start::
closeprocesses:
createrestorepoint:
virustotal: C:\ProgramData\Dllhost\dllhost.exe
virustotal: C:\Windows\system32\system32\system.exe
CustomCLSID: HKU\S-1-5-21-2411054893-1290119625-821264753-1001_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" -ToastActivated => Pas de fichier
AlternateDataStreams: C:\Windows\system32\9EarsSurroundSound.dll:72B1DE377E [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk:7661CCE9BF [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AZ Launcher - Minecraft.lnk:EE97536411 [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BakkesMod.lnk:14E057C8D9 [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks 5 Multi-Instance Manager.lnk:35C0D57199 [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks 5.lnk:088221F38A [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCUE.lnk:36398BE0BF [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCUE.lnk:97831153DE [10]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [7126]
HKU\S-1-5-21-2411054893-1290119625-821264753-1001\...\Policies\Explorer: [NoFolderOptions] 1
HKLM-x32\...\Run: [Adobe Creative Cloud] => "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true (Pas de fichier)
Task: {0901BF56-D85C-498C-AE0A-88720104203A} - System32\Tasks\dllhost => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {29B274DF-6AFA-4545-BB74-1E5C48C3DDF5} - System32\Tasks\OneDriveService => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
C:\ProgramData\Dllhost
Task: {8793948B-FBA8-4B11-B083-8F6D48BA6B34} - System32\Tasks\WmiPrvSE => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {ABACF3E6-6318-4115-B155-38A1CB7132EB} - System32\Tasks\AntiMalwareServiceExecutable => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {ACD933C3-74AA-4E7D-B049-2B7D1A3CCC93} - System32\Tasks\MicrosoftEdgeUpd => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {B521B7C3-1CBF-4E9B-9A75-21D0988E3036} - System32\Tasks\NvStray => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {B71AE28D-071D-4C30-82CF-FD24C15423AD} - System32\Tasks\WindowsDefender => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {EB496F0F-97B9-40AB-9D93-A0A409BCFEB9} - System32\Tasks\SecurityHealthSystray => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
Task: {F85FDB84-0A98-4FF3-A293-4BC2EA88E985} - System32\Tasks\Nonastronomic => C:\Windows\system32\system32\system.exe [10860716 2022-09-24] (Medicamentally) [Fichier non signé] <==== ATTENTION
Task: {FB8763F6-F9A4-46FD-95B8-2FF4FC55446A} - System32\Tasks\ActivationRule => C:\ProgramData\Dllhost\dllhost.exe [0 0000-00-00] (Microsoft® Windows® Operating System) [Accès refusé] <==== ATTENTION
C:\Windows\system32\system32
2022-09-30 22:44 - 2022-09-30 21:03 - 016280574 _____ C:\Windows\system32\Drivers\etc\hosts.rollback
2022-09-30 22:44 - 2022-09-30 21:03 - 016280574 _____ C:\Windows\system32\Drivers\etc\hosts.backup
2022-09-30 22:35 - 2022-09-30 22:35 - 000000000 ____D C:\Games
2022-09-30 19:54 - 2022-10-05 19:47 - 000000000 ___HD C:\ProgramData\HostData
2022-09-30 19:54 - 2022-09-30 20:01 - 757453312 _____ (Microsoft® Windows®) C:\Users\jujum\AppData\Roaming\ucFj746g.exe
2022-09-30 19:54 - 2022-09-30 19:54 - 000684984 _____ (Mozilla Foundation) C:\Users\jujum\AppData\LocalLow\freebl3.dll
2022-09-30 19:54 - 2022-09-30 19:54 - 000627128 _____ (Mozilla Foundation) C:\Users\jujum\AppData\LocalLow\mozglue.dll
2022-09-30 19:54 - 2022-09-30 19:54 - 000381456 _____ C:\Users\jujum\AppData\Roaming\zB5xR5o6.exe
2022-09-30 19:54 - 2022-09-30 19:54 - 000003588 _____ C:\Windows\system32\Tasks\AntiMalwareServiceExecutable
2022-09-30 19:54 - 2022-09-30 19:54 - 000003574 _____ C:\Windows\system32\Tasks\SecurityHealthSystray
2022-09-30 19:54 - 2022-09-30 19:54 - 000003564 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpd
2022-09-30 19:54 - 2022-09-30 19:54 - 000003562 _____ C:\Windows\system32\Tasks\WindowsDefender
2022-09-30 19:54 - 2022-09-30 19:54 - 000003562 _____ C:\Windows\system32\Tasks\OneDriveService
2022-09-30 19:54 - 2022-09-30 19:54 - 000003560 _____ C:\Windows\system32\Tasks\ActivationRule
2022-09-30 19:54 - 2022-09-30 19:54 - 000003548 _____ C:\Windows\system32\Tasks\WmiPrvSE
2022-09-30 19:54 - 2022-09-30 19:54 - 000003546 _____ C:\Windows\system32\Tasks\NvStray
2022-09-30 19:54 - 2022-09-30 19:54 - 000003546 _____ C:\Windows\system32\Tasks\dllhost
2022-09-30 19:54 - 2022-09-30 20:01 - 757453312 _____ (Microsoft® Windows®) C:\Users\jujum\AppData\Roaming\ucFj746g.exe
2022-09-30 19:54 - 2022-09-30 19:54 - 000381456 _____ () C:\Users\jujum\AppData\Roaming\zB5xR5o6.exe
cmd: netsh advfirewall reset
hosts:
emptytemp:
end::