start::
closeprocesses:
createrestorepoint:
virustotal: C:\Windows\System32\wbem\WmiPrvSE.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-4293708715-4276633199-947103255-1001\...\Run: [ExtreamFanV5] => C:\Users\matti\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe (Pas de fichier)
Startup: C:\Users\matti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk [2023-09-18]
ShortcutTarget: PowerExpertNT.lnk -> C:\Users\matti\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe (Pas de fichier)
GroupPolicy: Restriction - Windows Defender <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {4654354A-C033-4C35-ABC7-69668D2F7309} - \GoogleUpdateTaskMachineQC -> Pas de fichier <==== ATTENTION
Task: {2FA67D1C-12A1-46D1-BCA5-BFE59487728D} - System32\Tasks\bICKntBpnxqzoSsGnN => C:\Users\matti\AppData\Local\Temp\TeqlUkZeVhmIYafPV\UpOLbGrQfJYpXSf\gIKrxiZ.exe Gg /Lnsite_idbmG 385121 /S (Pas de fichier) <==== ATTENTION
C:\Users\matti\AppData\Local\Temp\TeqlUkZeVhmIYafPV\UpOLbGrQfJYpXSf\gIKrxiZ.exe
Task: {4D7CC7E5-8896-407F-B6F0-A345366CA6BF} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\TerminalSysInfo => %appdata%\\sysinfotool\\sitool.exe -st -tu 5 (Pas de fichier)
Task: {F4C4233D-8A01-4A72-AABC-AAB758A9A146} - System32\Tasks\WindowsAppPool\bMKK8mGK9sORGKR => C:\Users\matti\AppData\Local\Temp\bMKK8mGK9sORGKR.exe (Pas de fichier) <==== ATTENTION
Task: {CED214E1-AC10-43E3-B607-03DB133EF77E} - System32\Tasks\WindowsAppPool\eCSRuGSxsiqze6h => C:\Users\matti\AppData\Local\Temp\eCSRuGSxsiqze6h.exe (Pas de fichier) <==== ATTENTION
Task: {AA3633DA-CBE3-4A48-A978-77E29C329F6A} - System32\Tasks\WinTrackerSP HR => C:\ProgramData\WinTrackerSP\WinTrackerSP.exe (Pas de fichier) <==== ATTENTION
Task: {6FC068A4-ABD7-4AC9-92F5-0191960C9387} - System32\Tasks\WinTrackerSP LG => C:\ProgramData\WinTrackerSP\WinTrackerSP.exe (Pas de fichier) <==== ATTENTION
C:\Users\matti\AppData\Local\Temp\bMKK8mGK9sORGKR.exe
C:\Users\matti\AppData\Local\Temp\eCSRuGSxsiqze6h.exe
C:\ProgramData\WinTrackerSP
Task: C:\WINDOWS\Tasks\bICKntBpnxqzoSsGnN.job => C:\Users\matti\AppData\Local\Temp\TeqlUkZeVhmIYafPV\UpOLbGrQfJYpXSf\gIKrxiZ.exe <==== ATTENTION
S2 csovieby; C:\WINDOWS\SysWOW64\csovieby\ovcfuibl.exe [0 0000-00-00] () [Accès refusé]
C:\WINDOWS\SysWOW64\csovieby
S2 Audio Searcher; C:\ProgramData\Audio Searcher\Audio Searcher.exe [X] <==== ATTENTION
S4 VBoxGuest; VBoxGuest [X]
S4 VBoxMouse; VBoxMouse [X]
S4 VBoxService; VBoxService [X]
S4 VBoxSF; VBoxSF [X]
S4 VBoxVideo; VBoxVideo [X]
S4 VBoxWddm; VBoxWddm [X]
2023-09-18 00:58 - 2023-09-18 01:54 - 000000536 _____ C:\WINDOWS\Tasks\bICKntBpnxqzoSsGnN.job
2023-09-18 00:58 - 2023-09-18 00:59 - 000000000 ____D C:\Program Files (x86)\1694991508_0
2023-09-18 00:58 - 2023-09-18 00:58 - 000003554 _____ C:\WINDOWS\system32\Tasks\WinTrackerSP HR
2023-09-18 00:58 - 2023-09-18 00:58 - 000003298 _____ C:\WINDOWS\system32\Tasks\WinTrackerSP LG
2023-09-18 00:58 - 2023-09-18 00:58 - 000003080 _____ C:\WINDOWS\system32\Tasks\bICKntBpnxqzoSsGnN
2023-09-18 00:58 - 2023-09-18 00:58 - 000000290 __RSH C:\ProgramData\ntuser.pol
2023-09-18 00:58 - 2023-09-18 00:58 - 000000000 ____D C:\WINDOWS\SysWOW64\csovieby
2023-09-18 00:58 - 2023-09-18 00:58 - 000000000 ____D C:\WINDOWS\system32\Tasks\WindowsAppPool
hosts:
emptytemp:
end::