Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-3770323076-2429481697-2139508862-1001\...\Run: [Steam] => D:\SteamLibrary\New folder\steam.exe [5767832 2026-03-13] (Valve Corp. -> Valve Corporation) 2025-02-05 09:47 - 2025-02-05 09:47 - 000003967 _____ () C:\Users\Abroadworks - Miggle\AppData\Local\91435242954 Folder: D:\Miggle Computer\Downloads\kaljsdix820902cjIA2392uxjw D:\Miggle Computer\Downloads\kaljsdix820902cjIA2392uxjw 2026-04-06 21:59 - 2026-04-06 21:59 - 000000000 ____D C:\Users\Mikko\AppData\Roaming\RenPy HKU\S-1-5-21-3770323076-2429481697-2139508862-1001\...\Run: [RiotClient] => C:\Riot Games\Riot Client\RiotClientServices.exe --launch-background-mode (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1001\...\Run: [Gather] => C:\Users\abant\AppData\Local\Programs\gather-electron\Gather.exe (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe --autostart (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1004\...\Run: [Surfshark] => C:\Program Files\Surfshark\Surfshark.exe (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1005\...\Run: [Gather] => C:\Users\Abroadworks - Miggle\AppData\Local\Programs\gather-electron\Gather.exe (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1005\...\Run: [RiotClient] => C:\Riot Games\Riot Client\RiotClientServices.exe --launch-background-mode (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1005\...\Run: [VoicemodV3] => "D:\Program Installs\Voicemod V3\Voicemod.exe" (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1005\...\Run: [Krisp] => "C:\Users\Abroadworks - Miggle\AppData\Local\Programs\Krisp\app-3.7.8\krisp.exe" --hidden (No File) HKU\S-1-5-21-3770323076-2429481697-2139508862-1005\...\Run: [io.teracy.app.teracy] => C:\Users\Abroadworks - Miggle\AppData\Local\Programs\Teracy\Teracy.exe (No File) Task: {8ED5D133-B0E9-406F-9247-E649EF94D907} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No File) Task: {93AEFBB6-5F4A-4B43-8918-963690F792AD} - System32\Tasks\Meta\Messenger-SL-Helper-S-1-5-21-3770323076-2429481697-2139508862-1001 => C:\Users\abant\AppData\Local\Programs\Messenger\MessengerHelper.exe --lassie (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) Task: {27761613-6162-4B63-8065-7EA239BA9D15} - System32\Tasks\ZoomUpdateTaskUser-S-1-5-21-3770323076-2429481697-2139508862-1005 => "C:\Users\Abroadworks - Miggle\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule (No File) S3 NEProtect; \??\D:\Program Installs\bloodstrike\Engine\Binaries\Win64\NEProtect.sys [X] 2026-03-08 07:20 - 2026-03-08 07:20 - 000000000 __SHD C:\AI_RecycleBin AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [10290] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [10290] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [10290] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [10290] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Upscayl.lnk:39D1598324 [10290] HKU\S-1-5-21-3770323076-2429481697-2139508862-1001\...\RunOnce: [Uninstall 26.045.0308.0003_1] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\abant\AppData\Local\Microsoft\OneDrive\26.045.0308.0003_1" [0 2026-04-07] () <==== ATTENTION [zero byte File/Folder] PowerShell: Remove-MpPreference -ExclusionPath "D:\Miggle Computer\Downloads\kaljsdix820902cjIA2392uxjw" CMD: vssadmin list shadowstorage EmptyTemp: End::