Malware Log Analysis

shared / Adorable-Lie2625
content copied

content

Start:: CloseProcesses: HKU\S-1-5-21-3630950357-4075521388-2021559087-1001\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION C:\Users\usuario\AppData\Roaming\Mozilla\Firefox\Profiles\dj8kol8j.default\Extensions\{5737b515-9d7d-44ca-bbe3-e2e15bec0d4f}.xpi C:\Users\usuario\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp FirewallRules: [{7C441CEA-2646-4893-994F-42E9483D7742}] => (Allow) C:\Program Files\Razer\RazerAppEngine\app-4.0.821\RazerAppEngine.exe => No File Comment: Check TPM and Secure Boot status StartPowershell: [PSCustomObject]@{ "TPM Detected" = (Get-Tpm).TpmPresent; "TPM Enabled" = (Get-Tpm).TpmEnabled; "Secure Boot On" = (Confirm-SecureBootUEFI) } EndPowershell: Comment: Network reset commands CMD: netsh int ip reset CMD: netsh int ipv6 reset CMD: ipconfig /flushDNS CMD: netsh winsock reset catalog Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp CMD: del %temp%\*.* /f /s /q CMD: rd /s /q %temp% C:\Windows\Temp\* C:\Windows\SystemTemp\* EmptyTemp: End::