start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
EmptyTemp:
2017-12-04 08:35 - 2017-12-04 08:35 - 000088064 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_ctypes.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000918528 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_hashlib.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000098816 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32api.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000110080 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\pywintypes27.dll
2017-12-04 08:35 - 2017-12-04 08:35 - 000364544 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\pythoncom27.dll
2017-12-04 08:35 - 2017-12-04 08:35 - 000686080 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\unicodedata.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000320512 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32com.shell.shell.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 001177088 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\wx._core_.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000806912 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\wx._gdi_.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000816640 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\wx._windows_.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 001067520 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\wx._controls_.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000733696 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\wx._misc_.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000736256 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\pysqlite2._sqlite.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000119808 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32file.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000108544 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32security.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000007168 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\hashobjs_ext.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000017920 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\thumbnails_ext.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000082432 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\usb_ext.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000013824 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\common.time34.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000018432 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32event.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000027648 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\windows.conditional.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000017408 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\windows.winwrap.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000089088 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\windows.volumes.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000167936 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32gui.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000046080 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_socket.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 001309696 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_ssl.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000129536 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_elementtree.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000127488 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\pyexpat.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000038912 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32inet.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000077824 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\wx._html2.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000036864 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_psutil_windows.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000524248 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\windows._lib_cacheinvalidation.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000011264 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32crypt.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000218624 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\PIL._imaging.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000027648 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_multiprocessing.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000020480 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\_yappi.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000035840 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32process.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000024064 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32pipe.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000010240 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\select.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000025600 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32pdh.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000059392 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\windows.device_monitor.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000017408 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32profile.pyd
2017-12-04 08:35 - 2017-12-04 08:35 - 000022528 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2211002\win32ts.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000088064 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_ctypes.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000918528 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_hashlib.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000098816 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32api.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000110080 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\pywintypes27.dll
2017-12-04 08:39 - 2017-12-04 08:39 - 000364544 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\pythoncom27.dll
2017-12-04 08:39 - 2017-12-04 08:39 - 000686080 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\unicodedata.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000320512 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32com.shell.shell.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 001177088 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\wx._core_.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000806912 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\wx._gdi_.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000816640 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\wx._windows_.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 001067520 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\wx._controls_.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000733696 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\wx._misc_.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000736256 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\pysqlite2._sqlite.pyd
2017-12-04 08:39 - 2017-12-04 08:40 - 000119808 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32file.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000108544 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32security.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000007168 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\hashobjs_ext.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000017920 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\thumbnails_ext.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000082432 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\usb_ext.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000013824 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\common.time34.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000018432 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32event.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000027648 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\windows.conditional.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000017408 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\windows.winwrap.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000089088 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\windows.volumes.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000167936 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32gui.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000046080 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_socket.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 001309696 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_ssl.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000129536 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_elementtree.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000127488 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\pyexpat.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000038912 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32inet.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000077824 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\wx._html2.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000036864 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_psutil_windows.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000524248 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\windows._lib_cacheinvalidation.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000011264 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32crypt.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000218624 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\PIL._imaging.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000027648 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_multiprocessing.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000020480 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\_yappi.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000035840 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32process.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000024064 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32pipe.pyd
2017-12-04 08:39 - 2017-12-04 08:39 - 000010240 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\select.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000025600 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32pdh.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000059392 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\windows.device_monitor.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000017408 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32profile.pyd
2017-12-04 08:40 - 2017-12-04 08:40 - 000022528 _____ () C:\Users\celine\AppData\Local\Temp\_MEI2193722\win32ts.pyd
AlternateDataStreams: C:\Users\gratien\Desktop\Apocalypto.avi:AFP_AfpInfo [130]
AlternateDataStreams: C:\Users\gratien\Desktop\Apocalypto.avi:Mac_Metadata [42]
AlternateDataStreams: C:\Users\gratien\Desktop\Jason.Bourne.2016.TRUEFRENCH.BDRip.XViD-FUNKKY.www.Zone-Telechargement.com.avi:AFP_AfpInfo [130]
AlternateDataStreams: C:\Users\gratien\Desktop\Jason.Bourne.2016.TRUEFRENCH.BDRip.XViD-FUNKKY.www.Zone-Telechargement.com.avi:com.apple.metadatakMDItemDownloadedDate [26]
AlternateDataStreams: C:\Users\gratien\Desktop\Jason.Bourne.2016.TRUEFRENCH.BDRip.XViD-FUNKKY.www.Zone-Telechargement.com.avi:com.apple.metadatakMDItemWhereFroms [242]
AlternateDataStreams: C:\Users\gratien\Desktop\Jason.Bourne.2016.TRUEFRENCH.BDRip.XViD-FUNKKY.www.Zone-Telechargement.com.avi:com.apple.quarantine [57]
AlternateDataStreams: C:\Users\gratien\Desktop\Jason.Bourne.2016.TRUEFRENCH.BDRip.XViD-FUNKKY.www.Zone-Telechargement.com.avi:Mac_Metadata [42]
AlternateDataStreams: C:\Users\gratien\Desktop\john.wick.2014.french.bdrip.x264.mkv:AFP_AfpInfo [130]
AlternateDataStreams: C:\Users\gratien\Desktop\john.wick.2014.french.bdrip.x264.mkv:Mac_Metadata [42]
AlternateDataStreams: C:\Users\gratien\Documents\slimhd-despicable.me.720ptf-www.Zone-Telechargement.com.mkv:AFP_AfpInfo [130]
AlternateDataStreams: C:\Users\gratien\Documents\slimhd-despicable.me.720ptf-www.Zone-Telechargement.com.mkv:com.apple.metadatakMDItemDownloadedDate [26]
AlternateDataStreams: C:\Users\gratien\Documents\slimhd-despicable.me.720ptf-www.Zone-Telechargement.com.mkv:com.apple.metadatakMDItemWhereFroms [234]
AlternateDataStreams: C:\Users\gratien\Documents\slimhd-despicable.me.720ptf-www.Zone-Telechargement.com.mkv:Mac_Metadata [42]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2ce.sys => ""="Driver"
Tcpip\..\Interfaces\{A00E48F9-21E4-46FC-B34E-01DDAAEBC587}: [DhcpNameServer] 40.33.1.66
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-557406763-1770075469-718621258-1002 -> DefaultScope {3263E692-8459-4521-8A48-A241C1DB8A3F} URL =
CHR HomePage: Default -> hxxp://avg.nation.com/avgtbavg/search/home?cid={48809034-C209-42DF-AEA1-347A1F49B837}&mid=0bf4371bf29b833d7c110610e7cf3067-b602d594afd2b0b327e07a06f36ca6a7e42546d0&lang=fr&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-29 20:15:42&v=17.0.1.7&pid=nation&sg=&sap=hp&cmpid=0913b
CHR HKU\S-1-5-21-557406763-1770075469-718621258-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
2017-12-03 18:33 - 2017-12-03 18:34 - 041565936 _____ (SweetLabs,Inc.) C:\Users\celine\AppData\Local\Temp\octBF81.tmp.exe
2015-05-28 20:58 - 2015-05-28 21:00 - 066882760 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct13D5.tmp.exe
2015-05-08 06:49 - 2015-05-08 06:57 - 107701776 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct1D5A.tmp.exe
2015-05-04 18:17 - 2015-05-04 18:29 - 107667040 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct2CF1.tmp.exe
2015-02-08 08:57 - 2015-02-08 09:00 - 061869384 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct5A04.tmp.exe
2015-06-21 16:52 - 2015-06-21 16:53 - 067289280 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct5CB7.tmp.exe
2015-03-13 12:32 - 2015-03-13 12:36 - 139274496 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct6ADA.tmp.exe
2016-11-30 23:34 - 2016-11-30 23:46 - 064111920 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct6BB.tmp.exe
2015-01-05 22:13 - 2015-01-05 22:14 - 087183720 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct6FFB.tmp.exe
2015-02-27 13:00 - 2015-02-27 14:33 - 135518328 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct74D4.tmp.exe
2014-12-01 15:48 - 2014-12-01 16:02 - 084041160 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\oct9C39.tmp.exe
2017-09-27 18:13 - 2017-09-27 18:41 - 041564368 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\octC5AD.tmp.exe
2015-09-09 14:37 - 2015-09-09 14:40 - 067202952 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\octC6B3.tmp.exe
2017-07-12 14:18 - 2017-07-12 14:20 - 064118864 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\octCA12.tmp.exe
2017-09-27 16:58 - 2017-09-27 17:04 - 063610200 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\octE346.tmp.exe
2014-12-19 20:36 - 2014-12-19 20:40 - 084724888 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\octE455.tmp.exe
2015-01-31 09:03 - 2015-01-31 09:04 - 061865696 _____ (SweetLabs,Inc.) C:\Users\gratien\AppData\Local\Temp\octEE37.tmp.exe
cmd: ipconfig /flushdns
end::