start::
CreateRestorePoint:
CloseProcesses:
Hosts:
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll -> Pas de fichier
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll -> Pas de fichier
Task: {2914DB1E-4FDC-475C-BDEA-43EDBB3D9F68} - System32\Tasks\majestiesmajesties => C:\Program Files (x86)\Letitia\Breathe.exe
C:\Program Files (x86)\Letitia
Task: {B16C44AC-B161-4FDC-88D0-90DB8060F40E} - System32\Tasks\correllcorrell => C:\Program Files (x86)\Obstructed\verona.exe
Task: {BF939826-2F68-47CF-9FA2-147A7E222B10} - System32\Tasks\harpe-dissembledharpe-dissembled => C:\Program Files (x86)\foret\Ouellette.exe
C:\Program Files (x86)\Obstructed
C:\Program Files (x86)\foret
Task: {F45A460D-4F59-4B51-B5D1-8B847062494F} - System32\Tasks\drainsdrains => C:\Program Files (x86)\heartful\heartful.exe
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "Cherubini"
HKLM\...\StartupApproved\Run: => "Kilometre"
HKLM\...\StartupApproved\Run: => "Partially"
HKLM\...\StartupApproved\Run32: => "IJNetworkScanUtility"
HKLM\...\StartupApproved\Run32: => "StartCCC"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLMLServer"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "Dropbox"
HKLM\...\StartupApproved\Run32: => "LGODDFU"
HKLM\...\StartupApproved\Run32: => "InstantBurn"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "UpdatePPShortCut"
HKLM\...\StartupApproved\Run32: => "UpdateP2GoShortCut"
HKLM\...\StartupApproved\Run32: => "MDS_Menu"
HKLM\...\StartupApproved\Run32: => "PlaysTV"
HKLM\...\StartupApproved\Run32: => "PowerDVD12Agent"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKLM\...\StartupApproved\Run32: => "PowerDVD13Agent"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "My Movies Tray"
HKLM\...\StartupApproved\Run32: => "RzWizard"
HKLM\...\StartupApproved\Run32: => "PowerDVD16Agent"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G10"
HKLM\...\StartupApproved\Run32: => "DivXUpdate"
HKLM\...\StartupApproved\Run32: => "Memberships"
HKLM\...\StartupApproved\Run32: => "Sein"
HKLM\...\StartupApproved\Run32: => "Reconfirmation"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\StartupFolder: => "DesktopVideoPlayer.lnk"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\StartupFolder: => "Twitch.lnk"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\StartupFolder: => "iStripper.lnk"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\StartupFolder: => "eludedeluded.lnk"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\StartupFolder: => "eluded.lnk"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "ownCloud"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "LightScribe Control Panel"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "TIDAL"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Power2GoExpress10"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "FFR9KUK9NQXO929"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "K8KTVCVCABGH7BA"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "tosti"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "gans"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Thorsten"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Overhanging"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Ashburn"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Pareja"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Roomed"
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\StartupApproved\Run: => "Creepier"
FirewallRules: [UDP Query User{383A41EB-11C1-47BC-B08B-E2374D5EB5D7}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe Pas de fichier
FirewallRules: [TCP Query User{F399F3DE-A1C6-4734-830E-949DB28B079F}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe Pas de fichier
FirewallRules: [{27BA419D-0696-4F77-BB73-D8BF0DCE0583}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector11\PDR10.EXE Pas de fichier
C:\program files (x86)\deluge
FirewallRules: [{CE7BBFD3-21B6-4E35-A07C-32F12374D1CA}] => (Allow) C:\Program Files\Microsoft SQL Server\MSSQL12.MYMOVIES\MSSQL\Binn\sqlservr.exe Pas de fichier
FirewallRules: [{9E083E4F-EF8F-41A9-B27F-4885B889902C}] => (Allow) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Movie\PowerDVD Cinema\PowerDVDCinema12.exe Pas de fichier
FirewallRules: [{10A2152C-2F0E-4E26-989D-DAE5514EECA9}] => (Allow) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\PowerDVD12ML.exe Pas de fichier
FirewallRules: [{1E7C6EF8-B715-4771-8B8B-8FB46349B465}] => (Allow) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\PowerDVD12Agent.exe Pas de fichier
FirewallRules: [{682786F2-B661-46A2-ACD1-47F3F16E0665}] => (Allow) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe Pas de fichier
FirewallRules: [{4F93F657-21B9-45D1-8348-22C9739D16AD}] => (Allow) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe Pas de fichier
FirewallRules: [{58EBF957-7166-43C0-92C2-3B8E536BC2DC}] => (Allow) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\PowerDVD12.exe Pas de fichier
FirewallRules: [UDP Query User{72945E1C-28A2-4FF2-AD70-2657F5E4FB75}C:\program files (x86)\diablo iii\x64\diablo iii64.exe] => (Allow) C:\program files (x86)\diablo iii\x64\diablo iii64.exe Pas de fichier
FirewallRules: [TCP Query User{9FA5C0AC-C83C-4D78-B687-4142A8D72C1A}C:\program files (x86)\diablo iii\x64\diablo iii64.exe] => (Allow) C:\program files (x86)\diablo iii\x64\diablo iii64.exe Pas de fichier
FirewallRules: [{EF5FE4B3-4F6D-4EFA-86D5-6FA6DCBC0B90}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
FirewallRules: [{911E7407-6833-4E3C-BACD-B7AC2C6DE20A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
FirewallRules: [{487FAA5C-46FA-43F6-86C0-9960E770F4AE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe Pas de fichier
FirewallRules: [{DBEBAC99-E206-41CB-A843-164E03A416C0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe Pas de fichier
FirewallRules: [{22B1C8D2-7680-4F08-AD66-7BB037CC613B}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe Pas de fichier
FirewallRules: [{9EB109A8-1712-41E2-9810-668C88CF1FC6}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe Pas de fichier
FirewallRules: [{7C5162D1-32CD-4FB2-90B8-16331B82D29C}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe Pas de fichier
FirewallRules: [{AFB435CC-9E70-4DD5-8CBC-CE3EC735B9DC}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe Pas de fichier
FirewallRules: [{268F716D-F7F5-4035-91F8-B64454483896}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe Pas de fichier
FirewallRules: [{8C568066-7BCB-454B-B8C7-37A228300960}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe Pas de fichier
FirewallRules: [{ADBE3887-DD52-49A2-8CE6-114FAEB5C95C}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe Pas de fichier
FirewallRules: [{DD9AC48E-C8D0-4362-9B2B-9D41F1EC238D}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe Pas de fichier
FirewallRules: [{3C92E679-B7D8-442C-BDF0-8384BF10D5C7}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe Pas de fichier
FirewallRules: [{3B18473C-A442-4274-8EE6-A1181B602EA4}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe Pas de fichier
FirewallRules: [{28B5A1C0-6031-4B5E-9D10-B034FF438040}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13.exe Pas de fichier
FirewallRules: [{8BEFE8E8-06E1-4B95-8E70-9A92B93789F8}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMR\PowerDVD13DMREngine.exe Pas de fichier
FirewallRules: [{F4245157-ACF2-472B-BF7A-C266FC6E1280}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe Pas de fichier
FirewallRules: [{414D0783-8BE8-4516-A8EA-337C2017C709}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe Pas de fichier
FirewallRules: [{BB6B1AF1-3B23-4ABA-9919-D58E1F3B6DB7}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13ML.exe Pas de fichier
FirewallRules: [{BFD2803A-26B6-425B-A63E-57548C97D037}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Movie\PowerDVD.exe Pas de fichier
FirewallRules: [{60EF8D4D-FCF5-4F3B-9CEE-C5B5CB8D5F60}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Movie\PowerDVD Cinema\PowerDVDCinema13.exe Pas de fichier
FirewallRules: [{BE6AB90F-F448-416C-8899-8A09520810AE}] => (Allow) C:\Program Files\CyberLink\PowerDirector14\PDR10.EXE Pas de fichier
FirewallRules: [{4A5A78DA-ADE9-47BB-9F92-B4094874CFBC}] => (Allow) C:\Program Files\Vuze\Azureus.exe Pas de fichier
FirewallRules: [{1638CFA3-C7E0-4C0D-ACE2-28AF948CA39B}] => (Allow) C:\Program Files\Vuze\Azureus.exe Pas de fichier
FirewallRules: [TCP Query User{C527A290-1D5F-41D2-85CB-4426EAB9C8C5}C:\program files\windowsapps\xbmcfoundation.kodi_17.9.601.0_x86__4n2hpmxwrvr6p\kodi.exe] => (Allow) C:\program files\windowsapps\xbmcfoundation.kodi_17.9.601.0_x86__4n2hpmxwrvr6p\kodi.exe Pas de fichier
FirewallRules: [UDP Query User{4A12F8F4-2458-437D-92B5-799F24A3F6A3}C:\program files\windowsapps\xbmcfoundation.kodi_17.9.601.0_x86__4n2hpmxwrvr6p\kodi.exe] => (Allow) C:\program files\windowsapps\xbmcfoundation.kodi_17.9.601.0_x86__4n2hpmxwrvr6p\kodi.exe Pas de fichier
FirewallRules: [TCP Query User{D5F5194D-35EE-416A-9665-B3453015F26A}C:\program files\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_151\bin\javaw.exe Pas de fichier
FirewallRules: [UDP Query User{0A9B65CE-AD62-44D5-A4CD-4E110062BF0E}C:\program files\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_151\bin\javaw.exe Pas de fichier
FirewallRules: [TCP Query User{27BC29ED-C17F-4DE6-89DD-DFA541D9FBB3}C:\program files\vuze\azureus.exe] => (Block) C:\program files\vuze\azureus.exe Pas de fichier
FirewallRules: [UDP Query User{72EE0B24-53D9-41BB-A39F-11DE2DAD4D99}C:\program files\vuze\azureus.exe] => (Block) C:\program files\vuze\azureus.exe Pas de fichier
FirewallRules: [{151E34EC-50FD-4B3C-B8AB-9374F0D6425E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe Pas de fichier
FirewallRules: [{E500C6EF-8847-4ABD-B7DB-A8844A7C4A3A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe Pas de fichier
FirewallRules: [{E4DEA4B4-961F-4472-874A-805E8AD220AF}] => (Allow) C:\Program Files (x86)\Letitia\Breathe.exe Pas de fichier
FirewallRules: [{EC91EC07-C610-4A29-8BAF-8D80CBAF2F61}] => (Allow) C:\Program Files (x86)\Interlacing\Breathe.exe Pas de fichier
FirewallRules: [{CB1B9386-855C-4DD0-B258-5A357CF68906}] => (Allow) C:\Program Files (x86)\foret\Ouellette.exe Pas de fichier
FirewallRules: [{1C764693-C9D3-4DC2-8BD3-5DBAFB4A7DDF}] => (Allow) C:\Program Files (x86)\Interlacing\Ouellette.exe Pas de fichier
HKLM\...\Run: [Partially] => "C:\Program Files (x86)\Letitia\Breathe.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKLM\...\Run: [Kilometre] => "C:\Program Files (x86)\foret\Ouellette.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKLM-x32\...\Run: [Reconfirmation] => "C:\Program Files (x86)\Letitia\Breathe.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKLM-x32\...\Run: [Sein] => "C:\Program Files (x86)\foret\Ouellette.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\Run: [Creepier] => "C:\Program Files (x86)\Letitia\Breathe.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\Run: [Roomed] => "C:\Program Files (x86)\foret\Ouellette.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\Run: [Ashburn] => "C:\Program Files (x86)\Letitia\Breathe.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\Run: [Overhanging] => "C:\Program Files (x86)\foret\Ouellette.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\Run: [tosti] => "C:\Program Files (x86)\Letitia\Breathe.exe" aesbuwaesbuwaesbuwaesbu.aesbuyaesbupaesbuqaesbu.aesbupaesbuwaesbu/aesbud2hg0hg1hgaesbu8hg1b2b1d8aesbudhghtml1J1aesburM7eM9wFFFaesbucHkzZ8M
HKU\S-1-5-21-2701282256-3662976809-551590350-1001\...\Run: [K8KTVCVCABGH7BA] => "C:\Program Files (x86)\cd0fuxnohlb\WPU6C.exe"
HKLM\...\Drivers32: [vidc.pDAD] => C:\WINDOWS\system32\prodad-codec.dll [607256 2016-09-13] (proDAD GmbH)
HKLM\...\Drivers32-x32: [vidc.i420] => C:\Windows\SysWOW64\i420vfw.dll [70656 2004-01-25] (www.helixcommunity.org)
HKLM\...\Drivers32-x32: [vidc.DIVX] => C:\Windows\SysWOW64\DivX.dll [720384 2010-02-19] (DivX, Inc.)
HKLM\...\Drivers32-x32: [vidc.yv12] => C:\Windows\SysWOW64\yv12vfw.dll [70656 2004-01-25] (www.helixcommunity.org)
Startup: C:\Users\jfs88\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eluded.lnk [2018-12-18]
ShortcutTarget: eluded.lnk -> C:\Program Files (x86)\Letitia\Breathe.exe (Pas de fichier)
Startup: C:\Users\jfs88\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eludedeluded.lnk [2018-12-18]
ShortcutTarget: eludedeluded.lnk -> C:\Program Files (x86)\foret\Ouellette.exe (Pas de fichier)
EmptyTemp:
RemoveProxy:
cmd: ipconfig /flushdns
cmd: netsh winsock reset
end::