Malware Log Analysis

Start:: CreateRestorePoint: CloseProcesses: 2026-04-06 20:35 - 2023-07-07 02:19 - 000000000 ____D C:\Users\Josiah\AppData\Roaming\RenPy CustomCLSID: HKU\S-1-5-21-1865880546-820590034-4202062218-1001_Classes\CLSID\{8264ad68-4549-2601-d4bf-f932d0630daa}\localserver32 -> "C:\Users\Josiah\Downloads\SCrawler_2023.6.19.0_x64\SCrawler.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-1865880546-820590034-4202062218-1001_Classes\CLSID\{ac712348-26cf-52ed-2026-fc5f9a241af7}\localserver32 -> "C:\Users\Josiah\Downloads\SCrawler_2023.6.19.0_x64\YouTubeDownloader.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-1865880546-820590034-4202062218-1001_Classes\CLSID\{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}\localserver32 -> "C:\Users\Josiah\AppData\Local\Microsoft\Teams\current\Teams.exe" --toast => No File AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\ProgramData\sldh.dat:136096DD5B [5146] AlternateDataStreams: C:\ProgramData\sldh.dat:F3D162C601 [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Newgrounds Player.lnk:61530B8D4C [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk:60EC9648C0 [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:5465085A2F [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:BE800952D3 [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk:104946E0EA [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\S69.lnk:06DB5D0CCF [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sticky Notes (new).lnk:3DF0A9C0EF [5146] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sticky Notes (new).lnk:954E53D7F9 [5146] AlternateDataStreams: C:\Users\Josiah\Application Data:b322c6efc9cf8c2607319ba6e8da6462 [394] AlternateDataStreams: C:\Users\Josiah\Desktop\Access.lnk:A1B76439FE [3442] AlternateDataStreams: C:\Users\Josiah\Desktop\Visual Studio 2022.lnk:F94DB65675 [4298] AlternateDataStreams: C:\Users\Josiah\AppData\Roaming:b322c6efc9cf8c2607319ba6e8da6462 [394] AlternateDataStreams: C:\Users\Public\Desktop\CrossDevice.Streaming.Source.dll:2B237C72B5 [5146] AlternateDataStreams: C:\Users\Public\Desktop\profile.tmp:B6AD24847F [3442] AlternateDataStreams: C:\Users\Public\Documents\profile.tmp:05863863DC [3442] Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) Task: {7EDF2EC6-51C9-4E2B-A213-65AFAE2F544B} - System32\Tasks\OneDrive Startup Task-S-1-5-21-1865880546-820590034-4202062218-1002 => C:\Program Files\Microsoft OneDrive\25.174.0907.0003\OneDriveLauncher.exe /startInstances (No File) S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys [X] S3 semav6msr64; \??\C:\WINDOWS\system32\drivers\semav6msr64.sys [X] 2026-04-09 22:02 - 2026-04-09 22:02 - 000002264 _____ C:\Users\Josiah\AppData\LocalLow\8341481cb10af140b5bf5ea2a0609483213048edf09bdaf105e58626ffa640be 2026-04-05 22:37 - 2026-04-05 22:37 - 000002264 _____ C:\Users\Josiah\AppData\LocalLow\9cbfff4ce4fcb14ca2397ac4226630ad7797f64bb90e1851df4bc5baaf722629 2026-04-05 22:35 - 2026-04-09 13:32 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\d99a24834e9efa7ce0cb5a6ab050cf02abbccc780af050e03fbf283c981ea97b 2026-04-05 22:35 - 2026-04-08 01:11 - 000074669 _____ C:\Users\Josiah\AppData\LocalLow\5dba33787bb47fd0f89ee06cb7c6906b70802638eda336c2ee4807c798fa8811 2026-04-05 22:35 - 2026-04-07 15:09 - 000055251 _____ C:\Users\Josiah\AppData\LocalLow\9320c2036d43ce99ffa027a4bc837e09d97f52e77f1fff7bf743910dd2eaf00e 2026-04-05 22:35 - 2026-04-05 22:35 - 000000026 _____ C:\Users\Josiah\AppData\LocalLow\4f13099e83db5eb4bf4b0c3157fe5cc45f8fef967a8d0577bc4a13e0c97016bb 2026-03-28 15:10 - 2026-03-28 15:10 - 000005882 _____ C:\Users\Josiah\AppData\LocalLow\6a66f3c9c358dbed8fbc1d5226a619c382c5e8c86ecdc9b52fb4b066cfcabe2b 2026-03-28 15:10 - 2026-03-28 15:10 - 000000026 _____ C:\Users\Josiah\AppData\LocalLow\066e7929338b7bb826c356decb7f0eef7c30c28f7c45c7a824b5c07f2f5c023e 2026-03-21 17:47 - 2026-03-21 17:47 - 000002264 _____ C:\Users\Josiah\AppData\LocalLow\0ea6034d47628464e91af16dbf232c12a0c1e1a48fd595582a8fa874aedd122c 2026-03-20 23:20 - 2026-03-21 17:47 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\08cf894e85c2732ddcb768fe6e58f8c3303add667b58c345dc46752d36df1213 2026-03-20 23:20 - 2026-03-21 17:45 - 000002991 _____ C:\Users\Josiah\AppData\LocalLow\ded40a3478f6c47b92e6cfa8bd07e7720be571a80d8c58e5c833362264ecc233 2026-03-18 18:24 - 2026-03-18 18:24 - 000002264 _____ C:\Users\Josiah\AppData\LocalLow\fae037385f87de9360f9fc2f7a333fd5642dc6c99d705e00504e4ad960881492 2026-03-18 18:21 - 2026-03-18 18:26 - 000030488 _____ C:\Users\Josiah\AppData\LocalLow\bb990d29af6b55ddd3a5fd814e95d9839aaabcea581e72683fc76243ca2789c4 2026-03-18 18:21 - 2026-03-18 18:23 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\ed9ab7826a86991ed4a18a1228ec94a3f405a714e8cb11206b0b89af564be999 2026-03-18 18:17 - 2026-03-19 12:46 - 000086816 _____ C:\Users\Josiah\AppData\LocalLow\bcf956163986033318544e2c6ce20f1bd022b60735b3665bf36ff8697d154fed 2026-03-18 18:17 - 2026-03-19 12:46 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\cb6c46d117f7155d8923f7808c129963e56d900a527c3611ea0206e841223706 2026-03-18 18:15 - 2026-03-18 20:08 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\d649ade4febc87ac237b4da1675631f14e0241f791c9d8cf7dd6e5eccdfbb6bc 2026-03-18 18:15 - 2026-03-18 18:15 - 000015933 _____ C:\Users\Josiah\AppData\LocalLow\1ca023833cdb25b466cdb497d5ac2d3707739a0e9cebaa8477a144ea0dc5f429 2026-03-18 18:15 - 2026-03-18 18:15 - 000000026 _____ C:\Users\Josiah\AppData\LocalLow\87798dea383d5484c2007928dfc17e207f1a5eb563479c538975ca16f852858b 2026-03-18 18:15 - 2026-03-18 18:15 - 000000026 _____ C:\Users\Josiah\AppData\LocalLow\71d5103207acc61c38539351c84edbd99252d6fd38e76434fa5d2153d85edc42 2026-04-09 22:02 - 2026-01-27 19:45 - 000000466 _____ C:\Users\Josiah\AppData\LocalLow\6aff8e61f6d8f86d7eec40be80dda910becd10bb5117aee576bf55f3353fe2c3 2026-04-09 22:01 - 2025-06-05 14:08 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\85c031caf51c45e6d5b4d3f5ea1878ee1bfc7bebf9c36e5ffb8eb0b54d9d332b 2026-04-09 22:00 - 2026-01-27 19:45 - 000525147 _____ C:\Users\Josiah\AppData\LocalLow\6147626b3324b2e2f1888ec78334155aa73dac440b2507def4cc4edea4f587fe 2026-04-08 01:40 - 2025-12-30 10:10 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\1a7d557f8f5f1853f8d42904522111e1f6f025366aa8469103d773dbcfd10550 2026-04-04 01:42 - 2026-01-05 15:22 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\31faf259cdb5eef5566ee88e2754906256aaf6f4257878c22be154bf111e3c06 2026-03-29 20:18 - 2025-06-10 13:34 - 000095283 _____ C:\Users\Josiah\AppData\LocalLow\8dfef56086aa96205f1564db8bb5c4117ad83eb253894d68f83f91bcb4f3f347 2026-03-29 17:37 - 2026-01-06 23:00 - 000102570 _____ C:\Users\Josiah\AppData\LocalLow\66a34170a8033480c6c4d32ce1e216d1c5c9392b2078f22ebe3f412c809d9245 2026-03-29 17:37 - 2026-01-06 23:00 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\d9c3fbd8ed4ac1ded7bb45b1fe258f0757f47f72f2006314a8391c05d0bde269 2026-03-29 17:35 - 2026-01-06 23:02 - 000002264 _____ C:\Users\Josiah\AppData\LocalLow\fcc3766f5741a4aa493c01e7a9bf932338c15719aa58918ff98407f4f4086503 2026-03-29 17:35 - 2026-01-06 23:00 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\8d52039b1c54a807ec7eb1b192922b351cb509ef840fd8234b7980a97fa0c6cd 2026-03-29 17:33 - 2026-01-06 23:00 - 000050799 _____ C:\Users\Josiah\AppData\LocalLow\796d53fa5becefcef7490f17530c719dc21c7ea0ac20d6bb5475ece6938d0139 2026-03-27 23:46 - 2026-01-05 15:22 - 000144423 _____ C:\Users\Josiah\AppData\LocalLow\6c57117fba6eec8ae8c98daf56642a11da6988c4f47dde126595a2714f9ee2ef 2026-03-22 15:34 - 2025-12-31 12:10 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\3f94ffa9554fcb9401ac7f065bfc13105d4e4c971b7b3d47b1ea2bb8d248482b 2026-03-19 18:52 - 2025-07-28 11:05 - 000000298 _____ C:\Users\Josiah\AppData\LocalLow\ed6ba7b3092c03f624f1f1db7fe97aef049e92f40e38b2cf51edf35b36db2ca8 2026-03-16 00:56 - 2026-01-26 16:01 - 000002264 _____ C:\Users\Josiah\AppData\LocalLow\5efa034b0a2e5df8720824e509cd40780b64dc2153511325606bc0169280c5db 2026-03-14 17:35 - 2026-02-15 23:57 - 000000130 _____ C:\Users\Josiah\AppData\LocalLow\49e10267f6daa87d3de44f1438d5bfe6c807a7a46b8182cfa4273724ef061ed0 2026-03-14 10:01 - 2026-02-15 23:57 - 000000298 _____ C:\Users\Josiah\AppData\LocalLow\fbb1960520da6f5731ac9950fb33b7f1ed232110454cbf44f9a02dff921d56c0 2026-03-12 13:10 - 2026-02-15 23:57 - 000325353 _____ C:\Users\Josiah\AppData\LocalLow\55bca3124406715c03e21cc1f2d09b74e361aa995fddbe8d12e7f3263dd35f47 2026-03-11 21:58 - 2025-07-28 11:05 - 000307936 _____ C:\Users\Josiah\AppData\LocalLow\f81772516d1609ab3f7b1560afb74b16eddf78ee85050bda3aaab7b88770d15a 2024-12-11 04:00 - 2024-12-11 04:00 - 000000048 ____R () C:\Users\Josiah\AppData\Local\8796FE72396E3C3922B7DC93298E159A HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION Task: {d0c705c9-b6c7-4a4d-b2e6-e4fc96b12d77} - no filepath. <==== ATTENTION S3 ThrottleStop; C:\Users\Josiah\AppData\Local\Temp\ThrottleStop.sys [50216 2026-04-07] (TechPowerUp LLC -> ) <==== ATTENTION StartPowershell: Try { $Paths=(Get-MpPreference).ExclusionPath $Extensions=(Get-MpPreference).ExclusionExtension $Processes=(Get-MpPreference).ExclusionProcess foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -force -ErrorAction Stop } foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -force -ErrorAction Stop } foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -force -ErrorAction Stop } } Catch { Write-Error "Error occurred while removing Windows Defender exclusions: $_" } EndPowershell: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: 2026-03-21 18:42 - 2026-03-21 18:42 - 000000000 ____D C:\.__capcut_export_temp_folder_1774089341__ 2024-05-23 14:34 - 2024-12-17 03:11 - 000000000 _____ () C:\ProgramData\sldh.dat EmptyTemp: End::