TrojanDropper:Win64/Tnega!MSR (Windows 10)

Start::
CloseProcesses:
HKU\S-1-5-21-3449150419-271838051-1508037707-1002\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-3449150419-271838051-1508037707-1002\...\Policies\Explorer: [NoWinKeys] 1
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
CMD: reg query "HKU\S-1-5-21-3449150419-271838051-1508037707-1002\SOFTWARE\Microsoft\Edge\Extensions" /S
CMD: reg query "HKLM\SOFTWARE\Microsoft\Edge\Extensions" /S
CMD: reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Edge\Extensions"" /S
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox" /S
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Mozilla\Firefox" /S
Edge HomePage: Default -> hxxp://www.go-setting.com/
C:\Users\nils\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\meckckfjnfnimlomkemnhcoonjfpbcoh
Edge HKLM\...\Edge\Extension: [meckckfjnfnimlomkemnhcoonjfpbcoh]
Edge HKU\S-1-5-21-3449150419-271838051-1508037707-1002\SOFTWARE\Microsoft\Edge\Extensions\...\Edge\Extension: [meckckfjnfnimlomkemnhcoonjfpbcoh]
Edge HKLM-x32\...\Edge\Extension: [meckckfjnfnimlomkemnhcoonjfpbcoh]
FF HKLM\...\Firefox\Extensions: [{a06de0b3-b00f-472c-a34e-3a74b64d1747}] - C:\Program Files (x86)\vondos\schnelledeals\schnelledeals-1.0.0-fx.xpi => not found
FF HKLM-x32\...\Firefox\Extensions: [{a06de0b3-b00f-472c-a34e-3a74b64d1747}] - C:\Program Files (x86)\vondos\schnelledeals\schnelledeals-1.0.0-fx.xpi => not found
CHR Notifications: Default -> hxxps://de.softonic.com; hxxps://secrethitler.io; hxxps://vulkanvegas.com; hxxps://www.facebook.com; hxxps://www.royalpanda.com
CHR HomePage: Default -> hxxp://www.go-setting.com/
CHR StartupUrls: Default -> "hxxp://www.go-setting.com/"
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ___DC C:\Users\nils\AppData\Roaming\IObit
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ___DC C:\Users\nils\AppData\Roaming\IObit
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ___DC C:\Users\nils\AppData\LocalLow\IObit
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ___DC C:\Users\nils\AppData\LocalLow\IObit
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ____D C:\ProgramData\IObit
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ____D C:\ProgramData\IObit
2021-02-19 20:32 - 2019-01-11 00:01 - 000000000 ____D C:\Program Files (x86)\IObit
C:\Users\nils\AppData\Roaming\nils.exe
CustomCLSID: HKU\S-1-5-21-3449150419-271838051-1508037707-1002_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\nils\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3449150419-271838051-1508037707-1002_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> "C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-3449150419-271838051-1508037707-1002_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\nils\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3449150419-271838051-1508037707-1002_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\nils\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
AlternateDataStreams: C:\Users\nils:Heroes & Generals [38]
AlternateDataStreams: C:\Users\nils\Anwendungsdaten:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\nils\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\nils\AppData\Local\Temp:$DATA​ [16]
AlternateDataStreams: C:\Users\nils\Anwendungsdaten:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\nils\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\nils\AppData\Local\Temp:$DATA​ [16]
HKU\S-1-5-21-3449150419-271838051-1508037707-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=620947&OCID=AVRES000&pc=UE00
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3449150419-271838051-1508037707-1002 -> DefaultScope {510A6C65-1EB9-40FA-875E-0CE4E3F57394} URL = 
CMD: ipconfig /flushdns
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: Bitsadmin /Reset /Allusers
powershell: Set-MpPreference -PUAProtection Enabled
powershell: Set-MpPreference -DisableScanningNetworkFiles 0
Hosts:
RemoveProxy:
SystemRestore: On 
EmptyTemp:
End::