Start::
CreateRestorePoint:
CloseProcesses:
Avast Update Helper
MSCONFIG\Services: avast => 2
MSCONFIG\Services: avastm => 3
MSCONFIG\Services: AvastSecureBrowserElevationService => 3
HKU\S-1-5-21-3323940460-2476448031-453550397-1001\...\StartupApproved\Run: => "AvastBrowserAutoLaunch_CFAAD7198488C610079C0286AEB9E63F"
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Temp\ose00000.exe
Task: {9A423570-A182-4C4D-B0E0-2785A875CB1C} - System32\Tasks\{2B3E483C-6661-4E04-8FF4-C7FCE7D864AE} => C:\Program Files (x86)\east-tec Eraser\etEraser.exe (No File)
Task: {538D9A45-4551-42A7-8DB8-FA1CD3228A1A} - System32\Tasks\Firefox Default Browser Agent 255DA52F89B9D88E => C:\Users\nickj\AppData\Roaming\bcetrtf [65440 2022-10-14] (Microsoft Corporation -> Microsoft Corporation) <==== ATTENTION 
KMSauto.net (HKLM-x32\...\{6A2B3E01-92B9-4E14-A6A4-59AD5F9479FF}) (Version: 1.0.0 - KMSauto.net)
2023-01-22 18:02 - 2023-01-22 18:02 - 000001622 _____ C:\Users\nickj\Desktop\Activation - Shortcut.lnk <-- deze zal hij zelf wel gemaakt hebben.
2023-01-22 17:51 - 2023-02-01 17:15 - 000000000 ____D C:\Users\nickj\AppData\Roaming\xzverbre
2023-01-22 17:51 - 2023-01-22 18:01 - 000000000 ____D C:\Users\nickj\AppData\Roaming\ytytyrbre
2023-01-22 17:51 - 2023-01-22 17:51 - 000003728 _____ C:\Windows\system32\Tasks\Firefox Default Browser Agent 255DA52F89B9D88E
2023-01-22 17:51 - 2023-01-22 17:51 - 000000000 ____D C:\Users\nickj\Documents\Custom Office Templates
2023-01-22 17:50 - 2023-02-01 17:15 - 000000000 ____D C:\Users\nickj\AppData\Roaming\Meow
2023-01-22 17:50 - 2023-01-22 19:26 - 000000000 ____D C:\Users\nickj\AppData\Roaming\Colors
2023-01-22 17:50 - 2023-01-22 17:50 - 000000000 ____D C:\Users\Public\Docs
2023-01-22 17:50 - 2023-01-22 17:50 - 000000000 ____D C:\Users\nickj\AppData\Local\Yandex
2023-01-22 17:49 - 2023-02-01 17:15 - 000000000 ____D C:\Users\nickj\AppData\Roaming\ViperFolder
2023-01-22 17:49 - 2023-01-22 18:01 - 000000000 ____D C:\Users\nickj\AppData\Roaming\Cached files
2023-01-22 17:49 - 2023-01-22 17:49 - 000002459 _____ C:\Users\nickj\Desktop\Word.lnk
2023-01-22 17:47 - 2023-01-22 18:01 - 000000000 ____D C:\Users\nickj\AppData\Roaming\License
2023-01-22 17:47 - 2023-01-22 17:47 - 000000000 ____D C:\Program Files (x86)\KMSauto.net 
EmptyTemp:
Reboot:
End::