start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --allow-insecure-localhost --enable-features=AllowDownloadResumptionWithoutStrongValidators,UseSurfaceLayerForVideo - (l'élément de données a 72 caractères en plus).
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --allow-insecure-localhost --enable-features=AllowDownloadResumptionWithoutStrongValidators,UseSurfaceLayerForVideo - (l'élément de données a 72 caractères en plus).
GroupPolicy: Restriction ? <==== ATTENTION
Task: {768311CF-EE92-468B-941A-2464BCFE07A1} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
Task: {E5C0C8DD-7909-4AD8-9423-37182CC452B9} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe /NOUACCHECK
Tcpip\..\Interfaces\{a696fb3b-2312-4989-90dc-81aeb5cdbeba}: [NameServer] 8.8.8.8,8.8.4.4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
Toolbar: HKU\S-1-5-21-3900148249-4271453783-3541137913-1001 -> Pas de nom - {EF293C5A-9F37-49FD-91C4-2B867063FC54} - Pas de fichier
Toolbar: HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481 -> Pas de nom - {EF293C5A-9F37-49FD-91C4-2B867063FC54} - Pas de fichier
CHR StartupUrls: Default -> "hxxp://home.torchbrowser.com/?systemid=448&appid=0&ua=Torch"
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Guest Profile [2020-01-28]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\System Profile [2020-01-28]
S3 mracsvc; C:\WINDOWS\System32\mracsvc.exe [16966416 2019-06-30] (Mail.Ru LLC -> LLC Mail.Ru)
S3 libusbK; C:\WINDOWS\System32\drivers\libusbK.sys [47200 2018-03-15] (Travis Lee Robinson -> hxxp://libusb-win32.sourceforge.net)
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [16228328 2019-06-30] (Mail.Ru LLC -> LLC Mail.Ru)
S3 digitalpower; \SystemRoot\system32\drivers\digitalpower.sys [X]
S3 zttap300; \SystemRoot\System32\drivers\zttap300.sys [X]
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth9.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth12.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth11.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth10.bin
2020-01-28 23:57 - 2020-01-28 23:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2020-02-03 21:14 - 2019-11-05 15:20 - 000012288 _____ C:\WINDOWS\SysWOW64\antimalware.unwanted_products.product_registry.kvdb
2020-02-03 21:14 - 2019-11-05 15:20 - 000012288 _____ C:\WINDOWS\SysWOW64\antimalware.patch_management.product_registry.kvdb
2020-02-21 13:53 - 2018-07-06 22:14 - 000000000 ____D C:\ProgramData\Kaspersky Lab
ShellIconOverlayIdentifiers: [
MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Pas de fichier
ShellIconOverlayIdentifiers: [
MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Pas de fichier
ShellIconOverlayIdentifiers: [
MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> Pas de fichier
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => -> Pas de fichier
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => -> Pas de fichier
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => -> Pas de fichier
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => -> Pas de fichier
2019-09-19 05:45 - 2019-09-19 05:45 - 000314368 ____N () [Fichier non signé] C:\Users\user\AppData\Local\Temp\Costura\187D1AE8845CD5F0AA5A8C8ACC15A5BC\64\vigemclient.dll
AlternateDataStreams: C:\Users\user\Application Data:6699d3ee8dd9cf775caae782c8f44f03 [394]
AlternateDataStreams: C:\Users\user\AppData\Roaming:6699d3ee8dd9cf775caae782c8f44f03 [394]
HKLM\...\StartupApproved\StartupFolder: => "Killer Network Manager.lnk"
HKLM\...\StartupApproved\StartupFolder: => "ScpToolkit Tray Notifications.lnk"
HKLM\...\StartupApproved\Run32: => "Acrobat Assistant 8.0"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\StartupApproved\StartupFolder: => "WO Mic Client.lnk"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\StartupApproved\Run: => "OneDriveSetup"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\StartupApproved\Run: => "DAEMON Tools Lite Automount"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\StartupApproved\Run: => "EpicGamesLauncher"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\StartupApproved\Run: => "Parsec.App.0"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001\...\StartupApproved\Run: => "btweb"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\StartupApproved\StartupFolder: => "WO Mic Client.lnk"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\StartupApproved\Run: => "OneDriveSetup"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\StartupApproved\Run: => "DAEMON Tools Lite Automount"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\StartupApproved\Run: => "EpicGamesLauncher"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\StartupApproved\Run: => "Parsec.App.0"
HKU\S-1-5-21-3900148249-4271453783-3541137913-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-02212020152356481\...\StartupApproved\Run: => "btweb"
FirewallRules: [OpenSSH-Server-In-TCP] => (Allow) %SystemRoot%\system32\OpenSSH\sshd.exe Pas de fichier
FirewallRules: [{27102D75-671B-45A9-9CFC-0DA80D1C5E8A}] => (Allow) D:\Outward\Outward Online Steam.exe Pas de fichier
FirewallRules: [{2E1B63FA-B07D-4610-AC56-3167A5D22C16}] => (Allow) D:\Outward\Outward Online Steam.exe Pas de fichier
FirewallRules: [{FB9A5DF7-F780-4141-B4C3-7300B53B0DCD}] => (Allow) C:\ProgramData\ZeroTier\One\zerotier-one_x64.exe Pas de fichier
FirewallRules: [{71E34A02-E61E-4572-8C5E-FA87CBC23E5E}] => (Allow) C:\ProgramData\ZeroTier\One\zerotier-one_x64.exe Pas de fichier
EmptyTemp:
cmd: ipconfig /flushdns
end::