Start:: 
CreateRestorePoint: 
CloseProcesses: 
HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [5881656 2020-02-22] (SoftEther Corporation -> SoftEther VPN Project at University of Tsukuba, Japan.) 
HKLM\...\Run: [wpapp] => C:\Users\welos\AppData\Roaming\BirdWallpaper\WpTinyTray.exe [1443232 2018-12-26] (Chengdu Qilu Technology Co. Ltd. -> ) 
HKLM-x32\...\Run: [360wp-srv] => C:\Users\welos\AppData\Roaming\BirdWallpaper\360wpsrv.exe [5112808 2019-12-03] (Chengdu Qilu Technology Co. Ltd. -> )
HKLM-x32\...\Run: [LDSGameMaster] => E:\LDSGameMaster\LDSGameHall\LDSGameHall.exe [5753456 2019-10-30] (天津六六游科技有限公司 -> ) 
HKU\S-1-5-21-2632264772-1639452754-1467669959-1001\...\Run: [GalaxyClient] => [X]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk [2020-02-22]
ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe (SoftEther Corporation -> SoftEther VPN Project at University of Tsukuba, Japan.) 
Startup: C:\Users\welos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\虎牙直播.lnk [2020-02-24]
ShortcutTarget: 虎牙直播.lnk -> C:\Program Files (x86)\HuyaLive\HuyaClient\Huya.exe (Pas de fichier)
Startup: C:\Users\welos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\虎牙直播加速.lnk [2020-02-24]
ShortcutTarget: 虎牙直播加速.lnk -> C:\Program Files (x86)\HuyaLive\HuyaClient\Huya.exe (Pas de fichier) 
Task: {267D2230-9E82-412B-AA12-672C1FCFFC7B} - \Upgrade 2345Explorer Task -> Pas de fichier 
Task: {673D07DE-5935-4D29-A369-BE110EFCD466} - \GSoInput{9055547F-25C8-4C19-AB57-629B7214A9D9} -> Pas de fichier
BHO: SafeBho Class -> {3D9B8BD6-E646-44B4-AA01-F4CA817E928A} -> C:\Program Files (x86)\2345Soft\2345SafeCenter\5.9.3.7446\2345SafeBho64.dll [2019-12-17] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc)
BHO-x32: SafeBho Class -> {3D9B8BD6-E646-44B4-AA01-F4CA817E928A} -> C:\Program Files (x86)\2345Soft\2345SafeCenter\5.9.3.7446\2345SafeBho.dll [2019-12-17] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc) 
FF Notifications: Mozilla\Firefox\Profiles\fxfp0qy9.default -> hxxps://uro3.androponhowrow.info
FF Plugin-x32: @qq.com/QQlive -> C:\Program Files (x86)\Tencent\QQLive\npQQLive.dll [Pas de fichier]
S2 masterPDF_Server; C:\Program Files (x86)\MasterPDF\pdfServer.exe [242128 2020-02-24] (天津速读科技有限公司 -> 天津速读科技有限公司) 
S3 mracsvc; C:\Windows\System32\mracsvc.exe [18534552 2019-10-05] (Mail.Ru LLC -> LLC Mail.Ru) 
R2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [5881656 2020-02-22] (SoftEther Corporation -> SoftEther VPN Project at University of Tsukuba, Japan.) 
S2 2345SafeCenterSvc; pas de ImagePath 
R0 2345Base; C:\Windows\System32\drivers\2345Base.sys [174776 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc)
R1 2345ExProtect; C:\Windows\System32\drivers\2345ExProtect.sys [332984 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc)
R0 2345Iron; C:\Windows\System32\drivers\2345Iron.sys [265400 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc)
R1 2345Misc; C:\Windows\System32\drivers\2345Misc.sys [259768 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc)
R1 2345NetMgr; C:\Windows\System32\drivers\2345NetMgr.sys [113848 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc)
R0 2345Prot; C:\Windows\System32\drivers\2345Prot.sys [344552 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> 2345.cc) 
R1 HardwareProtectWp; C:\Users\welos\AppData\Roaming\BirdWallpaper\wallpaperhelper\HardwareProtect_x64.sys [1313344 2019-10-31] (Chengdu Qilu Technology Co. Ltd. -> ) 
S3 mracdrv; C:\Windows\System32\drivers\mracdrv.sys [17770920 2019-10-05] (Mail.Ru LLC -> LLC Mail.Ru)
R3 Neo_VPN; C:\Windows\System32\drivers\Neo6_x64_VPN.sys [37824 2020-02-22] (SoftEther Corporation -> SoftEther Corporation) 
R1 SeLow; C:\Windows\system32\DRIVERS\SeLow_x64.sys [50624 2020-02-22] (SoftEther Corporation -> SoftEther Corporation) 
R1 SpDrv; E:\LDSGameMaster\Utils\SpDrv_amd64.sys [1291600 2019-01-28] (Chengdu Qilu Technology Co. Ltd. -> www.ludashi.com) 
R1 ttmtor; C:\Windows\System32\drivers\ttmtor.sys [203472 2020-02-24] (Shanghai 2345 Mobile Technology Co., Ltd. -> ) 
2020-02-24 19:16 - 2019-01-28 09:40 - 000000000 ____D C:\Users\welos\Desktop\Gamedata
2020-02-24 18:33 - 2020-02-24 18:33 - 000000924 _____ C:\Users\welos\Desktop\Sekan Kagura Burst Re-Newal.lnk
2020-02-24 18:02 - 2020-02-24 18:02 - 000000000 ____D C:\Users\welos\Documents\手机模拟大师 
2020-02-24 01:15 - 2020-02-24 01:15 - 000000933 _____ C:\Users\welos\AppData\Roaming\D3D5D3C0-0F3D-40c1-9973-CEB7C072AE32.ini
2020-02-24 01:15 - 2020-02-24 01:15 - 000000066 _____ C:\Users\welos\AppData\Roaming\installSystemInfo.cfg
2020-02-24 01:15 - 2020-02-24 01:15 - 000000000 ____D C:\Users\welos\AppData\Roaming\HuyaPc
2020-02-24 01:12 - 2020-02-24 01:12 - 000000000 ____D C:\Users\welos\AppData\Roaming\MasterPDFData
2020-02-24 01:12 - 2020-02-24 01:12 - 000000000 ____D C:\Program Files (x86)\MasterPDF
2020-02-24 01:11 - 2020-02-24 01:11 - 000000000 ____D C:\Users\welos\AppData\Local\WeiDuan
2020-02-24 01:11 - 2018-09-29 08:18 - 000330312 _____ (天津小飞鸟科技有限公司) C:\Windows\SysWOW64\netload.dll
2020-02-24 01:10 - 2020-02-24 01:11 - 000000000 ____D C:\Users\welos\AppData\Roaming\BirdWallpaper
2020-02-24 01:10 - 2020-02-24 01:11 - 000000000 ____D C:\ProgramData\{C155867C-DEA2-4a9f-8CC6-B66B11F71A8C}.tmp
2020-02-24 01:10 - 2020-02-24 01:10 - 000000000 ____D C:\Users\welos\AppData\Roaming\LDSGameCenterSpecLog
2020-02-24 01:10 - 2020-02-24 01:10 - 000000000 ____D C:\ProgramData\{2817CB67-26EB-4345-B7E2-512CF489286C}.tmp
2020-02-24 01:09 - 2020-02-24 19:02 - 000000000 ____D C:\Users\welos\AppData\Roaming\2345DomainMon
2020-02-24 01:09 - 2020-02-24 03:50 - 000000000 ____D C:\Windows\Defender
2020-02-24 01:09 - 2020-02-24 02:47 - 000000000 ____D C:\Users\welos\AppData\Roaming\LDSGameMaster
2020-02-24 01:09 - 2020-02-24 01:36 - 000000000 ____D C:\Users\welos\AppData\Roaming\2345PCSafe
2020-02-24 01:09 - 2020-02-24 01:09 - 000000000 ____D C:\Users\welos\AppData\Roaming\ttmpdll
2020-02-24 01:08 - 2020-02-24 18:06 - 000000000 ____D C:\Users\welos\AppData\Roaming\2345AvScan 
2020-02-24 01:08 - 2020-02-24 18:01 - 000102400 _____ C:\Windows\ProductInfo.ini
2020-02-24 01:08 - 2020-02-24 18:01 - 000000016 _____ C:\Windows\system32\pmdata.dat
2020-02-24 01:08 - 2020-02-24 18:01 - 000000016 _____ C:\Windows\system32\pmcfg.dat
2020-02-24 01:08 - 2020-02-24 18:01 - 000000016 _____ C:\Windows\system32\fmdata.dat
2020-02-24 01:08 - 2020-02-24 18:01 - 000000016 _____ C:\Windows\system32\fmcfg.dat
2020-02-24 01:08 - 2020-02-24 18:01 - 000000000 ____D C:\Users\welos\AppData\Roaming\MiniPage_2345
2020-02-24 01:08 - 2020-02-24 18:01 - 000000000 ____D C:\Users\welos\AppData\Roaming\Helper_2345
2020-02-24 01:08 - 2020-02-24 01:11 - 000000000 ____D C:\Users\welos\AppData\Roaming\lds
2020-02-24 01:08 - 2020-02-24 01:10 - 000000000 ____D C:\Users\welos\AppData\Roaming\Shield_2345Explorer
2020-02-24 01:08 - 2020-02-24 01:09 - 000000000 ____D C:\Users\welos\AppData\Local\LDSGameMaster
2020-02-24 01:08 - 2020-02-24 01:08 - 000344552 _____ (2345.cc) C:\Windows\system32\Drivers\2345Prot.sys
2020-02-24 01:08 - 2020-02-24 01:08 - 000332984 _____ (2345.cc) C:\Windows\system32\Drivers\2345ExProtect.sys
2020-02-24 01:08 - 2020-02-24 01:08 - 000265400 _____ (2345.cc) C:\Windows\system32\Drivers\2345Iron.sys
2020-02-24 01:08 - 2020-02-24 01:08 - 000259768 _____ (2345.cc) C:\Windows\system32\Drivers\2345Misc.sys
2020-02-24 01:08 - 2020-02-24 01:08 - 000174776 _____ (2345.cc) C:\Windows\system32\Drivers\2345Base.sys
2020-02-24 01:08 - 2020-02-24 01:08 - 000113848 _____ (2345.cc) C:\Windows\system32\Drivers\2345NetMgr.sys
2020-02-24 01:08 - 2019-12-30 12:41 - 002990952 _____ (He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si) C:\Windows\system32\gsoinput.dll
2020-02-24 01:08 - 2019-12-30 12:41 - 002654568 _____ (He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si) C:\Windows\SysWOW64\gsoinput.dll
2020-02-24 01:08 - 2019-12-30 12:41 - 002414440 _____ (He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si) C:\Windows\system32\gsoinput.ime
2020-02-24 01:08 - 2019-12-30 12:41 - 002038632 _____ (He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si) C:\Windows\SysWOW64\gsoinput.ime
2020-02-24 01:07 - 2020-02-24 18:01 - 000000000 ____D C:\Users\welos\AppData\Roaming\GameHall_2345
2020-02-24 01:07 - 2020-02-24 01:37 - 000203472 _____ () C:\Windows\system32\Drivers\ttmtor.sys
2020-02-24 01:07 - 2020-02-24 01:23 - 000000000 ____D C:\Users\welos\AppData\Roaming\InsLogicCfg
2020-02-24 01:07 - 2020-02-24 01:14 - 000000000 ____D C:\Users\welos\AppData\Local\2345Explorer
2020-02-24 01:07 - 2020-02-24 01:08 - 000000000 ____D C:\Users\welos\AppData\Roaming\2345SafeCenter
2020-02-24 01:07 - 2020-02-24 01:08 - 000000000 ____D C:\Program Files (x86)\2345Soft
2020-02-24 01:07 - 2020-02-24 01:07 - 000002315 _____ C:\Users\welos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345加速浏览器.lnk
2020-02-24 01:05 - 2020-02-24 01:05 - 000001254 _____ C:\Users\welos\AppData\Roaming\Microsoft\Windows\Start Menu\虎牙直播.lnk
2020-02-24 01:04 - 2020-02-24 01:04 - 000000000 ____D C:\Users\welos\AppData\LocalLow\VirtualStore
2020-02-24 01:04 - 2020-02-24 01:04 - 000000000 ____D C:\Users\Public\Win
2020-02-24 01:00 - 2020-02-24 01:08 - 000000222 _____ C:\ProgramData\InsDeft.xml
2020-02-24 00:57 - 2020-02-24 00:57 - 000000190 _____ C:\Users\welos\AppData\Roaming\GlobalMgr.db 
2020-02-22 01:23 - 2020-02-22 01:23 - 000037824 _____ (SoftEther Corporation) C:\Windows\system32\Drivers\Neo6_x64_VPN.sys
2020-02-22 01:20 - 2020-02-24 17:59 - 000000000 ____D C:\Program Files\SoftEther VPN Client
2020-02-22 01:20 - 2020-02-22 01:20 - 000143672 _____ (SoftEther VPN Project at University of Tsukuba, Japan.) C:\Windows\system32\vpncmd.exe
2020-02-22 01:20 - 2020-02-22 01:20 - 000050624 _____ (SoftEther Corporation) C:\Windows\system32\Drivers\SeLow_x64.sys
2020-02-22 01:20 - 2020-02-22 01:20 - 000001989 _____ C:\ProgramData\Microsoft\Windows\Start Menu\SoftEther VPN Client Manager.lnk
2020-02-22 01:20 - 2020-02-22 01:20 - 000001983 _____ C:\Users\Public\Desktop\SoftEther VPN Client Manager.lnk
2020-02-22 01:20 - 2020-02-22 01:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftEther VPN Client 
C:\Program Files (x86)\Tencent
C:\Users\welos\AppData\Roaming\BirdWallpaper
AlternateDataStreams: C:\Users\welos\Application Data:6699d3ee8dd9cf775caae782c8f44f03 [394]
AlternateDataStreams: C:\Users\welos\AppData\Roaming:6699d3ee8dd9cf775caae782c8f44f03 [394] 
EmptyTemp: 
End::