Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_503\bin\ssv.dll [2026-07-23] (Oracle America, Inc. -> Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_503\bin\jp2ssv.dll [2026-07-23] (Oracle America, Inc. -> Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_503\bin\ssv.dll [2026-07-23] (Oracle America, Inc. -> Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_503\bin\jp2ssv.dll [2026-07-23] (Oracle America, Inc. -> Oracle Corporation) PowerShell: Remove-MpPreference -ExclusionPath "J:\MO2" PowerShell: Remove-MpPreference -ExclusionPath "C:\Users\Mjriam\AppData\Local\ModOrganizer" PowerShell: Remove-MpPreference -ExclusionProcess "ModOrganizer.exe" PowerShell: Remove-MpPreference -ExclusionProcess "usvfs_proxy_x86.exe" PowerShell: Remove-MpPreference -ExclusionProcess "usvfs_proxy_x64.exe" PowerShell: Remove-MpPreference -ExclusionProcess "nxmhandler.exe" HKU\S-1-5-21-635488242-2524467947-181519453-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_AFB5541BEC401C0A26C219FA565701AF" FirewallRules: [TCP Query User{945BA075-01ED-4C47-BFBA-B36E056F3BAA}J:\downloads\anydesk.exe] => (Allow) J:\downloads\anydesk.exe (philandro Software GmbH -> AnyDesk Software GmbH) FirewallRules: [UDP Query User{A0091E8A-0D89-4348-AD4A-C898EAEE527B}J:\downloads\anydesk.exe] => (Allow) J:\downloads\anydesk.exe (philandro Software GmbH -> AnyDesk Software GmbH) HKU\S-1-5-21-635488242-2524467947-181519453-1001\...\Run: [MicrosoftEdgeAutoLaunch_AFB5541BEC401C0A26C219FA565701AF] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5018440 2026-08-20] (Microsoft Corporation -> Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-635488242-2524467947-181519453-1001_Classes\CLSID\{68FEF30E-155F-4692-9B34-2D3086B90900}\localserver32 -> C:\Users\Mjriam\AppData\Local\Discord\app-1.0.9254\Discord.exe => No File CustomCLSID: HKU\S-1-5-21-635488242-2524467947-181519453-1001_Classes\CLSID\{89b2b650-c4dd-d68b-46e7-3176f1973c8b}\localserver32 -> "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-635488242-2524467947-181519453-1001_Classes\CLSID\{B0AD3800-E2BB-4570-8EC0-58DA66302CBA}\localserver32 -> C:\Users\Mjriam\AppData\Local\WeMod\app-12.32.0\Wand.exe => No File ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ContextMenuHandlers1: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => -> No File ContextMenuHandlers3: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> No File ContextMenuHandlers5: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => -> No File ContextMenuHandlers6: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => -> No File AlternateDataStreams: C:\ProgramData\TEMP:07BF512B [124] AlternateDataStreams: C:\Users\Mjriam\Documents\medico:com.dropbox.attributes [168] AlternateDataStreams: C:\Users\Mjriam\Documents\medico:com.dropbox.attrs [54] AlternateDataStreams: C:\Users\Mjriam\Documents\Roba lavoro:com.dropbox.attributes [168] AlternateDataStreams: C:\Users\Mjriam\Documents\Roba lavoro:com.dropbox.attrs [54] Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No File HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File) FirewallRules: [UDP Query User{F9E6C9A2-4927-47DD-8118-18E4BEC10372}J:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe] => (Allow) J:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe => No File FirewallRules: [TCP Query User{06F9EB6A-A856-4139-9273-80F1780C05D3}J:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe] => (Allow) J:\xboxgames\sea of thieves\content\athena\binaries\wingdk\sotgame.exe => No File FirewallRules: [{EFABDB03-9D89-4886-939B-BE1E498FC0F2}] => (Allow) K:\Steam\steamapps\common\Breeders of the Nephelym Alpha\Radiant.exe => No File FirewallRules: [{0CAA4836-348C-42CB-B8E1-E5689EB62E9C}] => (Allow) K:\Steam\steamapps\common\Breeders of the Nephelym Alpha\Radiant.exe => No File FirewallRules: [{F9B2F855-16D5-4B60-A57C-4C5F9D2A1CD0}] => (Allow) M:\SoftEther VPN Client\vpncmd_x64.exe => No File FirewallRules: [{128C1555-3454-42B9-B28A-1F93DC87FEC1}] => (Allow) M:\SoftEther VPN Client\vpncmd.exe => No File FirewallRules: [{6C63EAE8-2982-424A-A7BA-5C6F5D5D0B11}] => (Allow) M:\SoftEther VPN Client\vpncmgr_x64.exe => No File FirewallRules: [{5B79F152-24C2-4950-81CB-E327D78A0744}] => (Allow) M:\SoftEther VPN Client\vpncmgr.exe => No File FirewallRules: [{C4E083E2-1A6F-4955-B2EE-88505A15B5F1}] => (Allow) M:\SoftEther VPN Client\vpnclient_x64.exe => No File FirewallRules: [{A0F6DE82-0692-4D9A-98B6-BE35DCC0FAC9}] => (Allow) M:\SoftEther VPN Client\vpnclient.exe => No File FirewallRules: [{4C14714C-536A-4B14-A51E-5D3B95556F21}] => (Allow) M:\SoftEther VPN Server\vpncmd_x64.exe => No File FirewallRules: [{1DB78710-C32D-4F37-9985-932F2345F244}] => (Allow) M:\SoftEther VPN Server\vpnserver_x64.exe => No File FirewallRules: [{1A204CCB-9944-4C9A-A2E7-F489EE50B7DD}] => (Allow) M:\SoftEther VPN Server\vpnsmgr_x64.exe => No File FirewallRules: [{18087599-8227-4634-917F-9B608AA56A78}] => (Allow) K:\Steam\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe => No File FirewallRules: [{BCDE6D44-45E2-43EB-AB1D-8E18E9081642}] => (Allow) K:\Steam\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe => No File FirewallRules: [UDP Query User{37016A1B-F91A-4620-BEFA-53BC48142A62}K:\blizzard\overwatch\_retail_\overwatch.exe] => (Allow) K:\blizzard\overwatch\_retail_\overwatch.exe => No File FirewallRules: [TCP Query User{A9D8952B-0D80-4C33-8C03-85AB8F2CE2A9}K:\blizzard\overwatch\_retail_\overwatch.exe] => (Allow) K:\blizzard\overwatch\_retail_\overwatch.exe => No File FirewallRules: [{21945C72-10F0-493D-8828-576804C7DFA4}] => (Allow) H:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{B99B8ECB-008A-43F3-8351-77A0409F47C6}] => (Allow) H:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [UDP Query User{3102A5BC-58B4-4F7B-B7A6-E406B76C8272}H:\battle.net\overwatch\overwatch.exe] => (Allow) H:\battle.net\overwatch\overwatch.exe => No File FirewallRules: [TCP Query User{FC157957-A972-487E-916E-3644B2ABDE38}H:\battle.net\overwatch\overwatch.exe] => (Allow) H:\battle.net\overwatch\overwatch.exe => No File FirewallRules: [{7E034A65-8047-46DF-947B-3DDE4C61EF48}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA_GameSetting.exe => No File FirewallRules: [{CF493EA5-F413-4C00-A29B-85EADAB8040B}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA_GameSetting.exe => No File FirewallRules: [{2E555688-DA1B-40EF-BD92-ADD293B59FED}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA.exe => No File FirewallRules: [{6F6A07E9-4048-44AA-BBF8-F82A0C20F699}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA.exe => No File FirewallRules: [{635560B2-7FAD-4359-8C55-159F1A14FBCD}] => (Allow) H:\Steam\steamapps\common\Sherlock Holmes - The Devil's Daughter\Binaries\Win64\Sherlock.exe => No File FirewallRules: [{E9D826B2-F466-452B-A886-7641CBB7CAD2}] => (Allow) H:\Steam\steamapps\common\Sherlock Holmes - The Devil's Daughter\Binaries\Win64\Sherlock.exe => No File FirewallRules: [{3B72A731-4A46-4E86-A0AD-D4265ABD65A1}] => (Allow) H:\Steam\steamapps\common\Uno\UNO.exe => No File FirewallRules: [{FE6CA90C-D434-45B4-9493-A984842070B5}] => (Allow) H:\Steam\steamapps\common\Uno\UNO.exe => No File FirewallRules: [{854476EB-47E8-4EBE-966F-399248F4EC77}] => (Allow) H:\Steam\steamapps\common\Monster Hunter World\MonsterHunterWorld.exe => No File FirewallRules: [{E5F587E0-6AEB-428E-AFA3-12330A8E9B9C}] => (Allow) H:\Steam\steamapps\common\Monster Hunter World\MonsterHunterWorld.exe => No File FirewallRules: [{75D14C1B-FB38-4005-8EFC-1545ACC6265A}] => (Allow) H:\Steam\steamapps\common\Tales of Zestiria\Tales of Zestiria.exe => No File FirewallRules: [{88F5E8F7-91E5-4C27-B42E-31CB63EC35B5}] => (Allow) H:\Steam\steamapps\common\Tales of Zestiria\Tales of Zestiria.exe => No File FirewallRules: [{04626507-B060-4FDF-A24A-6F8EF4798389}] => (Allow) H:\Steam\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe => No File FirewallRules: [{05F8C22E-E142-4A9E-B705-97A3AEF2DC10}] => (Allow) H:\Steam\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe => No File FirewallRules: [{A76F01DC-2791-4F58-8B0F-6310CB7D6324}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY FFX&FFX-2 HD Remaster\FFX&X-2_LAUNCHER.exe => No File FirewallRules: [{4E7E050E-D4EC-4E0F-A949-52F4DF29FA81}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY FFX&FFX-2 HD Remaster\FFX&X-2_LAUNCHER.exe => No File FirewallRules: [{1F43E86E-9B83-445A-9541-E94B2F1B95DD}] => (Allow) H:\Steam\steamapps\common\MGS_TPP\mgsvtpp.exe => No File FirewallRules: [{D091D824-C82F-4915-BC77-509CD4442D73}] => (Allow) H:\Steam\steamapps\common\MGS_TPP\mgsvtpp.exe => No File FirewallRules: [{5BD8DC57-5142-4C8C-8071-38D9FF49CB23}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XV\ffxv_s.exe => No File FirewallRules: [{7A905279-E6C8-4C45-B630-A7760CE5E270}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XV\ffxv_s.exe => No File FirewallRules: [{D96690D7-CF7D-4A64-A886-D037E1A86A99}] => (Allow) H:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Editor.exe => No File FirewallRules: [{558E9AA8-4AA3-49B0-A4A0-64064348293E}] => (Allow) H:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Editor.exe => No File FirewallRules: [{DBECB12E-7EE9-4DC0-A6F3-0DC4EB7FA960}] => (Allow) H:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Fable Anniversary.exe => No File FirewallRules: [{3124622E-8E32-40FC-B746-4F767AD3C7B0}] => (Allow) H:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Fable Anniversary.exe => No File FirewallRules: [{CD7C3DC8-AF77-4A58-AAA2-6F5D33AF84EC}] => (Allow) H:\Steam\steamapps\common\Pillars of Eternity II\PillarsOfEternityII.exe => No File FirewallRules: [{34B587D3-321F-4D71-AB50-13665D7F8C34}] => (Allow) H:\Steam\steamapps\common\Pillars of Eternity II\PillarsOfEternityII.exe => No File FirewallRules: [{E4B4A5E1-4B7C-44FC-A79B-DA28887E1D09}] => (Allow) H:\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe => No File FirewallRules: [{17C20E5F-A67F-41D3-A355-12A0B1C7D03E}] => (Allow) H:\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe => No File FirewallRules: [{7D353892-F02C-40C7-A557-FD5D59CA470B}] => (Allow) H:\Origin\Dragon Age Inquisition\DragonAgeInquisition.exe => No File FirewallRules: [{58FF0976-FB67-476D-856A-B2DC51C93706}] => (Allow) H:\Origin\Dragon Age Inquisition\DragonAgeInquisition.exe => No File FirewallRules: [{77B85164-6BA6-4ADE-8004-872F5EFDCA19}] => (Allow) H:\Steam\steamapps\common\Pillars of Eternity\PillarsOfEternity.exe => No File FirewallRules: [{6B6ACEC7-649B-458C-B6B6-DA4541CB6BB3}] => (Allow) H:\Steam\steamapps\common\Pillars of Eternity\PillarsOfEternity.exe => No File FirewallRules: [{D8C90EC3-BC76-452C-987B-0CE9B10E69A3}] => (Allow) H:\Steam\steamapps\common\RPG Maker MV\RPGMV.exe => No File FirewallRules: [{314AD98A-6C6A-4C15-BB88-CAA9A9D1FC43}] => (Allow) H:\Steam\steamapps\common\RPG Maker MV\RPGMV.exe => No File FirewallRules: [{14F6E89A-39FB-48D3-B2D2-4E82AD37978F}] => (Allow) H:\Steam\steamapps\common\Game Character Hub\GameCharacterHub.exe => No File FirewallRules: [{3BEAC69B-FF2D-4F18-8881-51E73A113F65}] => (Allow) H:\Steam\steamapps\common\Game Character Hub\GameCharacterHub.exe => No File FirewallRules: [{918A54D9-D269-462D-A326-6FA67E470F56}] => (Allow) H:\Steam\steamapps\common\RPGVXAce\RPGVXAce.exe => No File FirewallRules: [{573F88D5-6D86-420B-B441-345DD2CF6975}] => (Allow) H:\Steam\steamapps\common\RPGVXAce\RPGVXAce.exe => No File FirewallRules: [{5D601B7A-E22A-4D86-8FDC-8276D869544D}] => (Allow) H:\Steam\steamapps\common\RPGXP\RPGXP.exe => No File FirewallRules: [{FA3C1145-E63C-420B-AFAB-7A4C7EA6DA87}] => (Allow) H:\Steam\steamapps\common\RPGXP\RPGXP.exe => No File FirewallRules: [{40C7EFF6-59F6-4F3F-A8BE-63C518448C35}] => (Allow) H:\Steam\steamapps\common\Tales of Berseria\Tales of Berseria.exe => No File FirewallRules: [{D0BC0AF0-EDE8-449A-A6C6-C7A9B9D537B5}] => (Allow) H:\Steam\steamapps\common\Tales of Berseria\Tales of Berseria.exe => No File FirewallRules: [{C8B9DDA6-3811-41BD-BD36-832BBB513C32}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY IX\FF9_Launcher.exe => No File FirewallRules: [{567C224B-32B6-45F8-83BD-F2BC10D3F703}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY IX\FF9_Launcher.exe => No File FirewallRules: [{CB54F403-6790-4E66-AE12-B5A74934D16C}] => (Allow) H:\Steam\steamapps\common\Child of Light\ChildofLight.exe => No File FirewallRules: [{EDB50974-3B8D-411D-B1B2-FB050F9938B3}] => (Allow) H:\Steam\steamapps\common\Child of Light\ChildofLight.exe => No File FirewallRules: [{DE84CA9A-DD7D-47B6-A8CD-69C6F9C39A56}] => (Allow) H:\Steam\steamapps\common\Ori\ori.exe => No File FirewallRules: [{D5C474CB-1198-42CD-A656-1CC3B9AEF0EA}] => (Allow) H:\Steam\steamapps\common\Ori\ori.exe => No File FirewallRules: [{A062F5F8-EC4B-44F8-BC15-266A99FEFA6E}] => (Allow) H:\Steam\steamapps\common\Transistor\x64\Transistor.exe => No File FirewallRules: [{0761126D-3B49-4F6A-935D-85276F23656B}] => (Allow) H:\Steam\steamapps\common\Transistor\x64\Transistor.exe => No File FirewallRules: [{689058D5-7E6A-4D9F-A4C5-4290A3B255D9}] => (Allow) H:\Steam\steamapps\common\GarrysMod\hl2.exe => No File FirewallRules: [{330FB6C8-BB08-4B7A-8DE9-C535724F2168}] => (Allow) H:\Steam\steamapps\common\GarrysMod\hl2.exe => No File FirewallRules: [{F595B2A6-269F-4D42-B261-42829599F8B4}] => (Allow) H:\Steam\steamapps\common\Massive Chalice\MC.exe => No File FirewallRules: [{71BCC384-E1C7-42F5-9EE8-FABBD3DD7032}] => (Allow) H:\Steam\steamapps\common\Massive Chalice\MC.exe => No File FirewallRules: [{3B0AE85C-6DEE-4009-A4F6-1F3F27A150DE}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY VIII\FF8_Launcher.exe => No File FirewallRules: [{00030792-B87B-45BE-8CB1-F76CAF36AF30}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY VIII\FF8_Launcher.exe => No File FirewallRules: [{7E766C15-AC0C-478D-8C62-AB05044E7D01}] => (Allow) H:\Steam\steamapps\common\Mirror\game.exe => No File FirewallRules: [{56101DFB-BE0E-45A1-8C83-F1C905176107}] => (Allow) H:\Steam\steamapps\common\Mirror\game.exe => No File FirewallRules: [{C1D8A890-CAC7-4FE1-AAAA-F13F15721101}] => (Allow) H:\Steam\steamapps\common\Gems of War\GemsOfWar.exe => No File FirewallRules: [{87C67C90-8E12-4C72-8ECF-4FA2426CF72F}] => (Allow) H:\Steam\steamapps\common\Gems of War\GemsOfWar.exe => No File FirewallRules: [{2C42736E-B7B7-4D75-9548-6A27970DDE93}] => (Allow) H:\Steam\steamapps\common\MOBIUS FINAL FANTASY\mobiusff.exe => No File FirewallRules: [{C9C8E63A-1D2E-45A7-9FC4-5EC5D9C34A44}] => (Allow) H:\Steam\steamapps\common\MOBIUS FINAL FANTASY\mobiusff.exe => No File FirewallRules: [{A9FEFBC4-C0A4-41E1-9CAC-0611B96CDE0C}] => (Allow) H:\Steam\Steam.exe => No File FirewallRules: [{5995ABD8-717E-49EB-813F-6C6FE4FB4EC7}] => (Allow) H:\Steam\Steam.exe => No File FirewallRules: [{E020CB08-7442-4A8A-8E44-A62DBFC7A0A0}] => (Allow) F:\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe => No File FirewallRules: [{10BB1CF7-391F-4520-8B87-17E174499A07}] => (Allow) F:\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe => No File FirewallRules: [UDP Query User{BEF04A48-7771-4D86-84DD-05C66710CBBD}F:\games\heroes of the storm\versions\base66810\heroesofthestorm_x64.exe] => (Allow) F:\games\heroes of the storm\versions\base66810\heroesofthestorm_x64.exe => No File FirewallRules: [TCP Query User{B7F9FF7B-D28F-49CF-9713-EDE69DC22A26}F:\games\heroes of the storm\versions\base66810\heroesofthestorm_x64.exe] => (Allow) F:\games\heroes of the storm\versions\base66810\heroesofthestorm_x64.exe => No File FirewallRules: [{E62229D9-B150-4937-B6A3-8AF8D4F7E326}] => (Allow) F:\Steam\steamapps\common\Tales of Berseria\Tales of Berseria.exe => No File FirewallRules: [{8D0E0D55-5646-4512-AD62-527021AFE39A}] => (Allow) F:\Steam\steamapps\common\Tales of Berseria\Tales of Berseria.exe => No File FirewallRules: [{3DCE8CA4-151E-4957-A8D7-8EEF0ED4A8C4}] => (Allow) F:\Steam\steamapps\common\dont_starve\bin\dontstarve_steam.exe => No File FirewallRules: [{20E4C9AC-B8E7-4020-BFC0-A0E5A7C3CABB}] => (Allow) F:\Steam\steamapps\common\dont_starve\bin\dontstarve_steam.exe => No File FirewallRules: [{1D5938A9-4EE9-45F7-AE0D-CEA98B0E6AEB}] => (Allow) F:\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe => No File FirewallRules: [{F742BDBF-8E94-45C2-AED1-D865A3D6A649}] => (Allow) F:\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe => No File FirewallRules: [UDP Query User{56148842-BE0D-42AB-8F71-0B97F612EC0C}F:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) F:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File FirewallRules: [TCP Query User{1CFA3944-BC95-4F76-8943-AD66E47B8F97}F:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) F:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File FirewallRules: [{9EBAEC7D-3496-4294-A69C-CFC66A2C2A52}] => (Allow) F:\Steam\steamapps\common\Paladins\Binaries\Win32\HirezBridge.exe => No File FirewallRules: [{7AACD5D2-B08C-41D0-B523-0B9C7330E25F}] => (Allow) F:\Steam\steamapps\common\Paladins\Binaries\Win32\HirezBridge.exe => No File FirewallRules: [{C3F4FF93-870D-48E7-9781-1E520F90ACF3}] => (Allow) F:\Steam\steamapps\common\HatinTime\Binaries\Win64\HatinTimeGame.exe => No File FirewallRules: [{FE30EFB0-E047-4F2B-AC09-74CFB3B1F9CD}] => (Allow) F:\Steam\steamapps\common\HatinTime\Binaries\Win64\HatinTimeGame.exe => No File FirewallRules: [{A216BF60-841D-4DBE-8BDD-91252E7A6BFE}] => (Allow) F:\Steam\steamapps\common\Lethis - Path of Progress\Lethis-Path_Of_Progress.exe => No File FirewallRules: [{F4910DCA-5820-4391-8B8A-0F84B2E4766C}] => (Allow) F:\Steam\steamapps\common\Lethis - Path of Progress\Lethis-Path_Of_Progress.exe => No File FirewallRules: [{97033CC7-9E55-4A69-AA45-FB616817956E}] => (Allow) F:\Steam\steamapps\common\Town of Salem\TownOfSalem.exe => No File FirewallRules: [{0F225EE2-2040-4BA1-90D9-D9472995A28E}] => (Allow) F:\Steam\steamapps\common\Town of Salem\TownOfSalem.exe => No File FirewallRules: [{4C0B4513-2ED3-45C6-BD11-43628BFD6B12}] => (Allow) F:\Steam\steamapps\common\Subnautica\Subnautica.exe => No File FirewallRules: [{9A0A3007-3220-4B2D-B4BE-F6D9237F2826}] => (Allow) F:\Steam\steamapps\common\Subnautica\Subnautica.exe => No File FirewallRules: [{FC81C61B-A8CD-4FB1-B3AF-9275EE6CDE7B}] => (Allow) F:\Steam\steamapps\common\Viridi\Viridi.exe => No File FirewallRules: [{9690061F-EEA5-47FD-B469-EA6030E3EC89}] => (Allow) F:\Steam\steamapps\common\Viridi\Viridi.exe => No File FirewallRules: [{BC44AC7A-C05C-4FCF-969A-B3F940672364}] => (Allow) F:\Steam\steamapps\common\TotallyAccurateBattlegrounds\TotallyAccurateBattlegrounds.exe => No File FirewallRules: [{D85E0096-4B2E-4D28-92EE-73774AE1601D}] => (Allow) F:\Steam\steamapps\common\TotallyAccurateBattlegrounds\TotallyAccurateBattlegrounds.exe => No File FirewallRules: [{9C0761D3-91C5-436F-ADF2-FB488D7BAFBD}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PinballArcadeCabinet.exe => No File FirewallRules: [{C795EDEF-9A22-4982-9C6F-B2185F3C6012}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PinballArcadeCabinet.exe => No File FirewallRules: [{5EC73C6A-F39F-4C04-89C8-5441C1703198}] => (Allow) F:\Steam\steamapps\common\Ys II\config.exe => No File FirewallRules: [{8B1EF6CB-9844-4467-985F-4EFC427E6364}] => (Allow) F:\Steam\steamapps\common\Ys II\config.exe => No File FirewallRules: [{4FAF8A47-3C2F-4FCC-A1C3-00766052A969}] => (Allow) F:\Steam\steamapps\common\Ys II\ys2plus.exe => No File FirewallRules: [{CB288C5E-CB82-434D-8C37-F7D8C79EDE63}] => (Allow) F:\Steam\steamapps\common\Ys II\ys2plus.exe => No File FirewallRules: [{90802170-775E-4103-B4F6-74D493120B43}] => (Allow) F:\Steam\steamapps\common\Ys I\config.exe => No File FirewallRules: [{1B62C8BC-B345-4928-8CD0-6B35540DEC7B}] => (Allow) F:\Steam\steamapps\common\Ys I\config.exe => No File FirewallRules: [{09279B91-B02C-422F-88E3-0EAA051F3A3F}] => (Allow) F:\Steam\steamapps\common\Ys I\ys1plus.exe => No File FirewallRules: [{CA3006E7-4319-4AF9-A8CF-0682BA4BC655}] => (Allow) F:\Steam\steamapps\common\Ys I\ys1plus.exe => No File FirewallRules: [{BE782BCF-C078-41D7-8DF1-4AAE446C4EEF}] => (Allow) F:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe => No File FirewallRules: [{C63CD144-C54A-4746-9604-1CEC0B84542F}] => (Allow) F:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe => No File FirewallRules: [UDP Query User{B1137A57-B351-49BE-8525-197F9FFF954A}F:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) F:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe => No File FirewallRules: [TCP Query User{084EDE4C-248C-4B4E-AF1B-2F97C296E0E5}F:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) F:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe => No File FirewallRules: [{0FF9A52E-FF5A-4F00-B455-50BB7898BB7F}] => (Allow) F:\Steam\steamapps\common\ShadowOfMordor\x64\ShadowOfMordor.exe => No File FirewallRules: [{3BAC9741-DBF3-48BB-A1A8-C3E1354CF67D}] => (Allow) F:\Steam\steamapps\common\ShadowOfMordor\x64\ShadowOfMordor.exe => No File FirewallRules: [{24A7B5C1-F34B-4F30-872E-8DAA0DDD45E6}] => (Allow) F:\Steam\steamapps\common\Pillars of Eternity II\PillarsOfEternityII.exe => No File FirewallRules: [{A613203B-2D0A-4AED-BC03-983AE5B03261}] => (Allow) F:\Steam\steamapps\common\Pillars of Eternity II\PillarsOfEternityII.exe => No File FirewallRules: [{5D53B2A2-2676-4ED6-9E22-81695D9A35BB}] => (Allow) F:\Steam\steamapps\common\Momodora RUtM\MomodoraRUtM.exe => No File FirewallRules: [{0BAC4652-87DE-430B-834B-CC21D8CB4273}] => (Allow) F:\Steam\steamapps\common\Momodora RUtM\MomodoraRUtM.exe => No File FirewallRules: [{DF92E1AF-A580-4E97-8C00-20D8D725CBC7}] => (Allow) F:\Steam\steamapps\common\Slime Rancher\SlimeRancher.exe => No File FirewallRules: [{51A36BA4-D7B9-46AA-9D66-EE6BF18C566C}] => (Allow) F:\Steam\steamapps\common\Slime Rancher\SlimeRancher.exe => No File FirewallRules: [{14E9823A-0B4B-41CE-BFF8-D2432EB479DF}] => (Allow) F:\Steam\steamapps\common\Torchlight II\ModLauncher.exe => No File FirewallRules: [{4BAADD23-9F15-4043-9C17-2E809EC7894F}] => (Allow) F:\Steam\steamapps\common\Torchlight II\ModLauncher.exe => No File FirewallRules: [{6D7AEB72-74A5-4BE9-916D-10C1392C5DBB}] => (Allow) F:\Steam\steamapps\common\Nefarious\Nefarious.exe => No File FirewallRules: [{9FDDF98F-D790-4714-B7CE-C9EABFB0B708}] => (Allow) F:\Steam\steamapps\common\Nefarious\Nefarious.exe => No File FirewallRules: [{1C78602B-EF0A-4969-9B0F-531D6FBB27DF}] => (Allow) F:\Steam\steamapps\common\Jotun\Jotun.exe => No File FirewallRules: [{8DFA95F0-4F27-4A2A-91C6-C216315BFBC4}] => (Allow) F:\Steam\steamapps\common\Jotun\Jotun.exe => No File FirewallRules: [{FF92F9DA-70BC-4DB7-B014-473C9A79D7FE}] => (Allow) F:\Steam\steamapps\common\GalGun Double Peace\Binaries\Win64\GG2Game.exe => No File FirewallRules: [{D6368542-43CA-4F07-9C7B-EC80E28448DA}] => (Allow) F:\Steam\steamapps\common\GalGun Double Peace\Binaries\Win64\GG2Game.exe => No File FirewallRules: [{64C38552-4744-49CB-9A50-16ACAC6EB7AC}] => (Allow) F:\Steam\steamapps\common\Wildlife Park 2\WLP2fantasy-Steam.exe => No File FirewallRules: [{9DAA053F-B6C6-46BF-A313-841E52AEEF71}] => (Allow) F:\Steam\steamapps\common\Wildlife Park 2\WLP2fantasy-Steam.exe => No File FirewallRules: [{A4C10464-AEE2-4376-955C-1DEC94544C5E}] => (Allow) F:\Steam\steamapps\common\Stardew Valley\Stardew Valley.exe => No File FirewallRules: [{9149BAFF-5E5E-433B-92B2-68583EE59817}] => (Allow) F:\Steam\steamapps\common\Stardew Valley\Stardew Valley.exe => No File FirewallRules: [{72439B57-39CD-4C65-A6AE-FDB399AD307C}] => (Allow) F:\Steam\steamapps\common\Dead by Daylight\DeadByDaylight.exe => No File FirewallRules: [{B8BC58E0-C97F-4B56-8E04-1ADC84D0231C}] => (Allow) F:\Steam\steamapps\common\Dead by Daylight\DeadByDaylight.exe => No File FirewallRules: [{C9F6D83D-833A-4395-81F8-89E31D1E19A8}] => (Allow) F:\Steam\steamapps\common\Tengami\Tengami.exe => No File FirewallRules: [{1E966336-D33B-4840-8C06-4A3A43F1E2D7}] => (Allow) F:\Steam\steamapps\common\Tengami\Tengami.exe => No File FirewallRules: [{3F4CC103-BD14-4278-AD5D-BDB19495ED45}] => (Allow) F:\Steam\steamapps\common\Hell Girls\game.exe => No File FirewallRules: [{4BDE031A-2283-4D80-91D4-B79F5F84B86D}] => (Allow) F:\Steam\steamapps\common\Hell Girls\game.exe => No File FirewallRules: [{2AA53FE1-86F2-4AF1-8B20-36808ECA0DEA}] => (Allow) F:\Steam\steamapps\common\A New Beginning\VisionaireConfigurationTool.exe => No File FirewallRules: [{3FAD44FA-946D-4614-82E4-FBA5667416B8}] => (Allow) F:\Steam\steamapps\common\A New Beginning\VisionaireConfigurationTool.exe => No File FirewallRules: [{F49319D0-F265-4A36-8AA7-7F544920C0A3}] => (Allow) F:\Steam\steamapps\common\A New Beginning\anb.exe => No File FirewallRules: [{1A3AA5B5-11FF-4BA8-A0CA-0EDDDA8A41DE}] => (Allow) F:\Steam\steamapps\common\A New Beginning\anb.exe => No File FirewallRules: [{E4E791F3-D7DB-4969-B72D-5B356A85E91E}] => (Allow) F:\Steam\steamapps\common\Akiba's Trip Undead & Undressed\AkibaUU.exe => No File FirewallRules: [{88D28B76-12B2-4643-BF3E-76A1D5751BA5}] => (Allow) F:\Steam\steamapps\common\Akiba's Trip Undead & Undressed\AkibaUU.exe => No File FirewallRules: [{A6C203FD-8FAB-4AA8-83F9-B7DF42689028}] => (Allow) F:\Steam\steamapps\common\The Perils of Man\PoM.exe => No File FirewallRules: [{33DD2C03-0C0E-41A7-A437-23F619FE3F05}] => (Allow) F:\Steam\steamapps\common\The Perils of Man\PoM.exe => No File FirewallRules: [{C5B754E4-C83E-499F-8CD6-322A8EC90480}] => (Allow) F:\Steam\steamapps\common\Uno\UNO.exe => No File FirewallRules: [{03BB3B68-5F07-4643-B3E2-41FC2062BB80}] => (Allow) F:\Steam\steamapps\common\Uno\UNO.exe => No File FirewallRules: [{C8817D4E-B027-4A3D-BB74-9137AC5F7F25}] => (Allow) F:\Steam\steamapps\common\YearWalk\yearwalk.exe => No File FirewallRules: [{5FB907CA-2C73-4233-9DB2-8DCB83C66E09}] => (Allow) F:\Steam\steamapps\common\YearWalk\yearwalk.exe => No File FirewallRules: [{31FFF7F4-E216-4F78-B97F-7C2305867AEE}] => (Allow) F:\Steam\steamapps\common\Escape The Past\Escape The Past.exe => No File FirewallRules: [{3295069D-448D-4457-A441-C2D66198A9DE}] => (Allow) F:\Steam\steamapps\common\Escape The Past\Escape The Past.exe => No File FirewallRules: [{2B450DE3-DD13-49AD-83A8-ACCC6AB27CE8}] => (Allow) F:\Steam\steamapps\common\Lilly Looking Through\LillyLookingThrough.exe => No File FirewallRules: [{AB011240-5081-4FF0-9FE1-034A07BAE5E7}] => (Allow) F:\Steam\steamapps\common\Lilly Looking Through\LillyLookingThrough.exe => No File FirewallRules: [{4445ACD9-D5A3-47FA-A224-D6E7BC893307}] => (Allow) F:\Steam\steamapps\common\The Sandbox Evolution\TheSandbox2.exe => No File FirewallRules: [{A096D63D-DEF2-47E4-AB05-0A9D74D52560}] => (Allow) F:\Steam\steamapps\common\The Sandbox Evolution\TheSandbox2.exe => No File FirewallRules: [{34A06FF5-1FD9-4419-9CD0-2B7B38ED731C}] => (Allow) F:\Steam\steamapps\common\Slap Village Chapter 1\SlapVillage.exe => No File FirewallRules: [{987F280F-4BC7-4A4A-99C0-820AB3C2EEB0}] => (Allow) F:\Steam\steamapps\common\Slap Village Chapter 1\SlapVillage.exe => No File FirewallRules: [{BEA228DE-3B7B-4E63-AD3F-61BA7A46D55A}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY VIII\FF8_Launcher.exe => No File FirewallRules: [{B90DAADB-ED2C-4AD1-BA72-338B414593B5}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY VIII\FF8_Launcher.exe => No File FirewallRules: [{5BCA49A3-D0AD-4DEC-95C1-D991139C12EC}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY VII\FF7_Launcher.exe => No File FirewallRules: [{5174C79D-E028-4245-A9B8-609B13C096E0}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY VII\FF7_Launcher.exe => No File FirewallRules: [{AA60D846-AD27-4667-924C-5FD9901D7A72}] => (Allow) F:\Steam\steamapps\common\Prey\Binaries\Danielle\x64\Release\Prey.exe => No File FirewallRules: [{605F9293-F678-4035-B544-E9D5049B23C3}] => (Allow) F:\Steam\steamapps\common\Prey\Binaries\Danielle\x64\Release\Prey.exe => No File FirewallRules: [{CCDAE935-3A44-4BED-8F98-0095A029F2E0}] => (Allow) F:\IMMENSO SAVE AT ALL COST\Origin Games\Dragon Age\bin_ship\daorigins.exe => No File FirewallRules: [{C81A3533-819E-4BE4-BC50-1339B3FB4F97}] => (Allow) F:\IMMENSO SAVE AT ALL COST\Origin Games\Dragon Age\bin_ship\daorigins.exe => No File FirewallRules: [{A083ADC6-7C99-4B9C-9B61-3FE234BB5010}] => (Allow) F:\IMMENSO SAVE AT ALL COST\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe => No File FirewallRules: [{887679CB-ABA0-4F60-9F93-F26D8EAD4D15}] => (Allow) F:\IMMENSO SAVE AT ALL COST\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe => No File FirewallRules: [{C06FAB97-0A34-46FD-8C6F-D5E409C7926D}] => (Allow) F:\IMMENSO SAVE AT ALL COST\Origin Games\Dragon Age II\bin_ship\DragonAge2.exe => No File FirewallRules: [{CB5923BD-97C1-45E1-A536-90DF0A52FB6E}] => (Allow) F:\IMMENSO SAVE AT ALL COST\Origin Games\Dragon Age II\bin_ship\DragonAge2.exe => No File FirewallRules: [{0008A51E-5E7F-41EA-B7C8-8F2F7BD0621B}] => (Allow) F:\Steam\steamapps\common\Tales of Zestiria\Tales of Zestiria.exe => No File FirewallRules: [{ACFB1CF1-3F7E-47C4-BEE2-03DDE6A94DEF}] => (Allow) F:\Steam\steamapps\common\Tales of Zestiria\Tales of Zestiria.exe => No File FirewallRules: [{39208AB6-AFA7-45A8-9D27-81D58E24AD99}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win64\UDK.exe => No File FirewallRules: [{BD009936-1EA1-4284-B2F9-44DD876BCF07}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win64\UDK.exe => No File FirewallRules: [{8F10794E-B52A-47F3-ABE6-AB3EB8B0B38E}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win32\UDK.exe => No File FirewallRules: [{35A73670-16EE-4198-9D28-407C21BFA851}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win32\UDK.exe => No File FirewallRules: [{ADB6E91D-3765-40C6-BA38-8D70819D51DB}] => (Allow) F:\Steam\steamapps\common\Contrast\Binaries\Win32\ContrastGame.exe => No File FirewallRules: [{7A12D3C1-8670-42F0-A45D-962E1FFF9427}] => (Allow) F:\Steam\steamapps\common\Contrast\Binaries\Win32\ContrastGame.exe => No File FirewallRules: [UDP Query User{796651C5-EA39-49E3-BEB8-D098A29997F6}F:\steam\steamapps\common\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe] => (Block) F:\steam\steamapps\common\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe => No File FirewallRules: [TCP Query User{C8209B89-96C5-46BE-BBA4-5B9A5BFF06EC}F:\steam\steamapps\common\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe] => (Block) F:\steam\steamapps\common\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe => No File FirewallRules: [{00FFB147-21EC-470F-9671-C561FDA244E2}] => (Allow) F:\Steam\steamapps\common\Metro Last Light Redux\metro.exe => No File FirewallRules: [{FEB85115-740A-42C7-A3D9-50FDB5F3497A}] => (Allow) F:\Steam\steamapps\common\Metro Last Light Redux\metro.exe => No File FirewallRules: [{85A6D684-5405-4D5B-B137-4D29FCDDE0B4}] => (Allow) F:\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe => No File FirewallRules: [{45EB57E0-D26C-4664-A9A1-037E117909F1}] => (Allow) F:\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe => No File FirewallRules: [{62F8FA32-FA35-4F26-AC73-A1F3D694A273}] => (Allow) F:\Steam\steamapps\common\The Book of Unwritten Tales 2\Windows\BouT2.exe => No File FirewallRules: [{80E337D8-F414-4E43-B7EE-33A80DEF8B77}] => (Allow) F:\Steam\steamapps\common\The Book of Unwritten Tales 2\Windows\BouT2.exe => No File FirewallRules: [{7A44D80E-717E-4843-80FB-26D08E8DC874}] => (Allow) F:\Steam\steamapps\common\The Raven\launcher\TheRavenLauncher.exe => No File FirewallRules: [{EF063AF4-06D0-4241-B1E3-D6AD306CBFBF}] => (Allow) F:\Steam\steamapps\common\The Raven\launcher\TheRavenLauncher.exe => No File FirewallRules: [{FC5711AF-A399-4B69-A117-5F4341AD5EB5}] => (Allow) F:\Steam\steamapps\common\Crypt of the NecroDancer\NecroDancer.exe => No File FirewallRules: [{DA8297B6-AB12-46AA-8FE9-6BB7FAF3F76B}] => (Allow) F:\Steam\steamapps\common\Crypt of the NecroDancer\NecroDancer.exe => No File FirewallRules: [{834A83DA-C462-4961-AEEA-E3F88D1FBCD6}] => (Allow) F:\Steam\steamapps\common\LostWinds\LW1.exe => No File FirewallRules: [{2F3B7EDB-48D3-4A9C-AE9A-878AAA109C60}] => (Allow) F:\Steam\steamapps\common\LostWinds\LW1.exe => No File FirewallRules: [{7B0506FD-85D6-4C88-A9A7-8E0D5FD1CB7A}] => (Allow) F:\Steam\steamapps\common\LostWinds 2 Winter of the Melodias\LW2.exe => No File FirewallRules: [{66231247-412D-4A43-961B-898A4C182F49}] => (Allow) F:\Steam\steamapps\common\LostWinds 2 Winter of the Melodias\LW2.exe => No File FirewallRules: [{4134AD3E-329C-4000-A602-28DD5D7B242A}] => (Allow) F:\Steam\steamapps\common\gravilon\EQLauncher.exe => No File FirewallRules: [{1CD9276B-CDDB-4761-A9C5-F3D1F55EEFD3}] => (Allow) F:\Steam\steamapps\common\gravilon\EQLauncher.exe => No File FirewallRules: [{F98413E3-D8AB-41DD-8970-808F53A1A397}] => (Allow) F:\Steam\steamapps\common\Pillars of Eternity\PillarsOfEternity.exe => No File FirewallRules: [{1E2DE023-A472-4F68-9848-6A793B3018EA}] => (Allow) F:\Steam\steamapps\common\Pillars of Eternity\PillarsOfEternity.exe => No File FirewallRules: [{559AF11F-209C-4670-8401-B3D9BD8D3711}] => (Allow) F:\Steam\steamapps\common\htoL#NiQ The Firefly Diary\Hotaru.exe => No File FirewallRules: [{210E4894-6A59-4CFA-9EF6-A3287D898758}] => (Allow) F:\Steam\steamapps\common\htoL#NiQ The Firefly Diary\Hotaru.exe => No File FirewallRules: [{997EC1F0-F53C-4D15-9588-715DEFE48425}] => (Allow) F:\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe => No File FirewallRules: [{7C7808C9-9DBF-4136-B0A4-6F3698DF4ACD}] => (Allow) F:\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe => No File FirewallRules: [{541DDBCD-A3AF-4905-B055-6A25656C80B6}] => (Allow) F:\Steam\steamapps\common\FaceRig\Bin\FaceRig.exe => No File FirewallRules: [{F045CB0D-8009-461B-A343-576EABD7FA9E}] => (Allow) F:\Steam\steamapps\common\FaceRig\Bin\FaceRig.exe => No File FirewallRules: [{CB5B8240-FA12-4A67-900C-FF318B45AAA6}] => (Allow) F:\Steam\steamapps\common\FaceRig\Bin\Launcher.exe => No File FirewallRules: [{01A00F91-808A-4BEC-9810-F81ED0A3122A}] => (Allow) F:\Steam\steamapps\common\FaceRig\Bin\Launcher.exe => No File FirewallRules: [{B9ABBD13-EEAA-4ADF-B085-7B9AA954E058}] => (Allow) F:\Steam\steamapps\common\RPGVXAce\RPGVXAce.exe => No File FirewallRules: [{EF2359FA-A730-4FD9-BA00-ACA66302587E}] => (Allow) F:\Steam\steamapps\common\RPGVXAce\RPGVXAce.exe => No File FirewallRules: [{DCA9B678-9A56-4CBD-A0DA-4CC362D671E3}] => (Allow) F:\Steam\steamapps\common\RPGXP\RPGXP.exe => No File FirewallRules: [{ABF7C393-991A-4808-A805-A03849533CE9}] => (Allow) F:\Steam\steamapps\common\RPGXP\RPGXP.exe => No File FirewallRules: [{E0EAFBA7-DF88-47D2-A2D0-1206198E1C5D}] => (Allow) F:\Steam\steamapps\common\Sega Classics\SEGAGenesisClassics.exe => No File FirewallRules: [{863E211B-FD8F-4095-8761-6E0B9C93E5BA}] => (Allow) F:\Steam\steamapps\common\Sega Classics\SEGAGenesisClassics.exe => No File FirewallRules: [{39BB3319-1266-4932-BD73-3ABC232342B8}] => (Allow) F:\Steam\steamapps\common\Sega Classics\SEGAGameRoom.exe => No File FirewallRules: [{848F54EC-A3BE-41B1-A20B-84E5B7A8A501}] => (Allow) F:\Steam\steamapps\common\Sega Classics\SEGAGameRoom.exe => No File FirewallRules: [{BBF486B4-E80E-4E86-B6B6-AC7C0E3D4D54}] => (Allow) F:\Steam\steamapps\common\King's Quest\Binaries\Win\KingsQuest.exe => No File FirewallRules: [{C69BB1E7-350D-420D-8727-22857D6D49EB}] => (Allow) F:\Steam\steamapps\common\King's Quest\Binaries\Win\KingsQuest.exe => No File FirewallRules: [{E2F87061-DB9B-4519-B331-858B61D4340D}] => (Allow) F:\Steam\steamapps\common\Magicka 2\engine\Magicka2.exe => No File FirewallRules: [{B3F7ABFE-8439-4506-B084-DE6FEA015614}] => (Allow) F:\Steam\steamapps\common\Magicka 2\engine\Magicka2.exe => No File FirewallRules: [{B7895C5D-4DDE-4E34-BD5F-87FFF2CFDD96}] => (Allow) F:\Steam\steamapps\common\magicka\Magicka.exe => No File FirewallRules: [{9BAB8925-8D9F-491A-B7FC-EAC649A7FF4A}] => (Allow) F:\Steam\steamapps\common\magicka\Magicka.exe => No File FirewallRules: [{396E4887-689E-458D-9205-3994062BE958}] => (Allow) F:\Steam\steamapps\common\killingfloor\System\KillingFloor.exe => No File FirewallRules: [{8E48FE3B-A870-46B4-B0D8-D3B2133FA7BE}] => (Allow) F:\Steam\steamapps\common\killingfloor\System\KillingFloor.exe => No File FirewallRules: [{B9B1FF35-D423-4854-91BD-276BCF79D9D2}] => (Allow) F:\Steam\steamapps\common\Amnesia The Dark Descent\Launcher.exe => No File FirewallRules: [{3FC54B92-024F-42AD-899E-A3243BDFA937}] => (Allow) F:\Steam\steamapps\common\Amnesia The Dark Descent\Launcher.exe => No File FirewallRules: [{25606986-6E9F-4AF4-A514-D5618E17C73B}] => (Allow) F:\Steam\steamapps\common\Amnesia The Dark Descent\Amnesia.exe => No File FirewallRules: [{03B32A41-5775-4A9F-8CAA-D921ED3C45C4}] => (Allow) F:\Steam\steamapps\common\Amnesia The Dark Descent\Amnesia.exe => No File FirewallRules: [{321F3D78-12EB-45BE-8C66-1843F5DBDE36}] => (Allow) F:\Steam\steamapps\common\Saints Row Gat out of Hell\SaintsRowGatOutOfHell.exe => No File FirewallRules: [{E0FD1814-FCA2-474E-B8BB-BFC41618F58A}] => (Allow) F:\Steam\steamapps\common\Saints Row Gat out of Hell\SaintsRowGatOutOfHell.exe => No File FirewallRules: [{718261C5-450E-472C-B8C1-FDAF6E933856}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY IX\FF9_Launcher.exe => No File FirewallRules: [{1CCA117C-B7EF-438B-830B-FC6082EFEDE4}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY IX\FF9_Launcher.exe => No File FirewallRules: [{E3FDF29F-D036-49E5-B8BF-754E6F4BFF85}] => (Allow) F:\Steam\steamapps\common\Morphopolis\project.exe => No File FirewallRules: [{4C0A6462-D178-442E-8AA4-3977A25BCF8D}] => (Allow) F:\Steam\steamapps\common\Morphopolis\project.exe => No File FirewallRules: [{7D97A394-57C1-4405-B0BF-B9F6006A3CDD}] => (Allow) F:\Steam\steamapps\common\gravilon\gravilon.exe => No File FirewallRules: [{9EB725E0-A84B-47B9-B402-6ABB69E7FAA9}] => (Allow) F:\Steam\steamapps\common\gravilon\gravilon.exe => No File FirewallRules: [{60420539-BE32-4F48-83D0-3E333D85C302}] => (Allow) F:\Steam\steamapps\common\Howler\Howler.exe => No File FirewallRules: [{CBE5498D-013F-4368-94A5-BCB2D09C58CB}] => (Allow) F:\Steam\steamapps\common\Howler\Howler.exe => No File FirewallRules: [{9BF0D5A3-E890-4EAD-AC24-48E17A281DBF}] => (Allow) F:\Steam\steamapps\common\Edna & Harvey The Breakout\Edna.exe => No File FirewallRules: [{FBB93131-2E9A-461F-9CCF-2D670DA22A35}] => (Allow) F:\Steam\steamapps\common\Edna & Harvey The Breakout\Edna.exe => No File FirewallRules: [{AEB85142-B198-4D8B-AE3B-86243EA88B40}] => (Allow) F:\Steam\steamapps\common\Dracula's Legacy\DraculaLegacy.exe => No File FirewallRules: [{5FB6A960-A6EC-42D3-87B7-470C80050F21}] => (Allow) F:\Steam\steamapps\common\Dracula's Legacy\DraculaLegacy.exe => No File FirewallRules: [{342C2D73-38AB-4B0E-B7D2-6E1E6C022728}] => (Allow) F:\Steam\steamapps\common\Child of Light\ChildofLight.exe => No File FirewallRules: [{B6E99CA9-F5F9-4F44-8AEF-C355D8D0F07F}] => (Allow) F:\Steam\steamapps\common\Child of Light\ChildofLight.exe => No File FirewallRules: [{1CDA99D1-7B36-4A69-A0CC-5E94E98F4838}] => (Allow) F:\Steam\steamapps\common\deadrising3\deadrising3.exe => No File FirewallRules: [{7132014C-7F85-4094-AEE1-5C001BFAA942}] => (Allow) F:\Steam\steamapps\common\deadrising3\deadrising3.exe => No File FirewallRules: [{DD6C5068-BC71-43AB-AA02-223CB9A790D1}] => (Allow) F:\Steam\steamapps\common\Dead Rising 2 Off the Record\deadrising2otr.exe => No File FirewallRules: [{982B0357-A81F-4D59-A812-BA42A798CC49}] => (Allow) F:\Steam\steamapps\common\Dead Rising 2 Off the Record\deadrising2otr.exe => No File FirewallRules: [{F714CC51-A48B-4634-948F-C03C9A46394E}] => (Allow) F:\Steam\steamapps\common\Dead Rising 2\deadrising2.exe => No File FirewallRules: [{39CC4683-F7C9-428F-9658-5F9AD0054E54}] => (Allow) F:\Steam\steamapps\common\Dead Rising 2\deadrising2.exe => No File FirewallRules: [{FC8929FF-3EC9-4BEB-AA37-315BCCFDED15}] => (Allow) F:\Steam\steamapps\common\Data Hacker Corruption\Game.exe => No File FirewallRules: [{2A80C40E-E0DD-428D-B484-CC2DBACB6FF0}] => (Allow) F:\Steam\steamapps\common\Data Hacker Corruption\Game.exe => No File FirewallRules: [{68CEFF77-C37A-4D72-A358-B03C26323B6D}] => (Allow) F:\Steam\steamapps\common\Team Fortress 2\hl2.exe => No File FirewallRules: [{311A6DBB-D941-4650-87BC-9E463B4E93C0}] => (Allow) F:\Steam\steamapps\common\Team Fortress 2\hl2.exe => No File FirewallRules: [{FC9C47AB-2D87-46B8-BE40-D98D584760B5}] => (Allow) F:\Steam\steamapps\common\Dance of Death\dance_of_death.exe => No File FirewallRules: [{CE22C066-E986-446F-A675-C7C6C1522E5E}] => (Allow) F:\Steam\steamapps\common\Dance of Death\dance_of_death.exe => No File FirewallRules: [{61813774-3E66-4EB9-89D4-8FE60E751573}] => (Allow) F:\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe => No File FirewallRules: [{3A2302FB-EC4E-482A-934E-E434E244DEE5}] => (Allow) F:\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe => No File FirewallRules: [{2B03C1FA-A97C-456E-A016-FCEE97B07BE8}] => (Allow) F:\Steam\steamapps\common\Disney-Pixar Brave\Brave.exe => No File FirewallRules: [{86E996EE-E256-49BB-96EF-559B58D54799}] => (Allow) F:\Steam\steamapps\common\Disney-Pixar Brave\Brave.exe => No File FirewallRules: [{9119BEE6-E944-402A-8C26-944C1CF5B23E}] => (Allow) F:\Steam\steamapps\common\Disney Princess My Fairytale Adventure\DisneyPrincess.exe => No File FirewallRules: [{FA592859-EBA5-4FCF-BCC1-962F24206EF9}] => (Allow) F:\Steam\steamapps\common\Disney Princess My Fairytale Adventure\DisneyPrincess.exe => No File FirewallRules: [{A3733584-0914-4D84-A55E-457C7D09DEA8}] => (Allow) F:\Steam\steamapps\common\Disney's Princess Enchanted Journey\play.exe => No File FirewallRules: [{8FCBF23C-4ADD-4F19-B4B2-CD1AB5A3AC66}] => (Allow) F:\Steam\steamapps\common\Disney's Princess Enchanted Journey\play.exe => No File FirewallRules: [{9F3FDD39-4BA5-4A54-9C9D-C95EB398B33E}] => (Allow) F:\Steam\steamapps\common\Disney Fairies Tinker Bell's Adventure\FairiesPC.exe => No File FirewallRules: [{622208BD-008C-4C04-BEFC-CADBB8EE86CC}] => (Allow) F:\Steam\steamapps\common\Disney Fairies Tinker Bell's Adventure\FairiesPC.exe => No File FirewallRules: [{4EA9F5FD-5181-4AC4-B2A3-4C1929A53CCE}] => (Allow) F:\Steam\steamapps\common\Metal Slug 3\mslug3.exe => No File FirewallRules: [{E692702D-A29D-4D58-91E2-9E04D41369F6}] => (Allow) F:\Steam\steamapps\common\Metal Slug 3\mslug3.exe => No File FirewallRules: [{15F995DC-C772-4D6D-8D04-B00E7B3D7805}] => (Allow) F:\Steam\steamapps\common\Metal Slug X\mslugx.exe => No File FirewallRules: [{53D89774-0008-4922-8572-0033EA8C1376}] => (Allow) F:\Steam\steamapps\common\Metal Slug X\mslugx.exe => No File FirewallRules: [{083E81BA-1CF4-4E7E-97A6-7CCF5A7FF0EE}] => (Allow) F:\Steam\steamapps\common\METAL SLUG\mslug1.exe => No File FirewallRules: [{F86529C0-A276-47AA-9F26-190503CD6C35}] => (Allow) F:\Steam\steamapps\common\METAL SLUG\mslug1.exe => No File FirewallRules: [{E750DF85-3468-4D05-81A6-98011716CF2A}] => (Allow) F:\Steam\steamapps\common\Valiant Hearts\Valiant Hearts.exe => No File FirewallRules: [{7CD243FC-BFE7-43A4-A1B8-03474C9611E8}] => (Allow) F:\Steam\steamapps\common\Valiant Hearts\Valiant Hearts.exe => No File FirewallRules: [{90E0E504-56D9-45F4-8DFB-AF761AC88ADB}] => (Allow) F:\Steam\steamapps\common\NeverAlone\Never_Alone.exe => No File FirewallRules: [{EF15259E-91D7-44B0-8F9C-7945BC847AEA}] => (Allow) F:\Steam\steamapps\common\NeverAlone\Never_Alone.exe => No File FirewallRules: [{B4AE4F4B-BDD5-408A-A663-2A05D4C16161}] => (Allow) F:\Steam\steamapps\common\Portal of Evil Stolen Runes Collectors Edition\PortalOfEvil_StolenRunes.exe => No File FirewallRules: [{D24324C7-056A-4126-972E-34ED26FA5BFE}] => (Allow) F:\Steam\steamapps\common\Portal of Evil Stolen Runes Collectors Edition\PortalOfEvil_StolenRunes.exe => No File FirewallRules: [{2BD8A768-3F54-42F1-9A38-1F62D5C9C7F8}] => (Allow) F:\Steam\steamapps\common\WhisperingWillows\WhisperingWillows.exe => No File FirewallRules: [{7DF76DDE-218A-47F1-8CE2-4D4738521657}] => (Allow) F:\Steam\steamapps\common\WhisperingWillows\WhisperingWillows.exe => No File FirewallRules: [{FC8C56DD-FD24-4D68-953B-8AC6D352985F}] => (Allow) F:\Steam\steamapps\common\The Charnel House Trilogy\winsetup.exe => No File FirewallRules: [{A0B8A55D-3BF2-45B7-9097-8514E8A2311E}] => (Allow) F:\Steam\steamapps\common\The Charnel House Trilogy\winsetup.exe => No File FirewallRules: [{F7CF4C9B-DA62-475B-B305-1B6AD9FECEB7}] => (Allow) F:\Steam\steamapps\common\The Charnel House Trilogy\CHT.exe => No File FirewallRules: [{85C00C0D-ED18-4D09-A3BE-0E204EB23306}] => (Allow) F:\Steam\steamapps\common\The Charnel House Trilogy\CHT.exe => No File FirewallRules: [{F9BC8631-2955-41AB-BAD7-8E9330F5935D}] => (Allow) F:\Steam\steamapps\common\Evoland\Evoland.exe => No File FirewallRules: [{76257E58-59AC-4FE4-BD11-DACC61425A9A}] => (Allow) F:\Steam\steamapps\common\Evoland\Evoland.exe => No File FirewallRules: [{C03F6443-42D0-43C5-9552-69E84D860E90}] => (Allow) F:\Steam\steamapps\common\Memoria\VisionaireConfigurationTool.exe => No File FirewallRules: [{8A8DD966-BE1F-4D09-A2DE-DB65087291E0}] => (Allow) F:\Steam\steamapps\common\Memoria\VisionaireConfigurationTool.exe => No File FirewallRules: [{13E46346-AF5D-4767-B73E-5B81BE330825}] => (Allow) F:\Steam\steamapps\common\Memoria\memoria.exe => No File FirewallRules: [{EAF9CBD1-E6BE-4078-9087-378F5D8F7C2B}] => (Allow) F:\Steam\steamapps\common\Memoria\memoria.exe => No File FirewallRules: [{562FDEF4-DF82-4356-88D9-1E682944B822}] => (Allow) F:\Steam\steamapps\common\Little Inferno Beta\Little Inferno.exe => No File FirewallRules: [{E73B55CE-4614-48C1-807B-24F391B76215}] => (Allow) F:\Steam\steamapps\common\Little Inferno Beta\Little Inferno.exe => No File FirewallRules: [{9ACABAF7-E890-4FB8-85E2-5130977AAB7B}] => (Allow) F:\Steam\steamapps\common\Guardians of Victoria\nw.exe => No File FirewallRules: [{439E3302-9BEC-4940-AF58-F6BA0DA7540B}] => (Allow) F:\Steam\steamapps\common\Guardians of Victoria\nw.exe => No File FirewallRules: [{599E0AB7-0EC1-463D-84A9-66ACB4C8DA56}] => (Allow) F:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe => No File FirewallRules: [{1E60CD80-5548-4966-8E2E-157E5DF7C8C9}] => (Allow) F:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe => No File FirewallRules: [{2B24BC91-8951-4E73-9B85-E59BA0BB8FA6}] => (Allow) F:\Steam\steamapps\common\Dying Light\DyingLightGame.exe => No File FirewallRules: [{7F3B4FBF-0144-48C9-8606-3439A4805765}] => (Allow) F:\Steam\steamapps\common\Dying Light\DyingLightGame.exe => No File FirewallRules: [{FD893F62-5F7E-4E42-9A2B-EBE03B298E84}] => (Allow) F:\Steam\steamapps\common\Belladonna\Belladonna.exe => No File FirewallRules: [{12E56F1D-5F9E-4D1B-A133-CB2EEEADA6D6}] => (Allow) F:\Steam\steamapps\common\Belladonna\Belladonna.exe => No File FirewallRules: [{91B2AFBF-361B-4775-AA5E-18672E20D8E8}] => (Allow) F:\Steam\steamapps\common\Sakura Clicker\Sakura Clicker.exe => No File FirewallRules: [{FF3BEB80-11EB-4873-A8D9-46A02F4BEBB4}] => (Allow) F:\Steam\steamapps\common\Sakura Clicker\Sakura Clicker.exe => No File FirewallRules: [{CA96987F-2FDD-4F09-9181-07F1B88828BA}] => (Allow) F:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Editor.exe => No File FirewallRules: [{70CF06AC-4932-4572-983B-CE2177756E6C}] => (Allow) F:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Editor.exe => No File FirewallRules: [{9E13B498-91DE-447C-BD79-87CDEED690AF}] => (Allow) F:\Steam\steamapps\common\Bastion\Bastion.exe => No File FirewallRules: [{128201FF-4A2A-418A-9F07-7A0037929D20}] => (Allow) F:\Steam\steamapps\common\Bastion\Bastion.exe => No File FirewallRules: [{D3135C78-77F3-4C81-99D9-0203E363ADEC}] => (Allow) F:\Steam\steamapps\common\Undertale\UNDERTALE.exe => No File FirewallRules: [{EAE6F99A-EA77-42EB-8248-973951118B48}] => (Allow) F:\Steam\steamapps\common\Undertale\UNDERTALE.exe => No File FirewallRules: [{652D7159-A773-4AC6-B0E0-91B3DFAB0D82}] => (Allow) F:\Steam\steamapps\common\Transistor\x64\Transistor.exe => No File FirewallRules: [{6E66E843-9C9B-4CD3-85E5-97AE2644BAB8}] => (Allow) F:\Steam\steamapps\common\Transistor\x64\Transistor.exe => No File FirewallRules: [{E4B68B0F-D5A7-4D43-923A-00BBDD3555A0}] => (Allow) F:\Steam\steamapps\common\Amnesia\amnesia.exe => No File FirewallRules: [{58C2877B-9344-4D01-B4BA-50E1C6B9FAB2}] => (Allow) F:\Steam\steamapps\common\Amnesia\amnesia.exe => No File FirewallRules: [{C6DDD1EA-5ABA-4E4F-9B97-5E8201FABE22}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\config.exe => No File FirewallRules: [{672B002D-D581-40C9-B82F-27844EF3BD49}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\config.exe => No File FirewallRules: [{4D9B8F71-278F-430B-8D09-9621D7BF65E6}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\ysf_win.exe => No File FirewallRules: [{BD0951DC-A0D1-41F3-B41B-50A692E72A35}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\ysf_win.exe => No File FirewallRules: [{E0C54E04-8431-419B-AE94-61278677C300}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\config_dx9.exe => No File FirewallRules: [{93FEA274-AB40-4942-9157-0AC4056E10EB}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\config_dx9.exe => No File FirewallRules: [{780DCD37-A97D-41DC-89A7-6BFE47E84151}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\ysf_win_dx9.exe => No File FirewallRules: [{F2D9DEF1-7039-4938-AD30-455E116B664C}] => (Allow) F:\Steam\steamapps\common\Ys The Oath in Felghana\ysf_win_dx9.exe => No File FirewallRules: [{07C15316-A17A-41AD-93A2-8EAAC44546B1}] => (Allow) F:\Steam\steamapps\common\12 Labours of Hercules II The Cretan Bull\12LaboursOfHercules2.exe => No File FirewallRules: [{DB7973D2-1DE8-4BB3-8AFE-97F170655606}] => (Allow) F:\Steam\steamapps\common\12 Labours of Hercules II The Cretan Bull\12LaboursOfHercules2.exe => No File FirewallRules: [{0F271BC6-9F85-4F5F-9123-87BE731130FE}] => (Allow) F:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Fable Anniversary.exe => No File FirewallRules: [{A4BA820B-7B2E-45BB-8F85-76B6DDF5A5B6}] => (Allow) F:\Steam\steamapps\common\Fable Anniversary\Binaries\Win32\Fable Anniversary.exe => No File FirewallRules: [{51568E19-E30E-453C-AFA1-74CAA2F50558}] => (Allow) F:\Steam\steamapps\common\The Longest Journey\game.exe => No File FirewallRules: [{C25016C1-40EC-4903-B2FE-69ED013BF633}] => (Allow) F:\Steam\steamapps\common\The Longest Journey\game.exe => No File FirewallRules: [{474CD556-85AC-40B7-A52A-3E79F5517D9A}] => (Allow) F:\Steam\steamapps\common\Inbetween Land\InbetweenLand.exe => No File FirewallRules: [{5F056ED3-B0AC-422C-BEC5-9DD56FBF87DA}] => (Allow) F:\Steam\steamapps\common\Inbetween Land\InbetweenLand.exe => No File FirewallRules: [{6F0060C3-48A5-44DC-B25F-DD490DCBF7E9}] => (Allow) F:\Steam\steamapps\common\Beyond Eyes\BeyondEyes.exe => No File FirewallRules: [{80B9DBC9-D327-424B-B036-EC6BB57A104A}] => (Allow) F:\Steam\steamapps\common\Beyond Eyes\BeyondEyes.exe => No File FirewallRules: [{6BC115A1-39CE-4CC4-B4ED-4E9E2346C5FC}] => (Allow) F:\Steam\steamapps\common\Ghost Pirates of Vooju Island\main.exe => No File FirewallRules: [{09C4B3FB-F835-4825-BE45-DD5001E51C81}] => (Allow) F:\Steam\steamapps\common\Ghost Pirates of Vooju Island\main.exe => No File FirewallRules: [{902C9D65-CC4A-4C28-8DF0-17354CF2CEF9}] => (Allow) F:\Steam\steamapps\common\Lucius\Lucius.exe => No File FirewallRules: [{B8B10B4D-D87C-493F-AE6D-2E9CE5BA7B10}] => (Allow) F:\Steam\steamapps\common\Lucius\Lucius.exe => No File FirewallRules: [{DD9BAFAA-B620-4A91-89F3-796A20BFCEC4}] => (Allow) F:\Steam\steamapps\common\Lost Chronicles of Zerzura\Zerzura.exe => No File FirewallRules: [{009C58E1-43BC-4099-86BE-1DB8C48D485F}] => (Allow) F:\Steam\steamapps\common\Lost Chronicles of Zerzura\Zerzura.exe => No File FirewallRules: [{247632E3-53E5-42A5-B034-50BE04376899}] => (Allow) F:\Steam\steamapps\common\The Emptiness Deluxe Edition\TheEmptiness.exe => No File FirewallRules: [{041D8D1D-AFC9-4FB7-91E5-8B4CF073E702}] => (Allow) F:\Steam\steamapps\common\The Emptiness Deluxe Edition\TheEmptiness.exe => No File FirewallRules: [{F87FAD10-F1D0-4507-81BC-0745B6F0B9E8}] => (Allow) F:\Steam\steamapps\common\Haunted\bin\release_optimized\Haunted.exe => No File FirewallRules: [{D969B57C-7E16-4C1C-8435-56A8B409226F}] => (Allow) F:\Steam\steamapps\common\Haunted\bin\release_optimized\Haunted.exe => No File FirewallRules: [{96F9979C-3B10-4C6E-ADF9-32C22241488C}] => (Allow) F:\Steam\steamapps\common\GoatSimulator\Binaries\Win32\GoatGame-Win32-Shipping.exe => No File FirewallRules: [{E2C9C9D1-B0B9-48BF-9AB7-980CE667D7B3}] => (Allow) F:\Steam\steamapps\common\GoatSimulator\Binaries\Win32\GoatGame-Win32-Shipping.exe => No File FirewallRules: [{6FAACD9B-5508-4D46-936F-A40EECB2948A}] => (Allow) F:\Steam\steamapps\common\Fallout 4\Fallout4Launcher.exe => No File FirewallRules: [{35E6B63F-919C-4719-9170-21D7B0490D22}] => (Allow) F:\Steam\steamapps\common\Fallout 4\Fallout4Launcher.exe => No File FirewallRules: [{4BB8023E-6C94-4D5E-8C12-AEC61A7A9667}] => (Allow) F:\Steam\steamapps\common\Divinity Dragon Commander\Shipping\DCApp.exe => No File FirewallRules: [{ED04434B-807D-463E-9D07-3E3B4A73014A}] => (Allow) F:\Steam\steamapps\common\Divinity Dragon Commander\Shipping\DCApp.exe => No File FirewallRules: [{CACCBAC5-99BF-4EBE-9D7D-CB05E972A1B6}] => (Allow) F:\Steam\steamapps\common\Yet Another Zombie Defense\YetAnotherZombieDefense.exe => No File FirewallRules: [{6E038D05-BBAE-4465-9A38-2E8ACECA293F}] => (Allow) F:\Steam\steamapps\common\Yet Another Zombie Defense\YetAnotherZombieDefense.exe => No File FirewallRules: [{757EF75F-EE29-4070-80FB-BC06169AEF1B}] => (Allow) F:\Steam\steamapps\common\Contagion\contagion.exe => No File FirewallRules: [{3F706F2B-2153-4CF6-BDDF-4A6931DC5B94}] => (Allow) F:\Steam\steamapps\common\Contagion\contagion.exe => No File FirewallRules: [{7A156062-E267-4A7F-923B-251A3253DCDC}] => (Allow) F:\Steam\steamapps\common\DreadOut\dreadout32.exe => No File FirewallRules: [{A96EB4DC-BFEB-48E1-BA53-2B9C9D942503}] => (Allow) F:\Steam\steamapps\common\DreadOut\dreadout32.exe => No File FirewallRules: [{C0A5154C-3E3E-45AA-8EF7-562727BEB269}] => (Allow) F:\Steam\steamapps\common\DreadOut\dreadout.exe => No File FirewallRules: [{6D68D38B-0EE0-4B1A-9DB2-B5C1F8E0D514}] => (Allow) F:\Steam\steamapps\common\DreadOut\dreadout.exe => No File FirewallRules: [{62592229-F61B-4ACF-875D-B4A80CB2E323}] => (Allow) F:\Steam\steamapps\common\Fall of the New Age\Fall_Of_The_New_Age_CE.exe => No File FirewallRules: [{E215AE09-A2E9-47B6-A154-0AF9E1F7B32D}] => (Allow) F:\Steam\steamapps\common\Fall of the New Age\Fall_Of_The_New_Age_CE.exe => No File FirewallRules: [{E7B98A87-9B21-44EB-B7AB-C38C086EF2C0}] => (Allow) F:\Steam\steamapps\common\ParanormalStateCE\Paranormal.exe => No File FirewallRules: [{1A2C4FEC-B78F-4A65-90B7-6DC8F1C541EB}] => (Allow) F:\Steam\steamapps\common\ParanormalStateCE\Paranormal.exe => No File FirewallRules: [{862B2412-D6AF-4969-AB07-95B9E0320C12}] => (Allow) F:\Steam\steamapps\common\The Path\PathViewer.exe => No File FirewallRules: [{5EB1F552-5D49-4722-B414-2B25B0D1598B}] => (Allow) F:\Steam\steamapps\common\The Path\PathViewer.exe => No File FirewallRules: [{38A80D77-7461-48E8-B75E-A35BC49E7F37}] => (Allow) F:\Steam\steamapps\common\FATALE\Fatale.exe => No File FirewallRules: [{795BBF34-F1AE-4796-8F9B-611368919F39}] => (Allow) F:\Steam\steamapps\common\FATALE\Fatale.exe => No File FirewallRules: [{FA34B10E-7FE4-4FB7-9C1B-0A32C76D537C}] => (Allow) F:\Steam\steamapps\common\sh_thob\The_Hound_of_The_Baskervilles.exe => No File FirewallRules: [{7D1A5EEE-7686-481C-A1EE-000C7ADDA7E6}] => (Allow) F:\Steam\steamapps\common\sh_thob\The_Hound_of_The_Baskervilles.exe => No File FirewallRules: [{B8469687-5016-47E1-A126-1D810920EB6C}] => (Allow) F:\Steam\steamapps\common\The Graveyard\TheGraveyard.exe => No File FirewallRules: [{EAA75ED0-9E89-4968-A915-6432659BEEDC}] => (Allow) F:\Steam\steamapps\common\The Graveyard\TheGraveyard.exe => No File FirewallRules: [{6CFC276F-9BBF-4C9E-8919-042C67AB7660}] => (Allow) F:\Steam\steamapps\common\Almightree-TheLastDreamer\Almightree-TheLastDreamer.exe => No File FirewallRules: [{9A3CBFAC-2B60-48BF-B24F-A299DB697DB9}] => (Allow) F:\Steam\steamapps\common\Almightree-TheLastDreamer\Almightree-TheLastDreamer.exe => No File FirewallRules: [{71A08683-34A8-4E83-90FB-AEA30C65D217}] => (Allow) F:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe => No File FirewallRules: [{23FF3637-6F52-4B2F-9A7F-8D6B2A079333}] => (Allow) F:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe => No File FirewallRules: [{CB61FCAF-6882-4D7B-8D74-ECC3A255327C}] => (Allow) F:\Steam\steamapps\common\Goodbye Deponia\VisionaireConfigurationTool.exe => No File FirewallRules: [{B5D6AE35-E5F1-426F-AC29-B9480DAC2F89}] => (Allow) F:\Steam\steamapps\common\Goodbye Deponia\VisionaireConfigurationTool.exe => No File FirewallRules: [{CFBFBDC4-E7D9-449D-9F46-E1DE6EEF8CE2}] => (Allow) F:\Steam\steamapps\common\Goodbye Deponia\deponia3.exe => No File FirewallRules: [{35346CD6-09D5-4DDA-A217-C923B1E389AD}] => (Allow) F:\Steam\steamapps\common\Goodbye Deponia\deponia3.exe => No File FirewallRules: [{3FF2DF58-D93D-479F-BDE5-BABEDF53C802}] => (Allow) F:\Steam\steamapps\common\WoolfeTRHD\WoolfeLauncher.exe => No File FirewallRules: [{7904E215-C616-46C5-B713-BF12364AEC40}] => (Allow) F:\Steam\steamapps\common\WoolfeTRHD\WoolfeLauncher.exe => No File FirewallRules: [{37767718-BBD5-4410-8C91-B125B04F0B7D}] => (Allow) F:\Steam\steamapps\common\Edna and Harvey Harvey's New Eyes\VisionaireConfigurationTool.exe => No File FirewallRules: [{23E75A5F-581F-447D-8D77-44D61956D00A}] => (Allow) F:\Steam\steamapps\common\Edna and Harvey Harvey's New Eyes\VisionaireConfigurationTool.exe => No File FirewallRules: [{391B1558-6921-47FD-BFFC-0F3376DF7A1A}] => (Allow) F:\Steam\steamapps\common\Edna and Harvey Harvey's New Eyes\harvey.exe => No File FirewallRules: [{8774EB20-45FC-4A85-8006-739BE73E3674}] => (Allow) F:\Steam\steamapps\common\Edna and Harvey Harvey's New Eyes\harvey.exe => No File FirewallRules: [{C9124D47-64C6-4E0D-90A7-01FAF8402F2E}] => (Allow) F:\Steam\steamapps\common\CastleCrashers\castle.exe => No File FirewallRules: [{7B45D2BC-383D-41AC-B3CA-681C14A0C8CE}] => (Allow) F:\Steam\steamapps\common\CastleCrashers\castle.exe => No File FirewallRules: [{40426EAB-8035-42DA-84E8-0F7C31DF550D}] => (Allow) F:\Steam\steamapps\common\The Ship\ship.exe => No File FirewallRules: [{83B02ED6-A92B-42A7-8364-727E48AE31AE}] => (Allow) F:\Steam\steamapps\common\The Ship\ship.exe => No File FirewallRules: [{AEEBCDE3-F2D3-42DC-945C-E5069EE616A8}] => (Allow) F:\Steam\steamapps\common\The Ship Single Player\ship.exe => No File FirewallRules: [{136A531B-1087-41E0-842C-19C05F08F840}] => (Allow) F:\Steam\steamapps\common\The Ship Single Player\ship.exe => No File FirewallRules: [{3ABFF587-D17B-406C-A57D-AA0C3148232D}] => (Allow) F:\Steam\steamapps\common\SmallWorld2\SW2Executable.app\Contents\Win32\SW2Executable.exe => No File FirewallRules: [{91FF2466-9BA6-41EC-8D9B-F2E3FCF47D95}] => (Allow) F:\Steam\steamapps\common\SmallWorld2\SW2Executable.app\Contents\Win32\SW2Executable.exe => No File FirewallRules: [{16137967-7FBA-4DB2-8688-A2C54018D3BD}] => (Allow) F:\Steam\steamapps\common\The Ship Tutorial\ship.exe => No File FirewallRules: [{D2C6FC02-2095-4E1D-9CBB-C271591488D4}] => (Allow) F:\Steam\steamapps\common\The Ship Tutorial\ship.exe => No File FirewallRules: [{6199BA82-BA9D-420A-B28D-0CAFFC0EB40C}] => (Allow) F:\Steam\steamapps\common\12 Labours of Hercules\12LaboursOfHercules.exe => No File FirewallRules: [{398D79A2-8ED8-43BB-B498-65770226B66A}] => (Allow) F:\Steam\steamapps\common\12 Labours of Hercules\12LaboursOfHercules.exe => No File FirewallRules: [{CD0C662F-56F9-4B12-99F6-6870EA2531A9}] => (Allow) F:\Steam\steamapps\common\16bittrader\Trader.exe => No File FirewallRules: [{7CCB082C-7717-41D1-BCF5-60EF2112FF06}] => (Allow) F:\Steam\steamapps\common\16bittrader\Trader.exe => No File FirewallRules: [{E433D42F-80C2-4993-A9A8-9F5828FC35A2}] => (Allow) F:\Steam\steamapps\common\portal 2\portal2.exe => No File FirewallRules: [{E9A666C7-C0D1-4967-B556-C197D20721F0}] => (Allow) F:\Steam\steamapps\common\portal 2\portal2.exe => No File FirewallRules: [{CFD00A70-8D59-4A3E-B9C5-6A861A79F6F8}] => (Allow) F:\Steam\steamapps\common\Hare In The Hat\HIHW7.exe => No File FirewallRules: [{6F7524D2-0F7C-496F-94E0-0F23EC97FE73}] => (Allow) F:\Steam\steamapps\common\Hare In The Hat\HIHW7.exe => No File FirewallRules: [{58A44A9E-2262-4BDC-877A-A866EE1FCEAD}] => (Allow) F:\Steam\steamapps\common\RoadNotTaken\RoadNotTaken.exe => No File FirewallRules: [{C52BE1E2-AFFD-431E-9039-06D66A09C4D4}] => (Allow) F:\Steam\steamapps\common\RoadNotTaken\RoadNotTaken.exe => No File FirewallRules: [{D1F00D6B-05F1-412A-A465-4C613AE25858}] => (Allow) F:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe => No File FirewallRules: [{632D5659-2148-4BBA-9DF6-3191B7DEE77C}] => (Allow) F:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe => No File FirewallRules: [{06C220B0-A299-4A00-973A-9BC72A87F936}] => (Allow) F:\Steam\steamapps\common\The Testament of Sherlock Holmes\game.exe => No File FirewallRules: [{1A08A349-38DD-48A5-B99F-1E2B36BB620A}] => (Allow) F:\Steam\steamapps\common\The Testament of Sherlock Holmes\game.exe => No File FirewallRules: [{78C14A2D-8DE6-4982-818B-9EDC92141CC4}] => (Allow) F:\Steam\steamapps\common\Chaos on Deponia\VisionaireConfigurationTool.exe => No File FirewallRules: [{3C2C0FFE-5058-4227-BE43-11178BA58359}] => (Allow) F:\Steam\steamapps\common\Chaos on Deponia\VisionaireConfigurationTool.exe => No File FirewallRules: [{3EBB49D4-CD5C-4509-9E7C-18BF8B5441F2}] => (Allow) F:\Steam\steamapps\common\Chaos on Deponia\deponia2.exe => No File FirewallRules: [{78D9E4F9-3056-4F01-8140-DC0DB5B356D6}] => (Allow) F:\Steam\steamapps\common\Chaos on Deponia\deponia2.exe => No File FirewallRules: [{7A85BBB8-A812-4028-A531-A28C4A407604}] => (Allow) F:\Steam\steamapps\common\Deponia\VisionaireConfigurationTool.exe => No File FirewallRules: [{46CF2049-FA56-4A79-BAAD-CD3B3E77F4FA}] => (Allow) F:\Steam\steamapps\common\Deponia\VisionaireConfigurationTool.exe => No File FirewallRules: [{CE3AF852-4CB3-4D06-BBD8-19D8E181AA46}] => (Allow) F:\Steam\steamapps\common\Deponia\deponia.exe => No File FirewallRules: [{11AD0AAC-8E28-4B64-BD80-2D7017D552C1}] => (Allow) F:\Steam\steamapps\common\Deponia\deponia.exe => No File FirewallRules: [{4E29B64E-23D4-43A3-8EFD-56B648ED1BDA}] => (Allow) F:\Steam\steamapps\common\Metal Gear Solid Ground Zeroes\MgsGroundZeroes.exe => No File FirewallRules: [{4E306138-0299-4A62-8539-8931A4422794}] => (Allow) F:\Steam\steamapps\common\Metal Gear Solid Ground Zeroes\MgsGroundZeroes.exe => No File FirewallRules: [{987E50C5-4EB0-4509-8B67-7A491F7921F2}] => (Allow) F:\Steam\steamapps\common\The Vanishing of Ethan Carter Redux\EthanCarter.exe => No File FirewallRules: [{4FE9E967-A65C-422E-95D7-59EDA2C42B4F}] => (Allow) F:\Steam\steamapps\common\The Vanishing of Ethan Carter Redux\EthanCarter.exe => No File FirewallRules: [{68C7013A-0DD6-44EF-B5EE-E14EC4753365}] => (Allow) F:\Steam\steamapps\common\Mad Max\MadMax.exe => No File FirewallRules: [{40A49910-FFB5-4AA9-9F67-A8B9FFCFA73F}] => (Allow) F:\Steam\steamapps\common\Mad Max\MadMax.exe => No File FirewallRules: [{7EA8B781-D37C-4153-AF7A-F14B18E9AACB}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY TYPE-0 HD\fftype0hdlauncher.exe => No File FirewallRules: [{5B880609-AB8D-492F-A620-2B27B6BA4A5E}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY TYPE-0 HD\fftype0hdlauncher.exe => No File FirewallRules: [{91665A8C-CC94-45F4-BDE6-F8A1FAB6B57B}] => (Allow) F:\Steam\steamapps\common\MGS_TPP\mgsvtpp.exe => No File FirewallRules: [{04CB93D3-1FEB-40C4-B7FE-C2E20A525E5C}] => (Allow) F:\Steam\steamapps\common\MGS_TPP\mgsvtpp.exe => No File FirewallRules: [{401CD5CD-D2D5-4C06-AB82-59E1370258B8}] => (Allow) F:\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe => No File FirewallRules: [{FE613314-8421-46D8-A210-D3AFD683DB8C}] => (Allow) F:\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe => No File FirewallRules: [{3AA11F76-682E-472A-AC0B-2C8A85320543}] => (Allow) F:\Steam\steamapps\common\Trine 2\trine2_launcher.exe => No File FirewallRules: [{B7A85F47-4B42-4393-AC0D-56A1DFED2A09}] => (Allow) F:\Steam\steamapps\common\Trine 2\trine2_launcher.exe => No File FirewallRules: [{41C20F0A-CAA8-4C0A-9664-96FCB9277F64}] => (Allow) F:\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe => No File FirewallRules: [{C2D86449-1348-4EF3-92E7-81FB380AA432}] => (Allow) F:\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe => No File FirewallRules: [{846C884A-A368-48F6-A9F2-3213B32E75F3}] => (Allow) F:\Steam\steamapps\common\LongLiveTheQueen\LongLiveTheQueen.exe => No File FirewallRules: [{1FDBF00F-4356-4DFF-9B7A-278DEC024157}] => (Allow) F:\Steam\steamapps\common\LongLiveTheQueen\LongLiveTheQueen.exe => No File FirewallRules: [{83D8FEFF-07CF-4D7D-B257-116AC3514996}] => (Allow) F:\Steam\steamapps\common\Reus\Reus.exe => No File FirewallRules: [{D26089AA-E9A9-4469-9690-24463EF44615}] => (Allow) F:\Steam\steamapps\common\Reus\Reus.exe => No File FirewallRules: [{7BD3C835-AC49-4871-B0B9-68B50870E527}] => (Allow) F:\Steam\steamapps\common\DeadRealm\DeadRealm.exe => No File FirewallRules: [{8D824AFB-74D9-4A0F-946B-8249925CE68F}] => (Allow) F:\Steam\steamapps\common\DeadRealm\DeadRealm.exe => No File FirewallRules: [{E6825B25-427F-47CA-A92E-DEA5FC8CB360}] => (Allow) F:\Steam\steamapps\common\12 Labours of Hercules III Girl Power\12LaboursOfHercules3.exe => No File FirewallRules: [{E68E93B3-6F61-4BD5-BB99-45662F57C716}] => (Allow) F:\Steam\steamapps\common\12 Labours of Hercules III Girl Power\12LaboursOfHercules3.exe => No File FirewallRules: [{C8325EE1-CC45-4043-8C58-D0CFA8187770}] => (Allow) C:\Program Files\BitComet\BitComet.exe => No File FirewallRules: [{53DA8BD6-3928-4E23-8412-7596BD3E1081}] => (Allow) C:\Program Files\BitComet\BitComet.exe => No File FirewallRules: [{6CFFE6F6-BCE7-48D9-B419-0C9A452F7897}] => (Allow) E:\Steam\steamapps\common\GarrysMod\hl2.exe => No File FirewallRules: [{84058FB1-74CA-4A92-AB04-1E2C1ED4072E}] => (Allow) E:\Steam\steamapps\common\GarrysMod\hl2.exe => No File FirewallRules: [{FD39D20A-B41C-4447-AA01-1BB9BD9609A3}] => (Allow) E:\Steam\steamapps\common\FINAL FANTASY VII\FF7_Launcher.exe => No File FirewallRules: [{E1272AFB-DBE7-4889-AFAC-EA695DD527C1}] => (Allow) E:\Steam\steamapps\common\FINAL FANTASY VII\FF7_Launcher.exe => No File FirewallRules: [{F0DB7A28-5728-438A-BAC9-83112505819C}] => (Allow) C:\Program Files\BitComet\BitComet.exe => No File FirewallRules: [{2A34448C-026B-4DC1-823E-EE1F6FBEA9EE}] => (Allow) C:\Program Files\BitComet\BitComet.exe => No File FirewallRules: [{4068DB64-C5A5-49F9-870E-8008870ED625}] => (Allow) F:\Steam\Steam.exe => No File FirewallRules: [{C19801E3-968A-4EB7-83CD-72FCF45329E4}] => (Allow) F:\Steam\Steam.exe => No File FirewallRules: [{500B8F2E-BB3E-4A4F-89C3-3E8C62A36F81}] => (Allow) F:\Steam\steamapps\common\Escape Rosecliff Island\EscapeRosecliffIsland.exe => No File FirewallRules: [{445C9112-2AB3-46FA-AEC8-ADDDE105CDD3}] => (Allow) F:\Steam\steamapps\common\Escape Rosecliff Island\EscapeRosecliffIsland.exe => No File FirewallRules: [{F91CD6B2-4171-43AC-AE16-19DEAA3425BE}] => (Allow) F:\Steam\steamapps\common\CookServeDelicious\CSDSteamBuild.exe => No File FirewallRules: [{7D33B414-C767-4D13-931E-1401D538953E}] => (Allow) F:\Steam\steamapps\common\CookServeDelicious\CSDSteamBuild.exe => No File FirewallRules: [{EF504763-0D7E-4180-9174-7C0DCD834D33}] => (Allow) F:\Steam\steamapps\common\Game Character Hub\GameCharacterHub.exe => No File FirewallRules: [{0C04221D-B981-4612-95B6-C12697583991}] => (Allow) F:\Steam\steamapps\common\Game Character Hub\GameCharacterHub.exe => No File FirewallRules: [{D20CAC63-A584-4B14-89A9-97E73D96A215}] => (Allow) F:\Steam\steamapps\common\Half-Life 2\hl2.exe => No File FirewallRules: [{4F8143A4-3C72-4C67-8190-AF37A231B53F}] => (Allow) F:\Steam\steamapps\common\Half-Life 2\hl2.exe => No File FirewallRules: [{5897D886-4CFC-447C-9A77-E9AB75D12B02}] => (Allow) F:\Steam\steamapps\common\Gems of War\GemsOfWar.exe => No File FirewallRules: [{00FB308B-84B9-43C0-A24D-41B4A776559A}] => (Allow) F:\Steam\steamapps\common\Gems of War\GemsOfWar.exe => No File FirewallRules: [{990D3000-4083-4877-BD4B-0B29228D62DB}] => (Allow) F:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe => No File FirewallRules: [{79FE80CA-56CF-4F4D-9A04-1CB577B3D647}] => (Allow) F:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe => No File FirewallRules: [{49FEDD76-93BB-4525-B3FE-51F072E4D83F}] => (Allow) F:\Steam\steamapps\common\GarrysMod\hl2.exe => No File FirewallRules: [{0FE757BD-2399-4A59-AE79-44D066302675}] => (Allow) F:\Steam\steamapps\common\GarrysMod\hl2.exe => No File FirewallRules: [{F86CDA44-343D-45FE-9BCA-B785C7DB233D}] => (Allow) F:\Steam\steamapps\common\Terraria\Terraria.exe => No File FirewallRules: [{0C3BCAD1-1E95-421A-9DDA-7C6032C12D63}] => (Allow) F:\Steam\steamapps\common\Terraria\Terraria.exe => No File FirewallRules: [{EB5BAB15-0982-40F3-BE3A-99D39037F873}] => (Allow) F:\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe => No File FirewallRules: [{24EF42F6-68EB-4394-9F9E-17A0B5FB6E12}] => (Allow) F:\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe => No File FirewallRules: [{75116D78-FE39-4EDC-8D8F-30DA30C6EA41}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PinballArcade.exe => No File FirewallRules: [{A68BC72F-656B-4D06-A395-EEEE23B1C7C3}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PinballArcade.exe => No File FirewallRules: [{457EE8EE-5B2B-4E82-A07C-BB14DDB0E8CC}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PinballArcade11.exe => No File FirewallRules: [{30114A38-29CE-45DD-8BDB-66AC8C6632DB}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PinballArcade11.exe => No File FirewallRules: [{C24A33EC-C8C4-496F-81C6-5D9447C03E1C}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PBAConfig.exe => No File FirewallRules: [{98FA2301-AAFB-4C54-A82D-A5A014FE4E7D}] => (Allow) F:\Steam\steamapps\common\PinballArcade\PBAConfig.exe => No File FirewallRules: [{3518A602-DFAF-4C95-B556-5A91C0F28CFD}] => (Allow) F:\Steam\steamapps\common\Forward to the Sky\ForwardToTheSky.exe => No File FirewallRules: [{FE0AB694-C82E-4ECF-9790-20869D562466}] => (Allow) F:\Steam\steamapps\common\Forward to the Sky\ForwardToTheSky.exe => No File FirewallRules: [{34AA4B30-364D-47E5-A86A-578C8963DFD9}] => (Allow) F:\Steam\steamapps\common\Violett\Violett.exe => No File FirewallRules: [{6F3A0A58-B1D4-4B6B-9CE6-36DC6231F7F8}] => (Allow) F:\Steam\steamapps\common\Violett\Violett.exe => No File FirewallRules: [{8329D30D-2377-40EE-8650-BEF23A668E64}] => (Allow) F:\Steam\steamapps\common\Tomb Raider (VI) The Angel of Darkness\Launcher.exe => No File FirewallRules: [{9E265498-75F7-41E2-A60E-A16665B2812A}] => (Allow) F:\Steam\steamapps\common\Tomb Raider (VI) The Angel of Darkness\Launcher.exe => No File FirewallRules: [{6ACE87C6-4189-428B-A1A8-DC24C9CA9863}] => (Allow) F:\Steam\steamapps\common\ValveTestApp207490\Rayman Origins.exe => No File FirewallRules: [{1258FB8C-3261-47E2-A84D-7F1809FA4C78}] => (Allow) F:\Steam\steamapps\common\ValveTestApp207490\Rayman Origins.exe => No File FirewallRules: [{D22919C1-F9A4-4AD4-9A1F-0AE5CB727CE9}] => (Allow) F:\games\Battle.net\Battle.net.exe => No File FirewallRules: [{58AB0BEB-2C81-4743-8EBA-1939F1D8DDCF}] => (Allow) F:\games\Battle.net\Battle.net.exe => No File FirewallRules: [{32F7C13C-D441-47CB-89F2-169E38015C69}] => (Allow) F:\games\StarCraft II\StarCraft II.exe => No File FirewallRules: [{F069996B-550E-4835-AA77-3C250771B3F1}] => (Allow) F:\games\StarCraft II\StarCraft II.exe => No File FirewallRules: [{6A9B00F8-2863-40D3-81B8-14D8BBF818A5}] => (Allow) F:\games\StarCraft II\StarCraft II Public Test.exe => No File FirewallRules: [{8258D2D1-E8FA-4557-A5F9-6C186D70C72B}] => (Allow) F:\games\StarCraft II\StarCraft II Public Test.exe => No File FirewallRules: [{7F42A4D1-22AF-4F09-9115-3585B2354B3D}] => (Allow) F:\Steam\steamapps\common\the witcher 2\Launcher.exe => No File FirewallRules: [{ECABE3DF-E0B9-43BA-84CC-B904C496CCBA}] => (Allow) F:\Steam\steamapps\common\the witcher 2\Launcher.exe => No File FirewallRules: [{6048C7EB-2D36-4327-9A6B-6C120C6C39EB}] => (Allow) F:\Steam\steamapps\common\FIST OF AWESOME\fistofawesome.exe => No File FirewallRules: [{41E338A3-331B-4D64-9CE2-C9872DA173D3}] => (Allow) F:\Steam\steamapps\common\FIST OF AWESOME\fistofawesome.exe => No File FirewallRules: [{CDB17CAD-59DC-48B9-AC4C-D070BA6D124A}] => (Allow) F:\Steam\steamapps\common\Whisper of a Rose\Game.exe => No File FirewallRules: [{CC174062-DC7A-4F68-9F20-9042198EE9E5}] => (Allow) F:\Steam\steamapps\common\Whisper of a Rose\Game.exe => No File FirewallRules: [{E803A9E6-5ACA-4206-872E-603AF1D702E8}] => (Allow) F:\Steam\steamapps\common\To the Moon\To the Moon\To the Moon.exe => No File FirewallRules: [{998BF8CD-73FF-4372-8785-223CD07305C2}] => (Allow) F:\Steam\steamapps\common\To the Moon\To the Moon\To the Moon.exe => No File FirewallRules: [{2B7C0B0E-9D8C-45B8-A106-821F4F29594B}] => (Allow) F:\Steam\steamapps\common\To the Moon\Minisode_1\Sigmund Holiday Special 1\Siggy - Holiday Special.exe => No File FirewallRules: [{B091B7CF-2580-47D3-9288-D765B5830AD8}] => (Allow) F:\Steam\steamapps\common\To the Moon\Minisode_1\Sigmund Holiday Special 1\Siggy - Holiday Special.exe => No File FirewallRules: [{43A4297E-07EB-4DFD-8C50-7F97CA834F3D}] => (Allow) F:\Steam\steamapps\common\To the Moon\Minisode_2\Sigmund Holiday Special 2\SigCorp Minisode 2.exe => No File FirewallRules: [{89354671-AEAB-4E73-9613-B4C7789806B1}] => (Allow) F:\Steam\steamapps\common\To the Moon\Minisode_2\Sigmund Holiday Special 2\SigCorp Minisode 2.exe => No File FirewallRules: [{0D4BD24B-E483-448A-8C22-82ACCB7211D6}] => (Allow) F:\Steam\steamapps\common\Samorost 2\Samorost2.exe => No File FirewallRules: [{D6D1119A-0B2A-4677-AC6A-C7196353A6F5}] => (Allow) F:\Steam\steamapps\common\Samorost 2\Samorost2.exe => No File FirewallRules: [{1E19E02D-BCF1-49E4-8E8B-A2479513C4C1}] => (Allow) F:\Steam\steamapps\common\HuniePop\HuniePop.exe => No File FirewallRules: [{982DB535-D420-466D-B897-4921D304EC1A}] => (Allow) F:\Steam\steamapps\common\HuniePop\HuniePop.exe => No File FirewallRules: [{45B14E2A-780A-4B11-9B41-069A37A7F773}] => (Allow) F:\Steam\steamapps\common\Botanicula\Botanicula.exe => No File FirewallRules: [{7A66267E-3652-497A-9040-52E2D9C4A692}] => (Allow) F:\Steam\steamapps\common\Botanicula\Botanicula.exe => No File FirewallRules: [{C0F2AFE5-96F2-4366-A60E-F2BFB54C406D}] => (Allow) F:\Steam\steamapps\common\CostumeQuest2\CostumeQuest2.exe => No File FirewallRules: [{791863C0-3557-46FD-93E6-E5C1784F9AF0}] => (Allow) F:\Steam\steamapps\common\CostumeQuest2\CostumeQuest2.exe => No File FirewallRules: [{D9EA5BB1-40F9-4471-A6AA-E3A09BF8BBE5}] => (Allow) F:\Steam\steamapps\common\CostumeQuest2\CostumeQuest2_DX9.exe => No File FirewallRules: [{D3A3CD9E-4A2F-4D34-9D2C-B5616FAA1640}] => (Allow) F:\Steam\steamapps\common\CostumeQuest2\CostumeQuest2_DX9.exe => No File FirewallRules: [{09715888-DE30-4245-801F-ECD8709C39C2}] => (Allow) F:\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe => No File FirewallRules: [{87216378-6880-4CEF-9E83-8ACABF26A223}] => (Allow) F:\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe => No File FirewallRules: [{2C790797-3711-45BA-9551-4EF2E35433A6}] => (Allow) F:\Steam\steamapps\common\Riddles Of The Past\RiddlesOfThePast.exe => No File FirewallRules: [{72F3BCAE-3D5E-4432-B301-55DE159C918B}] => (Allow) F:\Steam\steamapps\common\Riddles Of The Past\RiddlesOfThePast.exe => No File FirewallRules: [{70C62311-C557-461B-8A5A-49209850A59C}] => (Allow) F:\Steam\steamapps\common\dont_starve\bin\dontstarve_steam.exe => No File FirewallRules: [{F4D6C8AB-F77C-4511-B315-26B9F1FBB470}] => (Allow) F:\Steam\steamapps\common\dont_starve\bin\dontstarve_steam.exe => No File FirewallRules: [{A8B44721-2EA0-495A-8F4B-B61E9C80FAA9}] => (Allow) F:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe => No File FirewallRules: [{C51BB2DD-A927-4077-A750-C20F5DAA7350}] => (Allow) F:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe => No File FirewallRules: [{1AC9D099-6451-4B77-99A5-0CF5052211E9}] => (Allow) F:\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe => No File FirewallRules: [{4C50CB46-94FB-4F37-ADA8-CC1DB900D1AB}] => (Allow) F:\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe => No File FirewallRules: [{0711426E-FE85-4EB5-9041-3F226810BA16}] => (Allow) F:\Steam\steamapps\common\South Park - The Stick of Truth\South Park - The Stick of Truth.exe => No File FirewallRules: [{7CFEF18F-6DE4-4EC5-9357-1F22BB5AD3EE}] => (Allow) F:\Steam\steamapps\common\South Park - The Stick of Truth\South Park - The Stick of Truth.exe => No File FirewallRules: [{06DF63ED-0191-4E40-8596-100C75845E1B}] => (Allow) F:\Steam\steamapps\common\Cinders\Cinders.exe => No File FirewallRules: [{233C9813-ED26-425C-9B71-46381FB5DA2F}] => (Allow) F:\Steam\steamapps\common\Cinders\Cinders.exe => No File FirewallRules: [{BFBB53E2-2AB0-4089-85EC-1C48CA314A37}] => (Allow) F:\Steam\steamapps\common\Rock of Ages\Binaries\Win32\RoA.exe => No File FirewallRules: [{FF6ABB5C-6C52-41F0-9129-C5D08640FAEE}] => (Allow) F:\Steam\steamapps\common\Rock of Ages\Binaries\Win32\RoA.exe => No File FirewallRules: [{DF4C581A-0C60-477D-A5AE-2667D61BD02F}] => (Allow) F:\Steam\steamapps\common\Rescue Lucy\win32\Rescue Lucy.exe => No File FirewallRules: [{94B30AD4-FE41-409D-B1A2-4239544164CC}] => (Allow) F:\Steam\steamapps\common\Rescue Lucy\win32\Rescue Lucy.exe => No File FirewallRules: [TCP Query User{45C8904F-470E-4080-B5FB-925DB96C064C}F:\games\overwatch\overwatch.exe] => (Allow) F:\games\overwatch\overwatch.exe => No File FirewallRules: [UDP Query User{3304E515-9965-4288-806E-26CBEEC21DE3}F:\games\overwatch\overwatch.exe] => (Allow) F:\games\overwatch\overwatch.exe => No File FirewallRules: [{42FD70BC-BDC3-47D8-B8D7-FF8B67B2487D}] => (Allow) F:\Steam\steamapps\common\The Secret Order 4\TheSecretOrder4.exe => No File FirewallRules: [{564A4E4D-88F7-4AB2-BF13-407AD9D7E7A9}] => (Allow) F:\Steam\steamapps\common\The Secret Order 4\TheSecretOrder4.exe => No File FirewallRules: [{C2492AC6-8AFC-4446-9FB4-3AF0878D31E9}] => (Allow) F:\Steam\steamapps\common\Adventures of Bertram Fiddle Episode 1 A Dreadly Business\The Adventures of Bertram Fiddle Episode 1.exe => No File FirewallRules: [{B869E076-A9AD-46D5-ACD1-2DF46AEF07A6}] => (Allow) F:\Steam\steamapps\common\Adventures of Bertram Fiddle Episode 1 A Dreadly Business\The Adventures of Bertram Fiddle Episode 1.exe => No File FirewallRules: [{179ECC22-FE5C-4427-A151-9EF400878D58}] => (Allow) F:\Steam\steamapps\common\Limbo\limbo.exe => No File FirewallRules: [{10F73BDF-F29C-475A-B226-0890AA68FDF8}] => (Allow) F:\Steam\steamapps\common\Limbo\limbo.exe => No File FirewallRules: [{CFFFADCA-8070-40D0-9A12-00C7B307BF30}] => (Allow) F:\Steam\steamapps\common\Fran Bow\Fran Bow.exe => No File FirewallRules: [{C129A284-E1C2-43CF-B97E-8E1512D8CC6E}] => (Allow) F:\Steam\steamapps\common\Fran Bow\Fran Bow.exe => No File FirewallRules: [{E977DCA3-7CA5-4D3F-9BAB-DA8118F81D3F}] => (Allow) F:\Steam\steamapps\common\Dishonored2\Dishonored2.exe => No File FirewallRules: [{12D2AE40-6E9C-41ED-A716-1FB77A8CCB33}] => (Allow) F:\Steam\steamapps\common\Dishonored2\Dishonored2.exe => No File FirewallRules: [{A425F205-8B53-410C-862F-3A41FC884156}] => (Allow) F:\Steam\steamapps\common\Saints Row IV\SaintsRowIV.exe => No File FirewallRules: [{BB43C08F-5096-4304-8BC7-6FDAB1C36F6C}] => (Allow) F:\Steam\steamapps\common\Saints Row IV\SaintsRowIV.exe => No File FirewallRules: [{AAC6F000-C2E9-4B2E-9700-87D438F9F0FA}] => (Allow) F:\Steam\steamapps\common\HunieCam Studio\HunieCamStudio.exe => No File FirewallRules: [{52CF2B37-4FF2-443C-9A0A-5E62368F47BF}] => (Allow) F:\Steam\steamapps\common\HunieCam Studio\HunieCamStudio.exe => No File FirewallRules: [{C7EFF499-53C8-47C9-8FA2-4A81959E9309}] => (Allow) F:\Steam\steamapps\common\Dragon Rage\DRAGON_RAGE.exe => No File FirewallRules: [{7A8CA206-D679-4EC9-9E5A-8FF6D0E43507}] => (Allow) F:\Steam\steamapps\common\Dragon Rage\DRAGON_RAGE.exe => No File FirewallRules: [{35ED23DC-DD19-45F2-BDEC-2A739ACB2C9A}] => (Allow) F:\Steam\steamapps\common\Ori\ori.exe => No File FirewallRules: [{E7FDA6D6-E1D3-457D-BCD1-C50DF48B76AF}] => (Allow) F:\Steam\steamapps\common\Ori\ori.exe => No File FirewallRules: [{F040F267-3FEB-4B5F-93E9-464C0056DDC4}] => (Allow) F:\Steam\steamapps\common\Ori DE\oriDE.exe => No File FirewallRules: [{D0EE7198-FD43-4189-B6C4-7C214CED6DFB}] => (Allow) F:\Steam\steamapps\common\Ori DE\oriDE.exe => No File FirewallRules: [{CD461D93-BA98-49DD-AF91-71177F9A82EF}] => (Allow) F:\Steam\steamapps\common\The Walking Dead Season Two\TheWalkingDead2.exe => No File FirewallRules: [{987DAEF7-1991-4E01-8F87-44758A225984}] => (Allow) F:\Steam\steamapps\common\The Walking Dead Season Two\TheWalkingDead2.exe => No File FirewallRules: [{48121309-619F-44C6-84C1-7774962BA161}] => (Allow) F:\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{D4E5FC73-5AB0-45DB-8874-C36533253A2F}] => (Allow) F:\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{D80BAEEE-3099-4354-82E8-3A0E34B79D03}] => (Allow) F:\Steam\steamapps\common\PapersPlease\PapersPlease.exe => No File FirewallRules: [{6AB38F85-C7C8-49E4-83A9-206DAC7345C1}] => (Allow) F:\Steam\steamapps\common\PapersPlease\PapersPlease.exe => No File FirewallRules: [{D6DBFB73-EC93-40E5-AA94-328A2FE737DA}] => (Allow) F:\Steam\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe => No File FirewallRules: [{5E04AB09-5DBD-4652-9C15-EB9A5B675CD9}] => (Allow) F:\Steam\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe => No File FirewallRules: [{7D79762E-B7EE-4734-A584-65AEAF57B66B}] => (Allow) F:\Steam\steamapps\common\The Men of Yoshiwara Ohgiya\ohgiya.exe => No File FirewallRules: [{D42594E2-3BC1-4A2D-8DD4-496DE3C4862E}] => (Allow) F:\Steam\steamapps\common\The Men of Yoshiwara Ohgiya\ohgiya.exe => No File FirewallRules: [{ECE8F59B-4FA4-434D-88A8-7460F9EAD9D0}] => (Allow) F:\Steam\steamapps\common\The Men of Yoshiwara Kikuya\kikuya.exe => No File FirewallRules: [{AB9BBC74-8750-4FF1-8D4C-3E1B1CE66B7B}] => (Allow) F:\Steam\steamapps\common\The Men of Yoshiwara Kikuya\kikuya.exe => No File FirewallRules: [{8ABF9DAC-062D-49A2-815A-5F8A79E79E04}] => (Allow) F:\Steam\steamapps\common\HouseofSnark6-in-1Bundle\HouseOfSnark6in1.exe => No File FirewallRules: [{FD5485CE-773C-499F-BB5A-73F6212E69F5}] => (Allow) F:\Steam\steamapps\common\HouseofSnark6-in-1Bundle\HouseOfSnark6in1.exe => No File FirewallRules: [{0FD0BA31-D08E-436C-A552-FBC562BC369B}] => (Allow) F:\Steam\steamapps\common\HiddenObject6-in-1bundle\HiddenObject6in1.exe => No File FirewallRules: [{7F562B6E-BB6A-46E3-B4A7-DE43093BBB80}] => (Allow) F:\Steam\steamapps\common\HiddenObject6-in-1bundle\HiddenObject6in1.exe => No File FirewallRules: [{ED1A815E-AF80-4A8C-ACCF-B71EF61FC5C9}] => (Allow) F:\Steam\steamapps\common\Aragami\Aragami.exe => No File FirewallRules: [{F98C6D60-9B52-4AF3-9394-6746D9814020}] => (Allow) F:\Steam\steamapps\common\Aragami\Aragami.exe => No File FirewallRules: [{D1A07B4F-C418-41D4-80E2-3E0F859462CE}] => (Allow) F:\Steam\steamapps\common\Deponia Doomsday\deponia4.exe => No File FirewallRules: [{90A634D6-4D32-41E3-94F9-CCECCD6FF999}] => (Allow) F:\Steam\steamapps\common\Deponia Doomsday\deponia4.exe => No File FirewallRules: [{A2FF702D-A47B-4C17-840E-547FAB3A3F31}] => (Allow) F:\Steam\steamapps\common\Layers of Fear\Layers of Fear.exe => No File FirewallRules: [{DDA1D008-6599-4335-8990-B3F8AD9E1617}] => (Allow) F:\Steam\steamapps\common\Layers of Fear\Layers of Fear.exe => No File FirewallRules: [{CF36B498-5A73-45A6-9419-8C333907A625}] => (Allow) F:\Steam\steamapps\common\Hope Lake\HopeLake.exe => No File FirewallRules: [{A25ED44B-88CA-4E5D-B4B1-1548EA3CDA01}] => (Allow) F:\Steam\steamapps\common\Hope Lake\HopeLake.exe => No File FirewallRules: [{7ED04C64-44AF-45C9-A907-2BBE8A44FD5C}] => (Allow) F:\Steam\steamapps\common\Echoes of the Past The Revenge of the Witch Collector's Edition\EchoesOfThePast_TheRevengeOfTheWitch_CE.exe => No File FirewallRules: [{0132A22F-1FFC-411C-AEC3-5EDAF9D8820A}] => (Allow) F:\Steam\steamapps\common\Echoes of the Past The Revenge of the Witch Collector's Edition\EchoesOfThePast_TheRevengeOfTheWitch_CE.exe => No File FirewallRules: [{B6F3C6A7-CFE5-4F0E-90F1-DDC46028D8C7}] => (Allow) F:\Steam\steamapps\common\Toren\Toren.exe => No File FirewallRules: [{4AE5E13C-573D-44AB-817D-A5B84E0360B1}] => (Allow) F:\Steam\steamapps\common\Toren\Toren.exe => No File FirewallRules: [{2F9530A5-245D-42B6-AE83-641809275231}] => (Allow) F:\Steam\steamapps\common\Otherworld Spring of Shadows Collector's Edition\Otherworld_SpringofShadowsCE.exe => No File FirewallRules: [{FB0A6563-017A-466C-8315-C4B3928715DF}] => (Allow) F:\Steam\steamapps\common\Otherworld Spring of Shadows Collector's Edition\Otherworld_SpringofShadowsCE.exe => No File FirewallRules: [{29669D75-3C81-4B92-87FA-57E77EF9FC5C}] => (Allow) F:\Steam\steamapps\common\Massive Chalice\MC.exe => No File FirewallRules: [{59E737A4-96A0-4FC7-B2B4-7B3227B90AB8}] => (Allow) F:\Steam\steamapps\common\Massive Chalice\MC.exe => No File FirewallRules: [{787EAB55-7231-4458-BDFA-C83ADB80290E}] => (Allow) F:\Steam\steamapps\common\Grim Fandango Remastered\GrimFandango.exe => No File FirewallRules: [{87069C35-D9FA-460C-BDDA-0BE77C4A46E4}] => (Allow) F:\Steam\steamapps\common\Grim Fandango Remastered\GrimFandango.exe => No File FirewallRules: [{0CD0F670-8920-4EB1-AAF7-E44DD9B8FE95}] => (Allow) F:\Steam\steamapps\common\Day of the Tentacle Remastered\Dott.exe => No File FirewallRules: [{CED89F57-15EA-4D7B-9068-313C65AA5190}] => (Allow) F:\Steam\steamapps\common\Day of the Tentacle Remastered\Dott.exe => No File FirewallRules: [{E2597BC3-BE0C-4229-A1E8-EF36D373FA16}] => (Allow) F:\Steam\steamapps\common\Broken Age\BrokenAge.exe => No File FirewallRules: [{29C1846E-7F3E-41EE-B547-1ACBB1D63C72}] => (Allow) F:\Steam\steamapps\common\Broken Age\BrokenAge.exe => No File FirewallRules: [{D34A1B46-D7FB-49BF-9C59-25DA6D55054E}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe => No File FirewallRules: [{9AD2FFED-79C5-49D1-BDE9-0218921C7264}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe => No File FirewallRules: [{10C349B3-A04C-41DF-AC42-C740067504F5}] => (Allow) F:\Steam\steamapps\common\MOBIUS FINAL FANTASY\mobiusff.exe => No File FirewallRules: [{403E5698-BE9D-4AF4-A0D1-F9484888BAE9}] => (Allow) F:\Steam\steamapps\common\MOBIUS FINAL FANTASY\mobiusff.exe => No File FirewallRules: [TCP Query User{A41833F0-AD60-4246-8822-CC3348266EF4}F:\games\overwatch test\overwatch.exe] => (Allow) F:\games\overwatch test\overwatch.exe => No File FirewallRules: [UDP Query User{0926E66F-D184-43D9-AFE6-EDD76BC12243}F:\games\overwatch test\overwatch.exe] => (Allow) F:\games\overwatch test\overwatch.exe => No File FirewallRules: [{F7742673-7E92-4797-ACA8-9DFA9E6C53E3}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY FFX&FFX-2 HD Remaster\FFX&X-2_LAUNCHER.exe => No File FirewallRules: [{6AA5CBD9-46B0-4FD6-BD19-70FBBBD06620}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY FFX&FFX-2 HD Remaster\FFX&X-2_LAUNCHER.exe => No File FirewallRules: [{5296F038-7CB3-4CF9-8527-407CA8B080F9}] => (Allow) F:\Steam\steamapps\common\The Whispered World Special Edition\twwse.exe => No File FirewallRules: [{6836754C-B25C-4683-8176-D45CB9E09026}] => (Allow) F:\Steam\steamapps\common\The Whispered World Special Edition\twwse.exe => No File FirewallRules: [{B5DEB993-80A2-4B2E-871F-45EEF7FBAE67}] => (Allow) F:\Steam\steamapps\common\The Whispered World Special Edition\VisionaireConfigurationTool.exe => No File FirewallRules: [{1BD8BCF4-3110-4D96-A552-CCDBAE6F9B1A}] => (Allow) F:\Steam\steamapps\common\The Whispered World Special Edition\VisionaireConfigurationTool.exe => No File FirewallRules: [{8A3F7DDA-FE80-463B-BD9A-ECDCD4106158}] => (Allow) F:\Steam\steamapps\common\Masha Rescues Grandma\win32\Masha rescues grandma.exe => No File FirewallRules: [{B66C17A4-4F3C-4494-8600-2F0FBBD3C2A8}] => (Allow) F:\Steam\steamapps\common\Masha Rescues Grandma\win32\Masha rescues grandma.exe => No File FirewallRules: [{B4E0399B-72D9-4365-9AED-450BA65CF02F}] => (Allow) F:\Steam\steamapps\common\Silence\Silence.exe => No File FirewallRules: [{9494CF27-6233-46D6-A4EC-5F645F1CF83F}] => (Allow) F:\Steam\steamapps\common\Silence\Silence.exe => No File FirewallRules: [{A2297D93-4F36-4CA9-9C6F-52624E0CCA9B}] => (Allow) F:\Steam\steamapps\common\TheEvilWithin\EvilWithin.exe => No File FirewallRules: [{7E6D8783-93DB-4443-9674-0D3054BF9F2D}] => (Allow) F:\Steam\steamapps\common\TheEvilWithin\EvilWithin.exe => No File FirewallRules: [{EAF376FE-B72D-41C8-A034-69EE22CDC532}] => (Allow) F:\Steam\steamapps\common\TheEvilWithin2\TEW2.exe => No File FirewallRules: [{D0470E83-55B4-4103-8E54-2DB9CE198076}] => (Allow) F:\Steam\steamapps\common\TheEvilWithin2\TEW2.exe => No File FirewallRules: [{83FF18CA-0789-4B5E-B6C9-8A780282B768}] => (Allow) F:\Steam\steamapps\common\Evoland 2\Evoland2.exe => No File FirewallRules: [{721E950D-2F02-49D6-BE5C-9350521A8B5E}] => (Allow) F:\Steam\steamapps\common\Evoland 2\Evoland2.exe => No File FirewallRules: [{4C2665CE-9358-4EED-8BBC-28F22D92D04B}] => (Allow) F:\Steam\steamapps\common\Dead Space 2\deadspace2.exe => No File FirewallRules: [{4F21FFB9-EEEC-482B-949A-83F558B75284}] => (Allow) F:\Steam\steamapps\common\Dead Space 2\deadspace2.exe => No File FirewallRules: [{15498543-6F75-4F4E-B412-E8BB55394543}] => (Allow) F:\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe => No File FirewallRules: [{47E77CDA-6057-4067-86C8-AE7A7319F6AB}] => (Allow) F:\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe => No File FirewallRules: [{0EAC00C0-B414-4A89-9CB3-F3E155EFC985}] => (Allow) F:\Steam\steamapps\common\A Story About My Uncle\Binaries\Win32\ASAMU-Win32-Shipping.exe => No File FirewallRules: [{B268A5E5-AC54-455A-B1F6-F15D396A94ED}] => (Allow) F:\Steam\steamapps\common\A Story About My Uncle\Binaries\Win32\ASAMU-Win32-Shipping.exe => No File FirewallRules: [{F356F0B5-14E1-46E5-9596-E28369482794}] => (Allow) F:\Steam\steamapps\common\Fable The Lost Chapters\Fable.exe => No File FirewallRules: [{0D96E43A-9274-4767-8793-4406928F8FA3}] => (Allow) F:\Steam\steamapps\common\Fable The Lost Chapters\Fable.exe => No File FirewallRules: [{8EFDA4D4-05D3-4B7F-8C65-9DC317EDCDF7}] => (Allow) F:\Steam\steamapps\common\Deus Ex Human Revolution Director's Cut\DXHRDC.exe => No File FirewallRules: [{82E9CFD6-5727-4EE9-8088-33ADACC79338}] => (Allow) F:\Steam\steamapps\common\Deus Ex Human Revolution Director's Cut\DXHRDC.exe => No File FirewallRules: [{B883355B-56E8-4C4C-ADCC-C37500EE14A7}] => (Allow) F:\Steam\steamapps\common\Deus Ex\System\DeusEx.exe => No File FirewallRules: [{A8D886A7-D113-4439-B9FF-23BEE441DF2C}] => (Allow) F:\Steam\steamapps\common\Deus Ex\System\DeusEx.exe => No File FirewallRules: [{F9C2BDF3-90AB-4DCD-8832-5C2FC70763BE}] => (Allow) F:\Steam\steamapps\common\Deus Ex Invisible War\System\dx2.exe => No File FirewallRules: [{8D2E95A0-FC31-4F53-8EF6-3EF64F87AD0D}] => (Allow) F:\Steam\steamapps\common\Deus Ex Invisible War\System\dx2.exe => No File FirewallRules: [{2780AD76-235D-40D7-B4C3-5D9E82B2DF23}] => (Allow) F:\Steam\steamapps\common\Deus Ex The Fall\DeusEx_steam.exe => No File FirewallRules: [{D9D1F426-22D7-406F-AFAC-5EB110CB0CB7}] => (Allow) F:\Steam\steamapps\common\Deus Ex The Fall\DeusEx_steam.exe => No File FirewallRules: [{BB3736B6-D235-4505-A15D-943A7B95D948}] => (Allow) F:\Steam\steamapps\common\Magicka 2\engine\Magicka2.exe => No File FirewallRules: [{2A03E472-1CBE-4008-90C6-E73136854FFA}] => (Allow) F:\Steam\steamapps\common\Magicka 2\engine\Magicka2.exe => No File FirewallRules: [{B00B0507-4495-417D-9E65-8266410D2399}] => (Allow) F:\Steam\steamapps\common\Deus Ex Mankind Divided\retail\DXMD.exe => No File FirewallRules: [{6425614F-34B1-4FFE-AA47-47D28CA9A68A}] => (Allow) F:\Steam\steamapps\common\Deus Ex Mankind Divided\retail\DXMD.exe => No File FirewallRules: [{7F56C05E-5C12-440F-90E3-3175F950BC49}] => (Allow) F:\Steam\steamapps\common\Fairy Fencer F\FairyFencer.exe => No File FirewallRules: [{456008A8-F7B0-4FC9-831D-6ECDE24496E1}] => (Allow) F:\Steam\steamapps\common\Fairy Fencer F\FairyFencer.exe => No File FirewallRules: [{28383705-E0AE-477A-A8A2-E0CF4596FE01}] => (Allow) F:\Steam\steamapps\common\How to Survive\HowToSurvive.exe => No File FirewallRules: [{B2E0833C-06B5-4E6A-BA16-51F9C2BDA6BA}] => (Allow) F:\Steam\steamapps\common\How to Survive\HowToSurvive.exe => No File FirewallRules: [{892F8830-C504-4CB9-9152-B4D8D2E65F07}] => (Allow) F:\Steam\steamapps\common\How to Survive\Detect.exe => No File FirewallRules: [{DF0F49E3-60C3-4AE0-8E70-37E98E3FC657}] => (Allow) F:\Steam\steamapps\common\How to Survive\Detect.exe => No File FirewallRules: [{36A710CD-A8E6-41E8-A604-0974E2A207E7}] => (Allow) F:\Steam\steamapps\common\Dungeon Hearts\DungeonHearts.exe => No File FirewallRules: [{1C85E3EF-7D29-4D9A-BE38-6232E95DDF2C}] => (Allow) F:\Steam\steamapps\common\Dungeon Hearts\DungeonHearts.exe => No File FirewallRules: [{F97DF16B-B950-4666-9E80-F3C2327D27AF}] => (Allow) F:\Steam\steamapps\common\The Tiny Bang Story\ttbs.exe => No File FirewallRules: [{A16FA5B9-36B0-4615-886F-41DF23CD64D2}] => (Allow) F:\Steam\steamapps\common\The Tiny Bang Story\ttbs.exe => No File FirewallRules: [{E2B0B2D1-335C-49C5-9859-0FB3A494F733}] => (Allow) F:\Steam\steamapps\common\abyss_odyssey\Binaries\Win32\AO.exe => No File FirewallRules: [{DDA64EF5-96AF-46B0-9777-51C89E5CD482}] => (Allow) F:\Steam\steamapps\common\abyss_odyssey\Binaries\Win32\AO.exe => No File FirewallRules: [{10AC6C31-C625-4354-BC89-A44344D907F1}] => (Allow) F:\Steam\steamapps\common\LiliApp\Binaries\Win32\MazeGame-Win32-Shipping.exe => No File FirewallRules: [{DD78ED39-EE4C-49F5-8C8F-FBDFCBBC6420}] => (Allow) F:\Steam\steamapps\common\LiliApp\Binaries\Win32\MazeGame-Win32-Shipping.exe => No File FirewallRules: [{35015938-9231-46F9-AC2F-3CD1500FF9FD}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win32\UDK.exe => No File FirewallRules: [{3095658D-9DE3-4AEF-8A50-7622CF6AFDF0}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win32\UDK.exe => No File FirewallRules: [{EBE0F1F3-0EDF-4FBD-A012-F185F1591B5C}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win64\UDK.exe => No File FirewallRules: [{A1E07397-15CF-40A3-B676-BB4BA1A94090}] => (Allow) F:\Steam\steamapps\common\Viscera Cleanup Detail Santa's Rampage\Binaries\Win64\UDK.exe => No File FirewallRules: [{0743BC0B-CE9A-4038-9158-4D8A4134F3D2}] => (Allow) F:\Steam\steamapps\common\King's Quest\Binaries\Win\KingsQuest.exe => No File FirewallRules: [{CCBB9BF1-E2F0-4F02-A7CD-ECB69B5FC923}] => (Allow) F:\Steam\steamapps\common\King's Quest\Binaries\Win\KingsQuest.exe => No File FirewallRules: [{5ABF231B-F006-45AB-B7BA-F751792E8E9F}] => (Allow) F:\Steam\steamapps\common\The Sexy Brutale\game\game.exe => No File FirewallRules: [{13B91941-817A-480E-A403-CA93C12A52EE}] => (Allow) F:\Steam\steamapps\common\The Sexy Brutale\game\game.exe => No File FirewallRules: [{4C1BDF0E-9238-463C-B5F5-80D4883823E5}] => (Allow) F:\Steam\steamapps\common\Broken Sword 2\BrokenSword2.exe => No File FirewallRules: [{B64F28E6-90B6-476F-8E5C-8679CF3C7F3A}] => (Allow) F:\Steam\steamapps\common\Broken Sword 2\BrokenSword2.exe => No File FirewallRules: [{DFD93C93-D6CD-4F13-A13A-44E0C9890A5C}] => (Allow) F:\Steam\steamapps\common\Broken Sword Shadow of the Templars\bs1dc.exe => No File FirewallRules: [{D84B15DE-A3FF-4416-B26F-6CFEF40CB2ED}] => (Allow) F:\Steam\steamapps\common\Broken Sword Shadow of the Templars\bs1dc.exe => No File FirewallRules: [{35C703C2-DC04-4219-A8BB-805A75963150}] => (Allow) F:\Steam\steamapps\common\pixeljunkeden\eden.exe => No File FirewallRules: [{6ED0BCCE-E599-4678-9291-A91C5D82AC25}] => (Allow) F:\Steam\steamapps\common\pixeljunkeden\eden.exe => No File FirewallRules: [{74D0E86E-BE34-4AB6-B091-E43901F909F0}] => (Allow) F:\Steam\steamapps\common\TheDarkEye Cos\satinav.exe => No File FirewallRules: [{D91ED5FF-BFC6-4546-A551-9FCD55FFD03A}] => (Allow) F:\Steam\steamapps\common\TheDarkEye Cos\satinav.exe => No File FirewallRules: [{01FD2331-4782-4A88-8C00-18C8D62DA588}] => (Allow) F:\Steam\steamapps\common\TheDarkEye Cos\VisionaireConfigurationTool.exe => No File FirewallRules: [{F7FE650F-0293-4880-8497-590C88E15A59}] => (Allow) F:\Steam\steamapps\common\TheDarkEye Cos\VisionaireConfigurationTool.exe => No File FirewallRules: [{1E7A3F3E-6733-4006-958D-E6D23C1B61F2}] => (Allow) F:\Steam\steamapps\common\Tomb Raider (I)\dosbox.exe => No File FirewallRules: [{7D9D9DD9-74A4-48D3-B990-190B01A7311F}] => (Allow) F:\Steam\steamapps\common\Tomb Raider (I)\dosbox.exe => No File FirewallRules: [{07DA744D-C732-4478-B1F5-CBEE000F2315}] => (Allow) F:\Steam\steamapps\common\The Night of the Rabbit\rabbit.exe => No File FirewallRules: [{20B6CEBA-FB48-4BF9-B8C7-C9700ECF6E7A}] => (Allow) F:\Steam\steamapps\common\The Night of the Rabbit\rabbit.exe => No File FirewallRules: [{51FDD090-74F1-450E-A45D-9632673EF106}] => (Allow) F:\Steam\steamapps\common\The Night of the Rabbit\VisionaireConfigurationTool.exe => No File FirewallRules: [{4BF2690C-3985-4455-BDF0-E344EBC2BDD1}] => (Allow) F:\Steam\steamapps\common\The Night of the Rabbit\VisionaireConfigurationTool.exe => No File FirewallRules: [{3BE4001E-5DC4-43C8-8BD9-973848E8013D}] => (Allow) F:\Steam\steamapps\common\Serena\Dagon64.exe => No File FirewallRules: [{829DCBB8-5D1B-4CF8-82E4-A1AD2C4B8BE5}] => (Allow) F:\Steam\steamapps\common\Serena\Dagon64.exe => No File FirewallRules: [{C6400A96-C45E-441E-B275-10617D2FD222}] => (Allow) F:\Steam\steamapps\common\Divinity - Original Sin\Shipping\EoCApp.exe => No File FirewallRules: [{A83617B5-459A-4B9B-88C8-BC32D85B78A5}] => (Allow) F:\Steam\steamapps\common\Divinity - Original Sin\Shipping\EoCApp.exe => No File FirewallRules: [{255E9F6C-0B7C-4044-A606-E19B7DB52A2A}] => (Allow) F:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe => No File FirewallRules: [{8ADD9107-A552-4F53-81BF-CEA8F110861F}] => (Allow) F:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe => No File FirewallRules: [{443D335D-93F3-4554-BF78-6694D1593585}] => (Allow) F:\Steam\steamapps\common\RomancingSaGa2\rs2.exe => No File FirewallRules: [{11712CE2-7FA7-4BF0-B4BD-1DAA116F39CB}] => (Allow) F:\Steam\steamapps\common\RomancingSaGa2\rs2.exe => No File FirewallRules: [{842FCC78-5E78-44AF-BC7F-AFC4D2996C52}] => (Allow) F:\Steam\steamapps\common\Little Briar Rose\lbr.exe => No File FirewallRules: [{56DD6A24-377C-4974-B454-6BCD016680F0}] => (Allow) F:\Steam\steamapps\common\Little Briar Rose\lbr.exe => No File FirewallRules: [{6E63475B-D59B-467A-880A-AA920A46272A}] => (Allow) F:\Steam\steamapps\common\Dream Hills Captured Magic\dream_hills.exe => No File FirewallRules: [{74E0BA92-F3FE-4E8C-BDE7-659AF0C15FEA}] => (Allow) F:\Steam\steamapps\common\Dream Hills Captured Magic\dream_hills.exe => No File FirewallRules: [{6F8E0DBB-E952-4652-8A14-A912FCEFDC50}] => (Allow) F:\Steam\steamapps\common\VRChat\VRChat.exe => No File FirewallRules: [{1CC87DC7-F835-473B-B6DD-2E043097D90F}] => (Allow) F:\Steam\steamapps\common\VRChat\VRChat.exe => No File FirewallRules: [{4E64765E-8283-4D12-A628-F3FFBEA9C640}] => (Allow) F:\games\Editor\Unity.exe => No File FirewallRules: [{8AC36539-77D4-490C-891E-671CA61DC7E8}] => (Block) F:\games\Editor\Unity.exe => No File FirewallRules: [{D9A28ABA-25D8-4EA8-A8A0-06B04C55CBFD}] => (Allow) F:\games\Editor\Data\Tools\nodejs\node.exe => No File FirewallRules: [{98DD92D9-77DF-4B79-8878-AD649CB99EA5}] => (Block) F:\games\Editor\Data\Tools\nodejs\node.exe => No File FirewallRules: [{0CB27084-5A9A-4075-9427-7349114B74CA}] => (Allow) F:\Steam\steamapps\common\Doki Doki Literature Club\DDLC.exe => No File FirewallRules: [{AA2045F2-366F-4EFF-B229-497B69DDC90A}] => (Allow) F:\Steam\steamapps\common\Doki Doki Literature Club\DDLC.exe => No File FirewallRules: [{C4E91475-3B49-48D8-AF62-6C3AE9CD7F25}] => (Allow) F:\Programs\SoftEther VPN Client\vpnclient.exe => No File FirewallRules: [{42033507-C14F-4BC9-A45C-FE461D7B2024}] => (Allow) F:\Programs\SoftEther VPN Client\vpnclient_x64.exe => No File FirewallRules: [{4B57A864-7959-4DF8-ACD9-566A67A854BF}] => (Allow) F:\Programs\SoftEther VPN Client\vpncmgr.exe => No File FirewallRules: [{54D4E18C-6B82-4757-97C2-155784C84FD2}] => (Allow) F:\Programs\SoftEther VPN Client\vpncmgr_x64.exe => No File FirewallRules: [{E478F24E-2E7D-4CE6-BDC2-301507D6B5DC}] => (Allow) F:\Programs\SoftEther VPN Client\vpncmd.exe => No File FirewallRules: [{763F12B1-74EE-46C1-A49D-765E5DDE454C}] => (Allow) F:\Programs\SoftEther VPN Client\vpncmd_x64.exe => No File FirewallRules: [{F976C1F7-8A64-48F2-B173-883E0451CE40}] => (Allow) F:\Steam\steamapps\common\Mirror\game.exe => No File FirewallRules: [{4F29002B-724D-4D69-97CF-E9A59835E520}] => (Allow) F:\Steam\steamapps\common\Mirror\game.exe => No File FirewallRules: [{3EF11F2F-5177-4443-82BE-9C192D9E7282}] => (Allow) F:\Steam\steamapps\common\Gyroplosion\ItReallyIsGambling.exe => No File FirewallRules: [{973EE68C-87A9-4AAA-8729-D413AD3C02F8}] => (Allow) F:\Steam\steamapps\common\Gyroplosion\ItReallyIsGambling.exe => No File FirewallRules: [{5F22223D-6000-4BE0-BB93-892BD8A665EA}] => (Allow) F:\Steam\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe => No File FirewallRules: [{A1C25414-F0CF-4061-8F49-F3564141B0F0}] => (Allow) F:\Steam\steamapps\common\Black Desert Online\Black Desert Online Steam Launcher.exe => No File FirewallRules: [{611B218B-891F-490A-B20B-6CE75AF31ACC}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA.exe => No File FirewallRules: [{CEBA81B7-F71B-49AB-BB34-7DD8A82816A7}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA.exe => No File FirewallRules: [{BB02083B-1E30-45D7-8C09-65D6AA11E768}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA_GameSetting.exe => No File FirewallRules: [{739CD2D1-438C-4C50-AC55-E7E31545A6DA}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY XII THE ZODIAC AGE\x64\FFXII_TZA_GameSetting.exe => No File FirewallRules: [{8D68E489-9AF4-46CC-A629-522501448FCC}] => (Allow) F:\Steam\steamapps\common\Sherlock Holmes - The Devil's Daughter\Binaries\Win64\Sherlock.exe => No File FirewallRules: [{64634ACF-3E32-4A9F-A5DA-07B7785102C7}] => (Allow) F:\Steam\steamapps\common\Sherlock Holmes - The Devil's Daughter\Binaries\Win64\Sherlock.exe => No File FirewallRules: [{A7BA2729-E02E-4C68-A58D-40B6D59BC24E}] => (Allow) F:\Steam\steamapps\common\A Raven Monologue\A Raven Monologue.exe => No File FirewallRules: [{BB7C5FA2-E31E-4CB0-B360-F97B5C6AE6DE}] => (Allow) F:\Steam\steamapps\common\A Raven Monologue\A Raven Monologue.exe => No File FirewallRules: [{4F35FB80-1203-4B65-936E-8706D9C3FE9D}] => (Allow) F:\Steam\steamapps\common\Fuse\Code\Build\Output\bin\Release\Fuse.exe => No File FirewallRules: [{F5478FB2-B4E8-4924-A3E1-A7188F85D4FB}] => (Allow) F:\Steam\steamapps\common\Fuse\Code\Build\Output\bin\Release\Fuse.exe => No File FirewallRules: [{E2F7BC4C-BF89-4D57-9A32-87DFB73B2D3F}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY XV\ffxv_s.exe => No File FirewallRules: [{46B93404-21F6-46DF-9CC6-0280630A1180}] => (Allow) F:\Steam\steamapps\common\FINAL FANTASY XV\ffxv_s.exe => No File FirewallRules: [{C82A0950-F5AA-4CCE-A3C4-44E2EECC33D3}] => (Allow) F:\Steam\steamapps\common\RPG Maker MV\RPGMV.exe => No File FirewallRules: [{BCB4D565-7BD3-4A96-B5FF-C49339986017}] => (Allow) F:\Steam\steamapps\common\RPG Maker MV\RPGMV.exe => No File FirewallRules: [{85FF8E60-F7B2-4911-98CB-FA42BC8F139D}] => (Allow) F:\Steam\steamapps\common\Ni no Kuni II Revenant Kingdom\Nino2.exe => No File FirewallRules: [{2498C477-F788-4735-85E1-4B95D7791002}] => (Allow) F:\Steam\steamapps\common\Ni no Kuni II Revenant Kingdom\Nino2.exe => No File FirewallRules: [{5B91E2A0-3C1C-4B9C-A0F9-089C9DD92C1A}] => (Allow) F:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe => No File FirewallRules: [{0F95D4D3-8AF9-4B0B-8C8C-227451EE4817}] => (Allow) F:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe => No File FirewallRules: [{A472C614-CCD5-4A3B-BE53-6CC462F00CFB}] => (Allow) F:\Steam\steamapps\common\Seasons after Fall\Seasons after Fall.exe => No File FirewallRules: [{ED6178E0-99BB-42F5-9095-A2F1A0B44D0C}] => (Allow) F:\Steam\steamapps\common\Seasons after Fall\Seasons after Fall.exe => No File FirewallRules: [{7956479D-A334-4BF6-B40C-66BE18BC18CA}] => (Allow) H:\Programmi Utili\Winamp\winamp.exe => No File FirewallRules: [{C5578611-0C6A-452B-9ECD-2CBE337608B3}] => (Allow) H:\Programmi Utili\Winamp\winamp.exe => No File FirewallRules: [{9E429264-4AED-4482-B9C5-EA17AE9F96E8}] => (Allow) H:\Steam\steamapps\common\My Time At Portia\Portia.exe => No File FirewallRules: [{9965AD32-616A-401C-B0FC-84CEBB695851}] => (Allow) H:\Steam\steamapps\common\My Time At Portia\Portia.exe => No File FirewallRules: [{6A0A10C4-F3C1-4A4E-9987-F60398761F9E}] => (Allow) H:\Steam\steamapps\common\House Flipper\HouseFlipper.exe => No File FirewallRules: [{11BA7F9C-3080-4F03-9E6E-2B7D959501E1}] => (Allow) H:\Steam\steamapps\common\House Flipper\HouseFlipper.exe => No File FirewallRules: [{4D181BD3-C7E7-4D14-A3C7-143A69078494}] => (Allow) H:\Steam\steamapps\common\Dead by Daylight\DeadByDaylight.exe => No File FirewallRules: [{32FED7E4-7791-412D-BAAF-7B0733AAF853}] => (Allow) H:\Steam\steamapps\common\Dead by Daylight\DeadByDaylight.exe => No File FirewallRules: [{0254CA45-E19B-4C0C-9032-7978AC09B9A9}] => (Allow) H:\Steam\steamapps\common\Little Witch Academia\LWA.exe => No File FirewallRules: [{B77182EF-9E19-4F1D-888C-4A0EF07472B1}] => (Allow) H:\Steam\steamapps\common\Little Witch Academia\LWA.exe => No File FirewallRules: [TCP Query User{B0F7FA67-454E-4E11-AA7A-F189C133C55F}H:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) H:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe => No File FirewallRules: [UDP Query User{B79B0004-C851-416F-9889-6323F9641A30}H:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) H:\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe => No File FirewallRules: [{D2116AA1-1B85-416B-A735-7552BA486933}] => (Allow) H:\Steam\steamapps\common\Atelier Firis The Alchemist and the Mysterious Journey\A18Config.exe => No File FirewallRules: [{FA7C0233-26FD-4912-82B1-3CC0B47CF615}] => (Allow) H:\Steam\steamapps\common\Atelier Firis The Alchemist and the Mysterious Journey\A18Config.exe => No File FirewallRules: [{386EEFE7-F0B2-4155-856F-4746E6E4E56F}] => (Allow) H:\Steam\steamapps\common\Atelier Sophie The Alchemist of the Mysterious Book\A17Config.exe => No File FirewallRules: [{F6C6D388-9559-45BF-A973-0B1758E44AD7}] => (Allow) H:\Steam\steamapps\common\Atelier Sophie The Alchemist of the Mysterious Book\A17Config.exe => No File FirewallRules: [{24538091-E263-417F-93E0-1E311942654B}] => (Allow) H:\Steam\steamapps\common\HELLGATE_London\Hellgate.exe => No File FirewallRules: [{8E5D7381-5B94-4446-9FE7-E31463E0B162}] => (Allow) H:\Steam\steamapps\common\HELLGATE_London\Hellgate.exe => No File FirewallRules: [{2E997DC5-A9B3-4218-A004-551536DDECCE}] => (Allow) H:\Steam\steamapps\common\Awakening The Redleaf Forest Collector's Edition\Awakening_RedleafForestCE.exe => No File FirewallRules: [{04477287-47D7-4408-ABD2-2CCA944092F6}] => (Allow) H:\Steam\steamapps\common\Awakening The Redleaf Forest Collector's Edition\Awakening_RedleafForestCE.exe => No File FirewallRules: [{895ADA91-5DFA-4706-A89A-B97D8C91C82D}] => (Allow) H:\Steam\steamapps\common\Paladins\Binaries\Win64\PaladinsEAC.exe => No File FirewallRules: [{AA02DAD6-06B0-45B8-8A83-3E39A07203CE}] => (Allow) H:\Steam\steamapps\common\Paladins\Binaries\Win64\PaladinsEAC.exe => No File FirewallRules: [TCP Query User{7D4B4E55-31AD-486A-AA2F-A5FD742BCB87}H:\steam\steamapps\common\treasure hunter\th\binaries\win64\th-win64-shipping.exe] => (Allow) H:\steam\steamapps\common\treasure hunter\th\binaries\win64\th-win64-shipping.exe => No File FirewallRules: [UDP Query User{7E170E23-EFCE-4181-A157-02B23F61AE10}H:\steam\steamapps\common\treasure hunter\th\binaries\win64\th-win64-shipping.exe] => (Allow) H:\steam\steamapps\common\treasure hunter\th\binaries\win64\th-win64-shipping.exe => No File FirewallRules: [TCP Query User{D7CBBD8B-5589-4494-9909-B1BFF637BA76}H:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) H:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File FirewallRules: [UDP Query User{89205659-51E8-4F2D-9EED-A5AE2D4086A7}H:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) H:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File FirewallRules: [{F43508A4-4A57-4C69-935B-F713B28720B3}] => (Allow) H:\Steam\steamapps\common\Katamari Damacy REROLL\katamari.exe => No File FirewallRules: [{2760B8A5-AA13-43E4-8096-34B33BD515FD}] => (Allow) H:\Steam\steamapps\common\Katamari Damacy REROLL\katamari.exe => No File FirewallRules: [{D3EF2BEE-1C5E-499F-BA2C-0DEB564C091B}] => (Allow) H:\Steam\steamapps\common\Chrono Trigger\Chrono Trigger.exe => No File FirewallRules: [{691EF322-3931-4192-AF41-FAA2C5B23ACB}] => (Allow) H:\Steam\steamapps\common\Chrono Trigger\Chrono Trigger.exe => No File FirewallRules: [{619962CD-B336-42C1-9652-F0425FCC6FF2}] => (Allow) H:\Origin\Dragon Age II\bin_ship\DragonAge2.exe => No File FirewallRules: [{E96005A4-7929-45AD-A64B-1B7445CB66DC}] => (Allow) H:\Origin\Dragon Age II\bin_ship\DragonAge2.exe => No File FirewallRules: [{E9F4F7E5-3BA1-46E8-A308-6C101663EE86}] => (Allow) H:\Steam\steamapps\common\The Curse of Monkey Island\ScummVM\scummvm.exe => No File FirewallRules: [{D52470B9-462A-4F94-96D8-640A3C93CFEF}] => (Allow) H:\Steam\steamapps\common\The Curse of Monkey Island\ScummVM\scummvm.exe => No File FirewallRules: [{053D6DE1-3CF8-4F75-89F8-6B0BC724C379}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XIV Online\boot\ffxivboot.exe => No File FirewallRules: [{346B1944-CDF7-4D76-9A6A-AE2413E507DE}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY XIV Online\boot\ffxivboot.exe => No File FirewallRules: [{55BF864E-099E-4389-8E4E-E405F1DC6950}] => (Allow) H:\Steam\steamapps\common\Shiness\Binaries\Win64\ShinessGame.exe => No File FirewallRules: [{62EF2B0E-238C-4D2E-AE7E-5A04C5E79801}] => (Allow) H:\Steam\steamapps\common\Shiness\Binaries\Win64\ShinessGame.exe => No File FirewallRules: [{1AAB0139-DAFA-42E2-8BC7-B433FB77D0E2}] => (Allow) H:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe => No File FirewallRules: [{50D73552-2BF9-4288-B9D0-65B15779BB5F}] => (Allow) H:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe => No File FirewallRules: [{2D845156-4999-4281-8A03-E14179D111CF}] => (Allow) H:\Steam\steamapps\common\Eastshade\Eastshade.exe => No File FirewallRules: [{50A646BE-EFCB-4BBA-8F81-0F9FC77C1B79}] => (Allow) H:\Steam\steamapps\common\Eastshade\Eastshade.exe => No File FirewallRules: [{4E686E91-E6A0-41D1-BBE6-025050F657B3}] => (Allow) H:\Steam\steamapps\common\Sniper Elite 4\Launcher\SniperElite4.exe => No File FirewallRules: [{89838601-B25A-4880-ACBD-3D901C03F12B}] => (Allow) H:\Steam\steamapps\common\Sniper Elite 4\Launcher\SniperElite4.exe => No File FirewallRules: [{03E9F15F-83DA-480E-B607-A31082DAE5DD}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY VII\FF7_Launcher.exe => No File FirewallRules: [{46BF65C6-167A-432E-8E01-181D071EC871}] => (Allow) H:\Steam\steamapps\common\FINAL FANTASY VII\FF7_Launcher.exe => No File FirewallRules: [{9329AAF9-518A-4B3A-B320-745355B373BA}] => (Allow) H:\Steam\steamapps\common\WOFF\WOFF.exe => No File FirewallRules: [{3D60A950-489D-46E0-944D-6D2491A7F391}] => (Allow) H:\Steam\steamapps\common\WOFF\WOFF.exe => No File FirewallRules: [{521FD2A7-AB6A-48A6-A9C9-F994BA0A95FF}] => (Allow) H:\Steam\steamapps\common\WOFF\WOFF_config.exe => No File FirewallRules: [{1025C8CF-63BF-465A-9182-FA07210772D4}] => (Allow) H:\Steam\steamapps\common\WOFF\WOFF_config.exe => No File FirewallRules: [{0C616105-79A4-4CC4-8CA2-434B757C1D67}] => (Allow) K:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{7A48BA08-B69A-4E1E-BF4A-F01C0A34DEDA}] => (Allow) K:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{AC064623-98F5-45D1-A30D-AA9319F469D0}] => (Allow) K:\Steam\steamapps\common\Ni no Kuni Wrath of the White Witch™ Remastered\NinoKuni_WotWW_Remastered.exe => No File FirewallRules: [{E11E2605-AA08-4505-8CC9-E9C112FFEC79}] => (Allow) K:\Steam\steamapps\common\Ni no Kuni Wrath of the White Witch™ Remastered\NinoKuni_WotWW_Remastered.exe => No File FirewallRules: [{99FE912D-3328-450B-A228-8854F3D12D41}] => (Allow) K:\Steam\steamapps\common\LEWDAPOCALYPSE\Lewdapocalypse\Lewdapocalypse.exe => No File FirewallRules: [{D21A38AA-3C19-4157-B216-AEDE70DB8297}] => (Allow) K:\Steam\steamapps\common\LEWDAPOCALYPSE\Lewdapocalypse\Lewdapocalypse.exe => No File FirewallRules: [{0D3AE345-4775-46E5-B41D-3641DFCD62FA}] => (Allow) K:\Origin\Dragon Age Inquisition\DragonAgeInquisition.exe => No File FirewallRules: [{B09AA72E-0551-4E59-8FA5-BAE41162556C}] => (Allow) K:\Origin\Dragon Age Inquisition\DragonAgeInquisition.exe => No File FirewallRules: [{C34D3DD6-DAB2-4FD3-B167-23F87C2F621C}] => (Allow) K:\Steam\steamapps\common\Tales of Arise\Arise\Binaries\Win64\Tales of Arise.exe => No File FirewallRules: [{93CA1EBA-F1F7-4B04-84D6-254DF3808A0A}] => (Allow) K:\Steam\steamapps\common\Tales of Arise\Arise\Binaries\Win64\Tales of Arise.exe => No File FirewallRules: [{F438F174-7A2F-4773-9F25-4A60D3A937D4}] => (Allow) K:\Steam\steamapps\common\FINAL FANTASY VII REMAKE\ff7remake.exe => No File FirewallRules: [{1601314B-12BF-4633-A03D-E156E5973AA8}] => (Allow) K:\Steam\steamapps\common\FINAL FANTASY VII REMAKE\ff7remake.exe => No File FirewallRules: [TCP Query User{5582D3DF-ABDF-4E45-9751-B201F8270E2D}K:\steam\steamapps\common\final fantasy vii remake\end\binaries\win64\ff7remake_.exe] => (Allow) K:\steam\steamapps\common\final fantasy vii remake\end\binaries\win64\ff7remake_.exe => No File FirewallRules: [UDP Query User{6656E3ED-D0C6-498B-9FDB-C53E6115E76E}K:\steam\steamapps\common\final fantasy vii remake\end\binaries\win64\ff7remake_.exe] => (Allow) K:\steam\steamapps\common\final fantasy vii remake\end\binaries\win64\ff7remake_.exe => No File FirewallRules: [{CC5C8402-4EF9-4D9B-838F-9DFBA8755AA8}] => (Allow) K:\Steam\steamapps\common\Hogwarts Legacy\HogwartsLegacy.exe => No File FirewallRules: [{F53795E4-446F-4BFE-97C6-6F8751DC772B}] => (Allow) K:\Steam\steamapps\common\Hogwarts Legacy\HogwartsLegacy.exe => No File FirewallRules: [{E0663D6F-9949-4A82-AA10-A095076F65DC}] => (Allow) K:\Steam\steamapps\common\Deep Rock Galactic\Legacy\FSD.exe => No File FirewallRules: [{70313E90-8C7D-4258-B52D-F59CC2EDF731}] => (Allow) K:\Steam\steamapps\common\Deep Rock Galactic\Legacy\FSD.exe => No File FirewallRules: [{3D246430-FE04-4EC8-82FB-555D8B6687CE}] => (Allow) K:\Origin\The Sims 4\Game\Bin_LE\TS4.exe => No File FirewallRules: [{6ECCBDA9-AA5D-42C6-9253-06DC461499A6}] => (Allow) K:\Origin\The Sims 4\Game\Bin_LE\TS4.exe => No File FirewallRules: [{61C10D5C-B4B6-4E56-B5FE-2FDDF6E75349}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient.exe => No File FirewallRules: [{560F5698-EB36-41B3-9D9F-C4403A07B54A}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe => No File FirewallRules: [{ABDA2ADD-DEF3-456D-941B-DF14122DE408}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr.exe => No File FirewallRules: [{852695F5-AE35-467B-BF4F-FDE581B43EE9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe => No File FirewallRules: [{841DE71C-05CD-43FC-A860-A7853E2F6802}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd.exe => No File FirewallRules: [{FE67B53E-586E-40A6-BAC7-BD284403E730}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe => No File FirewallRules: [{9C35C0F1-F477-491A-B7A5-E72FADD570EC}] => (Allow) K:\Origin\The Sims 4\Game\Bin\TS4_x64.exe => No File FirewallRules: [{C08170D0-92C4-4DA9-A265-BFF2EE0D8CB6}] => (Allow) K:\Origin\The Sims 4\Game\Bin\TS4_x64.exe => No File FirewallRules: [TCP Query User{4FD6D77C-FDC1-40B5-AE08-0DEE88E02F9F}K:\steam\steamapps\common\potionomics\potionomics\binaries\win64\potionomics-win64-shipping.exe] => (Allow) K:\steam\steamapps\common\potionomics\potionomics\binaries\win64\potionomics-win64-shipping.exe => No File FirewallRules: [UDP Query User{4E89FED2-76D1-48B7-A00D-CE7E3AA51775}K:\steam\steamapps\common\potionomics\potionomics\binaries\win64\potionomics-win64-shipping.exe] => (Allow) K:\steam\steamapps\common\potionomics\potionomics\binaries\win64\potionomics-win64-shipping.exe => No File FirewallRules: [TCP Query User{2477C06D-EEC9-4A81-8B2D-572A0BB43762}K:\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) K:\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [UDP Query User{AFBCE0CC-04F8-41DE-92B5-F459E44A6EF7}K:\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) K:\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [{316D08A7-0B9A-424D-A891-0755817E1F44}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File FirewallRules: [{80ABCB88-7613-46CF-835E-00F06AF638EF}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File FirewallRules: [{1A4AFF02-8AFE-4099-A56C-9B55AA8E4A75}] => (Allow) K:\Steam\steamapps\common\PlateUp\PlateUp\PlateUp.exe => No File FirewallRules: [{431D9429-E302-4ED6-A249-912B21C01905}] => (Allow) K:\Steam\steamapps\common\PlateUp\PlateUp\PlateUp.exe => No File FirewallRules: [TCP Query User{1EBE17D7-9182-45EB-8036-1628B2E0BA7B}C:\users\mjriam\appdata\local\discord\app-1.0.9034\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9034\discord.exe => No File FirewallRules: [UDP Query User{A6FC17B5-2825-4650-88B4-8A2D0C5B5689}C:\users\mjriam\appdata\local\discord\app-1.0.9034\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9034\discord.exe => No File FirewallRules: [{988288CD-622F-41AD-891A-F51C2F688871}] => (Allow) H:\SteamLibrary\steamapps\common\Secret Agent Wizard Boy and the International Crime Syndicate\Windows\WonderfulWizard.exe => No File FirewallRules: [{4DB3E6E1-7941-493A-9491-AAB88C71A9D1}] => (Allow) H:\SteamLibrary\steamapps\common\Secret Agent Wizard Boy and the International Crime Syndicate\Windows\WonderfulWizard.exe => No File FirewallRules: [{AFA65EAA-F1AD-482C-8AFC-9FD3355DEB60}] => (Allow) J:\Temp\7zS5756\HP.EasyStart.exe => No File FirewallRules: [TCP Query User{CD44FE9C-D407-4651-B39D-9E4E8D367D76}C:\users\mjriam\appdata\local\discord\app-1.0.9237\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9237\discord.exe => No File FirewallRules: [UDP Query User{38CA3C50-61D6-4A66-9459-45B72D7A207A}C:\users\mjriam\appdata\local\discord\app-1.0.9237\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9237\discord.exe => No File FirewallRules: [TCP Query User{E77AF9E1-429A-4BC8-8BDD-1AF3ADABE0C4}C:\users\mjriam\appdata\local\discord\app-1.0.9243\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9243\discord.exe => No File FirewallRules: [UDP Query User{6B2A465A-A9CC-408D-86CD-8107A4BF4F19}C:\users\mjriam\appdata\local\discord\app-1.0.9243\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9243\discord.exe => No File FirewallRules: [TCP Query User{0F6B5CCF-9509-416B-AE3A-2C6BEA7891E1}C:\users\mjriam\appdata\local\discord\app-1.0.9244\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9244\discord.exe => No File FirewallRules: [UDP Query User{EC1074B3-EF20-4919-83CC-2577A0666E3E}C:\users\mjriam\appdata\local\discord\app-1.0.9244\discord.exe] => (Block) C:\users\mjriam\appdata\local\discord\app-1.0.9244\discord.exe => No File Task: {00CA9935-827F-4EB9-AE0C-C295E89F1905} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION Task: {00D7F2BF-09AE-4FAF-8008-61655EE09938} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION Task: {02C3EDA6-6C39-43FA-9BCA-60A86CEC7002} - \{D0F86A81-F224-4762-8BEC-616714F3A223} -> No File <==== ATTENTION Task: {0750B8B7-5BF9-44A0-8985-0ABD03CD5977} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION Task: {0E26E5DB-FF61-4F2B-A35B-BBDEE4FEC8E5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION Task: {0E7AA5FA-B757-4B6B-B1C1-26E7052DBCF1} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION Task: {111B28E7-4B10-4D07-863C-B63DE953D204} - \{7FC7BFF8-6D3E-4A86-9EAB-5CFF7EB356DE} -> No File <==== ATTENTION Task: {3FC7DD2F-9B35-4289-8D94-E4836B29ACB5} - \{F7F38451-6E1C-42CE-9269-EFC423D58924} -> No File <==== ATTENTION Task: {4F8D4585-DACD-4FDA-9A28-CCBCA34DEE81} - \AdobeAAMUpdater-1.0-Mjriam-PC-Mjriam -> No File <==== ATTENTION Task: {56B66DC7-8C47-4CA9-9581-9EE288187482} - \{92BA6514-A3BB-4C44-9E45-13275EA1F0C4} -> No File <==== ATTENTION Task: {572D21F6-02F1-4841-A4C4-C7C4AB848C4E} - \{0EF6BC55-4524-409A-8A38-6E5BB8D0A80A} -> No File <==== ATTENTION Task: {5D51BF4C-D56F-4FF0-93B4-B6BF4BF99C49} - \{27BFBDB8-DC78-4B54-AF95-09230B4FB41F} -> No File <==== ATTENTION Task: {6E4DF997-8E10-41AB-B2DB-491501C8A6E2} - \{42E2E75F-1933-490E-A278-9F81CAFC6239} -> No File <==== ATTENTION Task: {71CCF894-54A4-4B65-8E99-7BB1472CFE4D} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION Task: {87AC3841-37CA-4DEC-B2E7-4F0F3AC338E3} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION Task: {929D19EC-6293-4C07-8278-1ADDA9D2C04E} - \{99ED3927-D954-47A2-B5B7-8153731D0BBC} -> No File <==== ATTENTION Task: {97059C14-781F-479B-9F2A-88F8D8AA1B24} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION Task: {975A2493-7970-4A4D-8C75-BB08DCCC9C42} - \{55DB5C97-C18D-4C36-A1D6-266546D090A5} -> No File <==== ATTENTION Task: {98C77419-5E05-4E3D-884A-6E4A2B4D7B75} - \{FDCB8B81-B86E-40AC-A7B1-30D064354A96} -> No File <==== ATTENTION Task: {99BBA602-D226-4809-B2B9-CBD8F448B940} - \{DA653D6E-36ED-47B5-804C-E5AC379145B1} -> No File <==== ATTENTION Task: {AC291A39-2A7F-4CC9-87CB-F66D2576981D} - \{1CADA0F6-A22D-48B5-BFF9-9C298D0B78C8} -> No File <==== ATTENTION Task: {B7A218C6-E1B9-4BF2-8A31-306BDCDE78B9} - \{1262E431-FE36-4986-B13D-44921E6650AF} -> No File <==== ATTENTION Task: {BDA8E5F8-4BD8-4BBD-A652-9FD8A851B9A6} - \{8B0B108B-06F1-4FE3-AD72-86004C37FEE1} -> No File <==== ATTENTION Task: {CDF2C18F-C4EA-4D90-8E6C-F05963B93FA7} - \{B5EAF43C-7DF4-4EEF-BFDE-23A6B143B1DF} -> No File <==== ATTENTION Task: {CF38CAD9-F0C5-4664-96FF-3D012644A75A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION Task: {D660F26D-2DA8-4277-A947-5E5B1CE7C6E0} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION Task: {DF21F775-6A89-4DE7-A4AA-16310E91E8C0} - \{A92E9365-3ADC-408F-A569-06BCCBF2FF90} -> No File <==== ATTENTION Task: {E39373A8-2F43-4A90-9988-1D1882AFF0E6} - \{B45E8666-4639-4EA3-A91A-5BC3C630D946} -> No File <==== ATTENTION Task: {E6F9A641-ED9E-41ED-866A-C6FA8FCA100A} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION Task: {E94F1456-8E25-4F6F-AFD9-0F7B7D1A438D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION Task: {FD778E13-1F1D-4AC0-A587-CF8DED898EA6} - \{7D56D06B-5FCA-44E2-910C-E852D393E6AF} -> No File <==== ATTENTION Task: {D8D1004E-4F30-454F-8F6C-58BF2213F915} - System32\Tasks\{0E857885-289E-432C-BB1C-6537DE749645} => C:\Program Files (x86)\Final Fantasy VII\ff7.exe (No File) Task: {97ED4445-CCCB-49E0-A31B-6966DC6B678D} - System32\Tasks\{10FF3BB9-D023-49EC-A7B0-9E20FF0D0020} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {5A3A1326-4002-49D0-8E30-A3B6C58B14AD} - System32\Tasks\{35320803-5F88-4D93-A87A-F35EDC536DBC} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {A868DAB3-8887-48E8-98C8-9C65ACEBA4CF} - System32\Tasks\{383500CD-4150-492B-80F3-6DA3EA4A65DA} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {F9E1DB31-2A6E-4708-A0B5-4D642FE3220D} - System32\Tasks\{3CBDE894-D2C9-48AB-9FF6-D20207FEE88D} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {0F5F7F20-1D8C-4057-AF0D-91FB7BC99495} - System32\Tasks\{462C6C9F-D498-41B4-86D3-4BA73CD9D106} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {CB3AF095-349C-492C-B819-862E85802AD6} - System32\Tasks\{9EEB8B52-6D14-4C93-9A46-686EEF04431B} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {25D29079-67F1-4512-AF56-849A464964E7} - System32\Tasks\{C3B2DCE1-8249-4A9E-8C41-1A37CB53202D} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {EA6D1BF1-3733-4326-88A0-2F96F78F7166} - System32\Tasks\{D1F924AB-69AE-47FA-B82E-1C28E1F63DA4} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {E75C95DF-FB23-4AC6-9563-2DF704EE22B4} - System32\Tasks\{E2154AF9-3084-4BCB-9ECE-F2F0DE62C7DC} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {BE914FE4-DF5A-4BFB-86E6-CABA43540956} - System32\Tasks\{EC242B32-4479-46FB-A9A5-A623AC90C836} => F:\MIO\eroga 2\KISS\CM3D2\ReiPatcher\ReiPatcher.exe (No File) Task: {F4A81856-5963-412F-8518-A2E6F17CBA40} - System32\Tasks\AMD Updater => "C:\Program Files\AMD\CIM\\Bin64\RadeonInstaller.exe" /AUTOUPDATEIN (No File) Task: {D3C25C41-C68C-409B-991B-44E898ED2020} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No File) Task: {2231754A-D4DD-4173-B9E1-324A2EDB5186} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.00.95\AsLoader.exe -Run (No File) Task: {338A99B6-2CC6-48DE-8CCC-D1156DE5539A} - System32\Tasks\ASUS\TurboVHelp => C:\Program Files (x86)\ASUS\TurboV EVO\TurboVHELP.exe (No File) Task: {89CAAC61-858D-4F56-84D5-8BFA9E8EE033} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-635488242-2524467947-181519453-1001Core => C:\Users\Mjriam\AppData\Local\Google\Update\GoogleUpdate.exe /c (No File) Task: {E8AC6067-305A-4412-BEDF-FCB28762E7C4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-635488242-2524467947-181519453-1001Core1d257e5da541379 => C:\Users\Mjriam\AppData\Local\Google\Update\GoogleUpdate.exe /c (No File) Task: {41E38812-B423-43FE-892F-4F54FE63ACB7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-635488242-2524467947-181519453-1001UA => C:\Users\Mjriam\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler (No File) Task: {EEF94CB9-18B9-4947-9AAD-7532E6018259} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-635488242-2524467947-181519453-1001UA1d257e5da5c5117 => C:\Users\Mjriam\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler (No File) Task: {6824B93F-8130-4FAB-AA31-24629B7BE505} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelper_Daily => "C:\Program Files (x86)\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe" (No File) Task: {09FE21ED-26CF-4030-893E-55E30A6FC693} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelper_Metrics => "C:\Program Files (x86)\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe" --chrome-upload-metrics (No File) Task: {419251C0-38D9-4BDF-BE89-C6CA5CFA1767} - System32\Tasks\Microsoft\Office\OfficeOsfInstaller => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\osfinstaller.exe (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {8EB025E9-A84E-4CF8-8026-64F748326825} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch (No File) Task: {B10EDBED-0D7D-4DA0-A885-D6EC94C863CF} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (No File) Task: {0F3ADF83-6D37-4AC1-9CEA-B4805AA3C78F} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (No File) Task: {3C3C4935-9A73-4EB4-AEB9-56C06A3E965F} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe /DRMInit (No File) Task: {D743FC8C-FC3C-4843-B4F2-D9A77AD06CB6} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (No File) Task: {A0516865-DD1F-4FB6-A0B4-CB30A9CA12F5} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate $(Arg0) (No File) Task: {C12DD53F-EBBA-4E26-876D-88DCF84B3C91} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate -crl -hms -pscn 15 (No File) Task: {A3A25A7B-0637-4075-83EF-D6D58D7945BB} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask (No File) Task: {E7C0BABC-080C-46DF-A467-5DB42F5387E8} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask (No File) Task: {1450FCD4-DC53-4AB6-A36D-1565B99FC5AC} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate (No File) Task: {0C263FFF-37A3-4657-989B-44B94E01F657} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (No File) Task: {B69A1A4B-8C0F-4DFF-BB8C-548C86BE9C06} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery (No File) Task: {045DB261-28DC-442F-A43E-C84F76637F09} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (No File) Task: {EF6EBFD6-A97E-4422-9AF0-B5AF2BEB9AB6} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (No File) Task: {2A8720E0-E5B6-42C6-98BF-29AFD1634696} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe -pscn 0 (No File) Task: {542FC482-1389-47EA-92E7-1EFD04623C2C} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask (No File) Task: {198947CE-0CE4-4C31-8B5C-3CF4CD1F24F4} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe -PvrSchedule (No File) Task: {9898857D-1680-4769-81D1-DCCF7170EBA2} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec /RestartRecording (No File) Task: {B601F21C-E825-480A-838C-C4A7B4798F4E} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (No File) Task: {B251DD5B-8B2E-4B98-B164-9201D2417DF4} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot (No File) Task: {C7F0F41A-A8D9-4950-99EC-B0D226329B02} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask (No File) Task: {B8965FAD-393B-4E65-98A3-086902EE6DD6} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec /StartRecording (No File) Task: {51876C2C-0235-49B4-9D5A-DA6330330869} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (No File) Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File) Task: {8E8BC7A2-C14A-480C-9168-9A88631DBC9A} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => %CommonProgramFiles%\Microsoft Shared\Ink\InputPersonalization.exe (No File) Task: {055DC8FA-8232-41BB-A811-A1B90DD14306} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval => %systemroot%\system32\MusNotification.exe Display (No File) Task: {6ECC17BA-2F21-4D1D-A937-AF5B7E29ED7A} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => %systemroot%\system32\MusNotification.exe RebootDialog (No File) Task: {6A2EDE59-9F83-4DB7-AF5D-F771020898F9} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC RebootDialog (No File) Task: {3C1A490D-49A6-4A77-8ABC-129141B32088} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery RebootDialog (No File) Task: {3B511DB5-D415-4DE3-BD59-48E6F8972653} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display => %systemroot%\system32\MusNotification.exe Display (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.10 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.11 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @videolan.org/vlc,version=3.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File] FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npwacom.dll [No File] FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.5 -> C:\Program Files (x86)\TabletPlugins\npwacom.dll [No File] FF Plugin HKU\S-1-5-21-635488242-2524467947-181519453-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Mjriam\AppData\Local\Google\Update\1.3.33.7\npGoogleUpdate3.dll [No File] FF Plugin HKU\S-1-5-21-635488242-2524467947-181519453-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Mjriam\AppData\Local\Google\Update\1.3.33.7\npGoogleUpdate3.dll [No File] FF Plugin HKU\S-1-5-21-635488242-2524467947-181519453-1001: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [No File] U3 idsvc; no ImagePath S3 SIUSBXP; \??\C:\Windows\system32\drivers\SiUSBXp.sys (No File) HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 <==== ATTENTION GroupPolicyScripts-x32: Restriction <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION File: C:\WINDOWS\system32\userinit.exe File: C:\WINDOWS\SysWOW64\userinit.exe Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden HKU\S-1-5-21-635488242-2524467947-181519453-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1398380783&from=kmp&uid=MAXTORXSTM3320820AS_6QF1KXM0XXXX6QF1KXM0&q={searchTerms} HKU\S-1-5-21-635488242-2524467947-181519453-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://it.msn.com/?ocid=iehp HKU\S-1-5-21-635488242-2524467947-181519453-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1398380783&from=kmp&uid=MAXTORXSTM3320820AS_6QF1KXM0XXXX6QF1KXM0&q={searchTerms} Comment: This snippet reverts SmartScreen settings to default StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer] "SmartScreenEnabled"="Warn" [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter] "EnabledV9"=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppHost] "EnableWebContentEvaluation"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppHost] "EnableWebContentEvaluation"=dword:00000001 EndRegedit: CMD: netsh.exe advfirewall reset HKLM\...\Winlogon: [Userinit] C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\SysWOW64\userinit.exe, <==== ATTENTION File: C:\Users\Mjriam\AppData\Roaming\qone8\UninstallManager.exe File: C:\Users\Mjriam\AppData\Local\Google\Update\GoogleUpdate.exe 2015-04-06 14:09 - 2015-04-06 14:09 - 000000220 _____ () C:\Users\Mjriam\AppData\Local\5D515C96_stp.CIS.part 2015-04-06 14:09 - 2015-04-06 14:09 - 000385602 _____ () C:\Users\Mjriam\AppData\Local\5D515C96_stp.CIS 2015-04-06 14:09 - 2015-04-06 14:09 - 000000290 _____ () C:\Users\Mjriam\AppData\Local\4A594BA6_stp.CIS.part 2015-04-06 14:09 - 2015-04-06 14:09 - 000193388 _____ () C:\Users\Mjriam\AppData\Local\4A594BA6_stp.CIS 2015-04-06 14:09 - 2015-04-06 14:09 - 000000330 _____ () C:\Users\Mjriam\AppData\Local\3F032532_stp.CIS.part 2015-04-06 14:09 - 2015-04-06 14:09 - 000000000 _____ () C:\Users\Mjriam\AppData\Local\3F032532_stp.CIS 2015-04-06 14:09 - 2015-04-06 14:09 - 000000309 _____ () C:\Users\Mjriam\AppData\Local\1DC8B7A7_stp.CIS.part 2015-04-06 14:09 - 2015-04-06 14:09 - 000069441 _____ () C:\Users\Mjriam\AppData\Local\1DC8B7A7_stp.CIS 2012-07-21 20:31 - 2013-04-15 10:52 - 001838080 _____ (CPUID) C:\Users\Mjriam\AppData\Roaming\siw_sdk.dll Comment: Service / Driver Status (thanks to AdvancedSetup) Comment: 0 = Boot Comment: 1 = System Comment: 2 = Automatic Comment: 3 = Manual / Demand Comment: 4 = Disabled Comment: R = Running Comment: S = Stopped Comment: U = Unknown / unable to determine service state cleanly Comment: === rifteyy's default non-intrusive fixlist template === Comment: The following are done automatically with this fixlist: Comment: Hardens Windows Defender (for maximum efficiency DISABLE TAMPER PROTECTION) Comment: Checks and corrects the default Windows PATH environmental variable Comment: Checks for internet connection, valid DNS Comment: Checks for Windows RE status Comment: Checks and repairs WMI repository Comment: Checks Windows activation status Comment: Checks if TPM, Secure Boot are available and their status Comment: Restores original Windows services configuration Comment: Restores PowerShell execution policy Comment: Rebuilds performance counter library values Comment: Resynchronizes performance counter library values to WMI Comment: Enables file extensions Comment: Enables recovery environment Comment: Scans with HitmanPro from Sophos Comment: Scans and cleans with AdwCleaner from Malwarebytes Comment: Lists environment variables Comment: Lists Windows Defender properties, settings Comment: Lists drive info, identify possible damaged drives from Event Logs Comment: Lists Discord's "index.js" files that are often targeted by malware (to store and execute malicious code) Comment: Lists recent BSOD's Comment: Lists all installed applications, folder contents along with SHA256 for purposes of identifying installed app malware Comment: Lists 30 recent scheduled tasks Comment: Lists recent Run (Windows + R) executed commands, can identify ClickFix attacks Comment: Removes unwanted files (e.g. .exe, .com, .dll) from common folders (e.g. C:\ProgramData, AppData\Roaming) - these are not supposed to store any executable file types Comment: Removes generic filetypes associated with RenPyLoader from common folders Comment: Removes cache from Chrome, Firefox, Opera, Opera GX, Brave, Vivaldi, LibreWolf, Mullvad Browser, Zen and from Roblox, Fortnite, Discord, OBS Studio Comment: Removes policies Comment: Removes active BITS tasks Comment: Resets network Comment: Removes proxy servers Comment: Removes temporary files Comment: Repairs system files Comment: List environment variables StartPowerShell: $key = Get-Item -Path "HKCU:\Environment" -ErrorAction SilentlyContinue if ($key) { $path = "HKCU\Environment" foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "$path|$name=$value" } } $key = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -ErrorAction SilentlyContinue if ($key) { $path = "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "$path|$name=$value" } } Get-ChildItem Env: | Sort-Object Name | ForEach-Object { "SET|$($_.Name)=$($_.Value)" } Get-ChildItem Registry::HKEY_USERS | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $sid = $_.PSChildName $envPath = "Registry::HKEY_USERS\$sid\Environment" if (Test-Path $envPath) { $key = Get-Item -Path $envPath foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "HKEY_USERS\$sid\Environment|$name=$value" } } } EndPowerShell: StartPowerShell: # Checks default Windows PATH entries and repairs missing ones. $ErrorActionPreference = 'Continue' function Expand-PlainPath { param([string]$Entry) return [Environment]::ExpandEnvironmentVariables($Entry).TrimEnd('\') } # Templates expanded once to plain paths (C:\Windows\..., C:\Users\...) $systemDefaults = @( (Expand-PlainPath '%SystemRoot%\system32') (Expand-PlainPath '%SystemRoot%') (Expand-PlainPath '%SystemRoot%\System32\Wbem') (Expand-PlainPath '%SystemRoot%\System32\WindowsPowerShell\v1.0') (Expand-PlainPath '%SystemRoot%\System32\OpenSSH') ) $userDefaults = @( (Expand-PlainPath '%USERPROFILE%\AppData\Local\Microsoft\WindowsApps') ) function Get-NormalizedPathEntries { param([string]$Raw) if ([string]::IsNullOrWhiteSpace($Raw)) { return @() } return @( $Raw -split ';' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [Environment]::ExpandEnvironmentVariables($_.Trim().TrimEnd('\')).ToLowerInvariant() } ) } function Get-CombinedPathEntries { $machineRaw = [Environment]::GetEnvironmentVariable('Path', 'Machine') $userRaw = [Environment]::GetEnvironmentVariable('Path', 'User') return Get-NormalizedPathEntries -Raw ($machineRaw + ';' + $userRaw) } function Test-InPath { param( [string]$PlainPath, [string[]]$NormalizedEntries ) $key = $PlainPath.TrimEnd('\').ToLowerInvariant() return $NormalizedEntries -contains $key } function Add-ToPath { param( [string]$PlainPath, [ValidateSet('Machine', 'User')] [string]$Scope ) # always store plain path, never %VAR% form $toAdd = $PlainPath.TrimEnd('\') $current = [Environment]::GetEnvironmentVariable('Path', $Scope) if ([string]::IsNullOrWhiteSpace($current)) { [Environment]::SetEnvironmentVariable('Path', $toAdd, $Scope) return } $normalized = Get-NormalizedPathEntries -Raw $current $key = $toAdd.ToLowerInvariant() if ($normalized -contains $key) { return } $newPath = $current.TrimEnd(';') + ';' + $toAdd [Environment]::SetEnvironmentVariable('Path', $newPath, $Scope) } function Write-Result { param( [string]$Entry, [string]$Status ) $label = $Entry.PadRight(58) Write-Output ("{0} {1}" -f $label, $Status) } function Repair-AndVerify { param( [string]$PlainPath, [ValidateSet('Machine', 'User')] [string]$Scope ) if (-not (Test-Path -LiteralPath $PlainPath)) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (no folder, cannot repair)' return 'failed' } if ($Scope -eq 'Machine') { $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()). IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (need Admin to repair)' return 'failed' } } try { Add-ToPath -PlainPath $PlainPath -Scope $Scope } catch { Write-Result -Entry $PlainPath -Status "ATTENTION !!! MISSING (repair failed: $_)" return 'failed' } # re-query PATH from registry and verify plain path is present $after = Get-CombinedPathEntries if (Test-InPath -PlainPath $PlainPath -NormalizedEntries $after) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING -> repaired (verified)' return 'repaired' } Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (repair ran, still missing after re-check)' return 'failed' } $combined = Get-CombinedPathEntries $hadMissing = $false $repairFailed = $false $repairedList = [System.Collections.Generic.List[string]]::new() Write-Output 'PATH CHECK' Write-Output ('-' * 72) foreach ($entry in $systemDefaults) { if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) { Write-Result -Entry $entry -Status 'OK' continue } $hadMissing = $true $result = Repair-AndVerify -PlainPath $entry -Scope Machine if ($result -eq 'repaired') { [void]$repairedList.Add($entry) $combined = Get-CombinedPathEntries } else { $repairFailed = $true } } foreach ($entry in $userDefaults) { if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) { Write-Result -Entry $entry -Status 'OK' continue } $hadMissing = $true $result = Repair-AndVerify -PlainPath $entry -Scope User if ($result -eq 'repaired') { [void]$repairedList.Add($entry) $combined = Get-CombinedPathEntries } else { $repairFailed = $true } } Write-Output ('-' * 72) if (-not $hadMissing) { Write-Output 'RESULT: all default PATH entries present' } elseif ($repairedList.Count -gt 0 -and -not $repairFailed) { Write-Output "RESULT: $($repairedList.Count) missing entry/entries repaired and verified - open a new terminal" } elseif ($repairedList.Count -gt 0 -and $repairFailed) { Write-Output "RESULT: $($repairedList.Count) verified, some still missing - open a new terminal / run as Admin" } else { Write-Output 'RESULT: missing entries not repaired (run as Admin for System PATH)' } if ($repairedList.Count -gt 0) { Write-Output '' Write-Output 'REPAIRED:' foreach ($item in $repairedList) { Write-Output " $item" } } if ($hadMissing -or $repairFailed) { exit 1 } exit 0 EndPowerShell: Comment: Verify Windows activation CMD: cscript c:\windows\system32\slmgr.vbs /xpr & cscript c:\windows\system32\slmgr.vbs /dlv Comment: Check TPM and Secure Boot status StartPowershell: [PSCustomObject]@{ "TPM Detected" = (Get-Tpm).TpmPresent; "TPM Enabled" = (Get-Tpm).TpmEnabled; "Secure Boot On" = (Confirm-SecureBootUEFI) } EndPowershell: StartPowerShell: # Check for internet connection $ErrorActionPreference = 'Continue' $dnsServers = @( '1.1.1.1' '8.8.8.8' ) $hosts = @( 'google.com' 'cloudflare.com' 'malwarebytes.com' ) function Write-Result { param( [string]$Label, [string]$Status ) Write-Output ("{0} {1}" -f $Label.PadRight(42), $Status) } function Test-DnsServer { param([string]$Server) $pingOk = $false try { $pingOk = Test-Connection -ComputerName $Server -Count 1 -Quiet -ErrorAction SilentlyContinue } catch { } $resolveOk = $false try { $result = Resolve-DnsName -Name 'google.com' -Server $Server -Type A -DnsOnly -ErrorAction Stop $ip = ($result | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress if ($ip) { $resolveOk = $true } } catch { } # resolve is what matters; ping may be blocked if ($resolveOk) { return 'OK' } if ($pingOk) { return 'FAIL' } return 'FAIL' } function Test-HostReachable { param([string]$HostName) try { $dns = Resolve-DnsName -Name $HostName -Type A -ErrorAction Stop $resolvedIp = ($dns | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress if (-not $resolvedIp) { return 'FAIL' } } catch { return 'FAIL' } try { $null = Invoke-WebRequest -Uri "https://$HostName" -UseBasicParsing -TimeoutSec 10 -MaximumRedirection 5 -ErrorAction Stop return 'OK' } catch { if ($_.Exception.Response) { return 'OK' } return 'FAIL' } } $failed = 0 Write-Output 'INTERNET CHECK' Write-Output ('-' * 72) Write-Output 'DNS SERVERS' foreach ($server in $dnsServers) { $status = Test-DnsServer -Server $server Write-Result -Label $server -Status $status if ($status -eq 'FAIL') { $failed++ } } Write-Output '' Write-Output 'HOSTS' foreach ($h in $hosts) { $status = Test-HostReachable -HostName $h Write-Result -Label $h -Status $status if ($status -eq 'FAIL') { $failed++ } } Write-Output ('-' * 72) if ($failed -eq 0) { Write-Output 'RESULT: all checks passed' exit 0 } Write-Output "RESULT: $failed check(s) failed" exit 1 EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: Comment: List drive info, identify possible damaged drives (thanks to AdvancedSetup from Malwarebytes for parts of these) StartPowerShell: param( [int]$MaxEvents = 5000 ) $GPTTypeMap = @{ 'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7' = 'Microsoft Basic Data' 'E3C9E316-0B5C-4DB8-817D-F92DF00215AE' = 'Microsoft Reserved (MSR)' 'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC' = 'Windows Recovery Environment (WinRE)' 'C12A7328-F81F-11D2-BA4B-00A0C93EC93B' = 'EFI System Partition' '21686148-6449-6E6F-744E-656564454649' = 'BIOS Boot Partition' 'A19D880F-05FC-4D3B-A006-743F0F84911E' = 'OEM Partition' '5808C8AA-7E8F-42E0-85D2-E1E90434CFB3' = 'Cluster Metadata Partition' '48465300-0000-11AA-AA11-00306543ECAC' = 'Apple HFS/HFS+' '7C3457EF-0000-11AA-AA11-00306543ECAC' = 'Apple APFS' '0FC63DAF-8483-4772-8E79-3D69D8477DE4' = 'Linux Filesystem' '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F' = 'Linux Swap' 'E6D6D379-F507-44C2-A23C-238F2A3DF928' = 'Linux LVM' } $MBRTypeMap = @{ '01'='FAT12';'04'='FAT16 <32M';'05'='Extended';'06'='FAT16';'07'='IFS/NTFS/exFAT/HPFS';'0B'='FAT32 CHS';'0C'='FAT32 LBA';'0E'='FAT16 LBA' '0F'='Extended LBA';'82'='Linux Swap';'83'='Linux Native';'8E'='Linux LVM';'A5'='FreeBSD';'A6'='OpenBSD';'A8'='Mac OS X';'AB'='Mac OS X Boot' 'AF'='Mac OS X HFS';'EE'='EFI GPT Protective';'EF'='EFI System Partition' } function Get-PartitionTypeInfo { param($Partition) $guid = $null if ($Partition.GptType) { $guid = ($Partition.GptType -replace '[{}]', '').ToUpper() } if ([string]::IsNullOrWhiteSpace($guid) -or $guid -eq '00000000-0000-0000-0000-000000000000') { $guid = switch ($Partition.Type) { "System" { "C12A7328-F81F-11D2-BA4B-00A0C93EC93B" } "Reserved" { "E3C9E316-0B5C-4DB8-817D-F92DF00215AE" } "Basic" { "EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" } "Recovery" { "DE94BBA4-06D1-4D40-A16A-BFD50179D6AC" } default { $null } } } if ($guid) { $name = $GPTTypeMap[$guid] if ($name) { return "$name (GPT GUID: $($guid.ToLower()))" } else { return "Unknown/Custom (GPT GUID: $($guid.ToLower()))" } } if ($Partition.MbrType) { $code = ($Partition.MbrType.ToString() -replace '^0x', '').PadLeft(2, '0').ToUpper() $name = $MBRTypeMap[$code] if ($name) { return "$name (MBR code: 0x$code)" } else { return "Unknown/Custom (MBR code: $($Partition.MbrType))" } } return $Partition.Type } function Get-DrMapping { param([int]$MaxEvents) $map = @{} try { $events = Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'disk' } -MaxEvents $MaxEvents -ErrorAction Stop } catch { return $map } foreach ($e in $events) { if ($e.Message -match 'Harddisk(\d+)\\DR(\d+)') { $n = [int]$Matches[1] $dr = [int]$Matches[2] if (-not $map.ContainsKey($n)) { $map[$n] = $dr } } } return $map } $drMap = Get-DrMapping -MaxEvents $MaxEvents $physicalDisks = Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, SerialNumber, MediaType, @{N='SizeGB';E={[math]::Round($_.Size / 1GB,2)}} foreach ($pd in $physicalDisks) { $devId = [int]$pd.DeviceId $drSuffix = if ($drMap.ContainsKey($devId)) { "\DR$($drMap[$devId])" } else { '\DR? (no event seen yet)' } Write-Host "" Write-Host "<=== \Device\Harddisk$devId$drSuffix ($($pd.FriendlyName)) ===>" Write-Host " DeviceId: $devId | Serial: $($pd.SerialNumber) | Media: $($pd.MediaType) | Size: $($pd.SizeGB) GB" try { $partitions = Get-Partition -DiskNumber $devId -ErrorAction Stop if (-not $partitions) { Write-Host " (no partitions found)" continue } foreach ($part in $partitions) { $driveLetter = if ($part.DriveLetter) { "$($part.DriveLetter):" } else { 'no letter' } $sizeGB = [math]::Round($part.Size / 1GB, 2) $typeInfo = Get-PartitionTypeInfo -Partition $part Write-Host " [PARTITION $($part.PartitionNumber)] Drive: $driveLetter - $sizeGB GB - $typeInfo" } } catch { Write-Host " [ERROR] cannot read partitions for disk $devId" } } if ($drMap.Count -eq 0) { Write-Host "" Write-Host "Note: no \Device\HarddiskN\DRx entries found in the last $MaxEvents System log events. Increase -MaxEvents, or the DR number will only appear once Windows actually logs a disk event for that drive (e.g. a bad block warning)." } EndPowerShell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } StartPowerShell: # Basic BSOD listings $ccKey = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" $cfg = Get-ItemProperty $ccKey -ErrorAction SilentlyContinue $dumpTypeMap = @{0='None';1='Complete';2='Kernel';3='Minidump';7='Automatic'} Write-Output "--- Configuration ---" Write-Output ("Dump Type: {0} ({1})" -f $cfg.CrashDumpEnabled, $dumpTypeMap[$cfg.CrashDumpEnabled]) Write-Output ("Full Dump Path: {0}" -f $(if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"})) Write-Output ("Minidump Folder: {0}" -f $(if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"})) Write-Output ("Auto Reboot: {0}" -f $(if($cfg.AutoReboot -eq 0){'Disabled'}else{'Enabled'})) Write-Output "--- Found Dump Files ---" $full = if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"} if (Test-Path $full) { Get-Item $full | Select Name,Length,LastWriteTime | Format-Table -AutoSize } $mini = if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"} if (Test-Path $mini) { Get-ChildItem $mini -Filter *.dmp | Select Name,Length,LastWriteTime | Format-Table -AutoSize } Write-Output "--- BugCheck Reasoning (recent events) ---" $map = @{ '0x0000000A'='IRQL_NOT_LESS_OR_EQUAL - faulty/outdated driver accessed memory at high IRQL' '0x0000001E'='KMODE_EXCEPTION_NOT_HANDLED - unhandled kernel exception, often driver/hardware' '0x0000002E'='DATA_BUS_ERROR - typically bad RAM or hardware fault' '0x0000003B'='SYSTEM_SERVICE_EXCEPTION - exception in a system service, often driver-related' '0x00000050'='PAGE_FAULT_IN_NONPAGED_AREA - bad RAM or faulty driver/antivirus' '0x0000007A'='KERNEL_DATA_INPAGE_ERROR - disk-related problem' '0x0000007B'='INACCESSIBLE_BOOT_DEVICE - system could not find/access the boot device' '0x0000007E'='SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - almost always a faulty driver' '0x0000007F'='UNEXPECTED_KERNEL_MODE_TRAP - hardware issue (CPU/RAM/overclocking)' '0x0000009F'='DRIVER_POWER_STATE_FAILURE - driver failed to respond to a power state change' '0x000000C2'='BAD_POOL_CALLER - driver mishandling memory (pool corruption)' '0x000000D1'='DRIVER_IRQL_NOT_LESS_OR_EQUAL - typically a network or GPU driver' '0x000000EF'='CRITICAL_PROCESS_DIED - a critical system process died, often malware/system corruption' '0x00000116'='VIDEO_TDR_FAILURE - GPU driver failed to respond in time (timeout)' '0x00000124'='WHEA_UNCORRECTABLE_ERROR - hardware fault (CPU/RAM/PSU/overclocking)' '0x00000133'='DPC_WATCHDOG_VIOLATION - faulty driver or storage subsystem issue' '0x00000139'='KERNEL_SECURITY_CHECK_FAILURE - corrupted kernel structure, possibly malware' } $events = Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object { $_.ProviderName -match 'WER-SystemErrorReporting' } | Select-Object -First 5 if (-not $events) { Write-Output "No BugCheck events found in the log." } foreach ($ev in $events) { $code = if ($ev.Message -match 'bugcheck was:\s*(0x[0-9A-Fa-f]+)') { $matches[1] } else { $null } Write-Output ("Time: {0}" -f $ev.TimeCreated) Write-Output ("Code: {0}" -f $(if($code){$code}else{'not recognized'})) if ($code -and $map.ContainsKey($code.ToUpper())) { Write-Output ("Meaning: {0}" -f $map[$code.ToUpper()]) } elseif ($code) { Write-Output "Meaning: unknown code, look up at learn.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2" } Write-Output "" } EndPowerShell: StartPowerShell: # This snippet lists all installed apps and their folder contents along with SHA256 hashes. Useful for troubleshooting malware abusing installed app entry. param( [switch]$Recurse, [int]$MaxFilesPerApp = [int]::MaxValue ) $uninstallPaths = @( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $script:msiInstaller = $null function Get-MsiInstallLocation { param([string]$ProductCode) if (-not $script:msiInstaller) { try { $script:msiInstaller = New-Object -ComObject WindowsInstaller.Installer } catch { return $null } } try { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallLocation') if ([string]::IsNullOrWhiteSpace($loc)) { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallSource') } if ([string]::IsNullOrWhiteSpace($loc)) { return $null } return $loc } catch { return $null } } function Get-CleanPath { param([string]$RawValue) if ([string]::IsNullOrWhiteSpace($RawValue)) { return $null } $s = $RawValue.Trim() if ($s.StartsWith('"')) { $endQuote = $s.IndexOf('"', 1) if ($endQuote -gt 0) { return $s.Substring(1, $endQuote - 1) } } if ($s -match '^(.*?\.exe)\b') { return $Matches[1] } return $s } function Format-FileSize { param([long]$Bytes) if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) } if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) } if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) } return "$Bytes B" } $script:PeExtensions = @('.exe', '.dll', '.sys', '.ocx', '.cpl', '.scr', '.drv', '.efi', '.msi', '.msp', '.msu') function Test-IsPeFile { param([string]$Extension) return $script:PeExtensions -contains $Extension.ToLower() } function Get-SignatureInfo { param([string]$Path, [string]$Extension) if (-not (Test-IsPeFile -Extension $Extension)) { return [PSCustomObject]@{ Signer = 'N/A (not PE)'; Status = 'NotApplicable'; Valid = $false } } $result = [PSCustomObject]@{ Signer = 'Unsigned'; Status = 'NotSigned'; Valid = $false } try { $sig = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop $result.Status = $sig.Status.ToString() $result.Valid = ($sig.Status -eq 'Valid') if ($sig.SignerCertificate) { if ($sig.SignerCertificate.Subject -match 'CN=([^,]+)') { $result.Signer = $Matches[1].Trim('"') } else { $result.Signer = $sig.SignerCertificate.Subject } if (-not $result.Valid) { $result.Signer += " [INVALID: $($result.Status)]" } } elseif ($sig.Status -eq 'NotSigned') { $result.Signer = 'Unsigned' } else { $result.Signer = "Unknown [$($result.Status)]" } } catch { $result.Signer = 'Verification error' $result.Status = 'Error' $result.Valid = $false } return $result } $rawApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -and $_.DisplayName.Trim() -ne '' } | Select-Object @{Name = 'Name'; Expression = { $_.DisplayName } }, @{Name = 'Version'; Expression = { $_.DisplayVersion } }, @{Name = 'Publisher'; Expression = { $_.Publisher } }, @{Name = 'InstallFolder'; Expression = { if ($_.InstallLocation -and $_.InstallLocation.Trim() -ne '') { $_.InstallLocation } elseif ($_.UninstallString -match 'MsiExec\.exe.*?(\{[0-9A-Fa-f\-]{36}\})') { $productCode = $Matches[1] $msiLoc = Get-MsiInstallLocation -ProductCode $productCode if ($msiLoc) { $msiLoc } else { "MSI: $productCode (location not found)" } } elseif ($_.UninstallString) { $_.UninstallString } else { 'N/A' } } } | Sort-Object Name -Unique foreach ($app in $rawApps) { $versionText = if ($app.Version) { $app.Version } else { '?' } $publisherText = if ($app.Publisher) { $app.Publisher } else { '?' } Write-Host "" Write-Host "<=== $($app.Name) [$versionText] ($publisherText) ===>" if ($app.InstallFolder -eq 'N/A' -or $app.InstallFolder -match '^MSI: .* \(location not found\)$') { Write-Host " Path: $($app.InstallFolder)" continue } $cleanPath = Get-CleanPath -RawValue $app.InstallFolder $exists = $false try { $exists = Test-Path -LiteralPath $cleanPath -ErrorAction Stop } catch [System.UnauthorizedAccessException] { Write-Host " Path: $cleanPath" Write-Host " [ACCESS DENIED]" continue } catch { Write-Host " Path: $cleanPath" Write-Host " [ERROR] cannot access" continue } if (-not $exists) { Write-Host " Path: $cleanPath" Write-Host " [NOT FOUND]" continue } $rootItem = Get-Item -LiteralPath $cleanPath -Force $created = $rootItem.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $modified = $rootItem.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') if ($rootItem.PSIsContainer) { $subFolders = Get-ChildItem -LiteralPath $cleanPath -Directory -Force -ErrorAction SilentlyContinue $gciParams = @{ LiteralPath = $cleanPath; File = $true; Force = $true; ErrorAction = 'SilentlyContinue' } if ($Recurse) { $gciParams['Recurse'] = $true } $allFiles = Get-ChildItem @gciParams Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: $($allFiles.Count) | Folders: $($subFolders.Count)" foreach ($dir in $subFolders) { $dCreated = $dir.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $dModified = $dir.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') $dFileCount = (Get-ChildItem -LiteralPath $dir.FullName -File -Force -ErrorAction SilentlyContinue).Count Write-Host (" [DIR] {0} - {1} - {2,10} - {3}" -f $dCreated, $dModified, "$dFileCount files", $dir.FullName) } } else { $allFiles = @($rootItem) Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: 1" } if ($allFiles.Count -eq 0) { continue } $shown = $allFiles | Select-Object -First $MaxFilesPerApp foreach ($f in $shown) { $hash = 'N/A' try { $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction Stop).Hash } catch { $hash = 'HASH-ERROR' } $size = Format-FileSize -Bytes $f.Length $fcreated = $f.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $fmod = $f.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') $sigInfo = Get-SignatureInfo -Path $f.FullName -Extension $f.Extension Write-Host (" [{0}] {1} - {2} - {3,10} - Signer: {4} - {5}" -f $hash, $fcreated, $fmod, $size, $sigInfo.Signer, $f.FullName) } } EndPowerShell: Comment: List 30 recent scheduled tasks Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo Comment: List recent Run (Windows + R) executed commands, useful for identifying ClickFix attacks Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below. C:\ProgramData\*.csproj C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.csproj C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.csproj C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.csproj C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z Comment: RenPyLoader hollowed installed app generic removal C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.props C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.targets C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.tmp C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.csproj C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.user C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cache C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.config C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.bat C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cfg C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.props C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.targets C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.tmp C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.csproj C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.user C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cmd C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cache C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.config C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.bat C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cfg C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cfg Comment: Remove cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\ C:\Users\CurrentUserName\AppData\Local\Roblox\UniversalApp\WebView2\EBWebView\Default\Cache\Cache_Data\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4147\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4430\ C:\Users\CurrentUserName\AppData\Roaming\discord\Cache\Cache_Data\ C:\Users\CurrentUserName\AppData\Roaming\obs-studio\plugin_config\obs-browser\Cache\Cache_Data\ StartPowerShell: $ProfilesDirectory = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').ProfilesDirectory $DisplayNames = @{ "chrome" = "Chrome" "firefox" = "Firefox" "opera" = "Opera" "operagx" = "Opera GX" "brave" = "Brave" "msedge" = "Edge" "vivaldi" = "Vivaldi" "librewolf" = "LibreWolf" "mullvad" = "Mullvad Browser" "zen" = "Zen" } $ProcessNameMap = @{ "operagx" = "opera" "mullvad" = "mullvadbrowser" } $trueCacheNames = @("Cache", "Code Cache", "DawnCache", "GPUCache", "GrShaderCache", "ShaderCache", "Shared Dictionary\cache") function Get-CacheDirs { param([string]$BrowserName, [string]$ProfilesDirectory) switch ($BrowserName) { "chrome" { $dir = "$ProfilesDirectory\*\AppData\Local\Google\Chrome\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "firefox" { $dir = "$ProfilesDirectory\*\AppData\Local\Mozilla\Firefox\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "opera" { $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software" $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software" $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $r1 + $r2 } "operagx" { $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software\Opera GX Stable" $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software\Opera GX Stable" $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $r1 + $r2 } "brave" { $dir = "$ProfilesDirectory\*\AppData\Local\BraveSoftware\Brave-Browser\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "msedge" { $dir = "$ProfilesDirectory\*\AppData\Local\Microsoft\Edge\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "vivaldi" { $dir = "$ProfilesDirectory\*\AppData\Local\Vivaldi\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "librewolf" { $dir = "$ProfilesDirectory\*\AppData\Local\LibreWolf\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "mullvad" { $dir = "$ProfilesDirectory\*\AppData\Local\Mullvad\MullvadBrowser\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "zen" { $dir = "$ProfilesDirectory\*\AppData\Local\zen\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } } } function Format-Size { param([long]$Bytes) if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) } if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) } if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) } return "$Bytes B" } $BrowserKeys = @('chrome', 'firefox', 'opera', 'operagx', 'brave', 'msedge', 'vivaldi', 'librewolf', 'mullvad', 'zen') foreach ($key in $BrowserKeys) { $procName = if ($ProcessNameMap.ContainsKey($key)) { $ProcessNameMap[$key] } else { $key } Get-Process -Name $procName -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } Start-Sleep -Seconds 5 $grandBytes = 0L $grandFiles = 0 $anyFound = $false foreach ($key in $BrowserKeys) { $cacheDirs = Get-CacheDirs -BrowserName $key -ProfilesDirectory $ProfilesDirectory if (-not $cacheDirs -or $cacheDirs.Count -eq 0) { continue } $anyFound = $true $displayName = $DisplayNames[$key] $browserBytes = 0L $browserFiles = 0 foreach ($cacheDir in $cacheDirs) { if (-not (Test-Path $cacheDir)) { continue } $items = Get-ChildItem -Path $cacheDir -Force -Recurse -ErrorAction SilentlyContinue $files = $items | Where-Object { -not $_.PSIsContainer } $bytes = ($files | Measure-Object -Property Length -Sum).Sum if (-not $bytes) { $bytes = 0 } $browserFiles += $files.Count $browserBytes += $bytes Get-ChildItem -Path "$cacheDir\*" -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue } $grandBytes += $browserBytes $grandFiles += $browserFiles Write-Host ("{0,-16} freed {1,10} ({2} files)" -f $displayName, (Format-Size $browserBytes), $browserFiles) } if (-not $anyFound) { Write-Host "No cache found for any installed browser." } Write-Host "" Write-Host ("Total freed: {0} ({1} files)" -f (Format-Size $grandBytes), $grandFiles) EndPowerShell: Comment: Windows Recovery Environment (Windows RE) status and enable CMD: reagentc.exe /info CMD: reagentc.exe /enable Comment: Disable hidden file extensions cmd: reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f cmd: reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt" /v "CheckedValue" /t REG_DWORD /d 0 /f Comment: Verify WMI repository, repair & verify again CMD: winmgmt.exe /verifyrepository CMD: winmgmt.exe /salvagerepository CMD: winmgmt.exe /verifyrepository Comment: To rebuild the performance counter library values CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R" CMD: "%WINDIR%\SysWOW64\lodctr.exe /R" CMD: "C:\Windows\SYSTEM32\lodctr.exe /R" CMD: "C:\Windows\SysWOW64\lodctr.exe /R" Comment: Resync performance counter library values to WMI as well CMD: winmgmt.exe /resyncperf Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy CMD: gpupdate.exe /force Comment: Restores and hardens selected Microsoft Defender Antivirus preferences. Comment: Tamper Protection must be temporarily disabled before applying these settings. Comment: Thanks to AdvancedSetup from Malwarebytes DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender|DisableAntiSpyware DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender|DisableAntiVirus StartPowerShell: # Enable real-time and behavioral protection Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false # Enable potentially unwanted application blocking Set-MpPreference -PUAProtection Enabled # Enable cloud-delivered protection and automatic safe-sample submission Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent SendSafeSamples # Use Microsoft's recommended high cloud-blocking level Set-MpPreference -CloudBlockLevel High # Allow additional time for cloud analysis of suspicious files Set-MpPreference -CloudExtendedTimeout 30 # Block connections to known malicious or untrusted network destinations Set-MpPreference -EnableNetworkProtection Enabled # Enable Block at First Sight Set-MpPreference -DisableBlockAtFirstSeen $false # Enable archive, removable-drive, network-file, download, and script scanning Set-MpPreference -DisableArchiveScanning $false Set-MpPreference -DisableRemovableDriveScanning $false Set-MpPreference -DisableScanningNetworkFiles $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false # Check for current security intelligence before starting a scan Set-MpPreference -CheckForSignaturesBeforeRunningScan $true # Enable supported DNS attack inspection and sinkholing when available if ((Get-Command Set-MpPreference).Parameters.ContainsKey('EnableDnsSinkhole')) { Set-MpPreference -EnableDnsSinkhole $true } # Sets signature update interval to 12 hours (default 24 hours) Set-MpPreference -SignatureUpdateInterval 12 # Update Microsoft Defender security intelligence Update-MpSignature EndPowerShell: Comment: List Windows Defender properties, settings StartPowerShell: function Write-Section { param([string]$Title) Write-Host "" Write-Host "<=== $Title ===>" } Write-Section "Protection Status" Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, RealTimeProtectionEnabled, IsTamperProtected, NetworkProtectionStatus | Format-List Write-Section "Signature / Engine Versions" Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntispywareSignatureVersion | Format-List Write-Section "Preferences / Configuration" Get-MpPreference | Select-Object PUAProtection, MAPSReporting, SubmitSamplesConsent, CheckForSignaturesBeforeRunningScan, CloudBlockLevel, EnableNetworkProtection, DisableScriptScanning, DisableArchiveScanning, DisableRemovableDriveScanning, DisableScanningNetworkFiles, DisableScanningMappedNetworkDrivesForFullScan, DisableBlockAtFirstSeen, DisableHeuristics, DisableAutoExclusions | Format-List Write-Section "Threat Detections" $threats = Get-MpThreatDetection if ($threats) { $threats | Format-Table -AutoSize } else { Write-Host " (no threat detections found)" } EndPowerShell: Comment: Enable recovery environment CMD: bcdedit.exe /set {default} recoveryenabled yes Comment: Restore original Windows services configuration StartPowerShell: Set-Service -Name "Netlogon" -StartupType Manual Set-Service -Name "BITS" -StartupType Manual Set-Service -Name "Dhcp" -StartupType Automatic Set-Service -Name "EventLog" -StartupType Automatic Set-Service -Name "EventSystem" -StartupType Automatic Set-Service -Name "nsi" -StartupType Automatic Set-Service -Name "RasMan" -StartupType Manual Set-Service -Name "SDRSVC" -StartupType Manual Set-Service -Name "SstpSvc" -StartupType Manual Set-Service -Name "TrustedInstaller" -StartupType Manual Set-Service -Name "VSS" -StartupType Manual Set-Service -Name "Winmgmt" -StartupType Automatic Set-Service -Name "wuauserv" -StartupType Manual EndPowerShell: Comment: Reset the Windows Update download cache and update catalog database CMD: net.exe stop bits CMD: net.exe stop wuauserv CMD: net.exe stop cryptsvc CMD: net.exe stop msiserver CMD: rd /s /q "%SystemRoot%\SoftwareDistribution" CMD: rd /s /q "%SystemRoot%\System32\catroot2" CMD: net.exe start msiserver CMD: net.exe start cryptsvc CMD: net.exe start wuauserv CMD: net.exe start bits Comment: Enable automatic restart after a crash, enable automatic updates StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl] "AutoReboot"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] "NoAutoUpdate"=- EndRegedit: Comment: Reset PowerShell execution policy Powershell: Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force Comment: Fully reset the Windows network stack, WinHTTP proxy settings, DNS cache, and BITS transfer queue. Comment: Thanks to AdvancedSetup from Malwarebytes StartBatch: ipconfig.exe /flushdns ipconfig.exe /release netsh.exe winsock reset catalog netsh.exe int ip reset netsh.exe winhttp reset proxy netsh.exe winhttp reset autoproxy netsh.exe winhttp reset tracing EndBatch: Comment: BITS reset Startbatch: @echo off net.exe stop BITS ipconfig.exe /flushdns ren "%programdata%\Microsoft\Network\Downloader\qmgr*.*" qmgr*.*.old net.exe start BITS Endbatch: cmd: bitsadmin.exe /reset /allusers Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* C:\Windows\Prefetch\* Comment: System repair commands CMD: SFC.exe /scannow CMD: DISM.exe /Online /Cleanup-image /Restorehealth Comment: Remove set proxy servers RemoveProxy: Comment: Remove temporary files via FRST EmptyTemp: End::