Malware Log Analysis

Start CreateRestorePoint: CloseProcesses: Folder: C:\Users\dngo7\AppData\Local\Wacom Folder: C:\Users\dngo7\AppData\Local\Corsair Folder: C:\ProgramData\dev_observer_repository Folder: C:\ProgramData\Common Folder: C:\Users\dngo7\AppData\Roaming\152b6abba489 C:\Users\dngo7\AppData\Local\Google\Chrome\User Data\Default\Extensions\eppiocemhmnlbhjplcgkofciiegomcon 2026-10-15 20:35 - 2026-10-15 20:35 - 002069144 _____ (Plantronics, Inc.) C:\Users\dngo7\AppData\Local\DyIndex.exe 2026-10-15 20:35 - 2026-10-15 20:35 - 000000000 ____D C:\ProgramData\dev_observer_repository 2026-10-15 21:17 - 2024-12-03 06:18 - 000000000 ____D C:\ProgramData\Common 2026-10-15 20:35 - 2026-10-15 20:35 - 002069144 _____ (Plantronics, Inc.) C:\Users\dngo7\AppData\Local\DyIndex.exe 2026-10-15 20:38 - 2026-10-15 20:38 - 000000000 ____D C:\Users\dngo7\AppData\Local\Yandex 2026-10-15 20:36 - 2026-10-15 20:36 - 000000000 ____D C:\Users\dngo7\AppData\Local\Wacom 2026-10-15 20:36 - 2026-10-15 20:36 - 000000000 ____D C:\Users\dngo7\AppData\Local\Corsair 2026-10-15 20:34 - 2026-10-15 20:34 - 000000000 ____D C:\Users\dngo7\AppData\Roaming\RenPy HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\Environment\\UserInitMprLogonScript: -> C:\Users\dngo7\AppData\Roaming\152b6abba489\AutoIt3.exe [2026-10-16] (AUTOIT CONSULTING LTD -> AutoIt Team) C:\Users\dngo7\AppData\Roaming\152b6abba489 GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\Run: [MicrosoftEdgeAutoLaunch_C0E88C9E8F20EB1B9F971D563021B498] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5438280 2026-10-08] (Microsoft Corporation -> Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001_Classes\CLSID\{0BD55301-692E-4EE1-B523-C2F69555EC75}\localserver32 -> C:\Users\dngo7\AppData\Local\WeMod\app-12.41.1\Wand.exe => No File CustomCLSID: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001_Classes\CLSID\{23A5B06E-20BB-4E7E-A0AC-6982ED6A6041}\localserver32 -> C:\Users\dngo7\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner_nt64.exe => No File CustomCLSID: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001_Classes\CLSID\{AD0B6C12-FC3A-4337-871A-8D891CBB01B4}\localserver32 -> C:\Users\dngo7\AppData\Local\WeMod\app-12.45.0\Wand.exe => No File CustomCLSID: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001_Classes\CLSID\{EED69C32-195C-4500-8247-BABBB652A030}\localserver32 -> C:\Users\dngo7\AppData\Local\WeMod\app-12.58.0\Wand.exe => No File FirewallRules: [{F7B3898B-C2AB-4F76-A3B0-C4A407258697}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe => No File FirewallRules: [{6E20FBFE-260E-41E4-B887-19EF46BEBC29}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe => No File FirewallRules: [{FD557F57-EDAF-4000-B5D8-6CEDAA78D634}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe => No File FirewallRules: [{D7D7BFA5-35CB-472E-9747-D007F7234F1D}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe => No File FirewallRules: [TCP Query User{1DECA2AE-DBAA-4472-BCAD-CA5DAA449367}C:\users\dngo7\downloads\compressed\ea.sports.madden.nfl.27-steamrip.com_2\madden nfl 27\madden27.fixed.exe] => (Allow) C:\users\dngo7\downloads\compressed\ea.sports.madden.nfl.27-steamrip.com_2\madden nfl 27\madden27.fixed.exe => No File FirewallRules: [UDP Query User{3B448AD4-710C-44C1-B18C-A840C606649C}C:\users\dngo7\downloads\compressed\ea.sports.madden.nfl.27-steamrip.com_2\madden nfl 27\madden27.fixed.exe] => (Allow) C:\users\dngo7\downloads\compressed\ea.sports.madden.nfl.27-steamrip.com_2\madden nfl 27\madden27.fixed.exe => No File FirewallRules: [TCP Query User{54B18B5C-DE5B-4BB7-801F-01B571613817}C:\users\dngo7\downloads\compressed\earthx 2 open alpha (windows)\earthx.exe] => (Allow) C:\users\dngo7\downloads\compressed\earthx 2 open alpha (windows)\earthx.exe => No File FirewallRules: [UDP Query User{14146FC6-F4F5-47A9-9E38-418DD6ADBEAA}C:\users\dngo7\downloads\compressed\earthx 2 open alpha (windows)\earthx.exe] => (Allow) C:\users\dngo7\downloads\compressed\earthx 2 open alpha (windows)\earthx.exe => No File HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {151c4789-a2cc-11f1-8888-345a601ff3fe} - "D:\OnePlus_setup.exe" /s Task: {D126100E-330F-4F48-9A20-D313B6F112A1} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No File) C:\Users\dngo7\Downloads\Compressed\emu anadius_CollegeFB27_1.0.140.10383.rar C:\Users\dngo7\Downloads\Compressed\emu anadius_CollegeFB27_1.0.140.17622.rar C:\Users\dngo7\Downloads\Compressed\emu rune_Madden NFL 27_1.0.139.61898.rar C:\Users\dngo7\Downloads\Compressed\emu rune_CollegeFB27_1.0.139.46591.rar C:\Users\dngo7\Downloads\Compressed\emu rune_Madden NFL 27_1.0.139.48127.rar Folder: C:\Users\dngo7\AppData\Roaming\Loom File: C:\Users\dngo7\OneDrive\Desktop\payload.bin Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } Powershell: Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell/Operational'; Id='4104';} | Where-object -Property Message -Match "[A-Za-z0-9+/=]{150}" | Format-List -Property Message CMD: type "%appdata%\microsoft\windows\powershell\psreadline\consolehost_history.txt" CMD: Dir C:\WINDOWS\Installer /a:- /o:gd Powershell: Get-MpThreatDetection Comment: RenPyLoader hollowed installed app generic removal C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.props C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.targets C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.tmp C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.csproj C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.user C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cache C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.config C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.bat C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cfg C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.props C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.targets C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.tmp C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.csproj C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.user C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cmd C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cache C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.config C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.bat C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cfg C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\OneDriveSync Comment: This snippet investigates common folders abused by PavinLoader to drop its project files StartPowerShell: param( [string[]]$Paths = @( 'C:\ProgramData', 'C:\Users\*\AppData\Local\Microsoft\Windows\WebCache', 'C:\Users\*\AppData\Local\Microsoft\Windows\Explorer', 'C:\Users\*\AppData\Roaming\Microsoft\Windows\Themes', 'C:\Users\*\AppData\Roaming\Microsoft\Windows\Libraries', 'C:\Users\*\AppData\Local\Microsoft\Windows\Caches', 'C\Users\*\AppData\Roaming\Microsoft\Windows\Caches', 'C:\Users\*\AppData\Local\Microsoft\Windows\Notifications', 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache', 'C:\Users\*\AppData\Roaming\Microsoft\Crypto', 'C:\Users\*\AppData\Local\Microsoft\Windows\INetCache' ), [string[]]$Patterns = @('*.sln', '*.csproj.user', '*.Build.targets', '*.csproj'), [switch]$IncludeCsproj, [string]$CsvPath ) Write-Host "PavinLoader check - cache patterns" if ($IncludeCsproj) { $Patterns += '*.csproj' } function Get-RealFiles { param([string]$Path) foreach ($f in (Get-ChildItem -LiteralPath $Path -File -Force -ErrorAction SilentlyContinue)) { $f } foreach ($d in (Get-ChildItem -LiteralPath $Path -Directory -Force -ErrorAction SilentlyContinue)) { if ($d.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { continue } Get-RealFiles -Path $d.FullName } } $roots = foreach ($p in $Paths) { Get-Item -Path $p -Force -ErrorAction SilentlyContinue | Where-Object { $_.PSIsContainer } } $roots = $roots | Sort-Object FullName -Unique if (-not $roots) { Write-Warning 'None of the paths exist.'; return } $results = foreach ($root in $roots) { Write-Host "Verifying: $($root.FullName)" Get-RealFiles -Path $root.FullName | Where-Object { $n = $_.Name foreach ($pat in $Patterns) { if ($n -like $pat) { return $true } } $false } | ForEach-Object { [pscustomobject]@{ Folder = $_.DirectoryName Name = $_.Name SizeBytes = $_.Length Created = $_.CreationTime Modified = $_.LastWriteTime Attributes = $_.Attributes SHA256 = (Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash FullPath = $_.FullName } } } if (-not $results) { Write-Host 'No matches found.' return } $results | Group-Object Folder | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host "[$($_.Name)]" $_.Group | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host ("FullPath : " + $_.FullPath) Write-Host ("SHA256 : " + $_.SHA256) Write-Host ("SizeBytes : " + $_.SizeBytes) Write-Host ("Created : " + $_.Created) Write-Host ("Modified : " + $_.Modified) Write-Host ("Attributes : " + $_.Attributes) } } if ($CsvPath) { $results | Export-Csv -LiteralPath $CsvPath -NoTypeInformation -Encoding UTF8 Write-Host "CSV saved: $CsvPath" } EndPowerShell: Comment: This snippet investigates PavinLoader installed apps, commonly being dropped by RenPyLoader StartPowerShell: param( [string[]]$Patterns = @('*.sln', '*.csproj.user', '*.Build.targets', '*.csproj'), [switch]$IncludeCsproj, [switch]$Deep, [string]$CsvPath ) Write-Host "PavinLoader check - hollowed installed application" if ($IncludeCsproj) { $Patterns += '*.csproj' } function Get-RealSubDirs { param([string]$Path, [bool]$Recurse) foreach ($d in (Get-ChildItem -LiteralPath $Path -Directory -Force -ErrorAction SilentlyContinue)) { if ($d.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { continue } $d if ($Recurse) { Get-RealSubDirs -Path $d.FullName -Recurse $true } } } $results = New-Object System.Collections.Generic.List[object] $local = $env:LOCALAPPDATA if (-not $local -or -not (Test-Path -LiteralPath $local)) { Write-Host 'LOCALAPPDATA not found.'; return } Write-Host "Scanning: $local" foreach ($top in (Get-RealSubDirs -Path $local -Recurse $false)) { foreach ($sub in (@($top) + @(Get-RealSubDirs -Path $top.FullName -Recurse $Deep.IsPresent))) { foreach ($f in (Get-ChildItem -LiteralPath $sub.FullName -File -Force -ErrorAction SilentlyContinue)) { $match = $false foreach ($p in $Patterns) { if ($f.Name -like $p) { $match = $true; break } } if (-not $match) { continue } $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash $results.Add([pscustomobject]@{ Name = $f.Name SizeBytes = $f.Length Created = $f.CreationTime Modified = $f.LastWriteTime Attributes = $f.Attributes SHA256 = $hash FullPath = $f.FullName }) } } } if (-not $results.Count) { Write-Host 'No matches found.'; return } $results | Group-Object { Split-Path $_.FullPath -Parent } | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host "[$($_.Name)]" $_.Group | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host ("FullPath : " + $_.FullPath) Write-Host ("SHA256 : " + $_.SHA256) Write-Host ("SizeBytes : " + $_.SizeBytes) Write-Host ("Created : " + $_.Created) Write-Host ("Modified : " + $_.Modified) Write-Host ("Attributes : " + $_.Attributes) } } if ($CsvPath) { $results | Export-Csv -LiteralPath $CsvPath -NoTypeInformation -Encoding UTF8 Write-Host "CSV saved: $CsvPath" } EndPowerShell: C:\WINDOWS\Temp\* C:\WINDOWS\SystemTemp\* C:\Users\CurrentUserName\AppData\Local\Temp\* StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: CMD: del %temp%\*.* /f /s /q CMD: rd /s /q %temp% CMD: bitsadmin /reset /allusers CMD: netsh winsock reset catalog CMD: ipconfig /flushdns RemoveProxy: EmptyTemp: End