirewallRules: [TCP Query User{EB8A4A71-600F-4832-A8E0-737F1B00FFA9}C:\users\diego\downloads\rpcs3-v0.0.26-14636-3202cc70_win64\rpcs3.exe] => (Allow) C:\users\diego\downloads\rpcs3-v0.0.26-14636-3202cc70_win64\rpcs3.exe => No File FirewallRules: [UDP Query User{F1D25F3F-7405-44F2-83DB-2500949696DF}C:\xboxgames\dead by daylight\content\deadbydaylight\binaries\wingdk\deadbydaylight-wingdk-shipping.exe] => (Allow) C:\xboxgames\dead by daylight\content\deadbydaylight\binaries\wingdk\deadbydaylight-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{3B2333A4-1E44-427E-811F-CADB788230A6}C:\xboxgames\dead by daylight\content\deadbydaylight\binaries\wingdk\deadbydaylight-wingdk-shipping.exe] => (Allow) C:\xboxgames\dead by daylight\content\deadbydaylight\binaries\wingdk\deadbydaylight-wingdk-shipping.exe => No File FirewallRules: [{52325509-D12B-48EA-A0F4-80E9E1BF0196}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mafia\Mafia\Setup.exe => No File FirewallRules: [{DA8A00B0-7F69-400A-BA18-53677AA8D6AA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mafia\Mafia\Setup.exe => No File FirewallRules: [{CE3CF723-B1F8-467A-AF07-F2A4614C029F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mafia\Mafia\Game.exe => No File FirewallRules: [{200231B3-52B1-40A8-982B-85256C93FFB1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mafia\Mafia\Game.exe => No File FirewallRules: [UDP Query User{2894DEC3-4752-4100-9490-5625D357F548}C:\xboxgames\psychonauts 2\content\psychonauts2\binaries\wingdk\psychonauts2-wingdk-shipping.exe] => (Allow) C:\xboxgames\psychonauts 2\content\psychonauts2\binaries\wingdk\psychonauts2-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{4BAEDA89-C5ED-4637-A99D-E0E2031C84FA}C:\xboxgames\psychonauts 2\content\psychonauts2\binaries\wingdk\psychonauts2-wingdk-shipping.exe] => (Allow) C:\xboxgames\psychonauts 2\content\psychonauts2\binaries\wingdk\psychonauts2-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{B5325E5D-1CC9-4AB6-A884-7D7D75F7A676}C:\xboxgames\life is strange- true colors™\content\siren\binaries\wingdk\siren-wingdk-shipping.exe] => (Allow) C:\xboxgames\life is strange- true colors™\content\siren\binaries\wingdk\siren-wingdk-shipping.exe => No File FirewallRules: [TCP Query User{DEDD5AC1-C88B-4F4B-92F6-1AC7572F8B33}C:\xboxgames\life is strange- true colors™\content\siren\binaries\wingdk\siren-wingdk-shipping.exe] => (Allow) C:\xboxgames\life is strange- true colors™\content\siren\binaries\wingdk\siren-wingdk-shipping.exe => No File FirewallRules: [UDP Query User{997EC5A7-EFF5-401A-BA92-F25DEDC82CA1}C:\program files (x86)\zotacfirestorm\firestorm.exe] => (Allow) C:\program files (x86)\zotacfirestorm\firestorm.exe => No File FirewallRules: [TCP Query User{2829D1D5-1637-427F-A658-3D3F48C015FE}C:\program files (x86)\zotacfirestorm\firestorm.exe] => (Allow) C:\program files (x86)\zotacfirestorm\firestorm.exe => No File FirewallRules: [{EFFDBC86-7B9C-4A2C-A436-60F842E860F9}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{6820FF51-58D3-465F-8A10-AED1CCD8521B}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{844C536B-6F65-4958-86EC-59A0AB0BD6FE}C:\users\diego\downloads\clair.obscur.expedition.33.rexagames.com\sandfall\binaries\win64\sandfall-win64-shipping.exe] => (Block) C:\users\diego\downloads\clair.obscur.expedition.33.rexagames.com\sandfall\binaries\win64\sandfall-win64-shipping.exe => No File FirewallRules: [UDP Query User{6C8E029D-45DA-40C7-B6A6-FE768E1D3A03}C:\users\diego\downloads\clair.obscur.expedition.33.rexagames.com\sandfall\binaries\win64\sandfall-win64-shipping.exe] => (Block) C:\users\diego\downloads\clair.obscur.expedition.33.rexagames.com\sandfall\binaries\win64\sandfall-win64-shipping.exe => No File FirewallRules: [{339049FD-5680-4FEE-991D-7C802E5E967F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\bin\ui32.exe => No File FirewallRules: [{A4827D87-DF68-49B2-8DC6-E01A15C1E663}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\bin\ui32.exe => No File FirewallRules: [TCP Query User{8AD1D64E-02FE-415D-8662-9E621ACCBE90}C:\users\diego\downloads\replanted.v1.5.0.rexagames.com\replanted.exe] => (Block) C:\users\diego\downloads\replanted.v1.5.0.rexagames.com\replanted.exe => No File FirewallRules: [UDP Query User{A3E2291E-027F-4703-91C1-3648E4EFEFA7}C:\users\diego\downloads\replanted.v1.5.0.rexagames.com\replanted.exe] => (Block) C:\users\diego\downloads\replanted.v1.5.0.rexagames.com\replanted.exe => No File FirewallRules: [TCP Query User{D59164EE-17D1-4AB8-ABE0-4242341313C1}C:\users\diego\downloads\scrcpy-win64-v3.3.4\scrcpy-win64-v3.3.4\adb.exe] => (Allow) C:\users\diego\downloads\scrcpy-win64-v3.3.4\scrcpy-win64-v3.3.4\adb.exe => No File FirewallRules: [UDP Query User{A0BD59C5-463A-454E-B502-348B7965929D}C:\users\diego\downloads\scrcpy-win64-v3.3.4\scrcpy-win64-v3.3.4\adb.exe] => (Allow) C:\users\diego\downloads\scrcpy-win64-v3.3.4\scrcpy-win64-v3.3.4\adb.exe => No File FirewallRules: [{1FE4B1DD-B75C-4C8A-A934-33C93C450D7A}] => (Allow) C:\Users\diego\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe => No File FirewallRules: [{20309CBB-2507-4B49-B60E-61523F72EB1C}] => (Allow) C:\Users\diego\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe => No File FirewallRules: [TCP Query User{65CA0E62-6428-49F7-BC21-4EA2F1D24E4E}D:\games\yakuza 0 director's cut\runtime\media\yakuza0_dc.exe] => (Block) D:\games\yakuza 0 director's cut\runtime\media\yakuza0_dc.exe => No File FirewallRules: [UDP Query User{1BD62AE3-49FB-428D-99C5-AB9A7CB3A727}D:\games\yakuza 0 director's cut\runtime\media\yakuza0_dc.exe] => (Block) D:\games\yakuza 0 director's cut\runtime\media\yakuza0_dc.exe => No File FirewallRules: [TCP Query User{848D3F4A-69B8-40D1-9F88-ECF1DE4887BA}D:\games\pico-park-ankergames\pico-park-ankergames\pico_park.exe] => (Block) D:\games\pico-park-ankergames\pico-park-ankergames\pico_park.exe => No File FirewallRules: [UDP Query User{B8BCEFDF-CFF1-407F-A34E-2E8578C5A26C}D:\games\pico-park-ankergames\pico-park-ankergames\pico_park.exe] => (Block) D:\games\pico-park-ankergames\pico-park-ankergames\pico_park.exe => No File FirewallRules: [TCP Query User{EF7D866A-CCB1-4D8F-B484-97CFF32887ED}C:\games\resident evil requiem\re9.exe] => (Block) C:\games\resident evil requiem\re9.exe => No File FirewallRules: [UDP Query User{5346FF8C-17F8-4B3B-950A-DE741645A1D5}C:\games\resident evil requiem\re9.exe] => (Block) C:\games\resident evil requiem\re9.exe => No File FirewallRules: [TCP Query User{D92198B5-5516-4564-A34D-E5A34F559323}D:\games\reanimal\everholm\binaries\win64\reanimal.exe] => (Block) D:\games\reanimal\everholm\binaries\win64\reanimal.exe => No File FirewallRules: [UDP Query User{E5E556AF-C84F-4A47-8F1E-6112BFF0BEB0}D:\games\reanimal\everholm\binaries\win64\reanimal.exe] => (Block) D:\games\reanimal\everholm\binaries\win64\reanimal.exe => No File FirewallRules: [TCP Query User{6C5D50C6-E0B0-41FE-A907-47C225227BE2}D:\games\scott pilgrim vs the world\scott.exe] => (Block) D:\games\scott pilgrim vs the world\scott.exe => No File FirewallRules: [UDP Query User{DC88EA26-6566-407E-ADE6-C9BB5FC71D93}D:\games\scott pilgrim vs the world\scott.exe] => (Block) D:\games\scott pilgrim vs the world\scott.exe => No File FirewallRules: [TCP Query User{25FF0C68-591D-4445-B94E-F63893113498}D:\setup\armgddn browser\skybox vr video player v14717419(1.1.8) -armgddn\steamvr_sourcevrplayer.exe] => (Allow) D:\setup\armgddn browser\skybox vr video player v14717419(1.1.8) -armgddn\steamvr_sourcevrplayer.exe => No File FirewallRules: [UDP Query User{43676CDB-CC41-465C-827F-AAAB18930E3A}D:\setup\armgddn browser\skybox vr video player v14717419(1.1.8) -armgddn\steamvr_sourcevrplayer.exe] => (Allow) D:\setup\armgddn browser\skybox vr video player v14717419(1.1.8) -armgddn\steamvr_sourcevrplayer.exe => No File FirewallRules: [TCP Query User{9B83C390-6E67-4950-894C-EEF762DB3965}D:\games\psychonauts in the rhombus of ruin\psychonautsintherhombusofruin\binaries\win64\psychonautsintherhombusofruin-win64-shipping.exe] => (Block) D:\games\psychonauts in the rhombus of ruin\psychonautsintherhombusofruin\binaries\win64\psychonautsintherhombusofruin-win64-shipping.exe => No File FirewallRules: [UDP Query User{EF27A2F7-1BA8-4318-8A78-955E6E282E14}D:\games\psychonauts in the rhombus of ruin\psychonautsintherhombusofruin\binaries\win64\psychonautsintherhombusofruin-win64-shipping.exe] => (Block) D:\games\psychonauts in the rhombus of ruin\psychonautsintherhombusofruin\binaries\win64\psychonautsintherhombusofruin-win64-shipping.exe => No File FirewallRules: [TCP Query User{5A26255D-E8A3-48D2-9087-AB1C5F53FE35}D:\games\beat saber (1.42.3_15380 all dlc)\beat saber.exe] => (Block) D:\games\beat saber (1.42.3_15380 all dlc)\beat saber.exe => No File FirewallRules: [UDP Query User{200D7343-E05F-4686-8047-514B3E49E0F8}D:\games\beat saber (1.42.3_15380 all dlc)\beat saber.exe] => (Block) D:\games\beat saber (1.42.3_15380 all dlc)\beat saber.exe => No File FirewallRules: [TCP Query User{9520B8D8-150A-4116-BE04-4B2E21834848}C:\games\resident evil requiem biohazard requiem\re9.exe] => (Block) C:\games\resident evil requiem biohazard requiem\re9.exe => No File FirewallRules: [UDP Query User{CC8F6A72-F786-4F79-AAFC-02B0338B1F65}C:\games\resident evil requiem biohazard requiem\re9.exe] => (Block) C:\games\resident evil requiem biohazard requiem\re9.exe => No File FirewallRules: [TCP Query User{8C1C38C1-C91A-4304-8300-9F26914FD6B0}D:\games\the binding of isaac rebirth\isaac-ng.exe] => (Block) D:\games\the binding of isaac rebirth\isaac-ng.exe => No File FirewallRules: [UDP Query User{94D396E3-A1A5-4EB2-A172-EB9A1BD696AA}D:\games\the binding of isaac rebirth\isaac-ng.exe] => (Block) D:\games\the binding of isaac rebirth\isaac-ng.exe => No File FirewallRules: [TCP Query User{71B9CD87-FFD2-4EDB-96D4-07E3721FF4FF}D:\games\fruit ninja vr 2\fruit ninja vr 2.exe] => (Block) D:\games\fruit ninja vr 2\fruit ninja vr 2.exe => No File FirewallRules: [UDP Query User{A9835656-DAF6-4B80-839B-E38BABCB436E}D:\games\fruit ninja vr 2\fruit ninja vr 2.exe] => (Block) D:\games\fruit ninja vr 2\fruit ninja vr 2.exe => No File FirewallRules: [TCP Query User{719771AA-EA79-4939-B3B2-E6768B4AD202}D:\games\pools\pools.exe] => (Block) D:\games\pools\pools.exe => No File FirewallRules: [UDP Query User{921E217C-3298-43E3-B2B5-F3E01DE07006}D:\games\pools\pools.exe] => (Block) D:\games\pools\pools.exe => No File FirewallRules: [TCP Query User{9039F69B-4D90-4BFE-8AB8-65A66F59091E}D:\games\pools\poolsvr\pools.exe] => (Block) D:\games\pools\poolsvr\pools.exe => No File FirewallRules: [UDP Query User{41EBC287-37D9-4D9B-81C5-925B7845C732}D:\games\pools\poolsvr\pools.exe] => (Block) D:\games\pools\poolsvr\pools.exe => No File FirewallRules: [{F50B0B41-386D-49D6-B61B-9573572A8D02}] => (Allow) C:\Program Files (x86)\arcai.com\aips.exe => No File FirewallRules: [{670EA020-2760-4411-A65F-7B094F5CC828}] => (Allow) C:\Program Files (x86)\arcai.com\aips.exe => No File FirewallRules: [{E406AAC3-7256-4114-ACA0-57FFFE3F0B4E}] => (Allow) C:\Program Files (x86)\arcai.com\netcut_windows.exe => No File FirewallRules: [{EA20ED7B-949D-483A-B38A-85A5A77741BD}] => (Allow) C:\Program Files (x86)\arcai.com\netcut_windows.exe => No File FirewallRules: [{86CABB58-0CD2-4B4E-8A68-3377EBB772C5}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe => No File HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION HKU\S-1-5-21-3942013402-3740469761-1670386497-1001\Software\Classes\regfile: <==== ATTENTION HKU\S-1-5-21-3942013402-3740469761-1670386497-1001\Software\Classes\.reg: => <==== ATTENTION HKU\S-1-5-21-3942013402-3740469761-1670386497-1001\Software\Classes\.bat: => <==== ATTENTION HKU\S-1-5-21-3942013402-3740469761-1670386497-1001\Software\Classes\.cmd: => <==== ATTENTION Folder: C:\ProgramData\Jackett File: C:\Program Files\fpsVR\fpsvrCPUTempCounterService.exe Comment: This snippet reverts SmartScreen settings to default StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer] "SmartScreenEnabled"="Warn" [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter] "EnabledV9"=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppHost] "EnableWebContentEvaluation"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppHost] "EnableWebContentEvaluation"=dword:00000001 [HKU\S-1-5-21-3942013402-3740469761-1670386497-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost] "EnableWebContentEvaluation"=dword:00000001 EndRegedit: HKLM\Software\Policies\...\system: [ShellSmartScreenLevel] Warn StartPowerShell: # This snippet re-enables Windows Defender and applies optimized settings to ensure high protection against malware # Enable real-time protection Set-MpPreference -DisableRealtimeMonitoring $false # Enable behavioural protection Set-MpPreference -DisableBehaviorMonitoring $false # Enable PUP detection Set-MpPreference -PUAProtection Enabled # Enable cloud protection to level 4 - aggressively block unknowns and apply additional protection measures, alternatively use 2 for lower protection or 0 for default Set-MpPreference -CloudBlockLevel 4 # Send advanced information about malicious/unwanted software present on your device Set-MpPreference -MAPSReporting 2 # Send safe samples automatically to Microsoft Set-MpPreference -SubmitSamplesConsent 1 # Enables inspection of HTTP traffic to detect malicious websites Set-MpPreference -EnableNetworkProtection Enabled # Enables block at first seen Set-MpPreference -DisableBlockAtFirstSeen $false # Allows scanning of archive files, such as .zip and .cab files for malware/PUP Set-MpPreference -DisableArchiveScanning $false # Enables automatic scanning of USB & removal drives Set-MpPreference -DisableRemovableDriveScanning $false # Enables scanning of network files Set-MpPreference -DisableScanningNetworkFiles $false # Forces signature check before running a scan Set-MpPreference -CheckForSignaturesBeforeRunningScan $true # Extends cloud check timer from default 10 to 30 seconds Set-MpPreference -CloudExtendedTimeout 30 # Enables automatic scanning of all downloaded files and attachments Set-MpPreference -DisableIOAVProtection $false # Enables script detection Set-MpPreference -DisableScriptScanning $false # Disables automatic exclusions from scanning Set-MpPreference -DisableAutoExclusions 1 # Enables scanning of mapped network drives Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 0 # Enables scanning of email files Set-MpPreference -DisableEmailScanning 0 # Enables blocking of malicious domains and IP's on DNS level Set-MpPreference -EnableDnsSinkhole $true # Enables signature updates every 12 hours Set-MpPreference -SignatureUpdateInterval 12 # Enables automatic quarantine for threats labelled as high and severe Set-MpPreference -HighThreatDefaultAction Quarantine Set-MpPreference -SevereThreatDefaultAction Quarantine # Updates signatures Update-MpSignature EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below. C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy Comment: System repair commands CMD: DISM.exe /Online /Cleanup-image /Restorehealth CMD: SFC.exe /scannow Comment: Network reset commands CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winsock reset catalog Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* EmptyTemp: End::