start::
CreateRestorePoint:
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\Run: [HLXNX5KRMT] => "C:\Users\gladieu1\AppData\Roaming\Mondial-Relay-Suivi-Colis.vbs"
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\Run: [heDghqlNJV] => wscript.exe //B "C:\Users\gladieu1\AppData\Roaming\heDghqlNJV.vbs"
Task: {BC2C487E-1D22-4EF6-A70A-6E039651CD8A} - System32\Tasks\Skype => C:\Users\gladieu1\AppData\Roaming\Mondial-Relay-Suivi-Colis.vbs
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\StartupApproved\StartupFolder: => "heDghqlNJV.vbs"
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\StartupApproved\StartupFolder: => "Mondial-Relay-Suivi-Colis.vbs"
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\StartupApproved\StartupFolder: => "heDghqlNJV.wsh"
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\StartupApproved\Run: => "heDghqlNJV"
HKU\S-1-5-21-1593251271-2640304127-1825641215-2135140\...\StartupApproved\Run: => "HLXNX5KRMT"
C:\Users\gladieu1\AppData\Roaming\Mondial-Relay-Suivi-Colis.vbs
C:\Users\gladieu1\AppData\Roaming\heDghqlNJV.vbs
end::