start::
closeprocesses:
createrestorepoint:
Task: {681D548B-AFB2-492D-911C-468532166F6B} - System32\Tasks\OneNote 3043 => C:\Users\miche\AppData\Roaming\Network3043Man.cmd [252112 2024-01-16] () [File not signed] ->
Task: {8C3978BE-AE21-4FAD-A20F-33BCC56F3F73} - System32\Tasks\OneNote 4309 => C:\Users\miche\AppData\Roaming\Network4309Man.cmd [598476 2024-01-16] () [File not signed] ->
Task: {19AF32F7-D036-4748-9E2B-FFFBB98C533A} - System32\Tasks\{B5C34E1A-2878-4F31-8D98-E06ECEC9410F} => C:\Windows\system32\pcalua.exe [53760 2023-06-06] (Microsoft Windows -> Microsoft Corporation) -> -a E:\AutoRun.exe -d E:\
Task: {0292E8A1-1A77-4727-BD62-8FE1128711BF} - System32\Tasks\Microsoft\VisualStudio\VSIX Auto Update 14 => C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\VSIXAutoUpdate.exe (No File)
Task: {0CEC0B91-4AE9-4E8A-ACB2-3B4C811F442C} - System32\Tasks\Microsoft\Windows\WaaSMedic\PerformRemediation => {72566E27-1ABB-4EB3-B4F0-EB431CB1CB32} %systemroot%\system32\WaasMedicSvc.dll (No File)
Task: {5930C2BC-6A9C-46EE-B80A-96DC1F11089F} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-3820880270-2446757353-2433166087-1004 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /reporting (No File)
Task: {649A4E89-767F-40C6-80E8-273670A26820} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3820880270-2446757353-2433166087-1004 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (No File)
FF Notifications: Mozilla\Firefox\Profiles\1fry4lj2.default -> hxxps://traderie.com; hxxps://d2runewizard.com
S3 WaaSMedicSvc; %systemroot%\system32\WaasMedicSvc.dll [X]
S3 wuauserv; %systemroot%\system32\wuaueng.dll [X]
S4 DiagTrack; %SystemRoot%\system32\diagtrack.dll [X]
C:\Users\miche\AppData\Local\D2****.tmp
C:\Users\miche\AppData\Local\D2***.tmp
defaultuser0 (S-1-5-21-3820880270-2446757353-2433166087-1000 - Limited - Disabled) => C:\Users\defaultuser0
CustomCLSID: HKU\S-1-5-21-3820880270-2446757353-2433166087-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\miche\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3820880270-2446757353-2433166087-1001_Classes\CLSID\{227C9E8F-71A1-4B23-9076-682A1A8EAAED}\localserver32 -> "c:\program files\macrium\common\reflectmonitor.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-3820880270-2446757353-2433166087-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\miche\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3820880270-2446757353-2433166087-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\miche\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3820880270-2446757353-2433166087-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\miche\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\FileCoAuth.exe => No File
CustomCLSID: HKU\S-1-5-21-3820880270-2446757353-2433166087-1001_Classes\CLSID\{C52B9871-E5E9-41FD-B84D-C5ACADBEC7AE}\InprocServer32 -> C:/Users/miche/AppData/Local/Temp/Rar$EXa4768.26171/LEContextMenuHandler.DLL => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
cmd: netsh advfirewall reset
cmd: sfc /scannow
emptytemp:
end::