Malware Log Analysis

Start:: CloseProcesses: Folder: C:\Users\USER\AppData\Roaming\VoiceAccess Folder: C:\Users\USER\AppData\Roaming\smart-meeting File: C:\Users\USER\Downloads\ttl3067fhmrk7hf0.exe AV: McAfee (Enabled - Up to date) {0BE13B34-492A-21C0-AE43-C1742279CCB6} CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] Task: {42CFE0FC-D224-4854-A509-582810565F57} - System32\Tasks\Lenovo\Vantage\StartupFixPlan => C:\Program Files (x86)\Lenovo\VantageService\4.0.75.0\\uninstall.exe /repair (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) S3 polarbear-split-tunneling; \??\C:\Program Files\McAfee\wps\1.27.184.1\vpn\Drivers\x64\SplitTunnelingDriver.sys (No File) 2026-06-29 23:28 - 2025-05-08 22:09 - 000000130 _____ C:\Users\USER\AppData\LocalLow\4c4dbb116a6549df53c630444745f2035f0b70432bc24de0f282fe5b9b32bd4b 2026-06-29 18:52 - 2025-05-10 10:39 - 000000130 _____ C:\Users\USER\AppData\LocalLow\73b744cda150126a967fb4386c87d2172628aa829d81a22b29a36c31ff42d8a4 2026-06-24 22:51 - 2025-05-06 10:28 - 000000130 _____ C:\Users\USER\AppData\LocalLow\30a085bcaa17b5e7d810964f3df7957c063e61b540b792207984ce4ef0dd6792 2026-06-24 14:31 - 2025-05-05 16:08 - 000000130 _____ C:\Users\USER\AppData\LocalLow\eb4180b566259c4c4151d8ed10e3afc287d78be326e06067b72f2537b238d9e9 2026-06-19 19:36 - 2025-05-05 16:08 - 000000130 _____ C:\Users\USER\AppData\LocalLow\e9943804e2f13bd11bbc9f09e9daa618bf6ba9e3f4a3b68b86d68ae8d1c209c4 2026-06-12 23:49 - 2025-05-05 16:08 - 000080059 _____ C:\Users\USER\AppData\LocalLow\afe1d7afbacb9b5afdc2d0937fb9cb8b3b4479eeea0dc2cbb6b974f7916ddb10 StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winsock reset catalog C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* EmptyTemp: End::