Endfield Records Malware Warning (Pull Tracker Explained)

This video explains the malware discovered on EndfieldRecords.com, a website that was used by players to track banner pull logs for Arknights: Endfield.

If you used the site, you should check your PC to make sure the malicious script did not create persistence tasks or registry entries on your system.

Timestamps:
0:00 Brief explanation
0:30 What happened
0:45 What the malware steals
1:05 How to check if your system is infected
1:22 Event Viewer
2:30 Task Scheduler
3:16 Checking Task Scheduler and Startup Programs with Powershell Commands
4:15 System32 Folder
4:54 The 2 Options to Remove the Malware
5:15 How to invalidate the old Token
5:40 What to do after, in case you followed the guide by the Discord user to remove the Malware
5:50 Outro

In this guide I explain:

- what happened with EndfieldRecords
- what the malware attempts to steal
- how to check if your system is infected
- how to remove it

The script reportedly attempted to collect data from files related to games like Wuthering Waves, Genshin Impact, Honkai Star Rail and Zenless Zone Zero, as well as Firefox browser data and Notepad files.

Even if nothing suspicious appears during the checks, it is still recommended to change your passwords and clean sessions if you used the website while it was online.

🔎 PowerShell commands used in the guide:

Check for the scheduled task:

Get-ScheduledTask -TaskName "RegisterDeviceScopeChange" -TaskPath "\Microsoft\Windows\DeviceDirectoryClient"

Check for the registry keys:

Get-Item "HKCU:\Software\Orutime\Lethreme"

Get-Item "HKLM:\Software\Orutime\Lethreme"

Check startup programs:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

Ideally the first three commands should return something like: ObjectNotFound.

The last two commands will show programs that are configured to start automatically when Windows starts.

If you see unknown programs or suspicious URLs, investigate them further before allowing them to run.

⚠️ If you find any of the suspicious files or scheduled tasks mentioned in the video, consider doing a clean Windows reinstall to make sure the malware is completely removed.

#ArknightsEndfield #MalwareWarning #EndfieldRecords

Видео Endfield Records Malware Warning (Pull Tracker Explained) канала NITrogen