Malware Log Analysis

Start:: CreateRestorePoint: CloseProcesses: Folder: C:\Users\edupm\AppData\Local\Microsoft\Windows\INetCache Folder: C:\Users\edupm\AppData\Local\SotS CMD: type "C:\Windows\system32\Tasks\error code: 523" Startup: C:\Users\edupm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OfficeC2R.lnk [2026-07-07] ShortcutAndArgument: OfficeC2R.lnk -> C:\Windows\System32\cmd.exe => /c "C:\Users\edupm\AppData\Local\Microsoft\Windows\INetCache\analytics_bb8c.cmd" <==== ATTENTION C:\Users\edupm\AppData\Local\Microsoft\Windows\INetCache\analytics_bb8c.cmd C:\Users\edupm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OfficeC2R.lnk HKU\S-1-5-21-1088700390-3371008292-2644570097-1001\Software\Classes\exefile: <==== ATTENTION HKLM\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) HKLM\...\RunOnce: [221a1558-f067-4771-b32b-c075a52c089c] => "C:\Users\edupm\AppData\Local\Temp\{e6824716-2699-4dc6-82df-c8a00d416cc2}\221a1558-f067-4771-b32b-c075a52c089c.cmd" (No File) <==== ATTENTION HKU\S-1-5-21-1088700390-3371008292-2644570097-1001\...\Run: [OneDrive] => "C:\Program Files\Microsoft OneDrive\OneDrive.exe" /background (No File) HKU\S-1-5-21-1088700390-3371008292-2644570097-1001\...\Run: [GalaxyClient] => [X] Task: {621EFF2D-22F6-4D13-B980-537AD92B0819} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe (No File) Task: {07FC1201-A123-4563-8FC2-D5B9C2272B7F} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-1088700390-3371008292-2644570097-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe /reporting (No File) CustomCLSID: HKU\S-1-5-21-1088700390-3371008292-2644570097-1001_Classes\CLSID\{FD848478-65F5-4F01-ACD9-69195EC3631F}\localserver32 -> "C:\Program Files\cFosSpeed\cFosSpeed.exe" -ToastActivated => No File AlternateDataStreams: C:\ProgramData\TEMP:4FB9487F [184] FirewallRules: [TCP Query User{56FF4E86-F257-49DF-AB07-3B5184F08BE9}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File FirewallRules: [UDP Query User{D7463C1C-341D-4325-A338-677768436BED}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File FirewallRules: [TCP Query User{D36581F8-8C9F-48AE-A478-C0A5DB197015}C:\games\digimon story time stranger\digimon story time stranger.exe] => (Block) C:\games\digimon story time stranger\digimon story time stranger.exe => No File FirewallRules: [UDP Query User{C6C9A532-4039-4E5F-B599-3F0A06D1CFB7}C:\games\digimon story time stranger\digimon story time stranger.exe] => (Block) C:\games\digimon story time stranger\digimon story time stranger.exe => No File FirewallRules: [TCP Query User{6E38D7E5-798F-4E73-9C9F-C1E985533EA4}C:\games\into the breach\breach.exe] => (Block) C:\games\into the breach\breach.exe => No File FirewallRules: [UDP Query User{C97E3B33-DED8-4B78-AA78-CD471399483B}C:\games\into the breach\breach.exe] => (Block) C:\games\into the breach\breach.exe => No File FirewallRules: [TCP Query User{C1A49F0F-5C75-42A0-AF38-C4BB647FE186}C:\games\cairn\cairn\cairn.exe] => (Block) C:\games\cairn\cairn\cairn.exe => No File FirewallRules: [UDP Query User{F20719C2-8E88-45D5-B308-C976E3CED8AB}C:\games\cairn\cairn\cairn.exe] => (Block) C:\games\cairn\cairn\cairn.exe => No File FirewallRules: [TCP Query User{CCB53B5F-4809-4B52-A171-C8048220F3CD}C:\gog games\swat 4\contentexpansion\system\swat4x.exe] => (Block) C:\gog games\swat 4\contentexpansion\system\swat4x.exe => No File FirewallRules: [UDP Query User{36B098A6-80D9-4C1A-A30C-12F0DC374ECB}C:\gog games\swat 4\contentexpansion\system\swat4x.exe] => (Block) C:\gog games\swat 4\contentexpansion\system\swat4x.exe => No File FirewallRules: [TCP Query User{DB2BDF30-1424-4ECC-A583-464212ECD2BF}C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [UDP Query User{7B47A8DF-3F99-47A4-8DF2-F7D402A1F76F}C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [{43A80C47-7B8B-493A-851C-C22C52F15A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mafia II Definitive Edition\pc\Mafia II Definitive Edition.exe => No File FirewallRules: [{AFBAF43C-7FD0-4DFC-8B7E-2301C902EF5D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mafia II Definitive Edition\pc\Mafia II Definitive Edition.exe => No File FirewallRules: [TCP Query User{D1DBA36A-1352-4D70-8AB1-F311C05A3110}C:\games\cyber manhunt\cybermanhunt.exe] => (Block) C:\games\cyber manhunt\cybermanhunt.exe => No File FirewallRules: [UDP Query User{7C041586-957F-4020-AE81-86F0459A4FB2}C:\games\cyber manhunt\cybermanhunt.exe] => (Block) C:\games\cyber manhunt\cybermanhunt.exe => No File FirewallRules: [TCP Query User{199E689E-15CB-4D25-986F-E9314DC5CFD9}E:\gog\cyber manhunt\cybermanhunt.exe] => (Block) E:\gog\cyber manhunt\cybermanhunt.exe => No File FirewallRules: [UDP Query User{52D901C6-34CD-4B79-A90A-7373D44328ED}E:\gog\cyber manhunt\cybermanhunt.exe] => (Block) E:\gog\cyber manhunt\cybermanhunt.exe => No File FirewallRules: [TCP Query User{A4699FEE-5F6D-4472-9949-CEDA70F6D723}C:\games\resident evil requiem biohazard requiem\re9.exe] => (Block) C:\games\resident evil requiem biohazard requiem\re9.exe => No File FirewallRules: [UDP Query User{FD910D72-3D5D-46C8-8960-B0DE4FD2EDBF}C:\games\resident evil requiem biohazard requiem\re9.exe] => (Block) C:\games\resident evil requiem biohazard requiem\re9.exe => No File FirewallRules: [TCP Query User{AE3CA0FF-8CE6-432C-A5D5-BF2BA7C7166B}C:\games\news tower\news tower.exe] => (Block) C:\games\news tower\news tower.exe => No File FirewallRules: [UDP Query User{E0BB4077-6EA9-4276-A85C-2ABC67F0887E}C:\games\news tower\news tower.exe] => (Block) C:\games\news tower\news tower.exe => No File FirewallRules: [TCP Query User{22A82824-C486-409C-AC98-1A748192D483}C:\games\kaiju princess 2\kaiju princess 2.exe] => (Block) C:\games\kaiju princess 2\kaiju princess 2.exe => No File FirewallRules: [UDP Query User{57B4B4E0-6788-4806-B5B9-5071CA3C75DE}C:\games\kaiju princess 2\kaiju princess 2.exe] => (Block) C:\games\kaiju princess 2\kaiju princess 2.exe => No File FirewallRules: [TCP Query User{C6B0931B-597D-4829-9CBE-460908DC61C7}C:\games\she will punish them\she will punish them.exe] => (Block) C:\games\she will punish them\she will punish them.exe => No File FirewallRules: [UDP Query User{01B59B60-03BB-4D11-87F5-4F421956CDEF}C:\games\she will punish them\she will punish them.exe] => (Block) C:\games\she will punish them\she will punish them.exe => No File FirewallRules: [TCP Query User{644625C3-3F64-4777-905C-B7902D1DBAAA}C:\games\house flipper 2\houseflipper2.exe] => (Block) C:\games\house flipper 2\houseflipper2.exe => No File FirewallRules: [UDP Query User{AFD9667A-67ED-48DC-B2E2-2DDAD203B476}C:\games\house flipper 2\houseflipper2.exe] => (Block) C:\games\house flipper 2\houseflipper2.exe => No File FirewallRules: [{64D2AA97-E8BD-47F2-841D-0D0A375359F6}] => (Block) C:\Games\Car Mechanic Simulator 2021\Car Mechanic Simulator 2021.exe => No File FirewallRules: [TCP Query User{BEB81223-B589-4363-9172-8076F3C7413F}C:\games\two point museum\tpm.exe] => (Block) C:\games\two point museum\tpm.exe => No File FirewallRules: [UDP Query User{D2E33E44-0E14-4852-BDCE-C1D0EEA1CCFE}C:\games\two point museum\tpm.exe] => (Block) C:\games\two point museum\tpm.exe => No File FirewallRules: [TCP Query User{3386873D-FD4C-4A5A-BD2F-8A75797B043D}C:\games\pragmata\pragmata.exe] => (Block) C:\games\pragmata\pragmata.exe => No File FirewallRules: [UDP Query User{A971A8A4-562D-44A8-B557-22D48C77D274}C:\games\pragmata\pragmata.exe] => (Block) C:\games\pragmata\pragmata.exe => No File FirewallRules: [TCP Query User{303D229D-30C2-4CB1-88DC-091FCFF20A66}C:\games\av director life!\avdirectorlife\binaries\win64\avdirectorlife-win64-shipping.exe] => (Block) C:\games\av director life!\avdirectorlife\binaries\win64\avdirectorlife-win64-shipping.exe => No File FirewallRules: [UDP Query User{96A59FDB-261F-409F-AACD-9FD1133833B1}C:\games\av director life!\avdirectorlife\binaries\win64\avdirectorlife-win64-shipping.exe] => (Block) C:\games\av director life!\avdirectorlife\binaries\win64\avdirectorlife-win64-shipping.exe => No File FirewallRules: [TCP Query User{A90D0C2D-992A-4A99-98D4-B55888EE7409}C:\games\far cry 3 - duology\far cry 3\bin\farcry3.exe] => (Block) C:\games\far cry 3 - duology\far cry 3\bin\farcry3.exe => No File FirewallRules: [UDP Query User{5573747E-AC9D-4EA0-A777-4CD7FF3956F6}C:\games\far cry 3 - duology\far cry 3\bin\farcry3.exe] => (Block) C:\games\far cry 3 - duology\far cry 3\bin\farcry3.exe => No File FirewallRules: [TCP Query User{E3426EB6-522C-4B2C-80B2-764B646BC681}C:\games\far cry 3 - duology\far cry 3\bin\farcry3_d3d11.exe] => (Block) C:\games\far cry 3 - duology\far cry 3\bin\farcry3_d3d11.exe => No File FirewallRules: [UDP Query User{315D7D23-2B1D-456E-9DFC-1827314CCA91}C:\games\far cry 3 - duology\far cry 3\bin\farcry3_d3d11.exe] => (Block) C:\games\far cry 3 - duology\far cry 3\bin\farcry3_d3d11.exe => No File FirewallRules: [TCP Query User{45BAE29A-6656-4680-9AB0-0BD4817EF39E}C:\games\final fantasy ix\x64\unity.exe] => (Block) C:\games\final fantasy ix\x64\unity.exe => No File FirewallRules: [UDP Query User{BAC27358-E3FD-481F-99A0-AD76F7E23D71}C:\games\final fantasy ix\x64\unity.exe] => (Block) C:\games\final fantasy ix\x64\unity.exe => No File FirewallRules: [TCP Query User{60FEB24C-085B-48C1-A04A-7AC161DE4D98}C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [UDP Query User{52045764-0913-4AF0-92C1-0979E7C4944D}C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.7\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [TCP Query User{7C5AF3BF-1119-4B9F-AB73-221345086553}C:\games\lego batman - legacy of the dark knight\legobatmanlotdk\binaries\win64\legobatmanlotdk-win64-shipping.exe] => (Block) C:\games\lego batman - legacy of the dark knight\legobatmanlotdk\binaries\win64\legobatmanlotdk-win64-shipping.exe => No File FirewallRules: [UDP Query User{F98140E1-A1E9-4FC0-A9D5-C41AD0B0A3C8}C:\games\lego batman - legacy of the dark knight\legobatmanlotdk\binaries\win64\legobatmanlotdk-win64-shipping.exe] => (Block) C:\games\lego batman - legacy of the dark knight\legobatmanlotdk\binaries\win64\legobatmanlotdk-win64-shipping.exe => No File FirewallRules: [TCP Query User{B42E847E-5A52-4EF7-8475-34FCA279CE5C}C:\games\take me to the dungeon-steamgg.net\take me to the dungeon!!.exe] => (Block) C:\games\take me to the dungeon-steamgg.net\take me to the dungeon!!.exe => No File FirewallRules: [UDP Query User{6B71CE0A-34AA-43C1-9545-257C17CCED03}C:\games\take me to the dungeon-steamgg.net\take me to the dungeon!!.exe] => (Block) C:\games\take me to the dungeon-steamgg.net\take me to the dungeon!!.exe => No File FirewallRules: [TCP Query User{DB814654-F076-47EB-8B68-F434CC24E072}C:\games\horny suika wet watermelon\wetwatermelon.exe] => (Block) C:\games\horny suika wet watermelon\wetwatermelon.exe => No File FirewallRules: [UDP Query User{A9E5075E-40BF-4517-AAA8-05B8C2365EE1}C:\games\horny suika wet watermelon\wetwatermelon.exe] => (Block) C:\games\horny suika wet watermelon\wetwatermelon.exe => No File FirewallRules: [TCP Query User{86660C13-FDC7-4CCD-B116-0F09BE132562}C:\games\buttknight\buttknight.exe] => (Block) C:\games\buttknight\buttknight.exe => No File FirewallRules: [UDP Query User{9B9AAD81-B28A-44CE-B5F1-D09C76D544EC}C:\games\buttknight\buttknight.exe] => (Block) C:\games\buttknight\buttknight.exe => No File StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Comment: This snippet reverts User Account Control to default StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=dword:00000005 "ConsentPromptBehaviorUser"=dword:00000003 "EnableLUA"=dword:00000001 EndRegedit: Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy Comment: Reset Hosts file Hosts: Comment: Network reset commands CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winsock reset catalog Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* EmptyTemp: End::