Malware Log Analysis

Start CreateRestorePoint: CloseProcesses: AV: Norton Security Ultra (Enabled - Up to date) {1122B19A-E671-38EC-8EAC-87048FD4528D} AV: Norton Security Ultra (Enabled - Up to date) {A2708B76-6835-6565-CB96-694212954A75} FW: Norton Security Ultra (Enabled) {9A4B0A53-225A-643D-E0C9-C077EC460D0E} FW: Norton Security Ultra (Enabled) {291930BF-AC1E-39B4-A5F3-2E31710715F6} C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\llbcnfanfmjhpedaedhbcnpgeepdnnok CHR HKLM\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb] CHR HKLM-x32\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok] 2026-08-04 02:15 - 2026-08-04 02:15 - 000000000 ____D C:\Users\user\AppData\Roaming\RenPy HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe --startup_mode (No File) HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe --startup_mode (No File) HKU\S-1-5-21-2345603349-1785332311-319512340-1001\...\Run: [launcher] => E:\Games\Watcher of Realms\moontonlauncher.ex (No File) HKU\S-1-5-21-2345603349-1785332311-319512340-1001\...\Run: [AMDNoiseSuppression] => "C:\WINDOWS\system32\AMD\ANR\AMDNoiseSuppression.exe" (No File) HKU\S-1-5-21-2345603349-1785332311-319512340-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\user\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File) <==== ATTENTION HKU\S-1-5-21-2345603349-1785332311-319512340-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\user\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) <==== ATTENTION HKU\S-1-5-21-2345603349-1785332311-319512340-1001\...\RunOnce: [Uninstall 26.123.0628.0001] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\user\AppData\Local\Microsoft\OneDrive\26.123.0628.0001" (No File) HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\107.0.3.0\GoogleDriveFS.exe --startup_mode (No File) Task: {93C2C544-E650-4D75-8C3D-5134988CAEC8} - System32\Tasks\CareCenter\SunJavaUpdateSched_Reg_HKLMWow6432Run => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File) Task: {27A146E2-33AA-4C98-9D6C-89B96354BFD9} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC RebootDialog (No File) Task: {4A49B972-02C1-41F1-A7C4-10CAF39EBB01} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery RebootDialog (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) Task: {FA68D7E2-340E-4F08-9355-F68BE1E170A4} - System32\Tasks\Piriform\CCleaner 7 - Scheduled Cleaning - default - S-1-5-21-2345603349-1785332311-319512340-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe /bg /scheduledHC (No File) FF Plugin HKU\S-1-5-21-2345603349-1785332311-319512340-1001: @wpspdf.com/nppdf -> C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\knppdfplugin\knppdfplugin.dll [No File] S1 ewkanpun; \??\C:\WINDOWS\system32\drivers\ewkanpun.sys (No File) S1 kddydohr; \??\C:\WINDOWS\system32\drivers\kddydohr.sys (No File) S1 mcurmnts; \??\C:\WINDOWS\system32\drivers\mcurmnts.sys (No File) S1 shhvnivg; \??\C:\WINDOWS\system32\drivers\shhvnivg.sys (No File) CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{000209F0-0000-4b30-A977-D214852036FF}\InprocServer32 -> => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{28A80003-18FD-411D-B0A3-3C81F618E22B}\InprocServer32 -> C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwpsmenushellext64.dll => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{45540086-5750-5300-4B49-4E47534F4655}\InprocServer32 -> => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{74B989DB-3E7F-425C-AF5A-F6BFBF5B747A}\InprocServer32 -> => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{89795E3E-F6B0-4D88-B1A0-BCC3DF1A682E}\InprocServer32 -> C:\Users\user\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\kmsosidebar_3.1.0.2594\kmsosidebar64.dll => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{91493443-94BF-4940-926D-4F38FECF2A48}\InprocServer32 -> => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{AA147FFB-0B1F-4BB1-9B1E-8D062B35C146}\InprocServer32 -> C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.1.0.25242\office6\qingnse64.dll => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{F8686D90-7CB9-4D81-B596-69C3C408BA88}\InprocServer32 -> C:\Users\user\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\kmsosidebar_3.1.0.2594\kmsosidebar64.dll => No File CustomCLSID: HKU\S-1-5-21-2345603349-1785332311-319512340-1001_Classes\CLSID\{FC397F71-A3E3-4198-86FB-39B7267E5E8C}\InprocServer32 -> C:\Users\user\AppData\Local\Kingsoft\WPS Office\12.1.0.25242\office6\qingnse64.dll => No File ContextMenuHandlers1: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => -> No File ContextMenuHandlers4: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => -> No File ContextMenuHandlers5: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => -> No File AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\ProgramData\TEMP:04FDFCF6 [147] AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134] AlternateDataStreams: C:\ProgramData\TEMP:4E46F3AD [260] AlternateDataStreams: C:\ProgramData\TEMP:56EE2CAF [134] AlternateDataStreams: C:\ProgramData\TEMP:67BA17B9 [102] AlternateDataStreams: C:\ProgramData\TEMP:BAC2F271 [260] FirewallRules: [{BC66A3D4-F4E5-4925-ACC8-9CDB08978D4D}] => (Allow) C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe => No File FirewallRules: [{83577860-6216-49AF-89A8-16193B19F308}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File FirewallRules: [{6B8C4981-EC6B-4592-AB18-9840388C56A7}] => (Allow) E:\Games\BlueStacks X\Cloud Game.exe => No File FirewallRules: [{43CC9CD5-F837-43F3-897D-AFBFD0C5C477}] => (Allow) E:\Games\BlueStacks X\BlueStacksWeb.exe => No File FirewallRules: [{33406B5B-B731-45A2-94A4-B24CF9FC9704}] => (Allow) E:\Games\MuMuPlayerGlobal-12.0\shell\MuMuManager.exe => No File FirewallRules: [{984291CF-5FAE-4039-8A0F-EA1002394FF1}] => (Allow) E:\Games\MuMuPlayerGlobal-12.0\shell\MuMuMultiPlayer.exe => No File FirewallRules: [{D02C4DFF-E920-4374-84AC-13CA3B737E18}] => (Allow) E:\Games\MuMuPlayerGlobal-12.0\shell\MuMuPlayer.exe => No File FirewallRules: [{C63DDE60-5735-4AED-A22E-EE7C2991309D}] => (Allow) C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe => No File FirewallRules: [{36F31CF4-322D-45BE-AFFB-361E866C2559}] => (Allow) C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMHeadless.exe => No File FirewallRules: [UDP Query User{CC35A2BE-7924-4967-B6D5-857396B3546B}C:\program files\streamfab\streamfab\youtubedl\youtubetomp3service.exe] => (Allow) C:\program files\streamfab\streamfab\youtubedl\youtubetomp3service.exe => No File FirewallRules: [TCP Query User{3DD606A0-2E15-46EA-9993-9F06710C8E27}C:\program files\streamfab\streamfab\youtubedl\youtubetomp3service.exe] => (Allow) C:\program files\streamfab\streamfab\youtubedl\youtubetomp3service.exe => No File FirewallRules: [UDP Query User{AF054CDF-4F5F-44C8-8909-AC1A00CFE4F6}C:\program files\streamfab\streamfab\streamfab64.exe] => (Allow) C:\program files\streamfab\streamfab\streamfab64.exe => No File FirewallRules: [TCP Query User{C4148074-EB2B-41AC-B713-239CD4098CE2}C:\program files\streamfab\streamfab\streamfab64.exe] => (Allow) C:\program files\streamfab\streamfab\streamfab64.exe => No File FirewallRules: [UDP Query User{F051E5E9-5295-420E-8708-9F0A195C1DE9}C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe] => (Allow) C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe => No File FirewallRules: [TCP Query User{6B16A301-A4E9-4EDC-9662-73AD6EAFCA3A}C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe] => (Allow) C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe => No File FirewallRules: [UDP Query User{AFD6B182-C858-4FD5-8699-C045C4C58FD1}E:\games\hoyoplay\games\zenlesszonezero game\zenlesszonezero.exe] => (Allow) E:\games\hoyoplay\games\zenlesszonezero game\zenlesszonezero.exe => No File FirewallRules: [TCP Query User{C4573BBD-E770-4BBF-B725-48C369145D65}E:\games\hoyoplay\games\zenlesszonezero game\zenlesszonezero.exe] => (Allow) E:\games\hoyoplay\games\zenlesszonezero game\zenlesszonezero.exe => No File FirewallRules: [UDP Query User{382137EB-D90E-4363-9A72-B33FDFE6EE6C}C:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) C:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File FirewallRules: [TCP Query User{4464C055-F5E5-44AE-A33D-94EA5F9D4542}C:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) C:\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File FirewallRules: [UDP Query User{427356E8-D34B-4647-A9C1-073911044594}E:\games\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) E:\games\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File FirewallRules: [TCP Query User{54D66E2F-A129-476F-9D30-2FA7DAA133FD}E:\games\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe] => (Allow) E:\games\wuthering waves\wuthering waves game\client\binaries\win64\client-win64-shipping.exe => No File FirewallRules: [TCP Query User{A8E51F31-10D4-410D-ADCA-59DCA402785C}C:\counter strike 1.6 expandedcs 6153\hltv.exe] => (Allow) C:\counter strike 1.6 expandedcs 6153\hltv.exe => No File FirewallRules: [UDP Query User{D126A954-DD7B-41E1-8455-E69DAAE61996}C:\counter strike 1.6 expandedcs 6153\hltv.exe] => (Allow) C:\counter strike 1.6 expandedcs 6153\hltv.exe => No File FirewallRules: [{20B0F237-EFB1-47C4-B480-726573487697}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{3DC3107E-FBF1-4E56-8B8F-8A42A6801172}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{DDF9434E-511D-4F46-9267-2AA69C00DFB5}C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe => No File FirewallRules: [UDP Query User{0DF84F29-0642-42C9-A900-2D2098CE507B}C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe => No File FirewallRules: [TCP Query User{D25047CC-E74A-4AA1-ABCF-6FE3B5D7FC95}C:\program files\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe] => (Block) C:\program files\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe => No File FirewallRules: [UDP Query User{418B7B6F-8170-4833-950B-D5275EB17231}C:\program files\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe] => (Block) C:\program files\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe => No File FirewallRules: [TCP Query User{65E62ADD-A165-4A73-9997-5002CA78ADE7}C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe => No File FirewallRules: [UDP Query User{4FB87AEC-092B-43FD-93A8-51E7B42D3694}C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe => No File FirewallRules: [{7C27ADE7-5E71-4516-8BD3-D10F9AF10AF3}] => (Allow) D:\SteamLibrary\steamapps\common\Spin Rhythm\SpinRhythm.exe => No File FirewallRules: [{86F04340-23B5-49F8-B0E4-719F6CC6E178}] => (Allow) D:\SteamLibrary\steamapps\common\Spin Rhythm\SpinRhythm.exe => No File FirewallRules: [{A63E8EF8-E06C-4EF2-9193-63AC45661095}] => (Allow) D:\SteamLibrary\steamapps\common\Assassin's Creed Rogue\ACC.exe => No File FirewallRules: [{D5D8BCE4-F198-4304-AB7B-B61CC1002051}] => (Allow) D:\SteamLibrary\steamapps\common\Assassin's Creed Rogue\ACC.exe => No File FirewallRules: [{D8EEF458-6E8F-4AE8-9F90-9D7B3B502FC0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\launcher.exe => No File FirewallRules: [{2CC387D0-0616-4E4D-83BC-4B4EDB10F0D1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\launcher.exe => No File FirewallRules: [{F967C96B-BDCF-4E16-AC63-49805B09124B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\bin\diagnostics32.exe => No File FirewallRules: [{292F0DD7-C0B3-48C7-BBF3-54535D72B698}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\bin\diagnostics32.exe => No File FirewallRules: [{9B735324-FE52-4422-9FBF-5BE8E5BFA9F1}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient.exe => No File FirewallRules: [{E76A6A2E-2612-46EB-BCE1-4B1C7FE4F070}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe => No File FirewallRules: [{36BC574C-C972-43B8-AC7F-15AAAA32BAE2}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr.exe => No File FirewallRules: [{DBF784C0-D14E-43EA-A6FA-C5F43D694BC8}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe => No File FirewallRules: [{242DF1E1-8DC2-4984-8708-274572A0FD7A}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd.exe => No File FirewallRules: [{B55EE034-AC9B-4B19-9F3E-C08D5BA6504E}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe => No File FirewallRules: [TCP Query User{AE86458B-FADB-4237-8879-188FC2545DBB}C:\users\user\appdata\local\discord\app-1.0.9010\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9010\discord.exe => No File FirewallRules: [UDP Query User{63829348-382A-403E-9A94-0AA5162D3D00}C:\users\user\appdata\local\discord\app-1.0.9010\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9010\discord.exe => No File FirewallRules: [TCP Query User{157384B1-6427-45E5-A8FA-7C85BE3CF44E}C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe => No File FirewallRules: [UDP Query User{77CE87AB-DFCC-4268-997D-E6AAADCFB7A9}C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft launcher\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe => No File FirewallRules: [{4BB64F68-4C1E-42DE-B64B-D9C520369F30}] => (Allow) C:\Program Files (x86)\Nox\bin\Nox.exe => No File FirewallRules: [{058FE751-0EE0-4680-A191-E15AE78DF9A1}] => (Allow) C:\Program Files (x86)\Bignox\BigNoxVM\RT\NoxVMHandle.exe => No File FirewallRules: [TCP Query User{912B156D-704B-4029-931B-4A2C1414D86C}C:\program files\star rail\games\starrail.exe] => (Allow) C:\program files\star rail\games\starrail.exe => No File FirewallRules: [UDP Query User{DB99EF5F-D026-4B2C-B040-A5F3BA93BEA4}C:\program files\star rail\games\starrail.exe] => (Allow) C:\program files\star rail\games\starrail.exe => No File FirewallRules: [TCP Query User{C2B2BE49-EF89-4B5B-88EA-370CA8858E98}E:\games\age_of_empires_ii_win_rip_en\game files\empires2.exe] => (Block) E:\games\age_of_empires_ii_win_rip_en\game files\empires2.exe => No File FirewallRules: [UDP Query User{E1AD4B92-3E6C-469F-B54C-FBD59C261D44}E:\games\age_of_empires_ii_win_rip_en\game files\empires2.exe] => (Block) E:\games\age_of_empires_ii_win_rip_en\game files\empires2.exe => No File FirewallRules: [{AF12533B-0A74-43EE-BF84-4CA68CA2DE2E}] => (Allow) D:\SteamLibrary\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe => No File FirewallRules: [{AF9EA724-6242-4619-9384-37D75C1CDF00}] => (Allow) D:\SteamLibrary\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe => No File FirewallRules: [{D32FB4E0-FEE3-4DA1-84B4-7A2BDBB48326}] => (Allow) D:\SteamLibrary\steamapps\common\Kingdoms of Amalur Re-Reckoning\koa.exe => No File FirewallRules: [{8BBD4972-C7B8-433D-9AED-5F0E18FDDC35}] => (Allow) D:\SteamLibrary\steamapps\common\Kingdoms of Amalur Re-Reckoning\koa.exe => No File FirewallRules: [{B00437C9-0CB0-4D8E-9993-3F0B6BDFF474}] => (Allow) D:\SteamLibrary\steamapps\common\Black Mesa\bms.exe => No File FirewallRules: [{B6ED9107-AA36-494B-8293-A51946A87698}] => (Allow) D:\SteamLibrary\steamapps\common\Black Mesa\bms.exe => No File FirewallRules: [TCP Query User{907DF7DE-490A-465A-AB34-64D272FD908E}D:\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe] => (Allow) D:\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe => No File FirewallRules: [UDP Query User{3858C96A-46D2-49CD-8E98-C8B64F33A78F}D:\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe] => (Allow) D:\genshin impact\genshin impact game\genshinimpact_data\plugins\zfgamebrowser.exe => No File FirewallRules: [{DC7F666E-D038-45E5-8B62-94966C6BA04C}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe => No File FirewallRules: [{65AB1300-FF15-4DAE-BD9E-E57DEA5C58D0}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe => No File FirewallRules: [TCP Query User{5D2D3CD1-AA23-4045-B8E7-4D220B22A9A6}C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe] => (Allow) C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe => No File FirewallRules: [UDP Query User{FE627C1A-63BB-4D01-9E76-0A671AE48F72}C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe] => (Allow) C:\users\user\appdata\local\programs\lnv\stremio-4\stremio-runtime.exe => No File FirewallRules: [TCP Query User{53FFF023-1B5A-4C3E-B488-E2D2A24A913B}E:\games\resolve.exe] => (Allow) E:\games\resolve.exe => No File FirewallRules: [UDP Query User{72B4D299-45BA-48D5-BB0B-188B25546BCC}E:\games\resolve.exe] => (Allow) E:\games\resolve.exe => No File FirewallRules: [TCP Query User{07A335E3-945B-4657-A8CF-FE5210406C20}E:\games\modrinth app\modrinth app.exe] => (Allow) E:\games\modrinth app\modrinth app.exe => No File FirewallRules: [UDP Query User{076FA0A1-4674-4DDC-A082-A83B54681D64}E:\games\modrinth app\modrinth app.exe] => (Allow) E:\games\modrinth app\modrinth app.exe => No File FirewallRules: [{5B3505AE-E389-4545-B93A-5641F77BC665}] => (Allow) E:\Games\Resolve.exe => No File FirewallRules: [{2AC6CC40-7DBB-49AD-927E-B65200C809AC}] => (Allow) E:\Games\bmdpaneld.exe => No File FirewallRules: [{FC153C06-44A3-49B9-B96C-0A90453FC380}] => (Allow) E:\Games\DaVinciPanelDaemon.exe => No File FirewallRules: [{215EB851-E765-40FA-8E8D-6CC05139507F}] => (Allow) E:\Games\JLCooperPanelDaemon.exe => No File FirewallRules: [{030A07F2-7D80-40ED-A0C5-A33F3508A608}] => (Allow) E:\Games\EuphonixPanelDaemon.exe => No File FirewallRules: [{99D99A67-48FA-464A-82B2-DBA3D36EED05}] => (Allow) E:\Games\TangentPanelDaemon.exe => No File FirewallRules: [{30E78509-B18E-4E73-A77C-863B06C4262C}] => (Allow) E:\Games\ElementsPanelDaemon.exe => No File FirewallRules: [{0C623322-B99C-4D6F-8016-ECABE200AC9E}] => (Allow) E:\Games\fuscript.exe => No File FirewallRules: [{E321F300-2DA9-430B-9229-D8ED1E491964}] => (Allow) E:\SteamLibrary\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe => No File FirewallRules: [{471E42CE-002C-4B2A-9C80-E2DF98EAB957}] => (Allow) E:\SteamLibrary\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe => No File FirewallRules: [{8108415E-D232-4DDE-A1B5-464EAEFA513F}] => (Allow) E:\SteamLibrary\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File FirewallRules: [{F221AFB1-2780-4264-8F18-2AF33625DB44}] => (Allow) E:\SteamLibrary\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File FirewallRules: [{41D6ACA5-372D-4287-9DE3-A441F6B0DECE}] => (Allow) E:\SteamLibrary\steamapps\common\skyrim\skse_steam_boot.exe => No File FirewallRules: [{9F5F6CFA-6EC6-475C-9934-56291953349F}] => (Allow) E:\SteamLibrary\steamapps\common\skyrim\skse_steam_boot.exe => No File FirewallRules: [TCP Query User{AFA3679B-2024-4146-B369-DB640DD525C5}C:\users\user\appdata\local\kingsoft\wps office\12.1.0.25242\office6\wpscloudsvr.exe] => (Block) C:\users\user\appdata\local\kingsoft\wps office\12.1.0.25242\office6\wpscloudsvr.exe => No File FirewallRules: [UDP Query User{EB25D628-D05B-41A1-AF23-328DEF1096A3}C:\users\user\appdata\local\kingsoft\wps office\12.1.0.25242\office6\wpscloudsvr.exe] => (Block) C:\users\user\appdata\local\kingsoft\wps office\12.1.0.25242\office6\wpscloudsvr.exe => No File FirewallRules: [TCP Query User{31AF1FEC-9705-4D79-9A7D-5D4A9D68A71C}C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26372\office6\wpscloudsvr.exe] => (Allow) C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26372\office6\wpscloudsvr.exe => No File FirewallRules: [UDP Query User{ED00E5E0-99A8-483F-A4A2-78F31A255663}C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26372\office6\wpscloudsvr.exe] => (Allow) C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26372\office6\wpscloudsvr.exe => No File FirewallRules: [TCP Query User{9CFFAD5A-D54C-4C3F-9C24-4E94168F32E5}C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26880\office6\wpscloudsvr.exe] => (Block) C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26880\office6\wpscloudsvr.exe => No File FirewallRules: [UDP Query User{F4B2A5E3-A62D-4BD5-B0C1-C86D1ED6C6CF}C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26880\office6\wpscloudsvr.exe] => (Block) C:\users\user\appdata\local\kingsoft\wps office\12.1.0.26880\office6\wpscloudsvr.exe => No File FirewallRules: [TCP Query User{1E7CBDAB-F0A6-49B6-80BB-2027A59DAD53}C:\xboxgames\minecraft for windows\content\minecraft.windows.exe] => (Allow) C:\xboxgames\minecraft for windows\content\minecraft.windows.exe => No File FirewallRules: [UDP Query User{1199A94A-4053-4217-A168-11CF1506FF6A}C:\xboxgames\minecraft for windows\content\minecraft.windows.exe] => (Allow) C:\xboxgames\minecraft for windows\content\minecraft.windows.exe => No File FirewallRules: [TCP Query User{E035CEA4-6ED1-4593-BF5A-35056688202E}C:\users\user\appdata\local\discord\app-1.0.9248\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9248\discord.exe => No File FirewallRules: [UDP Query User{89600966-F3E0-49A3-A535-BB1FFF3A15D1}C:\users\user\appdata\local\discord\app-1.0.9248\discord.exe] => (Allow) C:\users\user\appdata\local\discord\app-1.0.9248\discord.exe => No File FirewallRules: [TCP Query User{05302C86-5A7F-479C-89D4-D1AB9151D1B4}C:\users\user\appdata\local\discord\app-1.0.9249\discord.exe] => (Block) C:\users\user\appdata\local\discord\app-1.0.9249\discord.exe => No File FirewallRules: [UDP Query User{0D72AF7D-0389-4CB1-9192-5177FAB3D293}C:\users\user\appdata\local\discord\app-1.0.9249\discord.exe] => (Block) C:\users\user\appdata\local\discord\app-1.0.9249\discord.exe => No File FF NewTab: Mozilla\Firefox\Profiles\zbhuy6pr.default -> hxxps://securesearch.org/homepage?hp=2&pId=BT171002&iDate=2021-01-04 05:48:20&iid=551dff7e-06f9-44ca-92a9-1d9b82411c23&bName= HKU\S-1-5-21-2345603349-1785332311-319512340-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://securesearch.org/homepage?hp=2&pId=BT171002&iDate=2021-01-04 05:48:20&iid=551dff7e-06f9-44ca-92a9-1d9b82411c23&bName= Folder: C:\Users\user\AppData\Roaming\citron team 2024-09-16 00:26 - 2024-09-16 00:26 - 000000012 _____ () C:\Users\user\AppData\Roaming\2457fe3357cbf1220231e8917326f70f C:\Users\user\AppData\Local\Temp\NFa3m7HFDFqLs0cwFic8X5s2LiHFPP5.exe Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } C:\WINDOWS\Temp\* C:\WINDOWS\SystemTemp\* C:\Users\user\AppData\Local\Temp\* StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: cmd: del %temp%\*.* /f /s /q cmd: rd /s /q %temp% cmd: bitsadmin /reset /allusers cmd: netsh winsock reset catalog cmd: ipconfig /flushdns RemoveProxy: EmptyTemp: End