start::
closeprocesses:
createrestorepoint:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
IE trusted site: HKU\S-1-5-21-890814186-2932927515-4263953315-1001\...\sharepoint.com -> hxxps://sciencespofr-files.sharepoint.com
FirewallRules: [TCP Query User{07795360-B5FF-4578-87A0-827D890C1CA3}C:\program files (x86)\gog galaxy\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\gog galaxy\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Pas de fichier
FirewallRules: [UDP Query User{BEC90775-5C07-444E-90BD-F33D10FF7F66}C:\program files (x86)\gog galaxy\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\gog galaxy\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Pas de fichier
FirewallRules: [{81DCB969-D1CC-4CB4-9C40-803F49622915}] => (Block) C:\program files (x86)\gog galaxy\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Pas de fichier
FirewallRules: [{5DEBF761-398D-4422-A5FE-7D58F7FEE01A}] => (Block) C:\program files (x86)\gog galaxy\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Pas de fichier
FirewallRules: [{4FC73D3D-8820-43C4-9779-EF103F0DDCAA}] => (Allow) C:\Windows\system32\winrmsrv.exe => Pas de fichier
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
Task: {5284387A-6303-402B-B371-9EC83E34C0AE} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary <==== ATTENTION
Task: {66ED8A92-2B56-4060-9D93-F8380825E85A} - System32\Tasks\Microsoft\Windows\Wininet\Winlogui => winlogui.exe <==== ATTENTION
Task: {6DBF6EC4-6D8D-4B1E-887A-E3B419DACA32} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\winrmsrv => winrmsrv.exe <==== ATTENTION
Task: {9ABBB47D-0ADB-445C-A048-E67B48494F20} - System32\Tasks\Microsoft\Windows\WDI\SrvHost => rundll32.exe winscomrssrv.dll,SrvMainHost <==== ATTENTION
C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\klekeajafkkpokaofllcadenjdckhinm
CHR HKLM\...\Chrome\Extension: [klekeajafkkpokaofllcadenjdckhinm]
CHR HKU\S-1-5-21-890814186-2932927515-4263953315-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [klekeajafkkpokaofllcadenjdckhinm]
S2 wuauserv; C:\Windows\system32\svchost.exe [57368 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (pas de ServiceDLL)
S2 wuauserv; C:\Windows\SysWOW64\svchost.exe [47232 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (pas de ServiceDLL)
2021-03-25 10:45 - 2021-03-25 13:37 - 000000000 ____D C:\ProgramData\McInstTemp0314021616665534
2021-03-22 02:28 - 2021-03-22 02:28 - 000271926 _____ C:\Users\Utilisateur\Desktop\ZHPDiag.txt
2021-03-22 02:26 - 2021-03-22 02:28 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\ZHP
2021-03-22 02:26 - 2021-03-22 02:26 - 003273368 _____ (Nicolas Coolman) C:\Users\Utilisateur\Downloads\ZHPDiag3.exe
2021-03-22 02:26 - 2021-03-22 02:26 - 000000871 _____ C:\Users\Utilisateur\Desktop\ZHPDiag.lnk
2021-03-22 02:26 - 2021-03-22 02:26 - 000000000 ____D C:\Users\Utilisateur\AppData\Local\ZHP
2021-03-21 02:34 - 2021-03-21 02:34 - 000000000 ____D C:\Program Files\Common Files\AV
2021-03-21 02:33 - 2021-03-25 13:37 - 000000000 ____D C:\ProgramData\McAfee
2021-03-25 13:37 - 2020-09-04 20:58 - 000000000 ____D C:\Program Files\McAfee
2021-03-25 13:37 - 2020-09-04 20:56 - 000000000 ____D C:\Program Files\Common Files\McAfee
C:\Windows\system32\winrmsrv.exe
C:\Windows\system32\winlogui.exe
emptytemp:
end::