"Redline Stealer" infection

[Bohauo]

[HEADING=1]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-09-2023
Ran by Bohauo (21-09-2023 22:24:00)
Running from C:\Users\bohau\Desktop
Microsoft Windows 10 Pro Version 22H2 19045.3448 (X64) (2021-03-13 11:18:37)
Boot Mode: Normal[/HEADING]
==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-2806114696-2502326770-847037938-500 - Administrator - Disabled)
Bohauo (S-1-5-21-2806114696-2502326770-847037938-1001 - Administrator - Enabled) => C:\Users\bohau
DefaultAccount (S-1-5-21-2806114696-2502326770-847037938-503 - Limited - Disabled)
Guest (S-1-5-21-2806114696-2502326770-847037938-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-2806114696-2502326770-847037938-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Malwarebytes (Enabled - Up to date) {0D452135-A081-B000-D6B6-132E52638543}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with “Hidden” flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat (64-bit) (HKLM...{AC76BA86-1053-1033-7760-BC15014EA700}) (Version: 23.006.20320 - Adobe)
Adobe Refresh Manager (HKLM-x32...{AC76BA86-0804-1033-1959-018244601052}) (Version: 1.8.0 - Adobe Systems Incorporated) Hidden
Assassin’s Creed III Remastered (HKLM-x32...\Uplay Install 5183) (Version: - Ubisoft)
Assassin’s Creed IV Black Flag (HKLM-x32...\Uplay Install 273) (Version: - Ubisoft)
Assassin’s Creed Odyssey (HKLM-x32...\Uplay Install 5059) (Version: - Ubisoft)
Assassin’s Creed Rogue (HKLM-x32...\Uplay Install 895) (Version: - Ubisoft)
Assassin’s Creed Valhalla (HKLM-x32...\Uplay Install 13504) (Version: - Ubisoft)
Battle.net (HKLM-x32...\Battle.net) (Version: - Blizzard Entertainment)
Carnal Instinct Launcher (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\carnal_instinct_launcher) (Version: 0.1.53 - Carnal Instinct Team)
Command & Conquer™ Remastered Collection (HKLM-x32...{CB92A22C-0421-4513-9EE4-00519B4A12CC}) (Version: 1.153.11.25008 - Electronic Arts Inc. (en_US))
Core Temp 1.18 (HKLM...{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.18 - ALCPU)
CPUID CPU-Z 1.99 (HKLM...\CPUID CPU-Z_is1) (Version: 1.99 - CPUID, Inc.)
CurseForge (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Overwolf_cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj) (Version: 0.234.3.1 - Overwolf app)
Cyberpunk 2077 (HKLM-x32...\1423049311_is1) (Version: 1.63_Hotfix - GOG.com)
Cyberpunk 2077 REDmod (HKLM-x32...\1597316373_is1) (Version: 1.63_Hotfix - GOG.com)
Diablo III (HKLM-x32...\Diablo III) (Version: - Blizzard Entertainment)
Discord (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Discord) (Version: 1.0.9002 - Discord Inc.)
Dragon Age™: Inquisition (HKLM-x32...{DC4C36DC-4E5B-4262-B0C7-157DF534B969}) (Version: 1.0.0.12 - Electronic Arts)
EA app (HKLM...{C2622085-ABD2-49E5-8AB9-D3D6A642C091}) (Version: 13.27.0.5540 - Electronic Arts) Hidden
EA app (HKLM-x32...{3f014b8d-db98-4a9b-84ee-d1cea7453dc9}) (Version: 13.27.0.5540 - Electronic Arts)
eM Client (HKLM-x32...{0A8D083B-E7DD-4CBF-B378-7B2679F062E7}) (Version: 9.2.2093.0 - eM Client Inc.)
Epic Games Launcher (HKLM-x32...{38032CA4-BABE-44FB-813F-E152455B8FED}) (Version: 1.1.291.0 - Epic Games, Inc.)
Epic Online Services (HKLM-x32...{32C68D93-D32F-4B01-8250-61642BFC22F8}) (Version: 2.0.28.0 - Epic Games, Inc.)
FTB App (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Overwolf_cmogmmciplgmocnhikmphehmeecmpaggknkjlbag) (Version: 1.23.829.1248 - Overwolf app)
Futuremark SystemInfo (HKLM-x32...{86F52E62-B358-48D2-801E-AD978E207A52}) (Version: 5.61.1173.0 - Futuremark)
Ghost Recon Breakpoint (HKLM-x32...\Uplay Install 11903) (Version: - Ubisoft)
GOG GALAXY (HKLM-x32...{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version: 2.0.71.2 - GOG.com)
Google Chrome (HKLM-x32...\Google Chrome) (Version: 116.0.5845.188 - Google LLC)
HWiNFO64 Version 6.28 (HKLM...\HWiNFO64_is1) (Version: 6.28 - Martin Malik - REALiX)
HxD Hex Editor 2.5 (HKLM...\HxD_is1) (Version: 2.5 - Maël Hörz)
ImageGlass (HKLM...{56828A2A-E2F5-47FC-898E-837BC31B8267}) (Version: 8.7.11.6 - Duong Dieu Phap)
Intel(R) Chipset Device Software (HKLM...{4F954DAC-F23D-4AF8-A730-65C372BF6661}) (Version: 10.1.18508.8239 - Intel Corporation) Hidden
Intel(R) Chipset Device Software (HKLM-x32...{a884defb-81e9-46b8-a7f2-5d27c231bf51}) (Version: 10.1.18508.8239 - Intel(R) Corporation)
itch (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\itch) (Version: 25.5.1 - itch corp.)
Java 8 Update 381 (64-bit) (HKLM...{77924AE4-039E-4CA4-87B4-2F64180381F0}) (Version: 8.0.3810.9 - Oracle Corporation)
KeyScrambler (HKLM-x32...\KeyScrambler) (Version: 3.18.0.0 - QFX Software Corporation)
Kingdom Come: Deliverance - A Woman’s Lot (HKLM-x32...\1460218995_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance – Band of Bastards (HKLM-x32...\1957357825_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance – From the Ashes (HKLM-x32...\1201995925_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance - HD Sound Pack (HKLM-x32...\1929089326_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance - HD Texture Pack (HKLM-x32...\1597510471_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance - HD Voice Pack - English (HKLM-x32...\2020258726_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance – The Amorous Adventures of Bold Sir Hans Capon (HKLM-x32...\1336069439_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance (HKLM-x32...\1719198803_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
Kingdom Come: Deliverance Treasures of the Past DLC (HKLM-x32...\1300320746_is1) (Version: 1.9.6-404-504czj3 - GOG.com)
K-Lite Mega Codec Pack 17.7.1 (HKLM-x32...\KLiteCodecPack_is1) (Version: 17.7.1 - KLCP)
Launcher Prerequisites (x64) (HKLM-x32...{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
LibreOffice 7.4.0.3 (HKLM...{94421B33-22DF-4227-BEB1-62BA8E5F1CF5}) (Version: 7.4.0.3 - The Document Foundation)
Lidas Adventures EP1 1.2.7 (HKLM-x32...\Lidas Adventures EP1 1.2.7) (Version: 1.2.7 - Terebonkoff Game Studio)
LOOT version 0.16.1 (HKLM-x32...{BF634210-A0D4-443F-A657-0DCE38040374}_is1) (Version: 0.16.1 - LOOT Team)
LOOT version 0.20.0 (64-bit) (HKLM...{BF634210-A0D4-443F-A657-0DCE38040374}_is1) (Version: 0.20.0 - LOOT Team)
Malwarebytes version 4.6.1.280 (HKLM...{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.6.1.280 - Malwarebytes)
Mass Effect™ (HKLM-x32...{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Mass Effect™ Legendary Edition (English US) (HKLM-x32...{068668C4-0B89-4431-A749-1829F845DB87}) (Version: 1.0.0.1621466 - Electronic Arts, Inc. (en_US))
Mass Effect™: Andromeda (HKLM-x32...{72BBCA87-9350-48BC-9E2F-6DBC1E80C993}) (Version: 1.0.0.10 - Electronic Arts)
Microsoft .NET 7.0 Templates 7.0.111 (x64) (HKLM...{D7ED4B4C-EBAC-4ADC-9BBC-EA24BF89A2B4}) (Version: 28.6.49313 - Microsoft Corporation) Hidden
Microsoft .NET AppHost Pack - 7.0.11 (x64) (HKLM...{B4590CD9-297D-4441-B5FC-9712E40BD049}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET AppHost Pack - 7.0.11 (x64_arm) (HKLM...{8B3A80E7-5F65-4C09-9F44-C0FF12BA1991}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET AppHost Pack - 7.0.11 (x64_arm64) (HKLM...{8B2F0265-640E-4B82-B443-9ED055D7E3AA}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET AppHost Pack - 7.0.11 (x64_x86) (HKLM...{9D2F1EC9-6DFA-45FF-A15C-A37374D5E8A5}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET Core 3.1.32 - Windows Server Hosting (HKLM-x32...{a46a9139-dc72-4798-b428-80a5d6e9134b}) (Version: 3.1.32.22566 - Microsoft Corporation)
Microsoft .NET Core Host - 3.1.32 (x64) (HKLM...{8A8E3A04-83BC-4CDE-9259-893B666C1AB1}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft .NET Core Host - 3.1.32 (x86) (HKLM-x32...{3C73457A-1A33-4DE0-B6C2-6FBA877E1FCF}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft .NET Core Host FX Resolver - 3.1.32 (x64) (HKLM...{ABC6B3C2-1A8D-4C5E-AC16-C2AE44F02743}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft .NET Core Host FX Resolver - 3.1.32 (x86) (HKLM-x32...{CE1A992F-4571-423D-9CAE-1184E8F29471}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft .NET Core Runtime - 3.1.32 (x64) (HKLM...{A741B803-3F0E-4684-81EF-FC128D15A92C}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft .NET Core Runtime - 3.1.32 (x64) (HKLM-x32...{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}) (Version: 3.1.32.31915 - Microsoft Corporation)
Microsoft .NET Core Runtime - 3.1.32 (x86) (HKLM-x32...{841FE4B1-2C3F-4304-A686-6DF41B4CC1A1}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft .NET Core Runtime - 3.1.32 (x86) (HKLM-x32...{9d5027e4-b04b-4aa9-92fb-1246f97f9cd7}) (Version: 3.1.32.31915 - Microsoft Corporation)
Microsoft .NET Host - 6.0.22 (x64) (HKLM...{A575E059-0C3F-4138-B87A-BAF55CABA9FA}) (Version: 48.88.905 - Microsoft Corporation) Hidden
Microsoft .NET Host - 7.0.11 (x64) (HKLM...{2F2A55AD-B437-48AD-A8EE-B7900DBB74A2}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.22 (x64) (HKLM...{E7598167-2D5C-4704-8777-8A25289EB8FE}) (Version: 48.88.905 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 7.0.11 (x64) (HKLM...{46EFE56D-D4FA-41C4-B4A8-758472829352}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.22 (x64) (HKLM...{853BA4E9-D41A-4FF6-AB22-A6FFDD77EA78}) (Version: 48.88.905 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 7.0.11 (x64) (HKLM...{D6647DA1-8C22-49DF-B7A4-DAFBC309FF62}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET SDK 7.0.111 (x64) (HKLM-x32...{527b38a9-ecde-43ea-aec8-06935060b142}) (Version: 7.1.1123.42529 - Microsoft Corporation)
Microsoft .NET Standard Targeting Pack - 2.1.0 (x64) (HKLM...{A7036CFB-B403-4598-85FF-D397ABB88173}) (Version: 24.0.28113 - Microsoft Corporation) Hidden
Microsoft .NET Targeting Pack - 7.0.11 (x64) (HKLM...{7C543980-5CE7-435D-A17E-B90E75A7111C}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft .NET Toolset 7.0.111 (x64) (HKLM...{D71CD72A-65DD-460A-B052-3A5B53477B40}) (Version: 28.6.49313 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 3.1.32 - Shared Framework (x64) (HKLM-x32...{65fddc17-d55b-46b7-a750-5c179fef3d81}) (Version: 3.1.32.22566 - Microsoft Corporation)
Microsoft ASP.NET Core 3.1.32 - Shared Framework (x86) (HKLM-x32...{b52191c1-a9c0-4b34-9a4e-930c2dd8a540}) (Version: 3.1.32.22566 - Microsoft Corporation)
Microsoft ASP.NET Core 3.1.32 Hosting Bundle Options (HKLM-x32...{893D6F21-4915-3A5F-BFF4-3288D275DBA1}) (Version: 3.1.32.22566 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 3.1.32 Shared Framework (x64) (HKLM...{2E69E59E-17DF-3977-A405-49096F8B8432}) (Version: 3.1.32.22566 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 3.1.32 Shared Framework (x86) (HKLM-x32...{C2C8E71E-42CF-3CFE-8CFB-F8F96670C190}) (Version: 3.1.32.22566 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 7.0.11 Shared Framework (x64) (HKLM...{CA88828A-2892-3C7C-A537-E06862C1A1AD}) (Version: 7.0.11.23425 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 7.0.11 Targeting Pack (x64) (HKLM...{10F73512-ACEB-3547-B80E-F5DA3D26AEE0}) (Version: 7.0.11.23425 - Microsoft Corporation) Hidden
Microsoft Edge (HKLM-x32...\Microsoft Edge) (Version: 117.0.2045.36 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32...\Microsoft EdgeWebView) (Version: 117.0.2045.31 - Microsoft Corporation)
Microsoft GameInput (HKLM-x32...{1F2B6AF3-C260-8666-5950-E3FEDBC851D6}) (Version: 10.1.22621.3036 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\OneDriveSetup.exe) (Version: 23.180.0828.0001 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32...{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM...{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM...{2953E19B-9F91-4A49-A23B-7E25970A1951}) (Version: 3.73.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM...{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM...{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32...{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32...{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32...{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM...{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32...{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32...{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32...{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32...{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32...{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (HKLM...{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM...{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (HKLM...{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM...{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (HKLM-x32...{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32...{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (HKLM-x32...{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32...{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32...{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32...{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (HKLM...{929FBD26-9020-399B-9A7A-751D61F0B942}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (HKLM...{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (HKLM-x32...{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (HKLM-x32...{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (HKLM-x32...{8bdfe669-9705-4184-9368-db9ce581e0e7}) (Version: 14.36.32532.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (HKLM-x32...{410c0ee1-00bb-41b6-9772-e12c2828b02f}) (Version: 14.36.32532.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (HKLM...{0025DD72-A959-45B5-A0A3-7EFEB15A8050}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (HKLM...{D5D19E2F-7189-42FE-8103-92CD1FA457C2}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (HKLM-x32...{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (HKLM-x32...{73F77E4E-5A17-46E5-A5FC-8A061047725F}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual Studio Code (User) (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1) (Version: 1.45.1 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 3.1.32 (x64) (HKLM...{5BEE5F3E-4D78-4DE8-A8F3-36D3E9D8868C}) (Version: 24.192.31915 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 3.1.32 (x64) (HKLM-x32...{0eddeab6-01c1-4cf7-83ba-164ea8974c90}) (Version: 3.1.32.31915 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 6.0.22 (x64) (HKLM...{6B3108CD-E279-4795-BCBF-BDEA037A7913}) (Version: 48.88.914 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.22 (x64) (HKLM-x32...{0f94f805-22c3-4413-b1e5-5ab275ba92d5}) (Version: 6.0.22.32825 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 7.0.11 (x64) (HKLM...{5821D2E1-1595-4753-AC3E-C87CA97A88BA}) (Version: 56.44.917 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Targeting Pack - 7.0.11 (x64) (HKLM...{18020BBB-E7E7-4693-A125-655E16BE2440}) (Version: 56.44.917 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32...{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Microsoft.NET.Sdk.Android.Manifest-7.0.100 (x64) (HKLM...{FE768F65-89B5-40E5-9CE5-25D002197AE7}) (Version: 33.0.4 - Microsoft Corporation) Hidden
Microsoft.NET.Sdk.iOS.Manifest-7.0.100 (x64) (HKLM...{543E585A-87D5-4F29-A914-7953B2F13EF2}) (Version: 16.0.0 - Microsoft Corporation) Hidden
Microsoft.NET.Sdk.MacCatalyst.Manifest-7.0.100 (x64) (HKLM...{7C190DE4-5808-421D-9C41-89ED1FBE95CC}) (Version: 15.4.0 - Microsoft Corporation) Hidden
Microsoft.NET.Sdk.macOS.Manifest-7.0.100 (x64) (HKLM...{57816DD5-505C-46E5-A8F5-4BC85E3A7D2C}) (Version: 12.3.0 - Microsoft Corporation) Hidden
Microsoft.NET.Sdk.Maui.Manifest-7.0.100 (x64) (HKLM...{8B3894C0-B5D2-4DDF-9732-75A96EE9A834}) (Version: 7.0.49 - Microsoft Corporation) Hidden
Microsoft.NET.Sdk.tvOS.Manifest-7.0.100 (x64) (HKLM...{6DAE2F44-C521-4219-8BE0-D72979F8C18E}) (Version: 16.0.0 - Microsoft Corporation) Hidden
Microsoft.NET.Workload.Emscripten.net6.Manifest (x64) (HKLM...{865931E6-4859-49E4-98AB-15A010B1CF49}) (Version: 56.44.898 - Microsoft Corporation) Hidden
Microsoft.NET.Workload.Emscripten.net7.Manifest (x64) (HKLM...{1E19FDB1-9EA4-4C55-A5AF-1687016C18A8}) (Version: 56.44.898 - Microsoft Corporation) Hidden
Microsoft.NET.Workload.Mono.Toolchain.net6.Manifest (x64) (HKLM...{9DC6E8FE-E22F-404C-B1F4-77BA208FF4BD}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Microsoft.NET.Workload.Mono.Toolchain.net7.Manifest (x64) (HKLM...{39EED48F-6686-44DB-AECB-5ABD6EDFFFE6}) (Version: 56.44.907 - Microsoft Corporation) Hidden
Minecraft Launcher (HKLM-x32...{27B34E47-68AE-4802-822A-9F0C187AF84A}) (Version: 1.0.0.0 - Mojang)
Notepad++ (64-bit x64) (HKLM...\Notepad++) (Version: 8.5.6 - Notepad++ Team)
NOX (HKLM-x32...{BF152F35-9708-452C-862C-F7E3B62DF732}) (Version: 2.0.0.22 - Electronic Arts, Inc.)
NVIDIA FrameView SDK 1.3.8513.32290073 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.3.8513.32290073 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.27.0.112 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.27.0.112 - NVIDIA Corporation)
NVIDIA GeForce NOW 2.0.33.123 (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GeforceNOW) (Version: 2.0.33.123 - NVIDIA Corporation)
NVIDIA Graphics Driver 537.34 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 537.34 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.40.14 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.40.14 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.21.0713 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.21.0713 - NVIDIA Corporation)
NVIDIA USBC Driver 1.50.831.832 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_USBC) (Version: 1.50.831.832 - NVIDIA Corporation)
OnePlus USB Drivers 1.00 (HKLM-x32...\OnePlus USB Drivers 1.00) (Version: 1.00 - OnePlus, Inc)
OpenTTD (HKLM-x32...\1293297882_is1) (Version: 13.4 - GOG.com)
Opera GX Stable 102.0.4880.55 (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Opera GX 102.0.4880.55) (Version: 102.0.4880.55 - Opera Software)
Opera Stable 102.0.4880.56 (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Opera 102.0.4880.56) (Version: 102.0.4880.56 - Opera Software)
Oracle VM VirtualBox 6.1.12 (HKLM...{BD4C2875-9059-4C94-A7B5-493A538AC180}) (Version: 6.1.12 - Oracle Corporation)
Overwolf (HKLM-x32...\Overwolf) (Version: 0.233.1.2 - Overwolf Ltd.)
paint.net (HKLM...{7F556477-50F2-4BCC-AFA7-2A3C09B57149}) (Version: 5.0.7 - dotPDN LLC)
Project Hospital - Department of Infectious Diseases (HKLM-x32...\1617011795_is1) (Version: 1.2.21034 - GOG.com)
Project Hospital - Doctor Mode (HKLM-x32...\2078914180_is1) (Version: 1.2.22856 - GOG.com)
Project Hospital - Hospital Services (HKLM-x32...\1553503979_is1) (Version: 1.2.22856 - GOG.com)
Project Hospital - Traumatology Department (HKLM-x32...\1269519984_is1) (Version: 1.2.22856 - GOG.com)
Project Hospital (HKLM-x32...\1660194629_is1) (Version: 1.2.22856 - GOG.com)
QuickSFV (HKLM...{89B56CFC-0270-4ACF-8BF1-048251FD9E08}) (Version: 3.0.0 - Totally Useful Software, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32...{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.051.0811.2021 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32...{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8186 - Realtek Semiconductor Corp.)
Realtek USB Ethernet Controller All-In-One Windows Driver (HKLM-x32...{04201224-2B34-4EE7-862B-B7BBF89DB3AB}) (Version: 10.53.20.520 - Realtek)
Rescue HQ - The Tycoon (HKLM-x32...\1273513892_is1) (Version: 2.2 - GOG.com)
RPG MAKER VX Ace RTP (HKLM-x32...\RPGVXAce_RTP_is1) (Version: 1.00 - Enterbrain)
Satisfactory Mod Manager 2.9.3 (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\05aa181a-e2c4-5231-ae02-02af49144086) (Version: 2.9.3 - mircearoata)
SimCity™ (HKLM-x32...{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 4.0.98.0213 - Electronic Arts)
SmartControl (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\SmartControl) (Version: 5.0.2.00 - PHL)
Speccy (HKLM...\Speccy) (Version: 1.32 - Piriform)
Spotify (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Spotify) (Version: 1.2.16.947.gcfbaa410 - Spotify AB)
Steam (HKLM-x32...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Surviving Mars - Colony Design Set (HKLM-x32...\1833146547_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Digital Deluxe Edition Upgrade Pack (HKLM-x32...\1507812678_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Green Planet (HKLM-x32...\1968222224_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - In-Dome Buildings Pack (HKLM-x32...\1922265339_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Marsvision Song Contest (HKLM-x32...\1908011586_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Mysteries Resupply Pack (HKLM-x32...\1990927897_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Project Laika (HKLM-x32...\1641787812_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Space Race (HKLM-x32...\1683782840_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars - Stellaris Dome Set (Pre-Order DLC) (HKLM-x32...\1424717003_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
Surviving Mars (HKLM-x32...\2129244347_is1) (Version: 1.5 Fuglesang 1011166 - GOG.com)
TechPowerUp GPU-Z (HKLM-x32...{8B0F211E-5846-4FB2-B0B9-4EB31546FDF9}}_is1) (Version: 2.54.0 - TechPowerUp)
The Witcher 3: Wild Hunt - Game of the Year Edition (HKLM-x32...\1495134320_is1) (Version: 4.04a - GOG.com)
Tom Clancy’s The Division 2 (HKLM-x32...\Uplay Install 4932) (Version: - Ubisoft)
TruckersMP Launcher 1.0.0.4 (HKLM...{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 1.0.0.4 - TruckersMP Team)
TrucksBook Client version 1.4.3 (HKLM-x32...\TrucksBook Client_is1) (Version: 1.4.3 - TrucksBook)
Trucky (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Overwolf_nhooheenabojigjaocnbanebmgdcmokbkbcdidea) (Version: 2.20.3.2 - Overwolf app)
Ubisoft Connect (HKLM-x32...\Uplay) (Version: 131.0.10667 - Ubisoft)
UE4 Prerequisites (x64) (HKLM...{36EAD5CF-44EF-4FCF-8BE1-D96C4835D7A4}) (Version: 1.0.11.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (HKLM-x32...{0d995f46-317b-4b5f-bf3e-9f98bae9d339}) (Version: 1.0.14.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (HKLM-x32...{2890ae6b-90e9-448d-b3e6-97e43c21e2fd}) (Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Unreal Development Kit: 2012-10 (HKLM...\UDK-9013d871-b7da-4c33-a34e-44d7ef9e74e5) (Version: - Epic Games, Inc.)
VLC media player (HKLM...\VLC media player) (Version: 3.0.16 - VideoLAN)
Voicemeeter, The Virtual Mixing Console (HKLM-x32...\VB:Voicemeeter {17359A74-1236-5467}) (Version: - VB-Audio Software)
Vortex (HKLM...\57979c68-f490-55b8-8fed-8b017a5af2fe) (Version: 1.9.3 - Black Tree Gaming Ltd.)
VTLog Plugin (HKLM-x32...{8AA77386-663E-4FAA-9A07-1C1349532B95}) (Version: 1.1.3 - VTLog)
Wargaming.net Game Center (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Wargaming.net Game Center) (Version: 23.3.0.3074 - Wargaming.net)
WeMod (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\WeMod) (Version: 8.11.1 - WeMod)
Winamp (HKLM-x32...\Winamp) (Version: 5.8 - Winamp SA)
World of Tanks EU (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\2249901971) (Version: - Wargaming.net)
World_of_Warships (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\4155503541) (Version: - Wargaming.net)
World_of_Warships_EU (HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\WOWS.EU.PRODUCTION) (Version: - Wargaming.net)
Wrye Bash (HKLM-x32...\Wrye Bash) (Version: 310.0.0.0 - Wrye & Wrye Bash Development Team)
X-Mouse Button Control 2.19.2 (HKLM-x32...\X-Mouse Button Control) (Version: 2.19.2 - Highresolution Enterprises)
Zemana AntiLogger (HKLM-x32...{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.664 - Zemana Ltd.)
[HEADING=1]Packages:[/HEADING]
Cortana → C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_4.2308.1005.0_x64__8wekyb3d8bbwe [2023-08-11] (Microsoft Corporation)
Grounded → C:\Program Files\WindowsApps\Microsoft.Maine_2.2.163.0_x64__8wekyb3d8bbwe [2023-07-13] (Microsoft Studios)
Microsoft Advertising SDK for XAML → C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2021-03-13] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML → C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2021-03-13] (Microsoft Corporation) [MS Ad]
Minecraft Launcher → C:\Program Files\WindowsApps\Microsoft.4297127D64EC6_1.3.7.0_x64__8wekyb3d8bbwe [2023-09-13] (Microsoft Studios)
NVIDIA Control Panel → C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.964.0_x64__56jybvy8sckqj [2023-09-12] (NVIDIA Corp.)
paint.net → C:\Program Files\WindowsApps\dotPDNLLC.paint.net_5.9.8621.0_x64__h55e3w7q8jbva [2023-08-10] (dotPDN LLC)
Photos Media Engine Add-on → C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2022-09-11] (Microsoft Corporation)
Realtek Audio Control → C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.38.277.0_x64__dt26b99r8h8gj [2023-03-28] (Realtek Semiconductor Corp)
Solitaire & Casual Games → C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.17.8180.0_x64__8wekyb3d8bbwe [2023-08-27] (Microsoft Studios) [MS Ad]
Two Point Campus → C:\Program Files\WindowsApps\7904SEGAEuropeLtd.TwoPointCampus_8.3.3285.0_x64__zs7esxpzd8d5c [2023-09-21] (SEGA Europe Ltd)
Valheim → C:\Program Files\WindowsApps\CoffeeStainStudios.Valheim_0.217.14.0_x64__496a1srhmar9w [2023-08-23] (Coffee Stain Publishing)
Windows Package Manager Source (winget) → C:\Program Files\WindowsApps\Microsoft.Winget.Source_2023.921.916.809_neutral__8wekyb3d8bbwe [2023-09-21] (Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [2.0 Zemana AntiMalware] → {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiLogger\ZAMShellExt64.dll [2023-09-18] (Zemana D.O.O. Sarajevo → )
ContextMenuHandlers1: [ANotepad++64] → {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\contextMenu\NppShell.dll [2023-08-15] (Notepad++ → Bjarke I. Pedersen gurli@gurlinet.dk)
ContextMenuHandlers1: [WinRAR] → {B41DB860-64E4-11D2-9906-E49FADC173CA} => E:\Program\WinRAR\rarext.dll [2014-08-27] (win.rar GmbH → Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] → {B41DB860-8EE4-11D2-9906-E49FADC173CA} => E:\Program\WinRAR\rarext32.dll [2014-08-27] (win.rar GmbH → Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] → {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2023-02-28] (Malwarebytes Inc. → Malwarebytes)
ContextMenuHandlers5: [NvCplDesktopContext] → {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_8c8de08a85de4474\nvshext.dll [2023-09-03] (NVIDIA Corporation → NVIDIA Corporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] → {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiLogger\ZAMShellExt64.dll [2023-09-18] (Zemana D.O.O. Sarajevo → )
ContextMenuHandlers6: [MBAMShlExt] → {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2023-02-28] (Malwarebytes Inc. → Malwarebytes)
ContextMenuHandlers6: [WinRAR] → {B41DB860-64E4-11D2-9906-E49FADC173CA} => E:\Program\WinRAR\rarext.dll [2014-08-27] (win.rar GmbH → Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] → {B41DB860-8EE4-11D2-9906-E49FADC173CA} => E:\Program\WinRAR\rarext32.dll [2014-08-27] (win.rar GmbH → Alexander Roshal)

==================== Codecs (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM...\Drivers32: [VIDC.HFYU] => C:\WINDOWS\system32\huffyuv.dll [55296 2005-01-22] () [File not signed]
HKLM...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] () [File not signed]
HKLM...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [310784 2019-12-28] () [File not signed]
HKLM...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM...\Drivers32: [VIDC.HFYU] => C:\Windows\SysWOW64\huffyuv.dll [39936 2004-05-18] (Disappearing Inc.) [File not signed]
HKLM...\Drivers32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] () [File not signed]
HKLM...\Drivers32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284160 2019-12-28] () [File not signed]
HKLM...\Drivers32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM...\Drivers32: [msacm.lameacm] => C:\Windows\SysWOW64\lameACM.acm [473088 2015-02-25] (hxxp://www.mp3dev.org/) [File not signed]
HKLM...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

2022-02-09 22:54 - 2022-02-09 22:54 - 093912576 _____ () [File not signed] C:\Program Files (x86)\eM Client\libcef\libcef.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000017920 _____ () [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\libEGL.DLL
2023-09-19 19:23 - 2023-09-19 19:23 - 003567616 _____ () [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\libGLESv2.dll
2023-03-03 09:54 - 2023-02-28 10:09 - 000051200 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp_frozenlist.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000037888 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp_helpers.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000204800 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp_http_parser.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000034304 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp_http_writer.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000022528 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp_websocket.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000034816 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\multidict_multidict.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000061952 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\psutil_psutil_windows.cp37-win32.pyd
2023-03-03 09:54 - 2023-02-28 10:09 - 000073216 _____ () [File not signed] D:\Program\GOG Galaxy\plugins\GalaxyPluginEpic\yarl_quoting.cp37-win32.pyd
2023-05-21 21:55 - 2023-05-21 21:55 - 002823680 _____ () [File not signed] D:\Program\itch\app-25.6.2\ffmpeg.dll
2023-05-21 21:55 - 2023-05-21 21:58 - 000449024 _____ () [File not signed] D:\Program\itch\app-25.6.2\libegl.dll
2023-05-21 21:55 - 2023-05-21 21:58 - 007620096 _____ () [File not signed] D:\Program\itch\app-25.6.2\libglesv2.dll
2018-01-20 10:34 - 2018-01-20 10:34 - 000373248 _____ (IntelleSoft) [File not signed] C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll
2021-01-23 12:12 - 2023-09-15 14:35 - 000483328 _____ (Microsoft Corporation) [File not signed] C:\WINDOWS\SYSTEM32\gameplatformservices.dll
2022-02-09 22:54 - 2022-02-09 22:54 - 000709120 _____ (The Chromium Authors) [File not signed] C:\Program Files (x86)\eM Client\libcef\chrome_elf.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 002849280 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\libcrypto-1_1-x64.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000685056 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\libssl-1_1-x64.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000046592 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\bearer\qgenericbearer.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000031744 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qgif.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000039936 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qicns.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000031232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qico.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000415232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qjpeg.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000025600 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qsvg.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000025088 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qtga.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000380416 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qtiff.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000023552 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qwbmp.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000532992 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\imageformats\qwebp.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 001455616 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\platforms\qwindows.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000227328 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt\labs\platform\qtlabsplatformplugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 006270976 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Core.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 006947328 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Gui.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 001389568 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Network.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000327168 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Positioning.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000319488 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5PrintSupport.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 003798528 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Qml.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000440832 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QmlModels.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000054784 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QmlWorkerScript.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 004254720 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Quick.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000171520 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QuickControls2.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000222208 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QuickShapes.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 001128960 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QuickTemplates2.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000075264 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QuickWidgets.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000334848 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Svg.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000133120 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5WebChannel.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000396288 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5WebEngine.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 103583232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5WebEngineCore.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000250880 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5WebEngineWidgets.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000157184 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5WebSockets.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 005611520 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Widgets.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000463360 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5WinExtras.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000210432 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Xml.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000056832 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtGraphicalEffects\private\qtgraphicaleffectsprivate.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000059392 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtGraphicalEffects\qtgraphicaleffectsplugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000018432 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick.2\qtquick2plugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000294400 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\qtquickcontrols2plugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000106496 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Layouts\qquicklayoutsplugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000017920 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Shapes\qmlshapesplugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000325120 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Templates.2\qtquicktemplates2plugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000045568 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Window.2\windowplugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000021504 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebChannel\declarative_webchannel.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000093696 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngine\qtwebengineplugin.dll
2023-09-19 19:23 - 2023-09-19 19:23 - 000135680 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\styles\qwindowsvistastyle.dll

==================== Alternate Data Streams (Whitelisted) ========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\Drivers\yvkurxwa.sys:changelist [1394]
AlternateDataStreams: C:\Users\bohau\Desktop\KVRT.exe:MBAM.Zone.Identifier [183]

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The “AlternateShell” will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => “”=“Service”
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ZAM.exe" /service => “”=“Service”
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => “”=“Service”
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ZAM.exe" /service => “”=“Service”
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zam64.sys => “”=“Driver”
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zamguard64.sys => “”=“Driver”

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

BHO: Java™ Plug-In SSV Helper → {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} → C:\Program Files\Java\jre-1.8\bin\ssv.dll [2023-06-14] (Oracle America, Inc. → Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper → {DBC80044-A445-435b-BC74-9C25C1C588A9} → C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll [2023-06-14] (Oracle America, Inc. → Oracle Corporation)

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2019-03-19 06:49 - 2023-09-21 16:52 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\Path → C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0;C:\WINDOWS\System32\OpenSSH;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR;C:\Program Files\dotnet;C:\Android;C:\Windows\System32;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0;C:\WINDOWS\System32\OpenSSH;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common
HKU\S-1-5-21-2806114696-2502326770-847037938-1001\Control Panel\Desktop\Wallpaper → C:\Users\bohau\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\truenorth11080p.jpg
DNS Servers: 192.168.50.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost => (EnableWebContentEvaluation: 1)
Windows Firewall is enabled.
[HEADING=1]Network Binding:[/HEADING]
Ethernet: VirtualBox NDIS6 Bridged Networking Driver → oracle_VBoxNetLwf (enabled)
VirtualBox Host-Only Network: VirtualBox NDIS6 Bridged Networking Driver → oracle_VBoxNetLwf (enabled)

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKLM...\StartupApproved\Run: => “KeePass 2 PreLoad”
HKLM...\StartupApproved\Run: => “Logitech Download Assistant”
HKLM...\StartupApproved\Run32: => “VirtualCloneDrive”
HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\StartupApproved\Run: => “OneDrive”
HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\StartupApproved\Run: => “Trainer Manager”
HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\StartupApproved\Run: => “Tobii GameHub”

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{7A5B8E0C-84CD-4B00-90BD-2050D4E42556}C:\users\bohau\appdata\local.ftba\bin\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe] => (Allow) C:\users\bohau\appdata\local.ftba\bin\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe
FirewallRules: [TCP Query User{27689D50-55BF-494E-A910-9AB25B644A84}C:\users\bohau\appdata\local.ftba\bin\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe] => (Allow) C:\users\bohau\appdata\local.ftba\bin\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe
FirewallRules: [{6696F653-FE23-424D-830D-9CAFF1795C9E}] => (Allow) D:\Steam Spel\steamapps\common\Train Station Renovation\TSR_STEAM.exe () [File not signed]
FirewallRules: [{CB15EF03-2752-464B-8B80-6873552AFDD8}] => (Allow) D:\Steam Spel\steamapps\common\Train Station Renovation\TSR_STEAM.exe () [File not signed]
FirewallRules: [{E50B87B5-A12E-44A1-8A80-5CACCA5CD48A}] => (Allow) F:\Steam Spel\steamapps\common\PlagueInc\PlagueIncEvolved.exe () [File not signed]
FirewallRules: [{896321C1-900F-41C8-B366-26DE6F0F93C9}] => (Allow) F:\Steam Spel\steamapps\common\PlagueInc\PlagueIncEvolved.exe () [File not signed]
FirewallRules: [UDP Query User{07250FBA-CFD4-4694-9C92-E05C4D1B963F}D:\spel\minecraft launcher\runtime\jre-x64\bin\javaw.exe] => (Allow) D:\spel\minecraft launcher\runtime\jre-x64\bin\javaw.exe
FirewallRules: [TCP Query User{E65DD0C2-02B9-4BB2-AFF3-0E9D8963FC22}D:\spel\minecraft launcher\runtime\jre-x64\bin\javaw.exe] => (Allow) D:\spel\minecraft launcher\runtime\jre-x64\bin\javaw.exe
FirewallRules: [UDP Query User{7A4A3C1F-9149-42B4-9934-D3B50362A68A}D:\gog spel\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\gog spel\cyberpunk 2077\bin\x64\cyberpunk2077.exe (CD PROJEKT SPÓŁKA AKCYJNA → CD PROJEKT S.A.)
FirewallRules: [TCP Query User{D4C4DC5D-7D7C-404C-8289-82F20000B273}D:\gog spel\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\gog spel\cyberpunk 2077\bin\x64\cyberpunk2077.exe (CD PROJEKT SPÓŁKA AKCYJNA → CD PROJEKT S.A.)
FirewallRules: [{AAFFB856-79CC-4481-844E-871C0886A6AE}] => (Allow) D:\Steam Spel\steamapps\common\MrPrepper\MrPrepper.exe () [File not signed]
FirewallRules: [{DAB13C1A-CF4B-4C75-88B5-43533CCC2AAA}] => (Allow) D:\Steam Spel\steamapps\common\MrPrepper\MrPrepper.exe () [File not signed]
FirewallRules: [UDP Query User{78F0862B-E766-462C-AD58-08FF3FC1D475}D:\steam spel\steamapps\common\beyond a steel sky\bass2\binaries\win64\bass2-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\beyond a steel sky\bass2\binaries\win64\bass2-win64-shipping.exe (Revolution Software Ltd.) [File not signed]
FirewallRules: [TCP Query User{E946D7DA-C2A3-46B0-9C22-3E9C698FA237}D:\steam spel\steamapps\common\beyond a steel sky\bass2\binaries\win64\bass2-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\beyond a steel sky\bass2\binaries\win64\bass2-win64-shipping.exe (Revolution Software Ltd.) [File not signed]
FirewallRules: [{AE97EE09-19A4-4002-ADF7-55BF7B5D9657}] => (Allow) D:\Steam Spel\steamapps\common\Beyond a Steel Sky\BASS2.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{C37CD899-26B7-4A08-A0C6-732DE38C590B}] => (Allow) D:\Steam Spel\steamapps\common\Beyond a Steel Sky\BASS2.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{5F8E9319-BF78-4EF5-83D2-6B1EEAE3DB30}] => (Allow) D:\Spel\Assassin’s Creed Valhalla\ACValhalla_Plus.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{F6C976C1-B59D-4551-941C-CDF11903F4AD}] => (Allow) F:\Steam Spel\steamapps\common\PapersPlease\PapersPlease.exe () [File not signed]
FirewallRules: [{5313FA80-80D8-4B7B-8DC1-FB1A96036590}] => (Allow) F:\Steam Spel\steamapps\common\PapersPlease\PapersPlease.exe () [File not signed]
FirewallRules: [UDP Query User{CA0920CD-2194-4C44-92DA-DA8767CF075E}D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe] => (Allow) D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe (Focus Entertainment SA → Focus Home Interactive)
FirewallRules: [TCP Query User{6669D1F5-EC5C-4F18-9058-AA7C8027F870}D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe] => (Allow) D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe (Focus Entertainment SA → Focus Home Interactive)
FirewallRules: [UDP Query User{69EE4891-5984-4702-8C1E-B03599070377}D:\spel\diablo iii\x64\diablo iii64.exe] => (Allow) D:\spel\diablo iii\x64\diablo iii64.exe (Blizzard Entertainment, Inc. → Blizzard Entertainment)
FirewallRules: [TCP Query User{7486445A-EF97-4AD0-9EF8-53B6B39DE612}D:\spel\diablo iii\x64\diablo iii64.exe] => (Allow) D:\spel\diablo iii\x64\diablo iii64.exe (Blizzard Entertainment, Inc. → Blizzard Entertainment)
FirewallRules: [{5F56D7B6-3C4E-4476-8AE2-2549FA1C09C2}] => (Allow) D:\Steam Spel\steamapps\common\Big Pharma\Big Pharma.exe () [File not signed]
FirewallRules: [{8538B12C-27C7-4E9E-B2B6-9B68A7A135D4}] => (Allow) D:\Steam Spel\steamapps\common\Big Pharma\Big Pharma.exe () [File not signed]
FirewallRules: [{60ED1A41-3137-44B4-920F-37C95DFFCFCE}] => (Allow) D:\Steam Spel\steamapps\common\Medieval Dynasty\Medieval_Dynasty.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{79DCD3B9-6F09-439F-93B4-19B165D2DAB5}] => (Allow) D:\Steam Spel\steamapps\common\Medieval Dynasty\Medieval_Dynasty.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{D8256588-5F07-4F49-89F9-034604CF6358}] => (Allow) D:\Steam Spel\steamapps\common\Tom Clancy’s The Division\thedivision.exe (Ubisoft Entertainment Sweden AB → Ubisoft)
FirewallRules: [{067E638A-A844-449D-8C8D-AAA2179DC08A}] => (Allow) D:\Steam Spel\steamapps\common\Tom Clancy’s The Division\thedivision.exe (Ubisoft Entertainment Sweden AB → Ubisoft)
FirewallRules: [{99F4374C-941E-416E-8BF5-7BA205F42FB3}] => (Allow) D:\Spel\Assassin’s Creed Odyssey\ACOdyssey_plus.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{0250A2C0-8357-432F-B3D0-BFA39F29FB74}] => (Allow) D:\Spel\Assassin’s Creed Odyssey\ACOdyssey_plus.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{E3278BB8-039E-4E3E-A74E-B6389E369A67}] => (Allow) F:\Steam Spel\steamapps\common\Mad Tower Tycoon\MadTowerTycoon.exe () [File not signed]
FirewallRules: [{4D6B5EE4-4582-4740-8C4E-AFBE503093B9}] => (Allow) F:\Steam Spel\steamapps\common\Mad Tower Tycoon\MadTowerTycoon.exe () [File not signed]
FirewallRules: [UDP Query User{BF757B99-1A20-40AF-BB2E-AED422476378}D:\steam spel\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [TCP Query User{2EF66358-414D-4C36-9721-E11239021A00}D:\steam spel\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{C509F393-181F-47F8-AE93-2260158D0AF6}] => (Allow) D:\Steam Spel\steamapps\common\Golf It!\GolfIt.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{F23065F3-1001-4FD8-A4DC-AB584193044A}] => (Allow) D:\Steam Spel\steamapps\common\Golf It!\GolfIt.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [UDP Query User{2997EA25-91F4-4DFC-A4CC-30C3D344968A}F:\spel\world of tanks\win64\worldoftanks.exe] => (Block) F:\spel\world of tanks\win64\worldoftanks.exe (Wargaming.net Limited → Wargaming.net)
FirewallRules: [TCP Query User{179E328D-79E6-4A3D-B61A-0218404B5A5A}F:\spel\world of tanks\win64\worldoftanks.exe] => (Block) F:\spel\world of tanks\win64\worldoftanks.exe (Wargaming.net Limited → Wargaming.net)
FirewallRules: [UDP Query User{80B0DF2E-B5E5-4684-A820-10F81F28014B}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe (Wargaming Group Limited → Wargaming.net)
FirewallRules: [TCP Query User{DC12F219-9950-43C2-825B-3030A97B9EFB}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe (Wargaming Group Limited → Wargaming.net)
FirewallRules: [{5D20D02A-11B4-4FD1-95A4-BD568511B76A}] => (Allow) D:\Steam Spel\steamapps\common\CookingSimulator\CookingSim.exe () [File not signed]
FirewallRules: [{C38F5D63-9604-42DF-81EA-8D47F3C3F6E4}] => (Allow) D:\Steam Spel\steamapps\common\CookingSimulator\CookingSim.exe () [File not signed]
FirewallRules: [UDP Query User{D73A9B1C-FCD2-4E73-A170-0BCC81A60DF0}D:\gog spel\kingdom come deliverance\bin\win64\kingdomcome.exe] => (Allow) D:\gog spel\kingdom come deliverance\bin\win64\kingdomcome.exe (Warhorse Studios sro) [File not signed]
FirewallRules: [TCP Query User{A191C1CB-76F1-426C-A5B1-2ADCCFEA5156}D:\gog spel\kingdom come deliverance\bin\win64\kingdomcome.exe] => (Allow) D:\gog spel\kingdom come deliverance\bin\win64\kingdomcome.exe (Warhorse Studios sro) [File not signed]
FirewallRules: [{D56C1F4B-1AFA-4945-BE80-1DDB0FED8EF2}] => (Allow) D:\Steam Spel\steamapps\common\Lumberjacks Dynasty\LumberjacksDynasty.exe () [File not signed]
FirewallRules: [{10BB459F-386A-4F0A-BDB8-BC5158262022}] => (Allow) D:\Steam Spel\steamapps\common\Lumberjacks Dynasty\LumberjacksDynasty.exe () [File not signed]
FirewallRules: [{B7C69C5D-B0FB-4DE6-8443-4E2800CFE88A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl → Skype Technologies S.A.)
FirewallRules: [{0872FC2E-A447-4C24-B087-65196B54EF27}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl → Skype Technologies S.A.)
FirewallRules: [{E99E8246-400C-4F8E-ADDD-C150681E9810}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl → Skype Technologies S.A.)
FirewallRules: [{F903922D-C795-4AC3-BDCA-9E6517AB92FB}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl → Skype Technologies S.A.)
FirewallRules: [{ED6A8969-A164-4CAF-8BAF-CF974008FAD9}] => (Allow) D:\Steam Spel\steamapps\common\Tech Executive Tycoon\Tech Executive Tycoon.exe () [File not signed]
FirewallRules: [{19EB183E-55C0-4FCF-AEAB-AF93BE475119}] => (Allow) D:\Steam Spel\steamapps\common\Tech Executive Tycoon\Tech Executive Tycoon.exe () [File not signed]
FirewallRules: [{13989CBF-0321-45B0-BB9C-539FE6EED24F}] => (Allow) D:\Steam Spel\steamapps\common\Raft\Raft.exe () [File not signed]
FirewallRules: [{716663FA-A505-4EF5-B309-E7FE3397A845}] => (Allow) D:\Steam Spel\steamapps\common\Raft\Raft.exe () [File not signed]
FirewallRules: [{6C611F26-2F99-4FEF-A3DD-2738129308A6}] => (Allow) D:\Steam Spel\steamapps\common\Uplink\Uplink.exe (Introversion Software) [File not signed]
FirewallRules: [{9B520128-D46F-4DC9-9A67-E887F23E0FD3}] => (Allow) D:\Steam Spel\steamapps\common\Uplink\Uplink.exe (Introversion Software) [File not signed]
FirewallRules: [{C10A22B4-B56D-4AEE-ABAA-46464F2DC8D5}] => (Allow) D:\Steam Spel\steamapps\common\SubnauticaZero\SubnauticaZero.exe () [File not signed]
FirewallRules: [{BBC0552F-5527-4959-A96B-8ABB6F679E89}] => (Allow) D:\Steam Spel\steamapps\common\SubnauticaZero\SubnauticaZero.exe () [File not signed]
FirewallRules: [{8B0E720E-93D6-4086-AF6E-9C1B7206FAA6}] => (Allow) D:\Steam Spel\steamapps\common\Subnautica\Subnautica.exe () [File not signed]
FirewallRules: [{A7C4C498-5C7B-462B-A326-AC861E2FFAAE}] => (Allow) D:\Steam Spel\steamapps\common\Subnautica\Subnautica.exe () [File not signed]
FirewallRules: [{7923E3A1-ABC2-47D5-BAF4-0473B0DE0126}] => (Allow) D:\Spel\Tom Clancy’s The Division 2\TheDivision2.exe (Ubisoft Entertainment Sweden AB → Ubisoft)
FirewallRules: [{85BAEE30-AE58-445E-8453-8EEB3E3E4468}] => (Allow) D:\Steam Spel\steamapps\common\No Man’s Sky\Binaries\NMS.exe (Hello Games) [File not signed]
FirewallRules: [{643CB8AF-0D0B-4F54-A011-8BAAD346E5EB}] => (Allow) D:\Steam Spel\steamapps\common\No Man’s Sky\Binaries\NMS.exe (Hello Games) [File not signed]
FirewallRules: [{462FB6C0-BD4D-400E-BE8A-A957745F7A6D}] => (Allow) D:\Steam Spel\steamapps\common\Mafia II Definitive Edition\pc\Mafia2Launcher\Launcher.exe (2K Games) [File not signed]
FirewallRules: [{8CF7E96C-4088-434C-B64E-985153792CC1}] => (Allow) D:\Steam Spel\steamapps\common\Mafia II Definitive Edition\pc\Mafia2Launcher\Launcher.exe (2K Games) [File not signed]
FirewallRules: [{25F6D782-A40E-4E05-B502-33EAC21E9ADF}] => (Allow) F:\Steam Spel\steamapps\common\Cities_Skylines\dowser.exe (Paradox Interactive AB (publ) → )
FirewallRules: [{AAFCA23A-FB3F-4103-A825-069FB11625CE}] => (Allow) F:\Steam Spel\steamapps\common\Cities_Skylines\dowser.exe (Paradox Interactive AB (publ) → )
FirewallRules: [{C53F6BF2-764F-4ABB-9549-0401E69C156F}] => (Allow) F:\Steam Spel\steamapps\common\PC Building Simulator\PCBS.exe () [File not signed]
FirewallRules: [{306A7582-E4F7-4AC8-927D-4ABA4B31244C}] => (Allow) F:\Steam Spel\steamapps\common\PC Building Simulator\PCBS.exe () [File not signed]
FirewallRules: [UDP Query User{5E522C5C-9BDD-43C2-9EE1-022D6EEC15FE}C:\users\bohau\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\bohau\appdata\roaming\spotify\spotify.exe (Spotify AB → Spotify Ltd)
FirewallRules: [TCP Query User{5E72177B-4C69-4D2D-8534-A706AE63289D}C:\users\bohau\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\bohau\appdata\roaming\spotify\spotify.exe (Spotify AB → Spotify Ltd)
FirewallRules: [{37A90D5F-1EA1-46EC-9F8A-FFC6F392FEA2}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. → Valve Corporation)
FirewallRules: [{1D8ED48F-7977-4E08-8088-D76E8C98F565}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. → Valve Corporation)
FirewallRules: [{56B69F31-6E66-454A-8B1B-8411D43782E2}] => (Allow) D:\Steam Spel\steamapps\common\House Flipper\HouseFlipper.exe (Frozen District Sp. z o.o. → )
FirewallRules: [{50A313DD-3AFD-4144-BAA3-0B89092F1BBF}] => (Allow) D:\Steam Spel\steamapps\common\House Flipper\HouseFlipper.exe (Frozen District Sp. z o.o. → )
FirewallRules: [{27E4836C-079A-431A-BA5F-47A848973374}] => (Allow) D:\Steam Spel\steamapps\common\theHunterCotW\theHunterCotW_F.exe () [File not signed]
FirewallRules: [{7D11DA37-258B-4ACF-BEF3-73F5C69DCA49}] => (Allow) D:\Steam Spel\steamapps\common\theHunterCotW\theHunterCotW_F.exe () [File not signed]
FirewallRules: [{2B978A81-C33F-4280-911F-83D892173F4A}] => (Allow) F:\Steam Spel\steamapps\common\Prison Architect\Launcher\dowser.exe (Paradox Interactive AB (publ) → )
FirewallRules: [{D6475ECE-403D-4DEF-9D6C-B3E8C384D8D4}] => (Allow) F:\Steam Spel\steamapps\common\Prison Architect\Launcher\dowser.exe (Paradox Interactive AB (publ) → )
FirewallRules: [UDP Query User{7F70A4FA-71AC-4EE9-ABCD-80A226C07696}D:\steam spel\steamapps\common\war thunder\launcher.exe] => (Allow) D:\steam spel\steamapps\common\war thunder\launcher.exe (Gaijin Network Ltd → Gaijin)
FirewallRules: [TCP Query User{90B0C1B0-E956-40FD-92AA-76AB7F21B2CF}D:\steam spel\steamapps\common\war thunder\launcher.exe] => (Allow) D:\steam spel\steamapps\common\war thunder\launcher.exe (Gaijin Network Ltd → Gaijin)
FirewallRules: [UDP Query User{658EE6B3-2AEE-46BB-A0CD-6102A9446605}D:\steam spel\steamapps\common\war thunder\win64\aces.exe] => (Allow) D:\steam spel\steamapps\common\war thunder\win64\aces.exe (Gaijin Network Ltd → Gaijin Entertainment)
FirewallRules: [TCP Query User{59C7D54D-2E4E-42BA-9338-B1CF2B8D5866}D:\steam spel\steamapps\common\war thunder\win64\aces.exe] => (Allow) D:\steam spel\steamapps\common\war thunder\win64\aces.exe (Gaijin Network Ltd → Gaijin Entertainment)
FirewallRules: [UDP Query User{55B56B06-E985-492F-BE8E-405319DCF917}D:\steam spel\steamapps\common\war thunder\launcher.exe] => (Allow) D:\steam spel\steamapps\common\war thunder\launcher.exe (Gaijin Network Ltd → Gaijin)
FirewallRules: [TCP Query User{23A63EAE-9974-4D38-85AB-23F1096C8D73}D:\steam spel\steamapps\common\war thunder\launcher.exe] => (Allow) D:\steam spel\steamapps\common\war thunder\launcher.exe (Gaijin Network Ltd → Gaijin)
FirewallRules: [{CDE0F0F5-CC4D-4ECA-A75F-5A6B8923DF65}] => (Allow) D:\Steam Spel\steamapps\common\TankMechanicSimulator\TankMechanicSimulator.exe () [File not signed]
FirewallRules: [{614B90A8-9EFE-4024-B41F-883FDB03F853}] => (Allow) D:\Steam Spel\steamapps\common\TankMechanicSimulator\TankMechanicSimulator.exe () [File not signed]
FirewallRules: [{ABD68EFA-EFA2-4B13-9228-62FEF328B216}] => (Allow) F:\Steam Spel\steamapps\common\3DMark\bin\x64\3DMark.exe (Underwriters Laboratories Inc. → )
FirewallRules: [{AC66ED89-B0FE-4BA2-9CD8-0C5BA472A83A}] => (Allow) F:\Steam Spel\steamapps\common\3DMark\bin\x64\3DMark.exe (Underwriters Laboratories Inc. → )
FirewallRules: [{F901373B-848F-49EF-9C84-C06E253354B6}] => (Allow) D:\Steam Spel\steamapps\common\TheLongDark\tld.exe () [File not signed]
FirewallRules: [{90A15799-6557-461A-9453-81D1C8E59455}] => (Allow) D:\Steam Spel\steamapps\common\TheLongDark\tld.exe () [File not signed]
FirewallRules: [{16129D6D-A291-4991-8236-5B6BB83247A5}] => (Allow) D:\Steam Spel\steamapps\common\Airport CEO\Airport CEO.exe () [File not signed]
FirewallRules: [{2DC4A56B-FCA0-485B-9C5F-DC06CE575B5E}] => (Allow) D:\Steam Spel\steamapps\common\Airport CEO\Airport CEO.exe () [File not signed]
FirewallRules: [{5C2D557D-3C6B-4503-8FC1-573A9F9ADEC3}] => (Allow) F:\Steam Spel\steamapps\common\TPH\TPH.exe () [File not signed]
FirewallRules: [{065D1C06-5936-420F-A488-CCCFD64F5EA6}] => (Allow) F:\Steam Spel\steamapps\common\TPH\TPH.exe () [File not signed]
FirewallRules: [{D9BBB37B-46A8-47E1-9923-49E307E8C8C0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. → Valve Corporation)
FirewallRules: [{C27DF9EE-B6AB-4442-9926-CE3CF9B458F4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. → Valve Corporation)
FirewallRules: [{60712436-E72F-4EA5-A6D0-2BB0F26B52A3}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{8D1F798D-C4E0-4031-9282-79922BDD64FF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{8AE651D7-2480-4BB3-BE18-EE1DB7B69FE6}] => (Allow) D:\Steam Spel\steamapps\common\Hunt and Snare\ruffleneck.exe () [File not signed]
FirewallRules: [{946DD558-0E85-46D1-8182-8B8E3CC4A563}] => (Allow) D:\Steam Spel\steamapps\common\Hunt and Snare\ruffleneck.exe () [File not signed]
FirewallRules: [{EA38F2FC-9F77-4AA8-AC6E-4188E146B2DB}] => (Allow) D:\Steam Spel\steamapps\common\TheOuterWorlds\TheOuterWorlds.exe (Private Division) [File not signed]
FirewallRules: [{2660C229-B017-40D5-A8CD-6309D9B83535}] => (Allow) D:\Steam Spel\steamapps\common\TheOuterWorlds\TheOuterWorlds.exe (Private Division) [File not signed]
FirewallRules: [TCP Query User{A823F1D6-EDEA-4374-B009-5ED5F7239B2C}D:\steam spel\steamapps\common\theouterworlds\indiana\binaries\win64\indiana-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\theouterworlds\indiana\binaries\win64\indiana-win64-shipping.exe (Private Division) [File not signed]
FirewallRules: [UDP Query User{4A07603C-22DD-4396-80BB-15A8785BBAC3}D:\steam spel\steamapps\common\theouterworlds\indiana\binaries\win64\indiana-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\theouterworlds\indiana\binaries\win64\indiana-win64-shipping.exe (Private Division) [File not signed]
FirewallRules: [{F53F73ED-9E8E-431B-8100-93148715BC19}] => (Allow) D:\Steam Spel\steamapps\common\Evil Genius 2\Launcher\eg2.exe (Rebellion) [File not signed]
FirewallRules: [{9FA7FC3F-87D6-4881-85E0-995C35427796}] => (Allow) D:\Steam Spel\steamapps\common\Evil Genius 2\Launcher\eg2.exe (Rebellion) [File not signed]
FirewallRules: [{41D676B0-E89F-4199-8F1F-DA74ABB856B2}] => (Allow) D:\Steam Spel\steamapps\common\Satisfactory\FactoryGame.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{03CAC883-0A8F-47E4-AF2C-4A8EB7E9644A}] => (Allow) D:\Steam Spel\steamapps\common\Satisfactory\FactoryGame.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{322E8677-8FFB-4849-AA5E-10ED0A35D504}] => (Allow) D:\Steam Spel\steamapps\common\RISK Global Domination\RISK.exe () [File not signed]
FirewallRules: [{59E6E478-C479-40BC-9AD4-BC6ADD37509F}] => (Allow) D:\Steam Spel\steamapps\common\RISK Global Domination\RISK.exe () [File not signed]
FirewallRules: [{391BC99A-F78E-4E74-921B-86015D330F09}] => (Allow) D:\Steam Spel\steamapps\common\War Thunder\eac_wt_mlauncher.exe (Gaijin Network Ltd → Gaijin Entertainment)
FirewallRules: [{5F1A106B-0F8C-46DD-8E7D-B1449E4F7DDE}] => (Allow) D:\Steam Spel\steamapps\common\War Thunder\eac_wt_mlauncher.exe (Gaijin Network Ltd → Gaijin Entertainment)
FirewallRules: [{E7E70C1C-16CE-422A-B1DC-000725ABDADC}] => (Allow) D:\Steam Spel\steamapps\common\Friendship with Benefits\FriendshipwithBenefits.exe () [File not signed]
FirewallRules: [{44F7F898-665A-4CCE-BB54-676C2EA5E6AC}] => (Allow) D:\Steam Spel\steamapps\common\Friendship with Benefits\FriendshipwithBenefits.exe () [File not signed]
FirewallRules: [{F0CE5724-C7AC-4B00-A882-D1FA06946C9A}] => (Allow) D:\Steam Spel\steamapps\common\Spacebase Startopia\sbs.exe () [File not signed]
FirewallRules: [{32439B12-9987-4D01-92D2-0D41C0B449F1}] => (Allow) D:\Steam Spel\steamapps\common\Spacebase Startopia\sbs.exe () [File not signed]
FirewallRules: [{49D409D4-D5FF-4D7D-A557-DED3CB170E96}] => (Allow) F:\Steam Spel\steamapps\common\Fallout 4\Fallout4Launcher.exe (Bethesda Softworks) [File not signed]
FirewallRules: [{E7B82512-9BD4-4166-9FF6-2B75EB41B24C}] => (Allow) F:\Steam Spel\steamapps\common\Fallout 4\Fallout4Launcher.exe (Bethesda Softworks) [File not signed]
FirewallRules: [{8C8814A5-6EEA-43D5-B1B3-8FCF96DAA214}] => (Allow) D:\Steam Spel\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe (BattlEye Innovations e.K. → BattlEye Innovations)
FirewallRules: [{F3ED3D0D-84CF-458C-B57B-2D7B75472C13}] => (Allow) D:\Steam Spel\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe (BattlEye Innovations e.K. → BattlEye Innovations)
FirewallRules: [{D6E55850-D7A0-4AA2-B323-5B49A1D95ECA}] => (Allow) D:\Steam Spel\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe (Wildcard Properties LLC → Epic Games, Inc.)
FirewallRules: [{ACD2F3EA-3C7A-4F6B-8C4C-6EEC7A412761}] => (Allow) D:\Steam Spel\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe (Wildcard Properties LLC → Epic Games, Inc.)
FirewallRules: [{0658A976-9AB0-4DAA-9C13-9CF43E9EF107}] => (Allow) F:\Steam Spel\steamapps\common\NITE Team 4\nt4.exe () [File not signed]
FirewallRules: [{513A4546-1CB4-46FD-901D-922782156B6A}] => (Allow) F:\Steam Spel\steamapps\common\NITE Team 4\nt4.exe () [File not signed]
FirewallRules: [{EA90A17D-4FF7-4E70-B23A-488CE16D530B}] => (Allow) D:\Steam Spel\steamapps\common\Insexsity\Insexsity.exe () [File not signed]
FirewallRules: [{6F9C0970-6396-4C4E-91F3-30A38E9837D6}] => (Allow) D:\Steam Spel\steamapps\common\Insexsity\Insexsity.exe () [File not signed]
FirewallRules: [{0FCC990C-D607-4C7F-92AC-BA480D324160}] => (Allow) D:\Steam Spel\steamapps\common\MGI Prologue\MGI Prologue\MGI.exe () [File not signed]
FirewallRules: [{4C40A911-2050-402B-AF37-DD6BF9FBF52B}] => (Allow) D:\Steam Spel\steamapps\common\MGI Prologue\MGI Prologue\MGI.exe () [File not signed]
FirewallRules: [{771CCCA4-1209-436D-B86A-13699041BFFD}] => (Allow) D:\Steam Spel\steamapps\common\Black Mesa\bms.exe () [File not signed]
FirewallRules: [{05F0CC12-D289-4367-8FC2-CAF329A99B94}] => (Allow) D:\Steam Spel\steamapps\common\Black Mesa\bms.exe () [File not signed]
FirewallRules: [{4722F0A1-5954-4832-9849-92DFD54C69DA}] => (Allow) D:\Steam Spel\steamapps\common\Deliver Us The Moon\MoonMan.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{33DC4621-A6EF-4F97-B641-E8C1A2A6F827}] => (Allow) D:\Steam Spel\steamapps\common\Deliver Us The Moon\MoonMan.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{03104CF1-6EF9-4250-9896-CDDCDC699DD1}] => (Allow) D:\Steam Spel\steamapps\common\Hentai Femdom Sim Femdom University\FemU.exe () [File not signed]
FirewallRules: [{855017CC-0D2F-4BED-9D6C-1A9F411C4430}] => (Allow) D:\Steam Spel\steamapps\common\Hentai Femdom Sim Femdom University\FemU.exe () [File not signed]
FirewallRules: [{20E3FCFF-AD89-49B7-AFF5-7213508694BB}] => (Allow) D:\Steam Spel\steamapps\common\Car Mechanic Simulator 2021\Car Mechanic Simulator 2021.exe (Unity Technologies ApS) [File not signed]
FirewallRules: [{CA6CFB87-7C2C-429C-AE53-8FDEEC05F299}] => (Allow) D:\Steam Spel\steamapps\common\Car Mechanic Simulator 2021\Car Mechanic Simulator 2021.exe (Unity Technologies ApS) [File not signed]
FirewallRules: [{69FBB28F-0A71-408F-961D-00DD390CB753}] => (Allow) D:\Steam Spel\steamapps\common\Lilly Knight\Lilly Knight.exe () [File not signed]
FirewallRules: [{02E5CFE9-02F3-4EED-A28F-9CD1FAFBBCD7}] => (Allow) D:\Steam Spel\steamapps\common\Lilly Knight\Lilly Knight.exe () [File not signed]
FirewallRules: [{A9C99C8F-8A1F-4642-9254-402D0A6494E8}] => (Allow) D:\Steam Spel\steamapps\common\WanderLust\WanderLust.exe () [File not signed]
FirewallRules: [{F891B468-3F8F-4AED-B423-611D4BFBD653}] => (Allow) D:\Steam Spel\steamapps\common\WanderLust\WanderLust.exe () [File not signed]
FirewallRules: [{73CA5D74-B451-435A-B6AF-2F6F4490362A}] => (Allow) D:\Steam Spel\steamapps\common\Ranch Simulator\Ranch_Simulator.exe (Epic Games Inc. → Epic Games, Inc.)
FirewallRules: [{EC765D42-7744-4699-96AC-8640EDC36336}] => (Allow) D:\Steam Spel\steamapps\common\Ranch Simulator\Ranch_Simulator.exe (Epic Games Inc. → Epic Games, Inc.)
FirewallRules: [{57085B07-BEDF-44B3-822A-E1EAE2278490}] => (Allow) D:\Steam Spel\steamapps\common\Hydroneer\Mining.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{1F346873-FF62-40B3-9F4B-AD92CDCBDE40}] => (Allow) D:\Steam Spel\steamapps\common\Hydroneer\Mining.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [TCP Query User{CF9626B2-D661-4BEC-A33B-C820F0695C97}D:\steam spel\steamapps\common\hydroneer\mining\binaries\win64\mining-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\hydroneer\mining\binaries\win64\mining-win64-shipping.exe (Foulball Hangover) [File not signed]
FirewallRules: [UDP Query User{FA8E4679-2B13-4817-9DA7-21F554287D6F}D:\steam spel\steamapps\common\hydroneer\mining\binaries\win64\mining-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\hydroneer\mining\binaries\win64\mining-win64-shipping.exe (Foulball Hangover) [File not signed]
FirewallRules: [TCP Query User{7E0DDE95-9FC2-4E82-A334-9AD537D9B88E}C:\users\bohau\appdata\local\nvidia corporation\geforcenow\cef\geforcenow.exe] => (Allow) C:\users\bohau\appdata\local\nvidia corporation\geforcenow\cef\geforcenow.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [UDP Query User{9AF63251-C328-4DDA-B8F1-D3F43E58C55A}C:\users\bohau\appdata\local\nvidia corporation\geforcenow\cef\geforcenow.exe] => (Allow) C:\users\bohau\appdata\local\nvidia corporation\geforcenow\cef\geforcenow.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{CF325CB7-9E2D-400C-B784-74E9CFBB18E9}] => (Allow) D:\Steam Spel\steamapps\common\Deus Ex Human Revolution Director’s Cut\DXHRDC.exe (Square Enix Ltd. → Square Enix Limited)
FirewallRules: [{49E847AB-BA3A-4CAC-8584-4F4CE16AD44D}] => (Allow) D:\Steam Spel\steamapps\common\Deus Ex Human Revolution Director’s Cut\DXHRDC.exe (Square Enix Ltd. → Square Enix Limited)
FirewallRules: [{6D00E7DE-52F0-4DAE-846E-1A7C006C4DCD}] => (Allow) D:\Steam Spel\steamapps\common\Journey of Life\JourneyOfLife.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{CDE61577-BEB8-4975-B9E8-546B77C57670}] => (Allow) D:\Steam Spel\steamapps\common\Journey of Life\JourneyOfLife.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [TCP Query User{B4736952-A2B9-464B-805B-A1FCAA93E8B2}D:\steam spel\steamapps\common\journey of life\journeyoflife\binaries\win64\journeyoflife-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\journey of life\journeyoflife\binaries\win64\journeyoflife-win64-shipping.exe (Hyperion Studio Ltd) [File not signed]
FirewallRules: [UDP Query User{8B7A00BE-CA0E-4182-BBA3-7F99D133244D}D:\steam spel\steamapps\common\journey of life\journeyoflife\binaries\win64\journeyoflife-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\journey of life\journeyoflife\binaries\win64\journeyoflife-win64-shipping.exe (Hyperion Studio Ltd) [File not signed]
FirewallRules: [{00893367-752C-49EE-A6B9-5FC2153FA3C3}] => (Allow) D:\Steam Spel\steamapps\common\Meltys Quest\nw.exe (The NWJS Community) [File not signed]
FirewallRules: [{323E2FBA-21FC-4D6D-B7AE-1C45DEC23835}] => (Allow) D:\Steam Spel\steamapps\common\Meltys Quest\nw.exe (The NWJS Community) [File not signed]
FirewallRules: [{3FC94E19-B43B-4BE5-8C6B-5CA7A67EA7FB}] => (Allow) D:\Program\Winamp\winamp.exe (Winamp SA → Winamp SA)
FirewallRules: [{6472140B-7CBC-47AA-A8E6-026DEDF6D94F}] => (Allow) D:\Program\Winamp\winamp.exe (Winamp SA → Winamp SA)
FirewallRules: [TCP Query User{9B783B94-969E-4DE3-A2C3-8F17D0F197A6}C:\users\bohau\appdata\local\programs\opera gx\opera.exe] => (Allow) C:\users\bohau\appdata\local\programs\opera gx\opera.exe (Opera Norway AS → Opera Software)
FirewallRules: [UDP Query User{F69015E9-359C-4E31-BA6A-B74B28438EF2}C:\users\bohau\appdata\local\programs\opera gx\opera.exe] => (Allow) C:\users\bohau\appdata\local\programs\opera gx\opera.exe (Opera Norway AS → Opera Software)
FirewallRules: [{326D8E9F-885C-49CB-9991-570A39D7D00F}] => (Allow) D:\Steam Spel\steamapps\common\New World\NewWorldLauncher.exe (Amazon.com Services LLC → Epic Games, Inc)
FirewallRules: [{9C807C61-5B6E-4A27-BC93-8D2CA0F4446E}] => (Allow) D:\Steam Spel\steamapps\common\New World\NewWorldLauncher.exe (Amazon.com Services LLC → Epic Games, Inc)
FirewallRules: [TCP Query User{15AA3866-1459-404A-BB58-EF2042857A69}D:\steam spel\steamapps\common\new world\bin64\newworld.exe] => (Allow) D:\steam spel\steamapps\common\new world\bin64\newworld.exe (Amazon.com Services LLC → Amazon.com, Inc.)
FirewallRules: [UDP Query User{D074034B-57CD-4382-BE41-4A2599526063}D:\steam spel\steamapps\common\new world\bin64\newworld.exe] => (Allow) D:\steam spel\steamapps\common\new world\bin64\newworld.exe (Amazon.com Services LLC → Amazon.com, Inc.)
FirewallRules: [{3CAA3C94-50EF-44D1-8A3A-DE30284EC77F}] => (Allow) D:\Steam Spel\steamapps\common\Terraforming Mars\TerraformingMars.exe (Unity Technologies ApS) [File not signed]
FirewallRules: [{12C75C9C-E311-4F7B-859F-5BE19C4E9EEB}] => (Allow) D:\Steam Spel\steamapps\common\Terraforming Mars\TerraformingMars.exe (Unity Technologies ApS) [File not signed]
FirewallRules: [{D7117FA5-FDC3-42CB-8879-AA0FB29EF7FF}] => (Allow) LPort=32976
FirewallRules: [{7440A2B4-816E-4193-8B25-FE149001ACA1}] => (Allow) LPort=17771
FirewallRules: [TCP Query User{58196195-074C-4A1A-BAAE-3B55FA00F7EF}D:\spel\minecraft launcher\curseforge mod\install\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe] => (Allow) D:\spel\minecraft launcher\curseforge mod\install\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe
FirewallRules: [UDP Query User{F8371B51-F267-44AF-8476-5E79DD6B8B6A}D:\spel\minecraft launcher\curseforge mod\install\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe] => (Allow) D:\spel\minecraft launcher\curseforge mod\install\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe
FirewallRules: [{6C9227A8-9686-4650-B798-55F71EDCBCA3}] => (Allow) D:\Steam Spel\steamapps\common\Megaquarium\Megaquarium.exe (Twice Circled Limited → )
FirewallRules: [{A6658524-0CC2-4F48-91C8-EA80968FDFF6}] => (Allow) D:\Steam Spel\steamapps\common\Megaquarium\Megaquarium.exe (Twice Circled Limited → )
FirewallRules: [{BB2070A0-452D-4051-AA05-0BB5266C99DE}] => (Allow) F:\Steam Spel\steamapps\common\Catan Universe\CatanUniverse.exe () [File not signed]
FirewallRules: [{9D412807-2F61-48AA-99BF-4B8E316EF2CE}] => (Allow) F:\Steam Spel\steamapps\common\Catan Universe\CatanUniverse.exe () [File not signed]
FirewallRules: [{680A2C6F-E30B-4F18-841F-15907D326B97}] => (Allow) D:\Steam Spel\steamapps\common\Breeders of the Nephelym Alpha\OBF.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{62A3EBE0-C6B4-48DD-AE72-A1695D6C368C}] => (Allow) D:\Steam Spel\steamapps\common\Breeders of the Nephelym Alpha\OBF.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{1CB621A1-D179-4114-A9D8-FBC59F9F09D8}] => (Allow) F:\Steam Spel\steamapps\common\GenerationZero\GenerationZero_F.exe (Fatalist Development AB → )
FirewallRules: [{3DD3978F-C9D1-4C27-B386-8BBCC5A3519B}] => (Allow) F:\Steam Spel\steamapps\common\GenerationZero\GenerationZero_F.exe (Fatalist Development AB → )
FirewallRules: [TCP Query User{EFB1D86A-02F9-4A55-95F8-6C7F32097459}D:\steam spel\steamapps\common\satisfactory\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\satisfactory\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [UDP Query User{0B28DAA5-43CD-47F7-8939-B7066E40B3A9}D:\steam spel\steamapps\common\satisfactory\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\satisfactory\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{D129F550-87F2-4B3B-B6A4-618F42F297E5}] => (Allow) F:\Steam Spel\steamapps\common\Midnight Ride\Midnight Ride.exe (Horny NPC Games) [File not signed]
FirewallRules: [{8405CBB1-EFB7-405C-B781-DD53DC02BDF3}] => (Allow) F:\Steam Spel\steamapps\common\Midnight Ride\Midnight Ride.exe (Horny NPC Games) [File not signed]
FirewallRules: [{2A885B5B-85A5-4E61-B3F4-05B3E1303936}] => (Allow) F:\Steam Spel\steamapps\common\Kerbal Space Program\KSP_x64.exe (Take-Two Interactive Software, Inc. → )
FirewallRules: [{2F14CA34-1E72-4016-B0FF-CCFF9A16A013}] => (Allow) F:\Steam Spel\steamapps\common\Kerbal Space Program\KSP_x64.exe (Take-Two Interactive Software, Inc. → )
FirewallRules: [{4FF0A5EC-EBAA-4E6F-83F4-A86B36B8DBE1}] => (Allow) D:\Steam Spel\steamapps\common\Icarus\Icarus.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{FBEBA748-946D-4199-B0BF-F0DC93EF826E}] => (Allow) D:\Steam Spel\steamapps\common\Icarus\Icarus.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{9FA0B93C-7F57-4A9E-8334-8253F6BF4D7F}] => (Allow) D:\Steam Spel\steamapps\common\Carcassonne The Official Board Game\Carcassonne.exe () [File not signed]
FirewallRules: [{E737F77F-2300-4F4C-BB68-76696D9DF45F}] => (Allow) D:\Steam Spel\steamapps\common\Carcassonne The Official Board Game\Carcassonne.exe () [File not signed]
FirewallRules: [TCP Query User{065C6720-7710-409D-BA17-E4774CBE4D8A}C:\users\bohau\appdata\local\programs\opera gx\opera.exe] => (Allow) C:\users\bohau\appdata\local\programs\opera gx\opera.exe (Opera Norway AS → Opera Software)
FirewallRules: [UDP Query User{0FDB336E-C3AA-4871-88E0-CC7EFE65DDA9}C:\users\bohau\appdata\local\programs\opera gx\opera.exe] => (Allow) C:\users\bohau\appdata\local\programs\opera gx\opera.exe (Opera Norway AS → Opera Software)
FirewallRules: [{68A38D35-9170-46B8-A443-916E06B63B20}] => (Allow) D:\Steam Spel\steamapps\common\Conan Exiles\Launcher\FuncomLauncher.exe (FUNCOM OSLO AS → Funcom)
FirewallRules: [{92DF28D2-16E6-4FCB-933E-0A14E27F0F9F}] => (Allow) D:\Steam Spel\steamapps\common\Conan Exiles\Launcher\FuncomLauncher.exe (FUNCOM OSLO AS → Funcom)
FirewallRules: [TCP Query User{227378D5-F93E-4F09-841D-B17BCDBFD980}D:\steam spel\steamapps\common\conan exiles\conansandbox\binaries\win64\conansandbox.exe] => (Allow) D:\steam spel\steamapps\common\conan exiles\conansandbox\binaries\win64\conansandbox.exe (FUNCOM OSLO AS → Funcom Oslo AS)
FirewallRules: [UDP Query User{E487AE17-437C-41EB-A3AE-C88C8FCBAF23}D:\steam spel\steamapps\common\conan exiles\conansandbox\binaries\win64\conansandbox.exe] => (Allow) D:\steam spel\steamapps\common\conan exiles\conansandbox\binaries\win64\conansandbox.exe (FUNCOM OSLO AS → Funcom Oslo AS)
FirewallRules: [TCP Query User{582BE808-F3F8-4FBC-9616-F69101B2A74D}D:\program\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) D:\program\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. → Epic Games, Inc.)
FirewallRules: [UDP Query User{70CD4B70-0EE3-4201-8B59-21C068BD0133}D:\program\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) D:\program\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. → Epic Games, Inc.)
FirewallRules: [{EBC5F2DD-918A-4BFB-80FE-647D7C58057D}] => (Allow) D:\Spel\Mass Effect Legendary Edition\Game\Launcher\MassEffectLauncher.exe (BioWare) [File not signed]
FirewallRules: [{7BF6C6DF-F510-4540-8962-7404D449685C}] => (Allow) D:\Spel\Mass Effect Legendary Edition\Game\Launcher\MassEffectLauncher.exe (BioWare) [File not signed]
FirewallRules: [{BCA3B8FD-6733-4601-8C1A-C5DBF7BCA6E6}] => (Allow) D:\Steam Spel\steamapps\common\Wingspan\Wingspan.exe () [File not signed]
FirewallRules: [{F8B0DB84-9560-4B99-A147-9B7DC69E16BD}] => (Allow) D:\Steam Spel\steamapps\common\Wingspan\Wingspan.exe () [File not signed]
FirewallRules: [{EEA05427-7565-48F5-83BA-335F49FBA542}] => (Allow) D:\Steam Spel\steamapps\common\The Planet Crafter\Planet Crafter.exe () [File not signed]
FirewallRules: [{30ADBA9D-09C7-467F-B156-7BD002690F32}] => (Allow) D:\Steam Spel\steamapps\common\The Planet Crafter\Planet Crafter.exe () [File not signed]
FirewallRules: [TCP Query User{2300EB42-A412-4413-9949-11A49B630C71}C:\users\bohau\appdata\local\programs\opera\opera.exe] => (Block) C:\users\bohau\appdata\local\programs\opera\opera.exe (Opera Norway AS → Opera Software)
FirewallRules: [UDP Query User{D4A3AE9B-8C3F-4FBF-80C9-5F77152BEE7C}C:\users\bohau\appdata\local\programs\opera\opera.exe] => (Block) C:\users\bohau\appdata\local\programs\opera\opera.exe (Opera Norway AS → Opera Software)
FirewallRules: [{CB2F5958-A274-48BA-BD88-F001365F22F0}] => (Allow) D:\Steam Spel\steamapps\common\The Tenants\The Tenants.exe () [File not signed]
FirewallRules: [{E9D99136-CB24-4FC2-AE82-4A4FBFEFE1EF}] => (Allow) D:\Steam Spel\steamapps\common\The Tenants\The Tenants.exe () [File not signed]
FirewallRules: [TCP Query User{5219D5C8-558B-48E6-BA98-9225D6B3A253}F:\steam spel\steamapps\common\prison architect\prison architect64.exe] => (Allow) F:\steam spel\steamapps\common\prison architect\prison architect64.exe () [File not signed]
FirewallRules: [UDP Query User{07CCDCDD-D5DB-478F-B5B7-0E206EA803D3}F:\steam spel\steamapps\common\prison architect\prison architect64.exe] => (Allow) F:\steam spel\steamapps\common\prison architect\prison architect64.exe () [File not signed]
FirewallRules: [TCP Query User{2F141804-45BA-409A-95DC-9A3D2BE6EFFE}D:\steam spel\steamapps\common\surviving the aftermath\aftermath64.exe] => (Allow) D:\steam spel\steamapps\common\surviving the aftermath\aftermath64.exe (Iceflake Studios Oy → )
FirewallRules: [UDP Query User{EEC26C57-51E8-42D6-AA65-03CD6658E100}D:\steam spel\steamapps\common\surviving the aftermath\aftermath64.exe] => (Allow) D:\steam spel\steamapps\common\surviving the aftermath\aftermath64.exe (Iceflake Studios Oy → )
FirewallRules: [TCP Query User{CDF4B9FE-579B-4C5B-909E-084837EB561B}D:\program\ch\aurora\aurora.exe] => (Allow) D:\program\ch\aurora\aurora.exe (Dingo Webworks, LLC → Cheat Happens)
FirewallRules: [UDP Query User{9D294777-88C2-4BE9-9FFA-3B2BC0526688}D:\program\ch\aurora\aurora.exe] => (Allow) D:\program\ch\aurora\aurora.exe (Dingo Webworks, LLC → Cheat Happens)
FirewallRules: [{B39106AD-F29D-458A-BAAD-D20CD6318F5F}] => (Allow) D:\Steam Spel\steamapps\common\Horizon Zero Dawn\HorizonZeroDawn.exe () [File not signed]
FirewallRules: [{F6B7F577-6351-4833-99E1-396A060C4324}] => (Allow) D:\Steam Spel\steamapps\common\Horizon Zero Dawn\HorizonZeroDawn.exe () [File not signed]
FirewallRules: [{00073FF6-7026-4FCF-A4F4-722468FFFC21}] => (Allow) D:\Spel\NOX\NOX.exe (Electronic Arts, Inc. → )
FirewallRules: [{F7BA0D6E-D3E7-4443-A3F9-77AC4F36F4A8}] => (Allow) D:\Spel\NOX\NOX.exe (Electronic Arts, Inc. → )
FirewallRules: [{25E1D357-55B1-46E2-A9DF-7F41C2F33776}] => (Allow) D:\Spel\NOX\Game.exe (Electronic Arts, Inc. → )
FirewallRules: [{74147D74-7391-4463-92F7-AD6ADE6458DB}] => (Allow) D:\Spel\NOX\Game.exe (Electronic Arts, Inc. → )
FirewallRules: [{FBCA2075-226E-48A1-9DBC-67019FB04248}] => (Allow) D:\Steam Spel\steamapps\common\ShadowOfWar\x64\ShadowOfWar.exe (WB Games Inc. → WB Games, Inc.) [File not signed]
FirewallRules: [{D3FE7FCC-A02F-4060-9DFF-888213B9D71A}] => (Allow) D:\Steam Spel\steamapps\common\ShadowOfWar\x64\ShadowOfWar.exe (WB Games Inc. → WB Games, Inc.) [File not signed]
FirewallRules: [{5A47B931-FE19-4A93-BF6A-A517618B2F18}] => (Allow) D:\Spel\Assassin’s Creed IV Black Flag\AC4BFSP.exe (Ubisoft Entertainment → )
FirewallRules: [{BD0C8745-17AE-42A1-A684-532B352A4EC1}] => (Allow) D:\Spel\Assassin’s Creed IV Black Flag\AC4BFSP.exe (Ubisoft Entertainment → )
FirewallRules: [{EC79EC01-A645-4E7C-B3F1-BD8ACB0AA5FC}] => (Allow) D:\Spel\Assassin’s Creed IV Black Flag\AC4BFMP.exe (Ubisoft Entertainment SA → )
FirewallRules: [{70B02E25-6A78-4F6C-B3F2-1BD338EB4B1A}] => (Allow) D:\Spel\Assassin’s Creed IV Black Flag\AC4BFMP.exe (Ubisoft Entertainment SA → )
FirewallRules: [{256BC8BB-434D-4174-857F-8872D9DE2144}] => (Allow) D:\Steam Spel\steamapps\common\Eco\Eco.exe () [File not signed]
FirewallRules: [{C1B59B62-2C35-4069-8148-77551F6F9393}] => (Allow) D:\Steam Spel\steamapps\common\Eco\Eco.exe () [File not signed]
FirewallRules: [{624B8926-5317-4431-AB65-B7EB832296D8}] => (Allow) D:\Steam Spel\steamapps\common\Gas Station Simulator\GSS2.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{C55BA908-2A17-4372-8F31-CFC00F279EF8}] => (Allow) D:\Steam Spel\steamapps\common\Gas Station Simulator\GSS2.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [TCP Query User{66D0E7EC-C94B-4206-AE97-97D5C5188270}D:\steam spel\steamapps\common\ranch simulator\ranch_simulator\binaries\win64\ranch_simulator-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\ranch simulator\ranch_simulator\binaries\win64\ranch_simulator-win64-shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [UDP Query User{66E25869-08F7-4CE9-9658-7F38F3FA07C5}D:\steam spel\steamapps\common\ranch simulator\ranch_simulator\binaries\win64\ranch_simulator-win64-shipping.exe] => (Allow) D:\steam spel\steamapps\common\ranch simulator\ranch_simulator\binaries\win64\ranch_simulator-win64-shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{575BCA89-705D-47CC-B92A-60D315338A59}] => (Allow) D:\Steam Spel\steamapps\common\SigmaTheory\sigma.exe () [File not signed]
FirewallRules: [{9FEA29B3-21A9-4F69-A8B9-B6E1697AF647}] => (Allow) D:\Steam Spel\steamapps\common\SigmaTheory\sigma.exe () [File not signed]
FirewallRules: [{040636E1-4868-490F-98B5-40BFE0E93731}] => (Allow) D:\Steam Spel\steamapps\common\Stardew Valley\Stardew Valley.exe (ConcernedApe) [File not signed]
FirewallRules: [{3EADBC66-68CC-4A8A-9315-1FE9936E5930}] => (Allow) D:\Steam Spel\steamapps\common\Stardew Valley\Stardew Valley.exe (ConcernedApe) [File not signed]
FirewallRules: [{B2765D22-FA95-4A1F-90BD-B46ACA894686}] => (Allow) D:\Steam Spel\steamapps\common\Claire’s Quest\Game.exe (KADOKAWA) [File not signed]
FirewallRules: [{84A63195-44BD-4C78-83EB-2E2BE54E60AD}] => (Allow) D:\Steam Spel\steamapps\common\Claire’s Quest\Game.exe (KADOKAWA) [File not signed]
FirewallRules: [{B9E67987-54F1-4E0D-A081-40C4A7E22EA5}] => (Allow) D:\Steam Spel\steamapps\common\Epic Chef\EpicChef.exe () [File not signed]
FirewallRules: [{F11A1EF2-403A-4E5F-BD5A-A214A271842B}] => (Allow) D:\Steam Spel\steamapps\common\Epic Chef\EpicChef.exe () [File not signed]
FirewallRules: [TCP Query User{CECCC2DF-6FFD-4A4A-883B-78966EA35545}D:\spel\assassin’s creed iii remastered\aciii.exe] => (Allow) D:\spel\assassin’s creed iii remastered\aciii.exe (Ubisoft Entertainment → )
FirewallRules: [UDP Query User{0287458C-FD15-471D-BFD8-B1E775475DDC}D:\spel\assassin’s creed iii remastered\aciii.exe] => (Allow) D:\spel\assassin’s creed iii remastered\aciii.exe (Ubisoft Entertainment → )
FirewallRules: [{7FE77BB2-3092-4FA0-BE40-D08CC762F703}] => (Allow) D:\Spel\Assassin’s Creed Rogue\ACC.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{9C789254-143C-4E30-8A0A-BD12CD85F95B}] => (Allow) D:\Spel\Assassin’s Creed Rogue\ACC.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{752A191B-F7E3-4079-ABB2-729827C6571D}] => (Allow) D:\Steam Spel\steamapps\common\BATTLETECH\BattleTechLauncher.exe (HarebrainedSchemes) [File not signed]
FirewallRules: [{F1D021B4-44FF-44F7-AC7B-F232E364A89B}] => (Allow) D:\Steam Spel\steamapps\common\BATTLETECH\BattleTechLauncher.exe (HarebrainedSchemes) [File not signed]
FirewallRules: [{2D9D1319-325E-496A-9F39-5E674278C47B}] => (Allow) F:\Steam Spel\steamapps\common\Kerbal Space Program\PDLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. → Take-Two Interactive Software, Inc.)
FirewallRules: [{504BFA11-A65F-4FCB-8DD3-69F34FA2041F}] => (Allow) F:\Steam Spel\steamapps\common\Kerbal Space Program\PDLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. → Take-Two Interactive Software, Inc.)
FirewallRules: [{3604DF0B-41FE-4000-BF49-360A32B142E7}] => (Allow) D:\Steam Spel\steamapps\common\Surviving the Aftermath\launcher\Paradox Launcher.exe (Paradox Interactive AB (publ) → Paradox Interactive)
FirewallRules: [{C7841BF7-80F7-4298-843B-26FD5D563F10}] => (Allow) D:\Steam Spel\steamapps\common\Surviving the Aftermath\launcher\Paradox Launcher.exe (Paradox Interactive AB (publ) → Paradox Interactive)
FirewallRules: [{5BABDDD0-ABCF-4AC1-8861-019ABBE54E2F}] => (Allow) D:\Steam Spel\steamapps\common\Food Truck Simulator Demo\FTR3.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{278B6BA0-DB40-450D-B59C-9D8C8D7027FA}] => (Allow) D:\Steam Spel\steamapps\common\Food Truck Simulator Demo\FTR3.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{80E063FE-9FA6-472B-B4FC-554FFCC18B91}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{077534FE-BB80-4435-BFE2-8DEB784796BF}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{C158F263-B56F-4625-BD20-6238DC37F783}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{27FBF7DF-6575-44B1-AE87-5A9E73B482A5}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{68F21856-E914-4E05-8DF6-9610B3D413D7}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{5A8FABEE-0F22-4371-9420-EC246B3E08B9}] => (Allow) D:\Steam Spel\steamapps\common\Who wants to strip this babe\Who wants to strip this Babe.exe () [File not signed]
FirewallRules: [{AAF37834-59C7-4FB9-927F-489BCC10C2F8}] => (Allow) D:\Steam Spel\steamapps\common\Who wants to strip this babe\Who wants to strip this Babe.exe () [File not signed]
FirewallRules: [{B75F4448-DD51-406F-AB08-7219AE854CE6}] => (Allow) D:\Steam Spel\steamapps\common\Who wants to strip this babe Hentai Streamer Girl\Who wants to strip this Babe Streamer Girl.exe () [File not signed]
FirewallRules: [{88B4E6E3-9DEC-4D88-B1B0-8B0EB2035AD8}] => (Allow) D:\Steam Spel\steamapps\common\Who wants to strip this babe Hentai Streamer Girl\Who wants to strip this Babe Streamer Girl.exe () [File not signed]
FirewallRules: [{38AA445E-2080-41B8-B4F7-F9166F85645D}] => (Allow) D:\Steam Spel\steamapps\common\The Bunker 69\game.exe (The NWJS Community) [File not signed]
FirewallRules: [{848C9059-0782-4946-83D4-155F08953796}] => (Allow) D:\Steam Spel\steamapps\common\The Bunker 69\game.exe (The NWJS Community) [File not signed]
FirewallRules: [{0A9FDB50-ED2D-4942-8A99-488577851AAF}] => (Allow) D:\Steam Spel\steamapps\common\Mafia II Definitive Edition\2KLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. → Take-Two Interactive Software, Inc.)
FirewallRules: [{40351C21-E019-43F6-8F17-944FCFCBFBD1}] => (Allow) D:\Steam Spel\steamapps\common\Mafia II Definitive Edition\2KLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. → Take-Two Interactive Software, Inc.)
FirewallRules: [{B3A7330D-5BC7-43E5-881E-ED1D9A652BCA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{43170745-40D0-43D6-8557-6223E4E58542}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{C2CAD18C-E4F8-47BE-90CC-F40CE6591764}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{2E6D559E-A359-499A-A1DE-0FF522B07338}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (Nvidia Corporation → NVIDIA Corporation)
FirewallRules: [{BBFCD5C3-78CF-48A8-A2F4-8D9B8EC0E496}] => (Allow) D:\Steam Spel\steamapps\common\Oblivion\OblivionLauncher.exe (Bethesda Softworks) [File not signed]
FirewallRules: [{FFDB3C72-A763-4132-86F9-6ABF2D480E9F}] => (Allow) D:\Steam Spel\steamapps\common\Oblivion\OblivionLauncher.exe (Bethesda Softworks) [File not signed]
FirewallRules: [{9937E086-1DB9-42FE-AE83-34D52C83C91B}] => (Allow) D:\Steam Spel\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe (Bethesda Softworks) [File not signed]
FirewallRules: [{407F6703-9166-4D6C-989B-7785633E857D}] => (Allow) D:\Steam Spel\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe (Bethesda Softworks) [File not signed]
FirewallRules: [{FAFE8A95-6574-4705-BE4F-EFA6BDDF5084}] => (Allow) D:\Steam Spel\steamapps\common\Life Not Supported Demo\Life Not Supported.exe (Unity Technologies ApS) [File not signed]
FirewallRules: [{10830C0F-CC38-4A6F-83D4-522C80F4005D}] => (Allow) D:\Steam Spel\steamapps\common\Life Not Supported Demo\Life Not Supported.exe (Unity Technologies ApS) [File not signed]
FirewallRules: [{084EDF31-A93A-4E47-9D7E-9421705DBB13}] => (Allow) D:\Steam Spel\steamapps\common\Maia\Maia.exe () [File not signed]
FirewallRules: [{94CCB195-FDC7-4C31-BF98-21DFECB63D9C}] => (Allow) D:\Steam Spel\steamapps\common\Maia\Maia.exe () [File not signed]
FirewallRules: [{DD81907A-E4BE-4786-BD2E-121D6D0C91A9}] => (Allow) D:\Spel\Ghost Recon Breakpoint\GRB_BE.exe (MrAntiFun.net) [File not signed]
FirewallRules: [{F3D4B888-78A9-4CF4-AC84-A6CAAD14A51F}] => (Allow) D:\Spel\Ghost Recon Breakpoint\GRB_BE.exe (MrAntiFun.net) [File not signed]
FirewallRules: [TCP Query User{63A0B781-E2AC-4F9A-80D6-EB8DC623ECDB}D:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe] => (Allow) D:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe (Access Denied) [File not signed]
FirewallRules: [UDP Query User{1EDE78B7-BCA6-4D11-A5F4-47EDCFB9F975}D:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe] => (Allow) D:\xboxgames\grounded\content\maine\binaries\wingdk\maine-wingdk-shipping.exe (Access Denied) [File not signed]
FirewallRules: [TCP Query User{AA0282EC-DB1A-4B19-BD72-BD035DE83AFB}D:\xboxgames\valheim\content\valheim.exe] => (Allow) D:\xboxgames\valheim\content\valheim.exe (Access Denied) [File not signed]
FirewallRules: [UDP Query User{709FD806-D198-4A99-BE36-4798550F530E}D:\xboxgames\valheim\content\valheim.exe] => (Allow) D:\xboxgames\valheim\content\valheim.exe (Access Denied) [File not signed]
FirewallRules: [{2DD49AFF-6C13-46EF-9EF2-D7983CCAF884}] => (Allow) D:\Steam Spel\steamapps\common\Wildlands\GRW.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{699F66C0-3FDE-41EF-B479-A18A57779DE3}] => (Allow) D:\Steam Spel\steamapps\common\Wildlands\GRW.exe (UBISOFT ENTERTAINMENT INC. → )
FirewallRules: [{753B2F82-CB9C-44FB-9B5E-2E4DCDB47585}] => (Allow) D:\Steam Spel\steamapps\common\Come Home\ComeHome.exe () [File not signed]
FirewallRules: [{A7A9EFA3-64C3-437B-A111-5BDC3D20AEB0}] => (Allow) D:\Steam Spel\steamapps\common\Come Home\ComeHome.exe () [File not signed]
FirewallRules: [{1B2A9A98-4409-40C4-AF33-DB2E2D8DD4D3}] => (Allow) F:\Steam Spel\steamapps\common\3DMark\bin\x64\3DMark.exe (Underwriters Laboratories Inc. → )
FirewallRules: [{C5171F21-578A-425A-8A57-C7B9D5B40133}] => (Allow) F:\Steam Spel\steamapps\common\3DMark\bin\x64\3DMark.exe (Underwriters Laboratories Inc. → )
FirewallRules: [{13D8382F-A816-49CE-A151-59A38BA19A98}] => (Allow) D:\XboxGames\SimCity\SimCity\SimCity.exe (Electronic Arts → Electronic Arts Inc.)
FirewallRules: [{6AEB80F6-03BE-426D-94FE-EC26DFEF9321}] => (Allow) D:\XboxGames\SimCity\SimCity\SimCity.exe (Electronic Arts → Electronic Arts Inc.)
FirewallRules: [{0D7CE105-FB6D-491D-91D0-8EB24E27254F}] => (Allow) F:\Steam Spel\steamapps\common\Farming Simulator 22\x64\FarmingSimulator2022Game.exe (GIANTS Software GmbH → GIANTS Software GmbH)
FirewallRules: [{55149857-3D5F-4E67-AB77-48C628B523D5}] => (Allow) F:\Steam Spel\steamapps\common\Farming Simulator 22\x64\FarmingSimulator2022Game.exe (GIANTS Software GmbH → GIANTS Software GmbH)
FirewallRules: [{131AC9BC-9B60-4F70-AA59-DB868C07AB50}] => (Allow) D:\Steam Spel\steamapps\common\Karryn’s Prison\nw.exe (The NW.js Community) [File not signed]
FirewallRules: [{8CB27EF3-CD13-4DCE-BB17-FDA62C33580D}] => (Allow) D:\Steam Spel\steamapps\common\Karryn’s Prison\nw.exe (The NW.js Community) [File not signed]
FirewallRules: [{B40B004A-5A7C-4DB5-A10B-F305D1B646EB}] => (Allow) D:\Steam Spel\steamapps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe () [File not signed]
FirewallRules: [{13C32091-837A-4B54-801D-B9B78FCA403F}] => (Allow) D:\Steam Spel\steamapps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe () [File not signed]
FirewallRules: [{EF3C9E52-FE31-454F-9301-B104DE18C0DB}] => (Allow) D:\Steam Spel\steamapps\common\AreaZ\Areaz.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{886C5A01-6529-4656-9BEC-19DDDF1E3F67}] => (Allow) D:\Steam Spel\steamapps\common\AreaZ\Areaz.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{0741D183-3ED2-4BE4-99B3-7E1C958EE88A}] => (Allow) D:\Steam Spel\steamapps\common\RimWorld\RimWorldWin64.exe () [File not signed]
FirewallRules: [{E25DFBDC-A486-4F74-9B21-37D365CAFC6E}] => (Allow) D:\Steam Spel\steamapps\common\RimWorld\RimWorldWin64.exe () [File not signed]
FirewallRules: [{25AB5150-60F8-419B-A568-702E409AF2ED}] => (Allow) D:\Steam Spel\steamapps\common\DragonStone\DragonStone.exe () [File not signed]
FirewallRules: [{8B010E9B-E9CF-4EB1-B3D7-2A0D1D3CA4A5}] => (Allow) D:\Steam Spel\steamapps\common\DragonStone\DragonStone.exe () [File not signed]
FirewallRules: [{DCBAFDCD-3285-4005-83DB-F9B8CB0162C1}] => (Allow) D:\Steam Spel\steamapps\common\Crypto Miner Tycoon Simulator Starter Edition\game.exe () [File not signed]
FirewallRules: [{FD503514-9880-454F-92AC-4D0DEBE319D7}] => (Allow) D:\Steam Spel\steamapps\common\Crypto Miner Tycoon Simulator Starter Edition\game.exe () [File not signed]
FirewallRules: [{ABC7AC65-B240-4BDD-89A7-CA502CBC8142}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{0D4274C2-1E99-49A5-8451-4DB50590FAAF}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{139BDD01-93B2-445E-A087-B3945825FC00}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{45C14516-5909-4ECC-8CA2-E367D66602E7}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{C8C4D79D-F46D-48E3-A506-F24F7F7124DF}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{310E6ED7-5D64-4599-8AF5-948D22A12B40}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALaunchHelper.exe (Electronic Arts, Inc. → Electronic Arts)
FirewallRules: [{71FB97FE-3DBA-4BA9-B65B-88105789FC75}] => (Allow) D:\Steam Spel\steamapps\common\X4 Foundations\X4.exe (Egosoft GmbH → EGOSOFT GmbH)
FirewallRules: [{A268235B-F2CE-4A9D-A129-2F173183FEF7}] => (Allow) D:\Steam Spel\steamapps\common\X4 Foundations\X4.exe (Egosoft GmbH → EGOSOFT GmbH)
FirewallRules: [{FDE82E64-A357-4888-9044-FD10C7372645}] => (Allow) D:\Steam Spel\steamapps\common\Occupy Mars The Game\OccupyMars.exe () [File not signed]
FirewallRules: [{DC1188D8-9A79-49E9-9F4C-F50FB0870EA5}] => (Allow) D:\Steam Spel\steamapps\common\Occupy Mars The Game\OccupyMars.exe () [File not signed]
FirewallRules: [{B8E4FD19-9501-41FD-B30B-E2B46A66F272}] => (Allow) D:\Steam Spel\steamapps\common\Wild West Dynasty\wwd.exe () [File not signed]
FirewallRules: [{59D95E7E-C6A9-4C29-8134-D1EAA3D385FE}] => (Allow) D:\Steam Spel\steamapps\common\Wild West Dynasty\wwd.exe () [File not signed]
FirewallRules: [{78343D5A-973D-4861-9E78-11F99FF827F4}] => (Allow) D:\EA Games\Mass Effect Andromeda\MassEffectAndromedaTrial.exe (Electronic Arts - BioWare) [File not signed]
FirewallRules: [{5DF08826-5012-4D58-8DA2-4E21CB5864BF}] => (Allow) D:\EA Games\Mass Effect Andromeda\MassEffectAndromedaTrial.exe (Electronic Arts - BioWare) [File not signed]
FirewallRules: [{EB4A4470-CAD1-4CEF-8072-15F272D38511}] => (Allow) D:\EA Games\Mass Effect Andromeda\MassEffectAndromeda.exe (Electronic Arts → Electronic Arts - BioWare)
FirewallRules: [{4CB55A86-00CD-4FCA-9CCF-E2EF41BC6D70}] => (Allow) D:\EA Games\Mass Effect Andromeda\MassEffectAndromeda.exe (Electronic Arts → Electronic Arts - BioWare)
FirewallRules: [{78ECF729-862D-450F-AEF8-5304498C1020}] => (Allow) D:\Steam Spel\steamapps\common\Forever Skies\ForeverSkies.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{4C85446D-F615-47A3-9D03-D6853DED6D51}] => (Allow) D:\Steam Spel\steamapps\common\Forever Skies\ForeverSkies.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{3D0EAEEF-89C9-457F-A3F2-E475265FDB47}] => (Allow) D:\Spel\Dragon Age Inquisition\DragonAgeInquisition.exe (Electronic Arts → Electronic Arts)
FirewallRules: [{65D9A7E1-4642-45AD-93A7-382764739E81}] => (Allow) D:\Spel\Dragon Age Inquisition\DragonAgeInquisition.exe (Electronic Arts → Electronic Arts)
FirewallRules: [{A333E971-E85A-4EA1-845C-9618DD5673EE}] => (Allow) D:\Steam Spel\steamapps\common\Builder Simulator\Builder Simulator.exe () [File not signed]
FirewallRules: [{0E91BCA1-3D6C-4679-9014-D87D868431B9}] => (Allow) D:\Steam Spel\steamapps\common\Builder Simulator\Builder Simulator.exe () [File not signed]
FirewallRules: [{8F46C14E-33C1-46D2-ACCE-AA82DEF05AC7}] => (Allow) D:\Steam Spel\steamapps\common\Starfield\Starfield.exe (Bethesda Softworks LLC → Bethesda Softworks)
FirewallRules: [{17E828E0-1BFD-4EE4-ABDF-9FFA8B0FCA24}] => (Allow) D:\Steam Spel\steamapps\common\Starfield\Starfield.exe (Bethesda Softworks LLC → Bethesda Softworks)
FirewallRules: [{C2FE5A46-BF67-4119-B4A0-D347F9152803}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC → Google LLC)
FirewallRules: [{A2CE44F5-6A47-48D7-9842-03DF222F79D7}] => (Allow) D:\Program\Overwolf\0.233.1.2\OverwolfBrowser.exe (Overwolf Ltd → Overwolf LTD)
FirewallRules: [{03CDFE8E-87AE-4D53-A680-4D1072021335}] => (Allow) D:\Program\Overwolf\0.233.1.2\OverwolfBrowser.exe (Overwolf Ltd → Overwolf LTD)
FirewallRules: [{FCE15E49-4967-4F6C-8AB4-FF81D4465C37}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.31\msedgewebview2.exe (Microsoft Corporation → Microsoft Corporation)

==================== Restore Points =========================

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================
[HEADING=1]Application errors:[/HEADING]
Error: (09/21/2023 10:15:57 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Starfield.exe version 1.7.29.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 3514

Start Time: 01d9ecb24d09e161

Termination Time: 6

Application Path: D:\Steam Spel\steamapps\common\Starfield\Starfield.exe

Report Id: d1d78040-ceab-49d4-b1e5-906192b8d3be

Faulting package full name:

Faulting package-relative application ID:

Hang type: Unknown

Error: (09/21/2023 04:52:29 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x8007001f, A device attached to the system is not functioning.
.

Operation:
Executing Asynchronous Operation

Context:
Current State: DoSnapshotSet

Error: (09/21/2023 04:52:18 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {f704f0ff-2494-481b-a14d-b622598eb388}

Error: (09/19/2023 04:27:26 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary ZAM Helper Driver.

System Error:
The system cannot find the file specified.
.

Error: (09/19/2023 04:27:26 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary ZAM Guard Driver.

System Error:
The system cannot find the file specified.
.

Error: (09/18/2023 06:18:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Acrobat.exe, version: 23.6.20320.0, time stamp: 0x64f8fdd7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00007fff0b63045f
Faulting process ID: 0x4690
Faulting application start time: 0x01d9ea4bb23b8d76
Faulting application path: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Faulting module path: unknown
Report ID: 9f8b8acb-8c03-4b71-be5a-d2488acc0b98
Faulting package full name:
Faulting package-relative application ID:

Error: (09/17/2023 09:23:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Qqsp.exe, version: 1.9.0.0, time stamp: 0x620d8d65
Faulting module name: Qqsp.exe, version: 1.9.0.0, time stamp: 0x620d8d65
Exception code: 0xc0000005
Fault offset: 0x00011128
Faulting process ID: 0x5140
Faulting application start time: 0x01d9e9992c85be1e
Faulting application path: Z:\SubStar Games\Girl Life - Brother mod\player\Qqsp.exe
Faulting module path: Z:\SubStar Games\Girl Life - Brother mod\player\Qqsp.exe
Report ID: 4187b41d-ccd2-423a-af07-a95055c794ac
Faulting package full name:
Faulting package-relative application ID:

Error: (09/17/2023 09:00:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Qqsp.exe, version: 1.9.0.0, time stamp: 0x620d8d65
Faulting module name: Qqsp.exe, version: 1.9.0.0, time stamp: 0x620d8d65
Exception code: 0xc0000005
Fault offset: 0x00011128
Faulting process ID: 0x33f8
Faulting application start time: 0x01d9e998e59f87c8
Faulting application path: Z:\SubStar Games\Girl Life - Brother mod\player\Qqsp.exe
Faulting module path: Z:\SubStar Games\Girl Life - Brother mod\player\Qqsp.exe
Report ID: fd3c29a1-2429-4f28-a511-9bea58001c76
Faulting package full name:
Faulting package-relative application ID:
[HEADING=1]System errors:[/HEADING]
Error: (09/21/2023 04:58:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ZAM Controller Service service terminated unexpectedly. It has done this 1 time(s).

Error: (09/21/2023 04:56:16 PM) (Source: DCOM) (EventID: 10010) (User: ANDERNA)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (09/21/2023 04:52:29 PM) (Source: DCOM) (EventID: 10010) (User: ANDERNA)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (09/21/2023 04:52:28 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Steam Client Service service terminated unexpectedly. It has done this 1 time(s).

Error: (09/21/2023 04:52:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The EABackgroundService service terminated unexpectedly. It has done this 1 time(s).

Error: (09/21/2023 04:52:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ZAM Controller Service service terminated unexpectedly. It has done this 3 time(s).

Error: (09/21/2023 04:52:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (09/21/2023 04:52:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
[HEADING=1]Windows Defender:[/HEADING]
Date: 2023-09-21 18:48:10
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin64%2FSpyboy%21MSR&threatid=2147848192&enterprise=0

Name: Trojan:Win64/Spyboy!MSR
Severity: Severe
Category: Trojan
Path: driver:_ZAM; driver:_ZAM_Guard; file:_C:\WINDOWS\System32\drivers\zam64.sys; file:_C:\WINDOWS\System32\drivers\zamguard64.sys
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.397.1344.0, AS: 1.397.1344.0, NIS: 1.397.1344.0
Engine Version: AM: 1.1.23080.2005, NIS: 1.1.23080.2005

Date: 2023-09-20 18:43:11
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2023-09-19 17:33:01
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin64%2FSpyboy%21MSR&threatid=2147848192&enterprise=0

Name: Trojan:Win64/Spyboy!MSR
Severity: Severe
Category: Trojan
Path: driver:_ZAM; driver:_ZAM_Guard; file:_C:\WINDOWS\System32\drivers\zam64.sys; file:_C:\WINDOWS\System32\drivers\zamguard64.sys
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.397.1238.0, AS: 1.397.1238.0, NIS: 1.397.1238.0
Engine Version: AM: 1.1.23080.2005, NIS: 1.1.23080.2005

Date: 2023-09-19 16:15:49
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin64%2FSpyboy%21MSR&threatid=2147848192&enterprise=0

Name: Trojan:Win64/Spyboy!MSR
Severity: Severe
Category: Trojan
Path: driver:_ZAM; driver:_ZAM_Guard; file:_C:\WINDOWS\System32\drivers\zam64.sys; file:_C:\WINDOWS\System32\drivers\zamguard64.sys
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.397.1225.0, AS: 1.397.1225.0, NIS: 1.397.1225.0
Engine Version: AM: 1.1.23080.2005, NIS: 1.1.23080.2005

Date: 2023-09-18 19:24:13
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin64%2FSpyboy%21MSR&threatid=2147848192&enterprise=0

Name: Trojan:Win64/Spyboy!MSR
Severity: Severe
Category: Trojan
Path: file:_C:\WINDOWS\system32\drivers\zam64.sys; file:_C:\WINDOWS\system32\drivers\zamguard64.sys
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.397.1174.0, AS: 1.397.1174.0, NIS: 1.397.1174.0
Engine Version: AM: 1.1.23080.2005, NIS: 1.1.23080.2005
Event[0]:

Date: 2023-09-18 17:20:27
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.397.779.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.23080.2005
Error code: 0x8007045b
Error description: A system shutdown is in progress.

Date: 2023-09-11 17:50:02
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.395.1098.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.23070.1005
Error code: 0x8007045b
Error description: A system shutdown is in progress.

Date: 2023-09-08 08:01:45
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version: 1.397.586.0
Previous security intelligence Version: 1.395.1098.0
Update Source: User
Security intelligence Type: AntiSpyware
Update Type: Full
Current Engine Version: 1.1.23080.2005
Previous Engine Version: 1.1.23070.1005
Error code: 0x80070002
Error description: The system cannot find the file specified.

Date: 2023-09-08 08:01:45
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version: 1.397.586.0
Previous security intelligence Version: 1.395.1098.0
Update Source: User
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version: 1.1.23080.2005
Previous Engine Version: 1.1.23070.1005
Error code: 0x80070002
Error description: The system cannot find the file specified.

Date: 2023-09-08 08:01:45
Description:
Microsoft Defender Antivirus has encountered an error trying to update the engine.
New Engine Version: 1.1.23080.2005
Previous Engine Version: 1.1.23070.1005
Error Code: 0x80070002
Error description: The system cannot find the file specified.
[HEADING=1]CodeIntegrity:[/HEADING]
Date: 2023-09-18 17:47:14
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

BIOS: American Megatrends Inc. 2.C0 06/04/2020
Motherboard: Micro-Star International Co., Ltd. Z370-A PRO (MS-7B48)
Processor: Intel(R) Core™ i7-8700K CPU @ 3.70GHz
Percentage of memory in use: 24%
Total physical RAM: 65478.2 MB
Available physical RAM: 49437.22 MB
Total Virtual: 69574.2 MB
Available Virtual: 50184.43 MB

==================== Drives ================================

Drive c: (Highway) (Fixed) (Total:232.34 GB) (Free:65.18 GB) (Model: Samsung SSD 850 EVO 250GB) NTFS
Drive d: (Highlight) (Fixed) (Total:3726.01 GB) (Free:557.95 GB) (Model: Samsung SSD 860 QVO 4TB) NTFS
Drive e: (Highrise) (Fixed) (Total:465.76 GB) (Free:338.49 GB) (Model: SAMSUNG HD501LJ) NTFS
Drive f: (Highland) (Fixed) (Total:931.51 GB) (Free:462.71 GB) (Model: ST1000DL002-9TT153) NTFS ==>[system with boot components (obtained from drive)]
Drive z: (Highscore) (Fixed) (Total:931.51 GB) (Free:158.83 GB) (Model: SAMSUNG HD103UJ) NTFS

\?\Volume{95b0e598-5cef-289f-7c39-1efdc41a6154}\ () (Fixed) (Total:0.01 GB) (Free:0 GB) NTFS
\?\Volume{8337dc35-0000-0000-0000-e0153a000000}\ () (Fixed) (Total:0.54 GB) (Free:0.11 GB) NTFS

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Size: 3726 GB) (Disk ID: BE14F2C7)

Partition: GPT.

==========================================================
Disk: 1 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 00037647)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==========================================================
Disk: 2 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 251CD827)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==========================================================
Disk: 3 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: CAB10BEE)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==========================================================
Disk: 4 (MBR Code: Windows 7/8/10) (Size: 232.9 GB) (Disk ID: 8337DC35)
Partition 1: (Not Active) - (Size=232.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=556 MB) - (Type=27)
Attempted reading MBR returned 0 bytes.
Could not read MBR for disk 5.

==================== End of Addition.txt =======================

[/HEADING]

[Bohauo]

I am going to bed now, it is 22:30 here, so i will read your answer in about 8 or 9 hours or so…

[Malnutrition]

@Bohauo I’ll answer all of your questions when we are done here, but I will say there are IMO a few suspicious items, which we are currently taking care of in this next FRST fix, the first round of fixes I targeted clutter, now that is out of the way the real work begins.

Adware Cleaner

[ul]
[li]Download AdwCleaner and save it to your Desktop[/li][li]Right-click on AdwCleaner.exeand select, Run as Administrator[/li][li]Accept the EULA (I accept), then click on Scan Now[/li][li]Let the scan complete[/li][li]Once the scan completes, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button[/li][li]Subsequently you may be asked to Run Basic Repair. This is optional. I would suggest holding off on this for now.[/li][li]Once the cleaning process is complete, AdwCleaner will ask you to restart your computer[/li][li]Close all other open windows and allow it to restart[/li][li]After the restart, Notepad will open with the AdwCleaner cleaning log[/li][li]Please Attach the contents of that log into your next reply to me[/li][/ul]

---

---

Copy the content of the code box below.
[COLOR=rgb(184, 49, 47)]Do not copy the word code!!!
Right Click FRST and run as Administrator.
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.

start::
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
RemoveProxy:
HKU\S-1-5-21-2806114696-2502326770-847037938-1001\...\Run: [Trainer Manager] => C:\Users\bohau\Documents\My Trainers\Cheat Happens\Trainer Manager EA\TrainerManager.exe (No File)
HKU\S-1-5-21-2806114696-2502326770-847037938-1001\...\Run: [electron.app.Lust Launcher] => D:\Programs\Lust Launcher\Lust Launcher.exe (No File)
FF Plugin HKU\S-1-5-21-2806114696-2502326770-847037938-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark\nplightsparkplugin.dll [No File]
OPR Extension: (Amazon Assistant Promotion) - C:\Users\bohau\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-08-14]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\yvkurxwa.sys:changelist [1394]
AlternateDataStreams: C:\Users\bohau\Desktop\KVRT.exe:MBAM.Zone.Identifier [183]
FirewallRules: [{D7117FA5-FDC3-42CB-8879-AA0FB29EF7FF}] => (Allow) LPort=32976
FirewallRules: [{7440A2B4-816E-4193-8B25-FE149001ACA1}] => (Allow) LPort=17771
File: C:\WINDOWS\system32\perfh01D.dat
File: C:\WINDOWS\system32\perfc01D.dat
Folder: C:\Users\bohau\AppData\Roaming\Qqsp
VirusTotal: C:\WINDOWS\system32\drivers\yvkurxwa.sys 
VirusTotal: C:\WINDOWS\system32\perfh01D.dat
VirusTotal: C:\WINDOWS\system32\perfc01D.dat
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"
CMD: del /f /s /q %windir%\prefetch\*.*
CMD: del /s /q C:\Windows\SoftwareDistribution\download\*.*
CMD: del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
CMD: del /s /q "%userprofile%\AppData\Local\temp\*.*"
CMD: ipconfig /flushdns
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
emptytemp:
Reboot:
End::

[/COLOR]

[Bohauo]

# -------------------------------
[HEADING=1]Malwarebytes AdwCleaner 8.4.0.0[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Build: 08-30-2022[/HEADING]
[HEADING=1]Database: 2023-07-19.3 (Cloud)[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Mode: Scan[/HEADING]
[HEADING=1]-------------------------------[/HEADING]
[HEADING=1]Start: 09-22-2023[/HEADING]
[HEADING=1]Duration: 00:00:05[/HEADING]
[HEADING=1]OS: Windows 10 (Build 19045.3448)[/HEADING]
[HEADING=1]Scanned: 31890[/HEADING]
[HEADING=1]Detected: 0[/HEADING]
***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

[Bohauo]

[HEADING=1]

Fix result of Farbar Recovery Scan Tool (x64) Version: 20-09-2023
Ran by Bohauo (22-09-2023 08:18:09) Run:2
Running from C:\Users\bohau\Desktop
Loaded Profiles: Bohauo
Boot Mode: Normal[/HEADING]
fixlist content:
[HR][/HR]
start::
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
RemoveProxy:
HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Run: [Trainer Manager] => C:\Users\bohau\Documents\My Trainers\Cheat Happens\Trainer Manager EA\TrainerManager.exe (No File)
HKU\S-1-5-21-2806114696-2502326770-847037938-1001...\Run: [electron.app.Lust Launcher] => D:\Programs\Lust Launcher\Lust Launcher.exe (No File)
FF Plugin HKU\S-1-5-21-2806114696-2502326770-847037938-1001: @lightspark.github.com/Lightspark;version=1 → C:\Program Files\Lightspark\nplightsparkplugin.dll [No File]
OPR Extension: (Amazon Assistant Promotion) - C:\Users\bohau\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-08-14]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\yvkurxwa.sys:changelist [1394]
AlternateDataStreams: C:\Users\bohau\Desktop\KVRT.exe:MBAM.Zone.Identifier [183]
FirewallRules: [{D7117FA5-FDC3-42CB-8879-AA0FB29EF7FF}] => (Allow) LPort=32976
FirewallRules: [{7440A2B4-816E-4193-8B25-FE149001ACA1}] => (Allow) LPort=17771
File: C:\WINDOWS\system32\perfh01D.dat
File: C:\WINDOWS\system32\perfc01D.dat
Folder: C:\Users\bohau\AppData\Roaming\Qqsp
VirusTotal: C:\WINDOWS\system32\drivers\yvkurxwa.sys
VirusTotal: C:\WINDOWS\system32\perfh01D.dat
VirusTotal: C:\WINDOWS\system32\perfc01D.dat
CMD: “%WINDIR%\SYSTEM32\lodctr.exe /R”
CMD: “%WINDIR%\SysWOW64\lodctr.exe /R”
CMD: “C:\Windows\SYSTEM32\lodctr.exe /R”
CMD: “C:\Windows\SysWOW64\lodctr.exe /R”
CMD: del /f /s /q %windir%\prefetch*.*
CMD: del /s /q C:\Windows\SoftwareDistribution\download*.*
CMD: del /s /q “%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache*."
CMD: del /s /q "%userprofile%\AppData\Local\temp*.”
CMD: ipconfig /flushdns
C:\Windows\Temp*.*
C:\WINDOWS\system32*.tmp
C:\WINDOWS\syswow64*.tmp
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
emptytemp:
Reboot:
End::
[HR][/HR]
Restore point was successfully created.
Processes closed successfully.

========= RemoveProxy: =========

“HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings” => removed successfully
“HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings” => removed successfully
“HKU\S-1-5-21-2806114696-2502326770-847037938-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings” => removed successfully
“HKU\S-1-5-21-2806114696-2502326770-847037938-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings” => removed successfully

========= End of RemoveProxy: =========

“HKU\S-1-5-21-2806114696-2502326770-847037938-1001\Software\Microsoft\Windows\CurrentVersion\Run\Trainer Manager” => removed successfully
“HKU\S-1-5-21-2806114696-2502326770-847037938-1001\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Lust Launcher” => removed successfully
HKU\S-1-5-21-2806114696-2502326770-847037938-1001\Software\MozillaPlugins@lightspark.github.com/Lightspark;version=1 => removed successfully
“C:\Program Files\Lightspark\nplightsparkplugin.dll” => not found
OPR Extension: (Amazon Assistant Promotion) - C:\Users\bohau\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-08-14] => Error: No automatic fix found for this entry.
C:\WINDOWS\system32\Drivers\yvkurxwa.sys => “:changelist” ADS removed successfully
C:\Users\bohau\Desktop\KVRT.exe => “:MBAM.Zone.Identifier” ADS removed successfully
“HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{D7117FA5-FDC3-42CB-8879-AA0FB29EF7FF}” => removed successfully
“HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7440A2B4-816E-4193-8B25-FE149001ACA1}” => removed successfully

========================= File: C:\WINDOWS\system32\perfh01D.dat ========================

C:\WINDOWS\system32\perfh01D.dat
File not signed
MD5: 240E0AB40143E0DFBD4D8F21B2AC1061
Creation and modification date: 2021-03-13 12:17 - 2023-09-21 17:04
Size: 000716668
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:
VirusTotal: 0

====== End of File: ======

========================= File: C:\WINDOWS\system32\perfc01D.dat ========================

C:\WINDOWS\system32\perfc01D.dat
File not signed
MD5: 2EC7AE9B67E770B244048D117418CAB4
Creation and modification date: 2021-03-13 12:17 - 2023-09-21 17:04
Size: 000149462
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:
VirusTotal: 0

====== End of File: ======

========================= Folder: C:\Users\bohau\AppData\Roaming\Qqsp ========================

2023-09-19 18:29 - 2023-09-19 18:29 - 000002174 ____A [529D2F574C9CE496F0E83253FB7D87B3] () C:\Users\bohau\AppData\Roaming\Qqsp\Qqsp.ini

====== End of Folder: ======

VirusTotal: C:\WINDOWS\system32\drivers\yvkurxwa.sys => VirusTotal
VirusTotal: C:\WINDOWS\system32\perfh01D.dat => VirusTotal
VirusTotal: C:\WINDOWS\system32\perfc01D.dat => VirusTotal

========= “%WINDIR%\SYSTEM32\lodctr.exe /R” =========

Error: Unable to rebuild performance counter setting from system backup store, error code is 2

========= End of CMD: =========

========= “%WINDIR%\SysWOW64\lodctr.exe /R” =========

Info: Successfully rebuilt performance counter setting from system backup store

========= End of CMD: =========

========= “C:\Windows\SYSTEM32\lodctr.exe /R” =========

Info: Successfully rebuilt performance counter setting from system backup store

========= End of CMD: =========

========= “C:\Windows\SysWOW64\lodctr.exe /R” =========

Info: Successfully rebuilt performance counter setting from system backup store

========= End of CMD: =========

========= del /f /s /q %windir%\prefetch*.* =========

Deleted file - C:\WINDOWS\prefetch\0.DAT-0EF914F3.pf
Deleted file - C:\WINDOWS\prefetch\ADWCLEANER.EXE-A7C26A94.pf
Deleted file - C:\WINDOWS\prefetch\AGENT.EXE-0DE385E4.pf
Deleted file - C:\WINDOWS\prefetch\AM_DELTA_PATCH_1.397.1344.0.E-0D4C71A7.pf
Deleted file - C:\WINDOWS\prefetch\APPLICATIONFRAMEHOST.EXE-CCD9A1AD.pf
Deleted file - C:\WINDOWS\prefetch\AUDIODG.EXE-7294161D.pf
Deleted file - C:\WINDOWS\prefetch\BACKGROUNDTASKHOST.EXE-1CCB634C.pf
Deleted file - C:\WINDOWS\prefetch\BATTLE.NET.EXE-F56BAE20.pf
Deleted file - C:\WINDOWS\prefetch\BATTLE.NET.EXE-F56BAE21.pf
Deleted file - C:\WINDOWS\prefetch\BATTLE.NET.EXE-F56BAE27.pf
Deleted file - C:\WINDOWS\prefetch\BCDEDIT.EXE-C593409F.pf
Deleted file - C:\WINDOWS\prefetch\BITSADMIN.EXE-327AEF0B.pf
Deleted file - C:\WINDOWS\prefetch\BUTLER.EXE-85BF6A49.pf
Deleted file - C:\WINDOWS\prefetch\cadrespri.7db
Deleted file - C:\WINDOWS\prefetch\CHCP.COM-49648F3F.pf
Deleted file - C:\WINDOWS\prefetch\CMD.EXE-4FC70BD8.pf
Deleted file - C:\WINDOWS\prefetch\CMD.EXE-B156931C.pf
Deleted file - C:\WINDOWS\prefetch\COMPPKGSRV.EXE-B86FFA30.pf
Deleted file - C:\WINDOWS\prefetch\CONHOST.EXE-D3D58372.pf
Deleted file - C:\WINDOWS\prefetch\CONSENT.EXE-07B2BFDE.pf
Deleted file - C:\WINDOWS\prefetch\CSRSS.EXE-0F6144B2.pf
Deleted file - C:\WINDOWS\prefetch\CTFMON.EXE-288C777F.pf
Deleted file - C:\WINDOWS\prefetch\DASHOST.EXE-12F61EEA.pf
Deleted file - C:\WINDOWS\prefetch\DBINSTALLER.EXE-404CC604.pf
Deleted file - C:\WINDOWS\prefetch\DEFRAG.EXE-ECCB83C1.pf
Deleted file - C:\WINDOWS\prefetch\DISCORD.EXE-5D1C2C90.pf
Deleted file - C:\WINDOWS\prefetch\DISCORD.EXE-5D1C2C91.pf
Deleted file - C:\WINDOWS\prefetch\DISCORD.EXE-5D1C2C97.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-0F2F3453.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-36D38ACE.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-3D891A19.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-44CE0D41.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-487C9835.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-68D05CED.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-6E4B45F7.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-99722B3A.pf
Deleted file - C:\WINDOWS\prefetch\DLLHOST.EXE-E31F3332.pf
Deleted file - C:\WINDOWS\prefetch\dynrespri.7db
Deleted file - C:\WINDOWS\prefetch\E5C1087F.EXE-168D2E07.pf
Deleted file - C:\WINDOWS\prefetch\EABACKGROUNDSERVICE.EXE-A16F7B17.pf
Deleted file - C:\WINDOWS\prefetch\EALOCALHOSTSVC.EXE-5326E973.pf
Deleted file - C:\WINDOWS\prefetch\ENC-AMF-TEST64.EXE-E8B7631F.pf
Deleted file - C:\WINDOWS\prefetch\EPICGAMESLAUNCHER.EXE-4D774F0A.pf
Deleted file - C:\WINDOWS\prefetch\EPICWEBHELPER.EXE-F669B95A.pf
Deleted file - C:\WINDOWS\prefetch\EPICWEBHELPER.EXE-F669B95B.pf
Deleted file - C:\WINDOWS\prefetch\EPICWEBHELPER.EXE-F669B961.pf
Deleted file - C:\WINDOWS\prefetch\FILECOAUTH.EXE-22D081E7.pf
Deleted file - C:\WINDOWS\prefetch\FONTDRVHOST.EXE-6F9BA2E1.pf
Deleted file - C:\WINDOWS\prefetch\FRST64.EXE-224907CB.pf
Deleted file - C:\WINDOWS\prefetch\GALAXYCLIENT HELPER.EXE-0E2A6E28.pf
Deleted file - C:\WINDOWS\prefetch\GALAXYCLIENT HELPER.EXE-0E2A6E29.pf
Deleted file - C:\WINDOWS\prefetch\GALAXYCLIENTSERVICE.EXE-4643D534.pf
Deleted file - C:\WINDOWS\prefetch\GALAXYUPDATER.EXE-32D5B9FA.pf
Deleted file - C:\WINDOWS\prefetch\GALAXYUPDATER.EXE-5D2DC9D8.pf
Deleted file - C:\WINDOWS\prefetch\GAMEBAR.EXE-48A58455.pf
Deleted file - C:\WINDOWS\prefetch\GAMEBARFTSERVER.EXE-CEA0A8EA.pf
Deleted file - C:\WINDOWS\prefetch\GAMEBARPRESENCEWRITER.EXE-454D8C29.pf
Deleted file - C:\WINDOWS\prefetch\GAMEINPUTSVC.EXE-A4A3C069.pf
Deleted file - C:\WINDOWS\prefetch\GAMEOVERLAYUI.EXE-6931D1E9.pf
Deleted file - C:\WINDOWS\prefetch\GAMINGSERVICES.EXE-F900AEB9.pf
Deleted file - C:\WINDOWS\prefetch\GET-GRAPHICS-OFFSETS32.EXE-A65937A3.pf
Deleted file - C:\WINDOWS\prefetch\GET-GRAPHICS-OFFSETS64.EXE-FD5C0064.pf
Deleted file - C:\WINDOWS\prefetch\GOOGLEUPDATE.EXE-0C74AC29.pf
Deleted file - C:\WINDOWS\prefetch\GPU_ENCODER_HELPER.EXE-92F636B7.pf
Deleted file - C:\WINDOWS\prefetch\IG-0.EXE-B3E459A9.pf
Deleted file - C:\WINDOWS\prefetch\IG-1.EXE-C73A142E.pf
Deleted file - C:\WINDOWS\prefetch\IG-2.EXE-DA8FCEB3.pf
Deleted file - C:\WINDOWS\prefetch\IG.EXE-E4EB6B06.pf
Deleted file - C:\WINDOWS\prefetch\IG.EXE-FF826E00.pf
Deleted file - C:\WINDOWS\prefetch\IGOPROXY32.EXE-2C929DAA.pf
Deleted file - C:\WINDOWS\prefetch\IPCONFIG.EXE-4C22F32F.pf
Deleted file - C:\WINDOWS\prefetch\ITCH-SETUP.EXE-AC6E7939.pf
Deleted file - C:\WINDOWS\prefetch\ITCH.EXE-2EC5E258.pf
Deleted file - C:\WINDOWS\prefetch\ITCH.EXE-2EC5E25A.pf
Deleted file - C:\WINDOWS\prefetch\JUSCHED.EXE-356E7D5A.pf
Deleted file - C:\WINDOWS\prefetch\KEYSCRAMBLER.EXE-EFD7106B.pf
Deleted file - C:\WINDOWS\prefetch\KVRT.EXE-36A9C531.pf
Deleted file - C:\WINDOWS\prefetch\LAUNCHER.EXE-48AC894A.pf
Deleted file - C:\WINDOWS\prefetch\LAUNCHER.EXE-C03AF1B5.pf
Deleted file - C:\WINDOWS\prefetch\Layout.ini
Deleted file - C:\WINDOWS\prefetch\LODCTR.EXE-070943E4.pf
Deleted file - C:\WINDOWS\prefetch\LODCTR.EXE-D109F848.pf
Deleted file - C:\WINDOWS\prefetch\LOGONUI.EXE-BDAAE9F5.pf
Deleted file - C:\WINDOWS\prefetch\MAILCLIENT.EXE-9A116B74.pf
Deleted file - C:\WINDOWS\prefetch\MAILCLIENT.EXE-9A116B75.pf
Deleted file - C:\WINDOWS\prefetch\MAILCLIENT.EXE-9A116B76.pf
Deleted file - C:\WINDOWS\prefetch\MBAMTRAY.EXE-F7116081.pf
Deleted file - C:\WINDOWS\prefetch\MBAMWSC.EXE-4897FA4A.pf
Deleted file - C:\WINDOWS\prefetch\MBUPDATRV5.EXE-7BBE1D47.pf
Deleted file - C:\WINDOWS\prefetch\MICROSOFTEDGEUPDATE.EXE-9CD0E6BD.pf
Deleted file - C:\WINDOWS\prefetch\MODORGANIZER.EXE-0A458F1C.pf
Deleted file - C:\WINDOWS\prefetch\MOUSOCOREWORKER.EXE-D85700E2.pf
Deleted file - C:\WINDOWS\prefetch\MPCMDRUN.EXE-C242E0AB.pf
Deleted file - C:\WINDOWS\prefetch\MPSIGSTUB.EXE-2DF9D4BA.pf
Deleted file - C:\WINDOWS\prefetch\MSEDGE.EXE-74759BD9.pf
Deleted file - C:\WINDOWS\prefetch\MSEDGE.EXE-74759BE0.pf
Deleted file - C:\WINDOWS\prefetch\MSIEXEC.EXE-576C42AA.pf
Deleted file - C:\WINDOWS\prefetch\NOTEPAD++.EXE-A5DDB0E4.pf
Deleted file - C:\WINDOWS\prefetch\NOTEPAD.EXE-8CD8358B.pf
Deleted file - C:\WINDOWS\prefetch\NOTEPAD.EXE-CA9CE04F.pf
Deleted file - C:\WINDOWS\prefetch\NVCONTAINER.EXE-F2B19613.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA GEFORCE EXPERIENCE.EXE-A443C9A9.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA GEFORCE EXPERIENCE.EXE-A443C9AA.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA GEFORCE EXPERIENCE.EXE-A443C9AB.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA NOTIFICATION.EXE-A92BF4B5.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA NOTIFICATION.EXE-A92BF4B6.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA SHARE.EXE-30558FA1.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA SHARE.EXE-30558FA2.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA SHARE.EXE-30558FA3.pf
Deleted file - C:\WINDOWS\prefetch\NVIDIA WEB HELPER.EXE-93CE50EF.pf
Deleted file - C:\WINDOWS\prefetch\NVNODEJSLAUNCHER.EXE-D879C37F.pf
Deleted file - C:\WINDOWS\prefetch\NVOAWRAPPERCACHE.EXE-49F72975.pf
Deleted file - C:\WINDOWS\prefetch\NVSHIM.EXE-1098879A.pf
Deleted file - C:\WINDOWS\prefetch\NVSPHELPER64.EXE-8C53D28E.pf
Deleted file - C:\WINDOWS\prefetch\NXMHANDLER.EXE-465B5B44.pf
Deleted file - C:\WINDOWS\prefetch\OAWRAPPER.EXE-5ED2F31D.pf
Deleted file - C:\WINDOWS\prefetch\OBS-NVENC-TEST.EXE-A18EC24B.pf
Deleted file - C:\WINDOWS\prefetch\OBS-QSV-TEST.EXE-73371F33.pf
Deleted file - C:\WINDOWS\prefetch\OPERA.EXE-569C54DE.pf
Deleted file - C:\WINDOWS\prefetch\OPERA.EXE-569C54DF.pf
Deleted file - C:\WINDOWS\prefetch\OPERA.EXE-569C54E0.pf
Deleted file - C:\WINDOWS\prefetch\OPERA.EXE-569C54E6.pf
Deleted file - C:\WINDOWS\prefetch\OPERA_AUTOUPDATE.EXE-EF834CA8.pf
Deleted file - C:\WINDOWS\prefetch\OPERA_AUTOUPDATE.EXE-EF834CAF.pf
Deleted file - C:\WINDOWS\prefetch\OPERA_CRASHREPORTER.EXE-65EE2557.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLF PROMOTIONS.EXE-309D1EFF.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLFBROWSER.EXE-82EBDC78.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLFBROWSER.EXE-82EBDC79.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLFBROWSER.EXE-82EBDC7A.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLFBROWSER.EXE-82EBDC80.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLFHELPER.EXE-82EC927A.pf
Deleted file - C:\WINDOWS\prefetch\OVERWOLFUPDATER.EXE-DD39217E.pf
Deleted file - C:\WINDOWS\prefetch\OW-OBS.EXE-1634C20E.pf
C:\WINDOWS\prefetch\PfPre_af658507.mkd
Deleted file - C:\WINDOWS\prefetch\PHONEEXPERIENCEHOST.EXE-5C6ABA28.pf
Deleted file - C:\WINDOWS\prefetch\PING.EXE-AE6AEB92.pf
Deleted file - C:\WINDOWS\prefetch\QTWEBENGINEPROCESS.EXE-F7D58D9D.pf
Deleted file - C:\WINDOWS\prefetch\REG.EXE-4EBD9CDE.pf
Deleted file - C:\WINDOWS\prefetch\REG.EXE-ED2E159A.pf
Deleted file - C:\WINDOWS\prefetch\REGSVR32.EXE-900AC3E6.pf
Deleted file - C:\WINDOWS\prefetch\ResPriHMStaticDb.ebd
Deleted file - C:\WINDOWS\prefetch\RTKAUDUSERVICE64.EXE-2DC117DB.pf
Deleted file - C:\WINDOWS\prefetch\RUNDLL32.EXE-0167FE80.pf
Deleted file - C:\WINDOWS\prefetch\RUNDLL32.EXE-23409B7B.pf
Deleted file - C:\WINDOWS\prefetch\RUNDLL32.EXE-59A353AF.pf
Deleted file - C:\WINDOWS\prefetch\RUNDLL32.EXE-8C1210FC.pf
Deleted file - C:\WINDOWS\prefetch\RUNDLL32.EXE-C30F1043.pf
Deleted file - C:\WINDOWS\prefetch\RUNDLL32.EXE-DEDDE42F.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-078AEB65.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-2DDEE75F.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-314FFE7A.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-317E21EE.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-4AA09179.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-88C94EFD.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-B2B2EF42.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-DEE38DBA.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-E33589A4.pf
Deleted file - C:\WINDOWS\prefetch\RUNTIMEBROKER.EXE-F4ECBEAA.pf
Deleted file - C:\WINDOWS\prefetch\SEARCHAPP.EXE-44A5EF19.pf
Deleted file - C:\WINDOWS\prefetch\SEARCHFILTERHOST.EXE-AA802AE6.pf
Deleted file - C:\WINDOWS\prefetch\SEARCHINDEXER.EXE-94A6B3ED.pf
Deleted file - C:\WINDOWS\prefetch\SEARCHPROTOCOLHOST.EXE-80E6FA72.pf
Deleted file - C:\WINDOWS\prefetch\SECURITYHEALTHHOST.EXE-1D56F298.pf
Deleted file - C:\WINDOWS\prefetch\SECURITYHEALTHSYSTRAY.EXE-CF964915.pf
Deleted file - C:\WINDOWS\prefetch\SFSE_LOADER.EXE-B0882589.pf
Deleted file - C:\WINDOWS\prefetch\SGRMBROKER.EXE-A337295A.pf
Deleted file - C:\WINDOWS\prefetch\SMARTSCREEN.EXE-D91584E7.pf
Deleted file - C:\WINDOWS\prefetch\SMSS.EXE-1998941A.pf
Deleted file - C:\WINDOWS\prefetch\SPPSVC.EXE-4534062F.pf
Deleted file - C:\WINDOWS\prefetch\SRTASKS.EXE-040E5B63.pf
Deleted file - C:\WINDOWS\prefetch\STARTMENUEXPERIENCEHOST.EXE-F5398540.pf
Deleted file - C:\WINDOWS\prefetch\STEAM.EXE-F2F0BF81.pf
Deleted file - C:\WINDOWS\prefetch\STEAMSERVICE.EXE-85E6D316.pf
Deleted file - C:\WINDOWS\prefetch\STEAMWEBHELPER.EXE-F6EACB9D.pf
Deleted file - C:\WINDOWS\prefetch\STEAMWEBHELPER.EXE-F6EACB9E.pf
Deleted file - C:\WINDOWS\prefetch\STEAMWEBHELPER.EXE-F6EACB9F.pf
Deleted file - C:\WINDOWS\prefetch\STEAMWEBHELPER.EXE-F6EACBA4.pf
Deleted file - C:\WINDOWS\prefetch\STEAMWEBHELPER.EXE-F6EACBA5.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-044C2CEE.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-130A03D7.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-1341D27E.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-2FD8DE5C.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-31BB715E.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-3B415129.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-441A9842.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-4C644FAC.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-4C9FF1FE.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-5457BD37.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-58647F97.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-619A17EF.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-64754733.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-6F0B7119.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-85AE3098.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-8A4B7BE6.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-8B002554.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-8D96E2CE.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-A03A3458.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-B1B79D02.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-B330945D.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-C0C40620.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-C1A95093.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-C2E6C886.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-C3B7F9D8.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-D165DB1B.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-D8ED70B8.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-DAC42F40.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-E1268428.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-E2E520BB.pf
Deleted file - C:\WINDOWS\prefetch\SVCHOST.EXE-ED9CB005.pf
Deleted file - C:\WINDOWS\prefetch\TASKHOSTW.EXE-FF52CF7C.pf
Deleted file - C:\WINDOWS\prefetch\TASKKILL.EXE-4A4ED827.pf
Deleted file - C:\WINDOWS\prefetch\TEXTINPUTHOST.EXE-8966E9F8.pf
Deleted file - C:\WINDOWS\prefetch\TIWORKER.EXE-A807FBB6.pf
Deleted file - C:\WINDOWS\prefetch\TRUSTEDINSTALLER.EXE-236C6799.pf
Deleted file - C:\WINDOWS\prefetch\UBISOFTCONNECT.EXE-44D7D85D.pf
Deleted file - C:\WINDOWS\prefetch\UPC.EXE-07D7CA27.pf
Deleted file - C:\WINDOWS\prefetch\UPDATE.EXE-7977B361.pf
Deleted file - C:\WINDOWS\prefetch\UPLAYSERVICE.EXE-2AC91783.pf
Deleted file - C:\WINDOWS\prefetch\UPLAYWEBCORE.EXE-D7714742.pf
Deleted file - C:\WINDOWS\prefetch\UPLAYWEBCORE.EXE-D7714743.pf
Deleted file - C:\WINDOWS\prefetch\UPLAYWEBCORE.EXE-D7714749.pf
Deleted file - C:\WINDOWS\prefetch\USEROOBEBROKER.EXE-1D959DB6.pf
Deleted file - C:\WINDOWS\prefetch\USOCLIENT.EXE-1BD19512.pf
Deleted file - C:\WINDOWS\prefetch\VSSVC.EXE-882CE84D.pf
Deleted file - C:\WINDOWS\prefetch\VULKANDRIVERQUERY.EXE-47A6154F.pf
Deleted file - C:\WINDOWS\prefetch\WERFAULT.EXE-A1931F2E.pf
Deleted file - C:\WINDOWS\prefetch\WEVTUTIL.EXE-AA4C1798.pf
Deleted file - C:\WINDOWS\prefetch\WINLOGON.EXE-6B149215.pf
Deleted file - C:\WINDOWS\prefetch\WINMGMT.EXE-104784A6.pf
Deleted file - C:\WINDOWS\prefetch\WINRAR.EXE-196060F7.pf
Deleted file - C:\WINDOWS\prefetch\WMIADAP.EXE-01E796F6.pf
Deleted file - C:\WINDOWS\prefetch\WMIPRVSE.EXE-606B6550.pf
Deleted file - C:\WINDOWS\prefetch\WMIPRVSE.EXE-B1AC0354.pf
Deleted file - C:\WINDOWS\prefetch\WMPNETWK.EXE-4DB03C03.pf
Deleted file - C:\WINDOWS\prefetch\WUAUCLT.EXE-24C86B85.pf
Deleted file - C:\WINDOWS\prefetch\XBOXPCAPPFT.EXE-0FC256D6.pf
Deleted file - C:\WINDOWS\prefetch\XMOUSEBUTTONCONTROL.EXE-6224CB5B.pf
Deleted file - C:\WINDOWS\prefetch\ZAM.EXE-04D9CBE5.pf

========= End of CMD: =========

========= del /s /q C:\Windows\SoftwareDistribution\download*.* =========

Deleted file - C:\Windows\SoftwareDistribution\download\53fa4504fc41cb5717603a86808ed78e6f4280d3
Deleted file - C:\Windows\SoftwareDistribution\download\Install\AM_Delta_Patch_1.397.1344.0.exe

========= End of CMD: =========

========= del /s /q “%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache*.*” =========

0

========= End of CMD: =========

========= del /s /q “%userprofile%\AppData\Local\temp*.*” =========

Deleted file - C:\Users\bohau\AppData\Local\temp.ses
Deleted file - C:\Users\bohau\AppData\Local\temp\23f5e943-8b80-4a07-92a7-aa6cba8a65eb.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\368b2643-4e96-4764-a946-fb82049743e8.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\44306644-f72b-4caf-8e56-0a19166f97b3.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\653045a4-8883-46e6-83a2-7341581fff21.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\AdobeARM.log
Deleted file - C:\Users\bohau\AppData\Local\temp\assistant_installer_20230921170126.log
Deleted file - C:\Users\bohau\AppData\Local\temp\assistant_installer_20230921170245.log
Deleted file - C:\Users\bohau\AppData\Local\temp\assistant_installer_20230921172825.log
Deleted file - C:\Users\bohau\AppData\Local\temp\assistant_installer_20230922075818.log
Deleted file - C:\Users\bohau\AppData\Local\temp\B66A.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\C524.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\CUsersbohauAppDataLocalProgramsOpera GX102.0.4880.55opera_autoupdate.download.lock
Deleted file - C:\Users\bohau\AppData\Local\temp\CUsersbohauAppDataLocalProgramsOpera102.0.4880.56opera_autoupdate.download.lock
Deleted file - C:\Users\bohau\AppData\Local\temp\d6232049-9f5d-4ff5-9ced-13821faa999f.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\ecache.bin
Deleted file - C:\Users\bohau\AppData\Local\temp\itch-setup-log.txt
Deleted file - C:\Users\bohau\AppData\Local\temp\jusched.log
Deleted file - C:\Users\bohau\AppData\Local\temp\wct1B97.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\wct1ED6.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\wct2B97.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\wct3C7D.tmp
Deleted file - C:\Users\bohau\AppData\Local\temp\zam-shadow-copy-record.mbr
Deleted file - C:\Users\bohau\AppData\Local\temp\zam-shadow-copy-record0.vbr
Deleted file - C:\Users\bohau\AppData\Local\temp\zam-shadow-copy-record1.vbr
Deleted file - C:\Users\bohau\AppData\Local\temp\zam-shadow-copy-record2.vbr
Deleted file - C:\Users\bohau\AppData\Local\temp\zam-shadow-copy-record3.vbr
Deleted file - C:\Users\bohau\AppData\Local\temp.opera\63C16947E202\Crash Reports\metadata
Deleted file - C:\Users\bohau\AppData\Local\temp.opera\63C16947E202\Crash Reports\settings.dat
Deleted file - C:\Users\bohau\AppData\Local\temp.opera\BE66E869410D\installer.exe
Deleted file - C:\Users\bohau\AppData\Local\temp\chrome_BITS_15648_1223763357\c478f302a331b28cb87cc89362ff38b25d75b925a5325a3dca89129ce1cc3c99.puff
Deleted file - C:\Users\bohau\AppData\Local\temp\chrome_BITS_19304_1404203578\03839086981499d0fd218fc68fbb18b352bd67793cb88b703423dd45b5ac6b98.puff
Deleted file - C:\Users\bohau\AppData\Local\temp\Dumps\79eb6c55-dc8d-46b1-904b-d6128021fa0d.blank
Deleted file - C:\Users\bohau\AppData\Local\temp\Dumps\bdbceaad-8e81-4899-bc33-9d9c3f6ebb13.blank
Deleted file - C:\Users\bohau\AppData\Local\temp\Dumps\c173ae7e-05bc-4527-a9e9-6825749991ae.blank
Deleted file - C:\Users\bohau\AppData\Local\temp\Dumps\d0370480-1dae-4498-a552-f5ecc834bb9b.blank
Deleted file - C:\Users\bohau\AppData\Local\temp\eM Client temporary files\YXBwX2ljb24=.png

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== “C:\Windows\Temp*.*” ==========

C:\Windows\Temp\93347afb-315a-466c-8eba-a699a27d2444.tmp => moved successfully
C:\Windows\Temp\BootClean.log => moved successfully
C:\Windows\Temp\catalog.json => moved successfully
C:\Windows\Temp\lpksetup-20230921-165739-0.log => moved successfully
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\msedge_installer.log => moved successfully
C:\Windows\Temp\WER67C8.tmp.WERDataCollectionStatus.txt => moved successfully

========= End → “C:\Windows\Temp*.*” ========

=========== “C:\WINDOWS\system32*.tmp” ==========

not found

========= End → “C:\WINDOWS\system32*.tmp” ========

=========== “C:\WINDOWS\syswow64*.tmp” ==========

not found

========= End → “C:\WINDOWS\syswow64*.tmp” ========

================== ExportKey: ===================

[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths]
“C:\Program Files (x86)\Zemana AntiLogger”=“0”
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths]

=== End of ExportKey ===

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 786432 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 15970837 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 54247276 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 8234 B
NetworkService => 9410 B
bohau => 102495 B

RecycleBin => 0 B
EmptyTemp: => 67.8 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 08:18:37 ====

[/HEADING]

[Malnutrition]

Download RogueKiller and install the program.
Once downloaded and installed, right click and run as admin.
Click the check for updates button.
Go to scan setting then slide the MalPE option right to activate.
Then go to scan, then start a full scan on your machine.
Then click report when the scan completes.
Under Share my report click on open then select text file.
Copy it and paste the results here.
Make sure you do not remove anything detected until I see the log please.

---

---

Download Autologger to your desktop.
Disable your Anitivirus/Defender prior to running.

[ul]
[li]Unzip it there. – If you are unsure how to unzip a program, then use ---- http://www.7-zip.org/ ----[/li][li]Right click Autologger and run as admin. (Xp user double click)[/li][li]AVZ4 will open and scan your machine, allow this to complete.[/li][li]Upload Collectionlog.zip to your next reply.[/li][/ul]

[Bohauo]

Program : RogueKiller Anti-Malware
Version : 15.12.1.0
x64 : Yes
Program Date : Sep 18 2023
Location : C:\Program Files\RogueKiller\RogueKiller64.exe
Premium : No
Company : Adlice Software
Website : https://www.adlice.com/
Contact : Support Form | Contact • Adlice Software
Website : Free Virus Cleaner | RogueKiller AntiMalware • Adlice Software
Operating System : Windows 10 (10.0.19045) 64-bit
64-bit OS : Yes
Startup : 0
WindowsPE : No
User : Bohauo
User is Admin : Yes
Date : 2023/09/22 12:29:51
Type : Scan
Aborted : No
Scan Mode : Standard
Duration : 859
Found items : 7
Total scanned : 124277
Signatures Version : 20230918_094309
Truesight Driver : Yes
Updates Count : 14

************************* Warnings *************************

************************* Updates *************************
CPUID CPU-Z 1.99 (64-bit), version 1.99
[+] Available Version : 2.07
[+] Size : 4,96 MB
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Program Files\CPUID\CPU-Z\

HWiNFO64 Version 6.28 (64-bit), version 6.28
[+] Available Version : 7.62
[+] Size : 5,27 MB
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Program Files\HWiNFO64\

Notepad++ (64-bit x64) (64-bit), version 8.5.6
[+] Available Version : 8.5.7
[+] Size : 16,6 MB
[+] Wow6432 : No
[+] Portable : No

VLC media player (64-bit), version 3.0.16
[+] Available Version : 3.0.18
[+] Wow6432 : No
[+] Portable : No
[+] update_location : D:\Program\VideoLAN\VLC

Malwarebytes version 4.6.1.280 (64-bit), version 4.6.1.280
[+] Available Version : 4.6.2
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Program Files\Malwarebytes\Anti-Malware

ImageGlass (64-bit), version 8.7.11.6
[+] Available Version : 8.9.6.9
[+] Size : 44,8 MB
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Users\bohau\AppData\Local\Programs\ImageGlass\

paint.net (64-bit), version 5.0.7
[+] Available Version : 5.0.9
[+] Size : 208 MB
[+] Wow6432 : No
[+] Portable : No

LibreOffice 7.4.0.3 (64-bit), version 7.4.0.3
[+] Available Version : 7.6.1
[+] Size : 831 MB
[+] Wow6432 : No
[+] Portable : No
[+] update_location : D:\Program\LibreOffice\

Oracle VM VirtualBox 6.1.12 (64-bit), version 6.1.12
[+] Available Version : 7.0.10
[+] Size : 216 MB
[+] Wow6432 : No
[+] Portable : No

Google Chrome (32-bit), version 116.0.5845.188
[+] Available Version : 117.0.5938.89
[+] Wow6432 : Yes
[+] Portable : No
[+] update_location : C:\Program Files\Google\Chrome\Application

K-Lite Mega Codec Pack 17.7.1 (32-bit), version 17.7.1
[+] Available Version : 17.8.0
[+] Size : 168 MB
[+] Wow6432 : Yes
[+] Portable : No
[+] update_location : C:\Program Files (x86)\K-Lite Codec Pack\

Ubisoft Connect (32-bit), version 2.0.0.0
[+] Available Version : 145.1.0.10933
[+] Wow6432 : Yes
[+] Portable : No
[+] update_location : D:\Program\Ubisoft\Ubisoft Game Launcher\

Spotify (64-bit), version 1.2.16.947.gcfbaa410
[+] Available Version : 1.2.18.999.g9b38fc27
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Users\bohau\AppData\Roaming\Spotify

Microsoft Visual Studio Code (User) (64-bit), version 1.45.1
[+] Available Version : 1.82
[+] Size : 234 MB
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Users\bohau\AppData\Local\Programs\Microsoft VS Code\

************************* Processes *************************

************************* Modules *************************

************************* Services *************************

************************* Scheduled Tasks *************************

************************* Registry *************************
[QUOTE]
[QUOTE]
[QUOTE]
[QUOTE]
[QUOTE]
[QUOTE]
XX - System Policies
└── [PUM.Policies (Potentially Malicious)] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin – 0 → Found
[/QUOTE]
[/QUOTE]
[/QUOTE]
[/QUOTE]
[/QUOTE]
[/QUOTE]
************************* WMI *************************

************************* Hosts File *************************
is_too_big : No
hosts_file_path : C:\Windows\System32\drivers\etc\hosts

************************* Filesystem *************************
[PUP.HackTool (Potentially Malicious)] (file) TrSpeedHack_x64.dll – C:\Users\bohau\AppData\Local\FLiNGTrainer\TrSpeedHack_x64.dll → Found
[PUP.HackTool (Potentially Malicious)] (file) me33-Bohauo.exe – C:\Users\bohau\Documents\My Trainers\me33-Bohauo.exe → Found
[PUP.HackTool (Potentially Malicious)] (file) MechWarrior 5 Mercenaries v1.0-v1.1.323 Plus 15 Trainer.exe – C:\Users\bohau\Documents\My Trainers\MechWarrior 5 Mercenaries v1.0-v1.1.323 Plus 15 Trainer.exe → Found
[PUP.HackTool (Potentially Malicious)] (file) No Mans Sky v1.0 Plus 25 Trainer.exe – C:\Users\bohau\Documents\My Trainers\No Mans Sky v1.0 Plus 25 Trainer.exe → Found
[Cloud.Generic (Malicious)] (file) unl-graw.exe – C:\Users\bohau\Documents\My Trainers\unl-graw.exe → Found
[Cloud.Generic (Malicious)] (file) w2-Bohauo.exe – C:\Users\bohau\Documents\My Trainers\w2-Bohauo.exe → Found

************************* Web Browsers *************************

************************* Antirootkit *************************

[Bohauo]

Autologger zipfile

[Malnutrition]

I’ll take a look at this when I return home.

[Malnutrition]

Navigate to this file location. (You can use everything search engine to get to it quickly)
[COLOR=rgb(184, 49, 47)]C:\WINDOWS\system32\drivers\yvkurxwa.sys[/COLOR][COLOR=rgb(184, 49, 47)]

Right click the file and select rename.
Rename the end of the file to .bak instead of .sys
I am unfamiliar with this file and am not finding any information on it, so let’s disable it; instead of nuking it.

---

---

---

Look in the Autologger folder and drag out the [COLOR=rgb(184, 49, 47)]Check_Browsers_LNK.log
To your desktop.
AutoLogger\CheckBrowserLnk

Drag and drop onto the ClearLNK utility .
After saving ClearLNK to desktop.
[IMG alt=“move.gif”]https://dragokas.com/tools/move.gif

---

---

Run HijackThis! as admin! (located in the folder …Autologger\HijackThis)
Do a system scan, then check each item below, make sure and only check the items listed.
Then click Fix checked.
The computer will need to reboot, allow it to do so.
O22 - Tasks_Migrated: \Microsoft\Windows\Diagnosis\RecommendedTroublesho otingScanner - C:\WINDOWS\system32\mitigationscanner.exe (file missing)
O22 - Tasks_Migrated: \Microsoft\Windows\termsrv\RemoteFX\RemoteFXvGPUDi sableTask - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe Disable (file missing)
O22 - Tasks_Migrated: \Microsoft\Windows\termsrv\RemoteFX\RemoteFXWarnin gTask - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe Warning (file missing)

---

---

Download and Run No Bot.
Click Check for updates.
Go to scan tab.
Choose threat scan.
Screen shot any detection.
Remove if any…[/IMG][/COLOR][/color]

[Bohauo]

Navigate to this file location. (You can use everything search engine to get to it quickly)

Right click the file and select rename.
Rename the end of the file to .bak instead of .sys
I am unfamiliar with this file and am not finding any information on it, so let’s disable it; instead of nuking it.

---

---

---

So, i couldn’t find that file anywhere with “everyting” i checked the whole computer.

[Bohauo]

---

---

---

Look in the Autologger folder and drag out the [COLOR=rgb(184, 49, 47)]Check_Browsers_LNK.log
To your desktop.

Drag and drop onto the ClearLNK utility .
After saving ClearLNK to desktop.
[IMG alt=“move.gif”]https://dragokas.com/tools/move.gif

---

---

I couldn’t download the file via the address you posted, MBAM freaked out with this info:

Malwarebytes

https://www.malwarebytes.com

-Log Details-
Protection Event Date: 23/09/2023
Protection Event Time: 10:05
Log File: ec860678-59e7-11ee-97ad-309c239ad9b7.json

-Software Information-
Version: 4.6.2.281
Components Version: 1.0.2131
Update Package Version: 1.0.75575
Licence: Premium

-System Information-
OS: Windows 10 (Build 19045.3448)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Users\bohau\AppData\Local\Programs\Opera GX\opera.exe, Blocked, -1, -1, 0.0.0, ,

-Website Data-
Category: RiskWare
Domain: dragokas.com
IP Address: 172.67.184.162
Port: 443
Type: Outbound
File: C:\Users\bohau\AppData\Local\Programs\Opera GX\opera.exe

(end)

So i downloaded the file from “Majorgeeks” i hope that is alright, here is the log from ClearLNK

ClearLNK by Alex Dragokas ver. 2.9.0.18

OS: x64 Windows 10 Pro, 10.0.19045.3448, Service Pack: 0
Time: 23.09.2023 - 10:08
Language: OS: en-GB (0x809). Display: en-GB (0x809). Non-Unicode: en-GB (0x809)
Elevated: Yes
User: Bohauo (group: Administrator)

_____________________________ Begin of Log ______________________________
.
[ OK ] 15 “C:\Users\bohau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Snipping Tool (2).lnk” → [ “C:\WINDOWS\system32\SnippingTool.exe” ] (icon has been recovered)
[ OK ] 23 “C:\Users\bohau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Snipping Tool.lnk” → [ “C:\WINDOWS\system32\SnippingTool.exe” ] (icon has been recovered)
[ OK ] 27 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk” → [ “C:\WINDOWS\system32\osk.exe” ] (icon has been recovered)
[ OK ] 28 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk” → [ “C:\WINDOWS\system32\narrator.exe” ] (icon has been recovered)
[ OK ] 29 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk” → [ “C:\Windows\System32\wfs.exe” ] (Method RN-S) (OK)
[ OK ] 69 “C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk” → [ “C:\WINDOWS\system32\osk.exe” ] (icon has been recovered)
.
[DEL ] 1 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TQ Game Launcher.lnk” (target was not recovered)
[DEL ] 2 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOOT.lnk” (target was not recovered)
[DEL ] 3 “C:\Users\Public\Desktop\LOOT.lnk” (target was not recovered)
[DEL ] 4 “C:\Users\bohau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\b243764c816c0b67\karrynsprison50.lnk” (target was not recovered)
[DEL ] 5 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhoreCraft\Microsoft .NET Framework 4.lnk” (target was not recovered)
[DEL ] 6 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhoreCraft\Epic Redist Package.lnk” (target was not recovered)
[DEL ] 7 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhoreCraft\Unreal Development Kit.lnk” (target was not recovered)
[DEL ] 8 “C:\Users\bohau\Desktop\Other Software\KeePass 2.lnk” (target was not recovered)
[DEL ] 9 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PassFab for Word\PassFab for Word.lnk” (target was not recovered)
[DEL ] 10 “C:\Users\bohau\Desktop\Other Software\PassFab for Word.lnk” (target was not recovered)
[DEL ] 11 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PassFab for Word\Uninstall PassFab for Word.lnk” (target was not recovered)
[DEL ] 12 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo Immortal\Diablo Immortal.lnk” (target was not recovered)
[DEL ] 13 “C:\Users\bohau\Desktop\Games\Diablo Immortal.lnk” (target was not recovered)
[DEL ] 14 “C:\ProgramData\Microsoft\Windows\GameExplorer{DE71236A-30E7-4970-96E0-4FE914BA3034}\PlayTasks\0\Play.lnk” (target was not recovered)
[DEL ] 16 “C:\Users\bohau\Desktop\Games\Command & Conquer™ Remastered Collection.lnk” (target was not recovered)
[DEL ] 17 “C:\ProgramData\Microsoft\Windows\GameExplorer{DE71236A-30E7-4970-96E0-4FE914BA3034}\PlayTasks\1\Game Manual.lnk” (target was not recovered)
[DEL ] 18 “C:\ProgramData\Microsoft\Windows\GameExplorer{DE71236A-30E7-4970-96E0-4FE914BA3034}\PlayTasks\2\ReadMe.txt.lnk” (target was not recovered)
[DEL ] 19 “C:\Users\bohau\Desktop\Other Software\MailWasherPro.lnk” (target was not recovered)
[DEL ] 20 “C:\Users\bohau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\b9d4a50bea9a196\name.lnk” (target was not recovered)
[DEL ] 21 “C:\Users\bohau\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\PERPET~1\DSINST~1.LNK” (target was not recovered)
[DEL ] 22 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Perpetual Change\Perpetual Change.lnk” (target was not recovered)
[DEL ] 24 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tixati\Tixati.lnk” (target was not recovered)
[DEL ] 25 “C:\Users\bohau\Desktop\Other Software\Cheat Engine.lnk” (target was not recovered)
[DEL ] 26 “C:\Users\bohau\Desktop\Other Software\ImageGlass.lnk” (target was not recovered)
[DEL ] 31 “C:\Users\bohau\Desktop\Other Software\Mail Washer Pro.lnk” (target was not recovered)
[DEL ] 32 “C:\Users\bohau\Desktop\Games\NFS Underground.lnk” (target was not recovered)
[DEL ] 33 “C:\Users\Public\Desktop\ImageGlass.lnk” (target was not recovered)
[DEL ] 34 “C:\Users\bohau\Desktop\Games\Airport Simulator 2019.lnk” (target was not recovered)
[DEL ] 35 “C:\Users\bohau\Desktop\Games\BattleTech Mod Manager.lnk” (target was not recovered)
[DEL ] 36 “C:\Users\bohau\Desktop\Games\Assassin’s Creed IV Black Flag.lnk” (target was not recovered)
[DEL ] 37 “C:\Users\bohau\Desktop\Games\Fallout 4 (F4SE).lnk” (target was not recovered)
[DEL ] 38 “C:\Users\bohau\Desktop\Games\Fallout Mod Manager.lnk” (target was not recovered)
[DEL ] 39 “C:\Users\bohau\Desktop\Games\Grand Theft Auto IV.lnk” (target was not recovered)
[DEL ] 40 “C:\Users\bohau\Desktop\Games\Hitman Absolution.lnk” (target was not recovered)
[DEL ] 41 “C:\Users\bohau\Desktop\Games\Pizza Tycoon 2.lnk” (target was not recovered)
[DEL ] 42 “C:\Users\bohau\Desktop\Games\Rescue 2013.lnk” (target was not recovered)
[DEL ] 43 “C:\Users\bohau\Desktop\Games\Skyrim (SKSE).lnk” (target was not recovered)
[DEL ] 44 “C:\Users\bohau\Desktop\Games\Space Station Sim.lnk” (target was not recovered)
[DEL ] 45 “C:\Users\bohau\Desktop\Games\Start The Witcher 2.lnk” (target was not recovered)
[DEL ] 46 “C:\Users\bohau\Desktop\Games\The Sims 4.lnk” (target was not recovered)
[DEL ] 47 “C:\Users\bohau\Desktop\Games\THE WITCHER 3 WILD HUNT.lnk” (target was not recovered)
[DEL ] 48 “C:\Users\bohau\Desktop\Games\TruckersMP.lnk” (target was not recovered)
[DEL ] 49 “C:\Users\bohau\Desktop\Games\World of Warships.lnk” (target was not recovered)
[DEL ] 50 “C:\Users\bohau\Desktop\Games\Halo The Master Chief Collection Halo Combat Evolved Anniversary.lnk” (target was not recovered)
[DEL ] 51 “C:\Users\bohau\Desktop\Games\MechWarrior 5 Mercenaries.lnk” (target was not recovered)
[DEL ] 52 “C:\Users\bohau\Desktop\Other Software\Mod Organizer - Skyrim SE.lnk” (target was not recovered)
[DEL ] 53 “C:\Users\bohau\Desktop\Games\The Outer Worlds.lnk” (target was not recovered)
[DEL ] 54 “C:\Users\bohau\Desktop\Other Software\Tobii Game Hub.lnk” (target was not recovered)
[DEL ] 55 “C:\Users\bohau\Desktop\Utilites\AORUS ENGINE.lnk” (target was not recovered)
[DEL ] 56 “C:\Users\bohau\Desktop\Utilites\Defraggler.lnk” (target was not recovered)
[DEL ] 57 “C:\Users\bohau\Desktop\Utilites\RGBFusion 2.0.lnk” (target was not recovered)
[DEL ] 58 “C:\Users\bohau\Desktop\Utilites\Ron’s Editor.lnk” (target was not recovered)
[DEL ] 59 “C:\Users\bohau\Desktop\Utilites\Tixati.lnk” (target was not recovered)
[DEL ] 60 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\Oblivion Mod Manager.lnk” (target was not recovered)
[DEL ] 61 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\Oblivion Mod Manager (Safe Mode).lnk” (target was not recovered)
[DEL ] 62 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\BSA creator.lnk” (target was not recovered)
[DEL ] 63 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\BSA browser.lnk” (target was not recovered)
[DEL ] 64 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\Run launcher.lnk” (target was not recovered)
[DEL ] 65 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\Conflict detector.lnk” (target was not recovered)
[DEL ] 66 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\NIF viewer.lnk” (target was not recovered)
[DEL ] 67 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\obmm Readme.lnk” (target was not recovered)
[DEL ] 68 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager\Uninstall Oblivion Mod Manager.lnk” (target was not recovered)
[DEL ] 70 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wargaming.net\World_of_Warships_EU\World_of_Warships_EU.lnk” (target was not recovered)
[DEL ] 71 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wargaming.net\World_of_Warships_EU\Uninstall World_of_Warships_EU.lnk” (target was not recovered)
[DEL ] 72 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diaperquest Launcher\Diaperquest Launcher.lnk” (target was not recovered)
[DEL ] 73 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diaperquest Launcher\Uninstall Diaperquest Launcher.lnk” (target was not recovered)
[DEL ] 74 “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diaperquest Launcher\Uninstall Diaperquest Launcher.lnk” (target was not recovered)
[DEL ] 75 “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk” (target was not recovered)
[DEL ] 76 “C:\Users\bohau\Desktop\Games\Alderon Games Launcher.lnk” (target was not recovered)
.
[WARN] 30 “C:\Users\bohau\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk” → [ “C:\WINDOWS\system32\mblctr.exe” ] (already cured)
.
____________________________ Icons location _____________________________
.
[ OK ] “C:\Users\bohau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Snipping Tool (2).lnk” → [ “.”, index=1 ] (Method: 3)
[ OK ] “C:\Users\bohau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Snipping Tool.lnk” → [ “.”, index=1 ] (Method: 3)
[ OK ] “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk” → [ “.”, index=1 ] (Method: 3)
[ OK ] “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk” → [ “.”, index=1 ] (Method: 3)
[ OK ] “C:\Users\bohau\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk” → [ “.”, index=1 ] (Method: 6)
[ OK ] “C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk” → [ “.”, index=1 ] (Method: 3)
.
______________________________ Statistics _______________________________
Cure ran per today: 1 times.

Total processed: 76
[CODE]     Cured:     6
     Deleted:   69
     Warnings:  1

______________________________ End of Log _______________________________
______________________________ Debug Info _______________________________

• Shortcut is damaged: “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk” (1153 bytes)
  2023-09-23 10:08:13 - Parser.GetLinkInfoTarget - #5 (Access is denied.) Invalid procedure call or argument. LastDllError = 0. File: C:\Users\bohau\Desktop\Games\Alderon Games Launcher.lnk Stady: 18

___________________________ End of debugging ____________________________[/CODE][/IMG][/COLOR][/QUOTE]

[Bohauo]

---

---

Run HijackThis! as admin! (located in the folder …Autologger\HijackThis)
Do a system scan, then check each item below, make sure and only check the items listed.
Then click Fix checked.
The computer will need to reboot, allow it to do so.

No Reboot was “mandatory” from HijackThis! so i manually rebooted my system.

[Bohauo]

Download and Run No Bot.
Click Check for updates.
Go to scan tab.
Choose threat scan.
Screen shot any detection.
Remove if any…

OK, i can’t do this step, NoBot is closing down after around 3% scan, i have rebooted the computer after installing it, and it has “administrative” privileges, (right click and “Run as administrator”)

No logs are produced either, meaning the log folder is empty.

[Malnutrition]

OK, skip nobot…

Are there any issues with the machine now?