start::
closeprocesses:
createrestorepoint:
virustotal: C:\Users\Michel\AppData\Roaming\Microsoft\VScan.exe
virustotal: C:\Users\Michel\AppData\Roaming\Dll\dlIhost.exe
HKLM\...\Policies\Explorer: [NoThumbnailCache] 0
HKLM\...\Policies\Explorer: [DisableThumbnailCache] 0
HKU\S-1-5-21-1874310451-637206807-3455439862-1001\...\Run: [VScan] => C:\Users\Michel\AppData\Roaming\Microsoft\VScan.exe [416947 2022-04-26] () [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1874310451-637206807-3455439862-1001\...\Run: [MSDllHelper] => C:\Users\Michel\AppData\Roaming\Dll\dlIhost.exe [4827648 2022-05-16] (Microsoft Corporation) [Fichier non signé]
C:\Users\Michel\AppData\Roaming\Microsoft\VScan.exe
C:\Users\Michel\AppData\Roaming\Dll\dlIhost.exe
S3 MpKsl47aef1bc; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98FB0D97-72FA-49AB-90CC-E81FF34C7A64}\MpKslDrv.sys [X]
S3 MpKslb4f057d4; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98FB0D97-72FA-49AB-90CC-E81FF34C7A64}\MpKslDrv.sys [X]
S3 MpKslce4baf9d; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98FB0D97-72FA-49AB-90CC-E81FF34C7A64}\MpKslDrv.sys [X]
2022-08-10 07:45 - 2022-08-10 10:43 - 000000000 ____D C:\Program Files (x86)\Asmwsoft PC Optimizer
FirewallRules: [TCP Query User{F69CDE2D-34F8-488B-A793-4499CA78B950}E:\michel\subsistence.v30.07.2021\binaries\win64\udk.exe] => (Allow) E:\michel\subsistence.v30.07.2021\binaries\win64\udk.exe => Pas de fichier
FirewallRules: [UDP Query User{3C2F6C95-B97F-461F-B737-6479B3D1D895}E:\michel\subsistence.v30.07.2021\binaries\win64\udk.exe] => (Allow) E:\michel\subsistence.v30.07.2021\binaries\win64\udk.exe => Pas de fichier
FirewallRules: [TCP Query User{C00AFBE1-5C59-44D5-A1F3-36D5A88D4E5D}C:\users\michel\desktop\this.land.is.my.land.v1.0.2.18918-goldberg\this land is my land.exe] => (Allow) C:\users\michel\desktop\this.land.is.my.land.v1.0.2.18918-goldberg\this land is my land.exe () [Fichier non signé]
FirewallRules: [UDP Query User{59F89186-20DC-487D-9A61-92A7987BD522}C:\users\michel\desktop\this.land.is.my.land.v1.0.2.18918-goldberg\this land is my land.exe] => (Allow) C:\users\michel\desktop\this.land.is.my.land.v1.0.2.18918-goldberg\this land is my land.exe () [Fichier non signé]
cmd: sfc /scannow
emptytemp:
end::