start::
closeprocesses:
createrestorepoint:
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-3562624878-454376653-1077335878-1001\...\line6.net -> line6.net
IE trusted site: HKU\S-1-5-21-3562624878-454376653-1077335878-1001\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3562624878-454376653-1077335878-1001\...\webcompanion.com -> hxxp://webcompanion.com
FirewallRules: [{CFD98CDD-26C9-4A2A-B69F-6B4CEFC27487}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
FirewallRules: [{755CF6CD-10CB-41AC-AFF0-8B87AEC6ACB0}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
HKU\S-1-5-18\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
C:\Program Files (x86)\Lavasoft
FF SearchPlugin: C:\Users\renato\AppData\Roaming\Mozilla\Firefox\Profiles\2fhihsat.default\searchplugins\bing-lavasoft-ff59.xml [2018-09-15]
HKU\S-1-5-21-3562624878-454376653-1077335878-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=COSP&ptag=D082918-A915F698E57&form=CONMHP&conlogo=CT3335818
SearchScopes: HKU\S-1-5-21-3562624878-454376653-1077335878-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D082918-A915F698E57&form=CONBDF&conlogo=CT3335818&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3562624878-454376653-1077335878-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D082918-A915F698E57&form=CONBDF&conlogo=CT3335818&q={searchTerms}
FF NewTab: Mozilla\Firefox\Profiles\2fhihsat.default -> hxxp://www.bing.com/?pc=COSP&ptag=D082918-A915F698E57&form=CONMHP&conlogo=CT3335818
virustotal: C:\Users\renato\Downloads\KeyGen.exe
cmd: sfc /scannow
emptytemp:
end::