start::
closeprocesses:
createrestorepoint:
CustomCLSID: HKU\S-1-5-21-1133188915-2473235476-1265324620-1001_Classes\CLSID\{23066764-9BDD-4FBD-8B1F-F4547CF2684F}\InprocServer32 -> C:\Users\alppl\AppData\Local\Microsoft\OneDrive\18.070.0405.0002\amd64\FileSyncShell64.dll => Pas de fichier
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`28hfm [0]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`29hfm [0]
AlternateDataStreams: C:\Users\alppl\AppData\Local\Temp:$DATA​ [16]
IE trusted site: HKU\S-1-5-21-1133188915-2473235476-1265324620-1001\...\sharepoint.com -> hxxps://ozanam35-files.sharepoint.com
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1133188915-2473235476-1265324620-1001\...\Policies\Explorer: []
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Tcpip\..\Interfaces\{5d2c97ef-b694-4b4b-8dbc-a7a333466226}: [DhcpNameServer] 10.10.10.100
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_161\bin\ssv.dll [2018-02-25] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-02-25] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-02-25] (Oracle America, Inc. -> Oracle Corporation)
S3 VBAudioVMVAIOMME; \SystemRoot\system32\DRIVERS\vbaudio_vmvaio64_win7.sys [X]
2019-03-10 12:37 - 2019-03-10 12:37 - 007979470 _____ C:\Users\alppl\Downloads\OFFICE 2016 SETUP + CRACK.ZIP
deletekey: HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WinRAR32
deletekey: HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32
deletekey: HKLM\SOFTWARE\Wow6432Node\Classes\Installer\Products\436F6625D7B77354DBCD89DDC6CFAB1A
deletekey: HKLM\SOFTWARE\Wow6432Node\Classes\Installer\Features\436F6625D7B77354DBCD89DDC6CFAB1A
C:\WINDOWS\Installer\241dfae8.msi
cmd: netsh advfirewall reset
emptytemp:
end::