Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: Folder: C:\Users\etern\AppData\Roaming\RenPy Folder: C:\Users\etern\AppData\Local\TP-Link 2026-09-08 00:17 - 2026-09-08 00:17 - 000000000 ____D C:\Users\etern\AppData\Local\TP-Link CHR HKLM\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] CHR HKU\S-1-5-21-4029519095-1310181654-452861188-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] CHR HKLM-x32\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] HKU\S-1-5-21-4029519095-1310181654-452861188-1001\...\Run: [MicrosoftEdgeAutoLaunch_DA588992DBA43C28CBA1EDA19E57A518] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --win-session-start [5417288 2026-09-10] (Microsoft Corporation -> Microsoft Corporation) HKU\S-1-5-21-4029519095-1310181654-452861188-1001\...\Run: [MicrosoftEdgeAutoLaunch_0BFC770EBEDBB5ACAD4D1DEE2EF1FF52] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --win-session-start [5417288 2026-09-10] (Microsoft Corporation -> Microsoft Corporation) AlternateDataStreams: C:\WINDOWS\tracing:? [12] HKLM\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) 2024-07-11 23:15 - 2024-07-11 23:15 - 000000024 _____ () C:\Users\etern\AppData\Roaming\C23W6Vk43XTwu662.dat 2024-07-11 23:16 - 2024-07-11 23:16 - 000000024 _____ () C:\Users\etern\AppData\Local\111111680 Comment: This snippet reverts User Account Control to default StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=dword:00000005 "ConsentPromptBehaviorUser"=dword:00000003 "EnableLUA"=dword:00000001 EndRegedit: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: StartPowershell: $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* CMD: cscript c:\windows\system32\slmgr.vbs /xpr & cscript c:\windows\system32\slmgr.vbs /dlv CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winhttp reset proxy CMD: netsh winsock reset catalog CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: bitsadmin /reset /allusers CMD: Winmgmt /salvagerepository CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R" CMD: "%WINDIR%\SysWOW64\lodctr.exe /R" CMD: "C:\Windows\SYSTEM32\lodctr.exe /R" CMD: "C:\Windows\SysWOW64\lodctr.exe /R" CMD: winmgmt.exe /resyncperf CMD: DISM.exe /Online /Cleanup-image /Restorehealth CMD: sfc /scannow RemoveProxy: EmptyTemp: End::