Malware Log Analysis

shared / SidHBK
content copied

content

Start:: CloseProcesses: DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-3052480637-688437526-2025535754-1001\Products\E43F6082AB61CB14AAC315433B4DA9D9 DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2806F34E-16BA-41BC-AA3C-5134B3D49A9D} DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\19E36D30CE208454EA2E4CA562570791 C:\WINDOWS\Installer\31032663.msi AlternateDataStreams: C:\Users\kumar\Downloads\EmsisoftEmergencyKit.exe:MBAM.Zone.Identifier [168] AlternateDataStreams: C:\Users\kumar\Downloads\esetonlinescanner.exe:MBAM.Zone.Identifier [240] 2026-07-28 02:20 - 2026-07-28 02:29 - 000063168 _____ C:\Users\kumar\AppData\LocalLow\5d9719002be2068ce9885bb8d170b43a7bd72defaae1a7b95f1b3692c69c3119 2026-07-28 02:20 - 2026-07-28 02:20 - 000000026 _____ C:\Users\kumar\AppData\LocalLow\65ab9bb7909ee7e36547098d6082ee1f4794b1921b1224fc26aa264b0f932812 2026-07-28 02:20 - 2026-07-28 02:20 - 000000026 _____ C:\Users\kumar\AppData\LocalLow\219e8b429a2e9a10bc2bb8ff2606bd6e99899b3a7b05345aedf13291e924313c 2026-07-28 01:34 - 2026-07-28 02:20 - 000025355 _____ C:\Users\kumar\AppData\LocalLow\7bfdd2079cc83f1cc34980a8e67011f48337a3ba8e95b3828e5e510423950d1a 2026-07-28 01:23 - 2026-07-28 01:23 - 000041469 _____ C:\Users\kumar\AppData\LocalLow\71f0008ccd3814e684738b999a1498aae61d2024c7f118fc128d713b0948ea49 Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* C:\Windows\Prefetch\* EmptyTemp: End::