start::
closeprocesses:
createrestorepoint:
virustotal: C:\ProgramData\99EA82CD\DA638325.dll
ProxyEnable: [.DEFAULT] => Proxy est activé.
ProxyServer: [.DEFAULT] => 127.0.0.1:8080
ProxyEnable: [S-1-5-19] => Proxy est activé.
ProxyServer: [S-1-5-19] => 127.0.0.1:8080
ProxyEnable: [S-1-5-20] => Proxy est activé.
ProxyServer: [S-1-5-20] => 127.0.0.1:8080
ProxyServer: [S-1-5-21-3112363182-2987540026-4192627873-1001] => 127.0.0.1:8080
CHR StartupUrls: Default -> "hxxp://fr.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_ir_15_26&param1=1&param2=f%3D7%26b%3DChrome%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EyEyEyE0ByDtByD0CyEyBtN0D0Tzu0StCtByBtCtN1L2XzutAtFtCtDtFtCtDtFtCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEzzyBtByCtCzzyCtGtAyEtCtAtGtDyE0B0AtGtByB0BtAtGtCzz0FtAtDtB0FzytD0A0CtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0CzztAyEtD0CtAtGyD0B0DtAtGyEyEyB0DtGzz0BtA0BtGyC0DyBtC0F0B0AzytCzzyBtC2QtN0A0LzuyE%26cr%3D1344537544%26a%3Dwncy_ir_15_26%26os%3DWindows 7 Home Premium","hxxp://www.dregol.com/?f=7&a=drg_ir_15_14&cd=2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EyEyEyE0ByDtByD0CyEyBtN0D0Tzu0StCtCzytDtN1L2XzutAtFzytFzztFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyB0C0BtB0D0EtGtC0FtA0CtG0D0B0DzytGyCyE0CyEtGyDtCzytBtByDzztAzzyC0A0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0CzztAyEtD0CtAtGyD0B0DtAtGyEyEyB0DtGzz0BtA0BtGyC0DyBtC0F0B0AzytCzzyBtC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyCyCyB&cr=1703916753&ir=","hxxp://www.mystartsearch.com/?type=hp&ts=1413794149&from=smt&uid=HitachiXHTS545050B9A300_100108PBG406Q7D6R51VX"
2020-09-22 18:56 - 2020-10-06 12:59 - 000000000 __RHD C:\ProgramData\99EA82CD
R2 99EA82CD; C:\ProgramData\99EA82CD\DA638325.dll [3430912 2020-09-22] () [Fichier non signé]
removeproxy:
emptytemp:
end::