Malware Log Analysis

Start CreateRestorePoint: CloseProcesses: Task: C:\WINDOWS\Tasks\Td.job => C:\ProgramData\com_usr_node_v9\OvSupervisor.exe C:\ProgramData\com_usr_node_v9 C:\Users\nsaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\eppiocemhmnlbhjplcgkofciiegomcon Folder: C:\Users\nsaka\AppData\Roaming\7575527ef53c Folder: C:\Users\nsaka\AppData\Roaming\com_usr_node_v9 2026-10-11 12:05 - 2026-10-11 12:05 - 000000000 ____D C:\Users\nsaka\AppData\Roaming\7575527ef53c 2026-10-11 10:31 - 2026-10-11 17:11 - 000000282 _____ C:\WINDOWS\Tasks\Td.job 2026-10-11 10:31 - 2026-10-11 10:31 - 000003154 _____ C:\WINDOWS\system32\Tasks\platform_utility_x64 2026-10-11 10:31 - 2026-10-11 10:31 - 000003074 _____ C:\WINDOWS\system32\Tasks\Td 2026-10-11 10:30 - 2026-10-11 10:30 - 000000000 ____D C:\Users\nsaka\AppData\Roaming\com_usr_node_v9 HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION App Explorer (HKU\S-1-5-21-1389370007-1104314709-1377541231-1002\...\Host App Service) (Version: 0.273.4.157 - SweetLabs) <==== ATTENTION App Explorer (HKU\S-1-5-80-863171341-2975503981-1811344707-3769924460-3995132968\...\Host App Service) (Version: 0.273.4.157 - SweetLabs) <==== ATTENTION HKU\S-1-5-21-1389370007-1104314709-1377541231-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_D6A43E312A447D33C295A90C757E3D48" HKU\S-1-5-21-1389370007-1104314709-1377541231-1001\...\Run: [MicrosoftEdgeAutoLaunch_D6A43E312A447D33C295A90C757E3D48] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5438280 2026-10-08] (Microsoft Corporation -> Microsoft Corporation) CHR HomePage: Default -> hxxp://www.delta-search.com/?affID=119747&babsrc=HP_ss&mntrId=2A74C89CDCD2D479 CHR StartupUrls: Default -> "hxxp://feed.snap.do/?publisher=ShoppingHelper&dpid=RY_196&co=FR&userid=daef91ea-0916-74ae-2b77-4a156f3ddf4e&searchtype=hp&installDate=29/12/2013","hxxps://fr.yahoo.com?fr=hp-avast&type=avastbcl","hxxps://www.google.com/?trackid=sp-006","hxxp://google.com/","hxxps://www.google.com/","hxxps://fr.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=87dbgpsszvwu2cegikmoxb001520&param1=y6bdVFVIsvuYsgEClQfz8Oeg2evwTgtkD45B1N7UYtl1i1TGbMZZmhyro3luh2h4WppSgtlH2GzxxTiNcmCErHlK1X3Tznq5UvDwSOiIp%2BuP4GqCMotASQlvwyZrgZX0UOr2TcbCZjlzupbdjo%2FywJF3z91PcouTnkO2SSHX%2FtUJzLwRShY%2FGhUf%2F%2F9SK1toAVydpCthCKGj46ws5j8VjnEMfvMG1KcFaNsBQ3wMPqibkowVuNhsKZwU118jmzwyvOIOmSrVz3YJou1hDGxhDKtRRH2DuFwgGoN6tH0NiPlE9wLmKV07g1l%2FENIaofdf2ifpa%2BZYhz1Z4PkK%2BCIdUlZzgtYxK43vijioHF%2BQFJUW8ajyXeXMYtY4et8QrO0CFJDA6YwVymHvM0gI1VlFotikjIu%2BkIPwqRpnsHkgTgo%3D" Folder: C:\Users\nsaka\AppData\Local\Yandex Folder: C:\Users\nsaka\AppData\Local\Wacom Folder: C:\Users\nsaka\AppData\Local\Realtek Folder: C:\Users\nsaka\AppData\Roaming\RenPy 2026-10-11 10:30 - 2026-10-11 10:30 - 000000000 ____D C:\Users\nsaka\AppData\Local\Yandex 2026-10-11 10:30 - 2026-10-11 10:30 - 000000000 ____D C:\Users\nsaka\AppData\Local\Wacom 2026-10-11 10:30 - 2026-10-11 10:30 - 000000000 ____D C:\Users\nsaka\AppData\Local\Realtek 2026-10-11 10:23 - 2026-10-11 12:02 - 000000000 ____D C:\Users\nsaka\AppData\Roaming\RenPy CustomCLSID: HKU\S-1-5-21-1389370007-1104314709-1377541231-1001_Classes\CLSID\{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}\localserver32 -> "C:\Users\nsaka\AppData\Local\Microsoft\Teams\current\Teams.exe" --toast => No File ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => -> No File AlternateDataStreams: C:\ProgramData\catcache3.bin:0C23A85016 [3442] AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\ExpressVPN.lnk:6566346E84 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\NotAllowedUnattendedBugReports:4666788B1E [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\NotAllowedUnattendedBugReports:AC55BD64A0 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AZ Launcher - Minecraft.lnk:EE97536411 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crusader Kings III Friends and Foes.lnk:A6921DFEA2 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite.lnk:073005E2F7 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite.lnk:35EB56C735 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:C8B6D970BF [3442] AlternateDataStreams: C:\Users\nsaka\Application Data:c15540c89c88cd704ccd25de5f07f873 [394] AlternateDataStreams: C:\Users\nsaka\AppData\Roaming:c15540c89c88cd704ccd25de5f07f873 [394] FirewallRules: [UDP Query User{1C005BC3-9A06-467F-8ED6-8594501D7CBE}L:\jeux\red dead redemption 2\rdr2.exe] => (Allow) L:\jeux\red dead redemption 2\rdr2.exe => No File FirewallRules: [TCP Query User{6CE21916-5F05-4712-AB97-5C7BE87FE967}L:\jeux\red dead redemption 2\rdr2.exe] => (Allow) L:\jeux\red dead redemption 2\rdr2.exe => No File FirewallRules: [UDP Query User{C5875CA5-3E41-494B-9C62-14412E4A1984}L:\steam\steamapps\common\total war three kingdoms\three_kingdoms.exe] => (Allow) L:\steam\steamapps\common\total war three kingdoms\three_kingdoms.exe => No File FirewallRules: [TCP Query User{5D4C5EF5-A40F-4899-8CCE-0242C3C229C5}L:\steam\steamapps\common\total war three kingdoms\three_kingdoms.exe] => (Allow) L:\steam\steamapps\common\total war three kingdoms\three_kingdoms.exe => No File FirewallRules: [{5A5F2596-5A2C-4516-BC0B-2EA2AAC71E56}] => (Allow) L:\Steam\steamapps\common\Total War THREE KINGDOMS\launcher\launcher.exe => No File FirewallRules: [{2232502B-1C66-44EC-B8BE-2AA8C5E49273}] => (Allow) L:\Steam\steamapps\common\Total War THREE KINGDOMS\launcher\launcher.exe => No File FirewallRules: [{517694D8-FF8F-40F2-95DB-02975029F274}] => (Allow) L:\Steam\steamapps\common\KingdomComeDeliverance\Bin\Win64\KingdomCome.exe => No File FirewallRules: [{7E241F9F-2550-404A-86E2-819EF4F23F90}] => (Allow) L:\Steam\steamapps\common\KingdomComeDeliverance\Bin\Win64\KingdomCome.exe => No File FirewallRules: [UDP Query User{17B21048-4140-414F-94FF-3DEFAAF44604}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [TCP Query User{721B6621-888B-44AA-9CC0-7B1FAA81AA28}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [{8F81EEEF-D9C2-4330-83DD-B6D1C27B29BD}] => (Allow) L:\Steam\steamapps\common\Songs Of Silence\SongsOfSilence.exe => No File FirewallRules: [{F6C5F18A-65F5-419D-B9A1-649570724491}] => (Allow) L:\Steam\steamapps\common\Songs Of Silence\SongsOfSilence.exe => No File FirewallRules: [{BC47427B-E794-4594-986F-6721BF68E753}] => (Allow) L:\Steam\steamapps\common\No Man's Sky\Binaries\NMS.exe => No File FirewallRules: [{1AE562AA-9B52-4FF4-AFA4-81BBC2818CB0}] => (Allow) L:\Steam\steamapps\common\No Man's Sky\Binaries\NMS.exe => No File FirewallRules: [UDP Query User{4BC11426-B2AD-46F6-872B-4871E15D6615}L:\jeux\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) L:\jeux\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [TCP Query User{42C9ABA3-BB1F-498A-8E9B-ABA3045E8B24}L:\jeux\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) L:\jeux\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [UDP Query User{6B77AB50-B863-4A8C-A5C1-0EC5D3AE3033}L:\jeux\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) L:\jeux\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [TCP Query User{5AF60D26-E98C-445D-A602-7881E4982919}L:\jeux\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) L:\jeux\baldurs gate 3\bin\bg3_dx11.exe => No File FirewallRules: [UDP Query User{44DDB5BA-21CA-4137-846B-D7F3613DB3EC}L:\epics\gtav\gta5.exe] => (Allow) L:\epics\gtav\gta5.exe => No File FirewallRules: [TCP Query User{C090A011-9EF6-4281-A323-55DFD47CFE1E}L:\epics\gtav\gta5.exe] => (Allow) L:\epics\gtav\gta5.exe => No File FirewallRules: [{51AA4A55-C533-4AC1-BAC9-B43DE321B971}] => (Allow) L:\Steam\steamapps\common\Victoria 3\launcher\dowser.exe => No File FirewallRules: [{A693EC6C-D54C-4A03-8ED6-ECC6A35F6603}] => (Allow) L:\Steam\steamapps\common\Victoria 3\launcher\dowser.exe => No File FirewallRules: [{D1A3F0D7-B6F8-49DF-BD2A-2D3B904F4EF5}] => (Allow) L:\Steam\steamapps\common\Detroit Become Human\DetroitBecomeHuman.exe => No File FirewallRules: [{B1565116-D9F6-410F-92ED-F528197570BB}] => (Allow) L:\Steam\steamapps\common\Detroit Become Human\DetroitBecomeHuman.exe => No File FirewallRules: [UDP Query User{11BCB76A-F50C-4028-BE3D-8B3108D30C24}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [TCP Query User{A4A1DE98-E298-428E-A9C1-0813A3D95F8F}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [UDP Query User{F30FD275-25E2-43EE-A1AA-6377CFAD799D}L:\mtga\mtga.exe] => (Allow) L:\mtga\mtga.exe => No File FirewallRules: [TCP Query User{FA4A8266-37F5-4D72-9A23-DED5EF543FC8}L:\mtga\mtga.exe] => (Allow) L:\mtga\mtga.exe => No File FirewallRules: [{7AE4A2C6-CC0E-45BB-8036-43736C2ADA1A}] => (Allow) C:\Program Files (x86)\Funcom\Secret World Legends\ClientPatcher.exe => No File FirewallRules: [{9CED59CE-06A6-4355-85F9-4114EFE70BAA}] => (Allow) C:\Program Files (x86)\Funcom\Secret World Legends\ClientPatcher.exe => No File FirewallRules: [{FF7365EE-7A1D-437A-8396-17DE70F2226E}] => (Allow) L:\Steam\steamapps\common\The Universim\The Universim.exe => No File FirewallRules: [{8BCDB33D-8396-4378-907C-87ACFE4D7007}] => (Allow) L:\Steam\steamapps\common\The Universim\The Universim.exe => No File FirewallRules: [{C6BB968C-FDAD-49BE-8C4A-D6056405F304}] => (Allow) L:\Steam\steamapps\common\ELDEN RING\Game\eldenring.exe => No File FirewallRules: [{7A646F89-ED52-42A4-9EBB-17C0D31EB7BC}] => (Allow) L:\Steam\steamapps\common\ELDEN RING\Game\eldenring.exe => No File FirewallRules: [{AAD8FACA-3891-430D-81DC-D9190A34BA8C}] => (Allow) L:\Steam\steamapps\common\ELDEN RING\Game\eldenring.exe => No File FirewallRules: [{F3C4A745-BAA4-4B41-8A5B-9C0F7B8908B5}] => (Allow) L:\Steam\steamapps\common\ELDEN RING\Game\eldenring.exe => No File FirewallRules: [{D3A2A830-BD06-456D-8D72-48129683391C}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.113.3210.0_x64__kzf8qxf38zg5c\Skype\Skype.exe => No File FirewallRules: [{5DA9AACE-192C-4A0F-BF3D-786225AFEFC0}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.113.3210.0_x64__kzf8qxf38zg5c\Skype\Skype.exe => No File FirewallRules: [{302764B2-5C11-4B30-B0AD-E1F7AAC8FE1D}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.113.3210.0_x64__kzf8qxf38zg5c\Skype\Skype.exe => No File FirewallRules: [{64649811-2626-4D00-980C-83D54A5F0DC0}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.113.3210.0_x64__kzf8qxf38zg5c\Skype\Skype.exe => No File FirewallRules: [{3F179675-69F6-48F1-826B-B39DB68401E6}] => (Allow) L:\Steam\steamapps\common\Startup Company\unity\StartupCompany.exe => No File FirewallRules: [{C5779490-4573-43C2-AB9F-010A949998DF}] => (Allow) L:\Steam\steamapps\common\Startup Company\unity\StartupCompany.exe => No File FirewallRules: [{5AF62B2E-483F-49BD-A338-CDF641642BAC}] => (Allow) L:\Steam\steamapps\common\Startup Company\electron\StartupCompany.exe => No File FirewallRules: [{98576A33-BCBB-4842-BD62-7BE4A368DEFC}] => (Allow) L:\Steam\steamapps\common\Startup Company\electron\StartupCompany.exe => No File FirewallRules: [UDP Query User{86A7A662-4A5D-4A6E-88A6-2AD360C96D65}L:\origin\ea sports fc 24\fc24.exe] => (Allow) L:\origin\ea sports fc 24\fc24.exe => No File FirewallRules: [TCP Query User{22149608-D620-4476-88D9-C9E6046CA5C2}L:\origin\ea sports fc 24\fc24.exe] => (Allow) L:\origin\ea sports fc 24\fc24.exe => No File FirewallRules: [{07859AAB-5863-4703-9EF3-CBEFECDA3F7A}] => (Allow) L:\Steam\steamapps\common\ELDEN RING\Game\start_protected_game.exe => No File FirewallRules: [{89F36040-0DD2-4601-AF40-7683BD6193AC}] => (Allow) L:\Steam\steamapps\common\ELDEN RING\Game\start_protected_game.exe => No File FirewallRules: [UDP Query User{17AE577E-BBF2-4A6E-BF2B-7A3429A9BCC9}L:\origin\ea sports fc 24\fc24.exe] => (Allow) L:\origin\ea sports fc 24\fc24.exe => No File FirewallRules: [TCP Query User{C5C1F67B-A09B-49B9-962D-F6AAC6AE0934}L:\origin\ea sports fc 24\fc24.exe] => (Allow) L:\origin\ea sports fc 24\fc24.exe => No File FirewallRules: [{A456414A-44B9-47BA-90EC-FABA04131223}] => (Allow) D:\Games\FIFA 23\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{2E98C8D7-E568-4227-BE2E-39004DD586A4}] => (Allow) D:\Games\FIFA 23\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{35CE4E9F-4816-4746-AB27-148FC7A47D5B}] => (Allow) L:\Steam\steamapps\common\Starfield\Starfield.exe => No File FirewallRules: [{6FDD49AE-9023-43D1-B006-C2ED3F512648}] => (Allow) L:\Steam\steamapps\common\Starfield\Starfield.exe => No File FirewallRules: [UDP Query User{D01B5A8F-336A-47D0-A8AF-C3CAFF252634}L:\steam\steamapps\common\arma 3\arma3_x64.exe] => (Allow) L:\steam\steamapps\common\arma 3\arma3_x64.exe => No File FirewallRules: [TCP Query User{7943A261-3B15-4A97-9EDF-B48E8AF771AC}L:\steam\steamapps\common\arma 3\arma3_x64.exe] => (Allow) L:\steam\steamapps\common\arma 3\arma3_x64.exe => No File FirewallRules: [UDP Query User{27221789-D2B2-467E-B5FE-BD23567E90C4}L:\steam\steamapps\common\arma 3\arma3_x64.exe] => (Allow) L:\steam\steamapps\common\arma 3\arma3_x64.exe => No File FirewallRules: [TCP Query User{0C5B9FAA-4877-48F0-8BC0-4751D0AF7478}L:\steam\steamapps\common\arma 3\arma3_x64.exe] => (Allow) L:\steam\steamapps\common\arma 3\arma3_x64.exe => No File FirewallRules: [{885955CE-A0E2-426C-9118-98AF9F6CE752}] => (Allow) L:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{5DA64033-274C-40FC-B4A4-A688E8F73A99}] => (Allow) L:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{AAD8A950-D3B7-4B09-8D27-FF43F9BD186D}] => (Allow) L:\Steam\Steam.exe => No File FirewallRules: [{42429C52-A5A3-4747-AF2E-2D1348574F96}] => (Allow) L:\Steam\Steam.exe => No File FirewallRules: [{9FFBE9E3-C7D2-40D4-BBD4-0B17DC6A9E93}] => (Allow) L:\Jeux\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{122659B4-E2BA-455B-A8A3-FFC8810A165C}] => (Allow) L:\Jeux\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{8DE019E1-9B4A-4D5A-86C5-1ED95522022B}] => (Allow) L:\Jeux\Steam.exe => No File FirewallRules: [{9A0C1B1F-A342-4A22-B367-FB6743AEDDBC}] => (Allow) L:\Jeux\Steam.exe => No File FirewallRules: [UDP Query User{86C29479-C7A0-4230-8618-49F634516931}D:\games\fifa 23\fifa23.exe] => (Allow) D:\games\fifa 23\fifa23.exe => No File FirewallRules: [TCP Query User{9836AE56-827A-4D77-A41F-ADA4CB77FF57}D:\games\fifa 23\fifa23.exe] => (Allow) D:\games\fifa 23\fifa23.exe => No File FirewallRules: [UDP Query User{4DD0DBD0-2F17-4F56-8751-265F887E98A0}D:\games\fifa 23\fifa23.exe] => (Block) D:\games\fifa 23\fifa23.exe => No File FirewallRules: [TCP Query User{E3000767-E2F8-416B-BDDB-A83801CF21AC}D:\games\fifa 23\fifa23.exe] => (Block) D:\games\fifa 23\fifa23.exe => No File FirewallRules: [UDP Query User{C63F6D2F-1D6F-4238-9BE8-9DB104F296F0}D:\games\sidmeierscivilizationvi\base\binaries\win64eos\civilizationvi.exe] => (Allow) D:\games\sidmeierscivilizationvi\base\binaries\win64eos\civilizationvi.exe => No File FirewallRules: [TCP Query User{D23C1FDA-949E-4ABD-82FA-41B66BA50A04}D:\games\sidmeierscivilizationvi\base\binaries\win64eos\civilizationvi.exe] => (Allow) D:\games\sidmeierscivilizationvi\base\binaries\win64eos\civilizationvi.exe => No File FirewallRules: [UDP Query User{F85D3342-FFF5-4ACF-93D1-B57B2B1B10A5}C:\program files (x86)\epic games\rocketleague\binaries\win64\rocketleague.exe] => (Allow) C:\program files (x86)\epic games\rocketleague\binaries\win64\rocketleague.exe => No File FirewallRules: [TCP Query User{A37EF2F5-AFF1-49EB-9249-B2932330701D}C:\program files (x86)\epic games\rocketleague\binaries\win64\rocketleague.exe] => (Allow) C:\program files (x86)\epic games\rocketleague\binaries\win64\rocketleague.exe => No File FirewallRules: [{EBD9FEB4-7B60-4F9F-8A59-263E4EBAC437}] => (Allow) D:\sauvegarde D\Program\Steam\steamapps\common\DARK SOULS III\Game\DarkSoulsIII.exe => No File FirewallRules: [{79E13459-9C58-4019-A8CC-98A67FAB3E18}] => (Allow) D:\sauvegarde D\Program\Steam\steamapps\common\DARK SOULS III\Game\DarkSoulsIII.exe => No File FirewallRules: [{B44B3B2D-72BC-4C8D-ACB1-FDA7CB9127D8}] => (Allow) D:\sauvegarde D\Program\Steam\steam.exe => No File FirewallRules: [{4CF49F82-E5B1-4246-AAF8-808423AC2C9E}] => (Allow) D:\sauvegarde D\Program\Steam\steam.exe => No File FirewallRules: [{B7FDB4BB-AFD6-4C2C-9549-0005E90829FB}] => (Allow) D:\sauvegarde D\Program\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{E803B281-B421-4AFC-B19C-FF4615ECEA31}] => (Allow) D:\sauvegarde D\Program\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{C7185334-835D-452A-844B-35D2CAB5962C}] => (Allow) D:\sauvegarde D\Program\Steam\steamapps\common\Magic Duels\MagicDuels.exe => No File FirewallRules: [{E95F223B-03F5-4871-B072-1162F30A4176}] => (Allow) D:\sauvegarde D\Program\Steam\steamapps\common\Magic Duels\MagicDuels.exe => No File FirewallRules: [TCP Query User{835C02BB-4AE4-4C88-B77E-C1961D0B6B26}D:\games\magicthegathering\mtga.exe] => (Allow) D:\games\magicthegathering\mtga.exe => No File FirewallRules: [UDP Query User{01243AE9-D311-415D-ADC7-A68713492444}D:\games\magicthegathering\mtga.exe] => (Allow) D:\games\magicthegathering\mtga.exe => No File FirewallRules: [TCP Query User{1D8A893C-D236-49FD-9D10-DE147C42C483}D:\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe] => (Allow) D:\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe => No File FirewallRules: [UDP Query User{E658E781-6F49-49E5-9FB9-5C4A20E690FF}D:\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe] => (Allow) D:\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe => No File FirewallRules: [TCP Query User{C7C20AC5-9760-4305-9EDA-991EDBB22E2E}D:\games\fifa 20\fifa20.exe] => (Allow) D:\games\fifa 20\fifa20.exe => No File FirewallRules: [UDP Query User{6D1F5D1B-B9C1-4533-8E16-BDA7762E1910}D:\games\fifa 20\fifa20.exe] => (Allow) D:\games\fifa 20\fifa20.exe => No File FirewallRules: [TCP Query User{E387FDBA-1EC2-40F9-B530-881BE0259299}C:1\games\fifa 20\fifa20.exe] => (Allow) C:1\games\fifa 20\fifa20.exe => No File FirewallRules: [UDP Query User{D32A6882-B3E3-4AED-8D09-25273B6CCB33}C:1\games\fifa 20\fifa20.exe] => (Allow) C:1\games\fifa 20\fifa20.exe => No File FirewallRules: [TCP Query User{AA0B5990-8F6B-48C7-BA8E-B605E75D07B9}C:2\sauvegarde d\program\steam\steam.exe] => (Allow) C:2\sauvegarde d\program\steam\steam.exe => No File FirewallRules: [UDP Query User{3B3A16F8-698F-4D35-AF07-94B6E8BEF310}C:2\sauvegarde d\program\steam\steam.exe] => (Allow) C:2\sauvegarde d\program\steam\steam.exe => No File FirewallRules: [TCP Query User{1BCE48E8-197B-4EBC-8777-C5A8210F0797}C:2\games\fifa 20\fifa20.exe] => (Allow) C:2\games\fifa 20\fifa20.exe => No File FirewallRules: [UDP Query User{A63DED95-30CA-42D8-952F-B518CACF34D9}C:2\games\fifa 20\fifa20.exe] => (Allow) C:2\games\fifa 20\fifa20.exe => No File FirewallRules: [TCP Query User{ACAE867C-914F-4826-8F2F-3087B862D028}C:2\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe] => (Allow) C:2\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe => No File FirewallRules: [UDP Query User{65F1A25E-6313-4AFC-BC50-FDF234416E24}C:2\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe] => (Allow) C:2\sauvegarde d\program\steam\steamapps\common\naruto to boruto\naruto\binaries\win64\naruto-win64-shipping.exe => No File FirewallRules: [{7EDD3437-AF08-4A63-A1AA-B38373D91C6D}] => (Allow) C:6\Games\FIFA 20\FIFASetup\fifaconfig.exe => No File FirewallRules: [{E4AEB315-C45E-4D53-BAF4-4439D7FFB2D0}] => (Allow) C:6\Games\FIFA 20\FIFASetup\fifaconfig.exe => No File FirewallRules: [TCP Query User{5C31B764-6787-4C56-A18B-C88285A2CEDD}C:6\games\fifa 20\fifa20.exe] => (Allow) C:6\games\fifa 20\fifa20.exe => No File FirewallRules: [UDP Query User{58E4DE8E-15FF-4D2A-95F9-BD89CB9EA4ED}C:6\games\fifa 20\fifa20.exe] => (Allow) C:6\games\fifa 20\fifa20.exe => No File FirewallRules: [TCP Query User{260C92C8-54A0-420D-843C-4FA4BFB38A86}D:\games\genshinimpact\genshin impact game\genshinimpact.exe] => (Allow) D:\games\genshinimpact\genshin impact game\genshinimpact.exe => No File FirewallRules: [UDP Query User{22EC76D7-7D9D-4A04-8061-3F15E923F3AA}D:\games\genshinimpact\genshin impact game\genshinimpact.exe] => (Allow) D:\games\genshinimpact\genshin impact game\genshinimpact.exe => No File FirewallRules: [TCP Query User{81A312F8-3757-42D0-8389-EB8949C50ABD}C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe => No File FirewallRules: [UDP Query User{C3D531F0-3E5E-4EF0-AA2C-483811D96AA9}C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe => No File FirewallRules: [TCP Query User{B9304314-D5EC-479A-B047-9A0682AF8355}D:\games\fifa 20\fifa20.exe] => (Allow) D:\games\fifa 20\fifa20.exe => No File FirewallRules: [UDP Query User{6726811E-1316-4FDF-8E18-B975AC7105FD}D:\games\fifa 20\fifa20.exe] => (Allow) D:\games\fifa 20\fifa20.exe => No File FirewallRules: [TCP Query User{A8711B95-E8CB-427B-8EAF-5C1D73227E03}C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe => No File FirewallRules: [UDP Query User{2004573F-D2C5-49AA-9603-A89ADE3EAE3A}C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\nsaka\appdata\local\microsoft\teams\current\teams.exe => No File FirewallRules: [TCP Query User{1A357A56-EA2F-492E-8E2A-486079BEBBBC}C:8\games\fifa 20\fifa20.exe] => (Allow) C:8\games\fifa 20\fifa20.exe => No File FirewallRules: [UDP Query User{02F67D36-BA67-4300-8D90-35BC1143193E}C:8\games\fifa 20\fifa20.exe] => (Allow) C:8\games\fifa 20\fifa20.exe => No File FirewallRules: [TCP Query User{A02FDBA7-CB02-4E35-A9D4-D45C44BCC7C8}D:\games\pathfinderkingmaker\kingmaker.exe] => (Allow) D:\games\pathfinderkingmaker\kingmaker.exe => No File FirewallRules: [UDP Query User{5EDB0AAD-BB39-4624-975D-D8050BF99DD3}D:\games\pathfinderkingmaker\kingmaker.exe] => (Allow) D:\games\pathfinderkingmaker\kingmaker.exe => No File FirewallRules: [{4E8D0A6A-5C1C-4B9E-A717-238D6EE11796}] => (Allow) D:\Games\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe => No File FirewallRules: [{800A7C04-B051-49D4-A9E6-AEFC299BD891}] => (Allow) D:\Games\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe => No File FirewallRules: [{A8F5A2C0-7C25-472E-97C3-E5BBCAC54C7E}] => (Allow) D:\Games\STAR WARS Battlefront II\starwarsbattlefrontii.exe => No File FirewallRules: [{B0D1EB2A-267B-4528-9DC9-A43426AC4297}] => (Allow) D:\Games\STAR WARS Battlefront II\starwarsbattlefrontii.exe => No File FirewallRules: [TCP Query User{4BB57720-A392-4C4C-8DEF-0BAE5E66DD6C}D:\games\pathfinderkingmaker\kingmaker.exe] => (Allow) D:\games\pathfinderkingmaker\kingmaker.exe => No File FirewallRules: [UDP Query User{B3BADABE-269C-46E4-9544-BBA799DDE493}D:\games\pathfinderkingmaker\kingmaker.exe] => (Allow) D:\games\pathfinderkingmaker\kingmaker.exe => No File FirewallRules: [TCP Query User{10423242-AD3F-486B-8208-9B2D2976F6A2}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe => No File FirewallRules: [UDP Query User{0AF82BE3-3C0B-4A4E-9FF8-C95518050127}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe => No File FirewallRules: [TCP Query User{4788FE63-340D-4F4B-A4C5-0A4F1AFC76C6}C:\program files (x86)\epic games\totalwarsagatroy\troy.exe] => (Allow) C:\program files (x86)\epic games\totalwarsagatroy\troy.exe => No File FirewallRules: [UDP Query User{04E16F6A-4BF6-456C-8638-83DDC25B4869}C:\program files (x86)\epic games\totalwarsagatroy\troy.exe] => (Allow) C:\program files (x86)\epic games\totalwarsagatroy\troy.exe => No File FirewallRules: [{C52E9BE5-09DB-4A01-877D-5EC7F4199595}] => (Allow) D:\sauvegarde D\Program\Steam\steamapps\common\DARK SOULS III\Game\DarkSoulsIII.exe => No File FirewallRules: [{4D9D0E31-D2E6-4538-9499-6D5FD590D49D}] => (Allow) D:\sauvegarde D\Program\Steam\steamapps\common\DARK SOULS III\Game\DarkSoulsIII.exe => No File FirewallRules: [TCP Query User{A48CA987-5982-4F05-8D50-B3A80BECDA8F}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe => No File FirewallRules: [UDP Query User{3B0EA851-F421-4EC9-AD8E-79FFE9D2FD06}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe => No File FirewallRules: [TCP Query User{DD7D1D82-58EA-459A-AC17-81A3B3C01685}D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{3A0D19ED-2564-4DFD-8F31-AA9A7F7B5A76}D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [{4DAEC246-919C-403E-82EF-DD34DFAA9795}] => (Allow) L:\Steam\steamapps\common\Cities Skylines II\Launcher\dowser.exe => No File FirewallRules: [{F7F295E9-0702-4C00-B49D-F7E58D73486C}] => (Allow) L:\Steam\steamapps\common\Cities Skylines II\Launcher\dowser.exe => No File FirewallRules: [{01601BB3-A177-4DAD-9EA8-B5AE44F54B63}] => (Allow) L:\Origin\EA SPORTS FC 24\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{859F403D-F4DC-466E-A7A1-E5E620DF5711}] => (Allow) L:\Origin\EA SPORTS FC 24\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{E1BAA2B4-85E8-415D-A131-10FF98503FD0}] => (Allow) L:\Steam\steamapps\common\Kenshi\kenshi_x64.exe => No File FirewallRules: [{8F334CED-87F9-4B39-BE5A-95E6D8DDCE5B}] => (Allow) L:\Steam\steamapps\common\Kenshi\kenshi_x64.exe => No File FirewallRules: [{1AF7BC48-1A64-483C-BE01-55B9E9DAB95C}] => (Allow) L:\Steam\steamapps\common\Kenshi\forgotten construction set.exe => No File FirewallRules: [{E3CD3332-6E10-4EE1-9E8C-A5101773D00C}] => (Allow) L:\Steam\steamapps\common\Kenshi\forgotten construction set.exe => No File FirewallRules: [{1F1D5706-F0DB-4E95-9034-3102F25BA5A4}] => (Allow) L:\Steam\steamapps\common\Expedition 33\Expedition33_Steam.exe => No File FirewallRules: [{B12AA731-7470-4BBF-91E2-3C7502143101}] => (Allow) L:\Steam\steamapps\common\Expedition 33\Expedition33_Steam.exe => No File FirewallRules: [{6246262D-0C1C-4E1A-BC80-FC37D3918F4A}] => (Allow) L:\Jeux\EA SPORTS FC 24\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{9FD68161-40D5-43F4-B93A-EF1906641A98}] => (Allow) L:\Jeux\EA SPORTS FC 24\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{903C7B17-1712-4DDE-B895-102E7BDA9613}] => (Allow) D:\Games\Jedi Survivor\SwGame\Binaries\Win64\JediSurvivor.exe => No File FirewallRules: [{AB731809-2086-4EB6-BED2-A96D49AAF957}] => (Allow) D:\Games\Jedi Survivor\SwGame\Binaries\Win64\JediSurvivor.exe => No File FirewallRules: [TCP Query User{FF654399-49F2-4DFC-AE9C-9725BDB1E540}L:\jeux\ea sports fc 25\fc25.exe] => (Allow) L:\jeux\ea sports fc 25\fc25.exe => No File FirewallRules: [UDP Query User{97D08FD1-235B-4884-B9FF-CA113FF87E5B}L:\jeux\ea sports fc 25\fc25.exe] => (Allow) L:\jeux\ea sports fc 25\fc25.exe => No File FirewallRules: [{04200C62-F971-4FCF-8EF1-637D0B57976B}] => (Allow) D:\Games\Jedi Survivor\SwGame\Binaries\Win64\JediSurvivor.exe => No File FirewallRules: [{2AA5506C-7857-4724-8747-CDE754DBC759}] => (Allow) D:\Games\Jedi Survivor\SwGame\Binaries\Win64\JediSurvivor.exe => No File FirewallRules: [TCP Query User{058A047C-5184-4B05-9059-92EEED36EF83}L:\jeux\ea sports fc 25\fc25.exe] => (Allow) L:\jeux\ea sports fc 25\fc25.exe => No File FirewallRules: [UDP Query User{86478B98-E79A-40EC-B0A0-3035E530A991}L:\jeux\ea sports fc 25\fc25.exe] => (Allow) L:\jeux\ea sports fc 25\fc25.exe => No File FirewallRules: [{278EDD53-35A8-4AEB-8AA5-77588F9EE072}] => (Allow) L:\Steam\steamapps\common\Frostpunk\Frostpunk.exe => No File FirewallRules: [{CF749DAC-99A4-4B29-9A9B-FB12D7FBF782}] => (Allow) L:\Steam\steamapps\common\Frostpunk\Frostpunk.exe => No File FirewallRules: [{F1CBE80D-E672-4C2F-888D-21FD7E1F8E07}] => (Allow) D:\Games\ItTakesTwo\Nuts\Binaries\Win64\ItTakesTwo.exe => No File FirewallRules: [{B5AD4566-F53F-49CD-BF06-AEEE3B25A9B1}] => (Allow) D:\Games\ItTakesTwo\Nuts\Binaries\Win64\ItTakesTwo.exe => No File FirewallRules: [{2A018430-5911-452F-83B3-1BD816D3579E}] => (Allow) D:\Games\ItTakesTwo\Nuts\Binaries\Win64\ItTakesTwo_Trial.exe => No File FirewallRules: [{DEBE8CF0-397E-42FA-ADDD-A1096147E131}] => (Allow) D:\Games\ItTakesTwo\Nuts\Binaries\Win64\ItTakesTwo_Trial.exe => No File FirewallRules: [TCP Query User{5C67FAD7-D7D4-423A-A6BB-739725D25A5D}L:\epics\sable\sable.exe] => (Allow) L:\epics\sable\sable.exe => No File FirewallRules: [UDP Query User{DE234B10-0032-4110-9162-847E915C8C21}L:\epics\sable\sable.exe] => (Allow) L:\epics\sable\sable.exe => No File FirewallRules: [{E272555E-B94B-4BAD-88F8-B1371A0D3B3D}] => (Allow) L:\Steam\steamapps\common\F1 2019\F1_2019_dx12.exe => No File FirewallRules: [{0CB25939-B7BE-4A89-90EB-4F1AEF4EB97A}] => (Allow) L:\Steam\steamapps\common\F1 2019\F1_2019_dx12.exe => No File FirewallRules: [{93CC55B7-5A20-45EA-ADFB-B75F7667B613}] => (Allow) L:\Steam\steamapps\common\F1 2019\F1_2019.exe => No File FirewallRules: [{BEF3C0DC-473A-42C9-86FB-DC6941C10B0E}] => (Allow) L:\Steam\steamapps\common\F1 2019\F1_2019.exe => No File FirewallRules: [{D9707B49-F089-4CC4-914E-A5DA78485977}] => (Allow) L:\Jeux\EA SPORTS FC 25\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{F5502FC0-16FD-4CE7-8CEC-9B2E82E87E2B}] => (Allow) L:\Jeux\EA SPORTS FC 25\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{B5ECBF95-BF01-498C-9B82-7BA146D35535}] => (Allow) L:\Jeux\EA SPORTS FC 25\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{C991225F-209E-46A8-8A73-748E9A401EBA}] => (Allow) L:\Jeux\EA SPORTS FC 25\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{8FCB2D30-8D71-4EB4-972F-C17294AD22A0}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{E6CAF490-8EF8-4FB8-A02A-7ACF8BA38F4E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{210D7D5E-3A16-442F-9361-70313B31F364}] => (Allow) D:\SteamLibrary\steamapps\common\Endless Space 2\EndlessSpace2.exe => No File FirewallRules: [{9DBB7E13-5EC7-41E7-B18A-9F9484C847F2}] => (Allow) D:\SteamLibrary\steamapps\common\Endless Space 2\EndlessSpace2.exe => No File FirewallRules: [{E6697F22-BE74-4604-820E-8A602D15E6A8}] => (Allow) C:\Program Files (x86)\Microsoft\Copilot\Application\M365Copilot.exe => No File FirewallRules: [{43908F8F-0E20-48CD-8433-07B330513E6B}] => (Allow) C:\Program Files (x86)\Microsoft\Copilot\Application\M365Copilot.exe => No File FirewallRules: [{F0D00D81-E5D8-4B57-8994-217FF054468B}] => (Allow) C:\Program Files (x86)\Microsoft\Copilot\Application\M365Copilot.exe => No File FirewallRules: [{B782F461-9C06-46DE-A201-3B4225DC6DA8}] => (Allow) C:\Program Files (x86)\Microsoft\Copilot\Application\M365Copilot.exe => No File HKLM-x32\...\Run: [TeamsMachineUninstallerProgramData] => %ProgramData%\Microsoft\Teams\Update.exe --uninstall --msiUninstall --source=default (No File) HKU\S-1-5-21-1389370007-1104314709-1377541231-1001\...\Run: [AMDNoiseSuppression] => "C:\WINDOWS\system32\AMD\ANR\AMDNoiseSuppression.exe" (No File) Task: {FCF4AFE5-384E-4507-96D8-7E1E59A40C4F} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File) Task: {C37B78A9-91F3-4C38-978E-5A197AD7B5F6} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval => %systemroot%\system32\MusNotification.exe Display (No File) Task: {A0FE984A-51F2-4484-BB9A-DD2F18EC0FD8} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC RebootDialog (No File) Task: {9E6F4136-4BC6-49AD-9937-1C5F2C784642} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery RebootDialog (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) Task: {D679562F-103A-46AC-9857-6B0BDF6C6545} - System32\Tasks\platform_utility_x64 => C:\ProgramData\com_usr_node_v9\OvSupervisor.exe (No File) Task: {21FB3A6F-7452-4D6A-97A0-E6FB5EE0866A} - System32\Tasks\Td => C:\ProgramData\com_usr_node_v9\OvSupervisor.exe (No File) S3 EAAntiCheat; system32\drivers\eaanticheat.sys (No File) S3 PRI-Driver; \??\C:\Windows\System32\drivers\PRI-Driver.sys (No File) S3 usbscan; \SystemRoot\System32\DriverStore\FileRepository\sti.inf_amd64_a6dc64e436f22951\usbscan.sys (No File) C:\WINDOWS\Installer\13990754.msi C:\WINDOWS\Installer\13990759.msi C:\Users\nsaka\AppData\Local\Temp\72nxn9Ww5NulYLpI C:\Users\nsaka\MegaAnaly128.exe Folder: C:\Users\nsaka\AppData\Local\Programs\Python Folder: C:\Users\nsaka\AppData\Local\Package Cache Folder: C:\Users\nsaka\AppData\Roaming\Cache Folder: C:\Users\nsaka\Documents\jeu StartPowerShell: $customPaths = @( "C:\Users\nsaka\Desktop\Discord.lnk" ) $shell = New-Object -ComObject WScript.Shell $customPaths | ForEach-Object { $shortcut = $shell.CreateShortcut($_) [PSCustomObject]@{ File = $_ TargetPath = $shortcut.TargetPath Arguments = $shortcut.Arguments } } | Format-List EndPowerShell: Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } Powershell: Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell/Operational'; Id='4104';} | Where-object -Property Message -Match "[A-Za-z0-9+/=]{150}" | Format-List -Property Message CMD: type "%appdata%\microsoft\windows\powershell\psreadline\consolehost_history.txt" CMD: Dir C:\WINDOWS\Installer /a:- /o:gd Powershell: Get-MpThreatDetection Comment: RenPyLoader hollowed installed app generic removal C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.props C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.targets C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.tmp C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.csproj C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.user C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cache C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.config C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.bat C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cfg C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.props C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.targets C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.tmp C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.csproj C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.user C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cmd C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cache C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.config C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.bat C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cfg C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\OneDriveSync Comment: This snippet investigates common folders abused by PavinLoader to drop its project files StartPowerShell: param( [string[]]$Paths = @( 'C:\Users\*\AppData\Local\Microsoft\Windows\WebCache', 'C:\Users\*\AppData\Local\Microsoft\Windows\Explorer', 'C:\Users\*\AppData\Roaming\Microsoft\Windows\Themes', 'C:\Users\*\AppData\Roaming\Microsoft\Windows\Libraries', 'C:\Users\*\AppData\Local\Microsoft\Windows\Caches', 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache', 'C:\Users\*\AppData\Roaming\Microsoft\Crypto', 'C:\Users\*\AppData\Local\Microsoft\Windows\INetCache' ), [string[]]$Patterns = @('*.sln', '*.csproj.user', '*.Build.targets', '*.csproj'), [switch]$IncludeCsproj, [string]$CsvPath ) Write-Host "PavinLoader check - cache patterns" if ($IncludeCsproj) { $Patterns += '*.csproj' } function Get-RealFiles { param([string]$Path) foreach ($f in (Get-ChildItem -LiteralPath $Path -File -Force -ErrorAction SilentlyContinue)) { $f } foreach ($d in (Get-ChildItem -LiteralPath $Path -Directory -Force -ErrorAction SilentlyContinue)) { if ($d.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { continue } Get-RealFiles -Path $d.FullName } } $roots = foreach ($p in $Paths) { Get-Item -Path $p -Force -ErrorAction SilentlyContinue | Where-Object { $_.PSIsContainer } } $roots = $roots | Sort-Object FullName -Unique if (-not $roots) { Write-Warning 'None of the paths exist.'; return } $results = foreach ($root in $roots) { Write-Host "Verifying: $($root.FullName)" Get-RealFiles -Path $root.FullName | Where-Object { $n = $_.Name foreach ($pat in $Patterns) { if ($n -like $pat) { return $true } } $false } | ForEach-Object { [pscustomobject]@{ Folder = $_.DirectoryName Name = $_.Name SizeBytes = $_.Length Created = $_.CreationTime Modified = $_.LastWriteTime Attributes = $_.Attributes SHA256 = (Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash FullPath = $_.FullName } } } if (-not $results) { Write-Host 'No matches found.' return } $results | Group-Object Folder | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host "[$($_.Name)]" $_.Group | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host ("FullPath : " + $_.FullPath) Write-Host ("SHA256 : " + $_.SHA256) Write-Host ("SizeBytes : " + $_.SizeBytes) Write-Host ("Created : " + $_.Created) Write-Host ("Modified : " + $_.Modified) Write-Host ("Attributes : " + $_.Attributes) } } if ($CsvPath) { $results | Export-Csv -LiteralPath $CsvPath -NoTypeInformation -Encoding UTF8 Write-Host "CSV saved: $CsvPath" } EndPowerShell: Comment: This snippet investigates PavinLoader installed apps, commonly being dropped by RenPyLoader StartPowerShell: param( [string[]]$Patterns = @('*.sln', '*.csproj.user', '*.Build.targets', '*.csproj'), [switch]$IncludeCsproj, [switch]$Deep, [string]$CsvPath ) Write-Host "PavinLoader check - hollowed installed application" if ($IncludeCsproj) { $Patterns += '*.csproj' } function Get-RealSubDirs { param([string]$Path, [bool]$Recurse) foreach ($d in (Get-ChildItem -LiteralPath $Path -Directory -Force -ErrorAction SilentlyContinue)) { if ($d.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { continue } $d if ($Recurse) { Get-RealSubDirs -Path $d.FullName -Recurse $true } } } $results = New-Object System.Collections.Generic.List[object] $local = $env:LOCALAPPDATA if (-not $local -or -not (Test-Path -LiteralPath $local)) { Write-Host 'LOCALAPPDATA not found.'; return } Write-Host "Scanning: $local" foreach ($top in (Get-RealSubDirs -Path $local -Recurse $false)) { foreach ($sub in (@($top) + @(Get-RealSubDirs -Path $top.FullName -Recurse $Deep.IsPresent))) { foreach ($f in (Get-ChildItem -LiteralPath $sub.FullName -File -Force -ErrorAction SilentlyContinue)) { $match = $false foreach ($p in $Patterns) { if ($f.Name -like $p) { $match = $true; break } } if (-not $match) { continue } $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash $results.Add([pscustomobject]@{ Name = $f.Name SizeBytes = $f.Length Created = $f.CreationTime Modified = $f.LastWriteTime Attributes = $f.Attributes SHA256 = $hash FullPath = $f.FullName }) } } } if (-not $results.Count) { Write-Host 'No matches found.'; return } $results | Group-Object { Split-Path $_.FullPath -Parent } | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host "[$($_.Name)]" $_.Group | Sort-Object Name | ForEach-Object { Write-Host "" Write-Host ("FullPath : " + $_.FullPath) Write-Host ("SHA256 : " + $_.SHA256) Write-Host ("SizeBytes : " + $_.SizeBytes) Write-Host ("Created : " + $_.Created) Write-Host ("Modified : " + $_.Modified) Write-Host ("Attributes : " + $_.Attributes) } } if ($CsvPath) { $results | Export-Csv -LiteralPath $CsvPath -NoTypeInformation -Encoding UTF8 Write-Host "CSV saved: $CsvPath" } EndPowerShell: Folder: C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache Folder: C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Explorer Folder: C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Windows\Themes C:\WINDOWS\Temp\* C:\WINDOWS\SystemTemp\* C:\Users\CurrentUserName\AppData\Local\Temp\* StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: CMD: del %temp%\*.* /f /s /q CMD: rd /s /q %temp% CMD: bitsadmin /reset /allusers CMD: netsh winsock reset catalog CMD: ipconfig /flushdns RemoveProxy: EmptyTemp: End