start::
CreateRestorePoint:
CloseProcesses:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {0BFC74F5-C42F-4C6C-93C2-C9ED44BD76D1} - System32\Tasks\Online Application V2G2 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: {21F0F1B7-563A-420F-8E0E-E959F3A353E1} - System32\Tasks\greiner pendantsgreiner pendants => C:\Program Files (x86)\Demarcated\Zealously.exe
Task: {2C85BC90-A08E-4B65-B04C-4B82AD087202} - System32\Tasks\spud-fallsspud-falls => C:\Program Files (x86)\raucous\Zealously.exe
Task: {4E71520A-3B24-4B71-8F19-11629946FFBB} - System32\Tasks\Online Application V2G6 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: {92924509-C2AA-4F0E-B84A-E20FC3A7501E} - System32\Tasks\keita_colorfulkeita_colorful => C:\Program Files (x86)\Demarcated\Coronations.exe
Task: {A2704268-D491-43FA-B2F7-4B31D3417771} - System32\Tasks\Online Application V2G5 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: {BBD8F296-6351-4A34-A2FD-48032BB237C5} - \AutoKMS -> Pas de fichier <==== ATTENTION
Task: {BE127252-C544-4F66-A7B6-CE6DCE5BDA42} - System32\Tasks\arendarend => C:\Program Files (x86)\Attests\Coronations.exe
Task: {BEB84655-0FD5-4111-876E-BE52D68DF38E} - System32\Tasks\Online Application V2G3 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: {CC3B326E-8079-4CF5-A16A-01F908428A79} - System32\Tasks\Online Application V2G1 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: {E5E43CF2-E41D-4CD9-872F-45475C1B6548} - System32\Tasks\Updater_Online_Application => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== ATTENTION
Task: {EE1ABAB2-EE93-4A3D-9D84-F32E2B7AE840} - System32\Tasks\Online Application V2G4 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Online Application V2G1.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Online Application V2G2.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Online Application V2G3.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Online Application V2G4.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Online Application V2G5.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Online Application V2G6.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\windows\Tasks\Updater_Online_Application.job => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== ATTENTION
C:\Program Files (x86)\Microleaves\Online Application
C:\Program Files (x86)\Demarcated
C:\Program Files (x86)\raucous
C:\Program Files (x86)\Attests
C:\Program Files (x86)\moonscape

HKU\S-1-5-21-2737998636-1275881301-2046671180-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://fr.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_wnzp_15_34¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0DtD0B0Fzy0CtD0C0F0EyD0CyD0DtC0FtN0D0Tzu0StCtAtByCtN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StC0DtCtCyC0Bzy0DtGtD0E0ByCtGtBzy0EtAtGtCtAtDzytGzy0DtCtDyEyE0ByE0DyDyDyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0DyCyE0EtAzy0EtGyEyCtD0CtGyEtAtD0FtGzztAtB0FtGzyyD0A0E0DyC0C0DyB0E0B0C2QtN0A0LzuyE%26cr%3D786011794%26a%3Dwncy_wnzp_15_34%26os%3DWindows%2B7%2BProfessional
SearchScopes: HKU\S-1-5-21-2737998636-1275881301-2046671180-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_wnzp_15_34¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0DtD0B0Fzy0CtD0C0F0EyD0CyD0DtC0FtN0D0Tzu0StCtAtByCtN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StC0DtCtCyC0Bzy0DtGtD0E0ByCtGtBzy0EtAtGtCtAtDzytGzy0DtCtDyEyE0ByE0DyDyDyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0DyCyE0EtAzy0EtGyEyCtD0CtGyEtAtD0FtGzztAtB0FtGzyyD0A0E0DyC0C0DyB0E0B0C2QtN0A0LzuyE%26cr%3D786011794%26a%3Dwncy_wnzp_15_34%26os%3DWindows%2B7%2BProfessional&p={searchTerms}
2020-05-22 21:40 - 2019-11-09 22:43 - 000000344 _____ C:\windows\Tasks\Online Application V2G6.job
2020-05-22 21:40 - 2019-11-09 22:43 - 000000344 _____ C:\windows\Tasks\Online Application V2G4.job
2020-05-22 21:40 - 2019-11-09 22:42 - 000000344 _____ C:\windows\Tasks\Online Application V2G5.job
2020-05-22 21:35 - 2019-11-09 22:43 - 000000344 _____ C:\windows\Tasks\Online Application V2G3.job
2020-05-22 21:35 - 2019-11-09 22:43 - 000000344 _____ C:\windows\Tasks\Online Application V2G2.job
2020-05-22 21:35 - 2019-11-09 22:42 - 000000344 _____ C:\windows\Tasks\Online Application V2G1.job
Online Application (HKLM-x32\...\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}) (Version: 2.7.0 - Microleaves) Hidden <==== ATTENTION
MSCONFIG\startupreg: Attracting => "C:\Program Files (x86)\Attests\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: autos => "C:\Program Files (x86)\moonscape\autos.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Conjoin => "C:\Program Files (x86)\raucous\Zealously.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Digressed => "C:\Program Files (x86)\Demarcated\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Doubting => "C:\Program Files (x86)\Attests\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Gratings => "C:\Program Files (x86)\Attests\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Hcv => "C:\Program Files (x86)\Demarcated\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Hossain => "C:\Program Files (x86)\Demarcated\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Mulcahy => "C:\Program Files (x86)\raucous\Zealously.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Onyx => "C:\Program Files (x86)\raucous\Zealously.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Powerplant => "C:\Program Files (x86)\Demarcated\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Renz => "C:\Program Files (x86)\raucous\Zealously.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: Squanders => "C:\Program Files (x86)\Attests\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
MSCONFIG\startupreg: synchronize => "C:\Program Files (x86)\Attests\Coronations.exe" mpsakuwmpsakuwmpsakuwmpsaku.mpsakummpsakupmpsakummpsaku.mpsakupmpsakuwmpsaku/mpsakuj2hu0hu1humpsaku9hu1z1z0j9mpsakujhuhtmcwLLmpsakuUe5yZgOIY6mpsakuYA5Xgf
FirewallRules: [TCP Query User{F0AE7362-BD35-4332-8FEE-CACF9E924568}C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe] => (Allow) C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe => Pas de fichier
FirewallRules: [UDP Query User{3B951E17-69BF-4319-BF39-B5613A6B728B}C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe] => (Allow) C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe => Pas de fichier
FirewallRules: [TCP Query User{69EB0A55-BF22-474E-8C18-BA929EE1ED96}C:\program files (x86)\wondershare\mobilego\mobilego.exe] => (Allow) C:\program files (x86)\wondershare\mobilego\mobilego.exe => Pas de fichier
FirewallRules: [UDP Query User{1660A9EC-F38B-4C6C-983B-01D2518AE4E4}C:\program files (x86)\wondershare\mobilego\mobilego.exe] => (Allow) C:\program files (x86)\wondershare\mobilego\mobilego.exe => Pas de fichier
FirewallRules: [TCP Query User{A66EEAEE-9BA3-4ABF-BF26-3ED1AC1FC0A1}C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe] => (Block) C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe => Pas de fichier
FirewallRules: [UDP Query User{5679410C-6B0F-4EF3-A79F-5D54E629074B}C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe] => (Block) C:\program files (x86)\wondershare\mobilego\mobilegoservice.exe => Pas de fichier
cmd: cscript %windir%\System32\slmgr.vbs /dlv
EmptyTemp:
end::