start::
closeprocesses:
createrestorepoint:
virustotal: C:\WINDOWS\nl.exe
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
SearchScopes: HKU\S-1-5-21-559369465-1132258585-3779535369-1001 -> DefaultScope {7432FDE9-FE01-46AF-99D3-C9FACE46A3D6} URL =
SearchScopes: HKU\S-1-5-21-559369465-1132258585-3779535369-1001 -> {7432FDE9-FE01-46AF-99D3-C9FACE46A3D6} URL =
IE trusted site: HKU\S-1-5-21-559369465-1132258585-3779535369-1001\...\sharepoint.com -> hxxps://saintgab-myfiles.sharepoint.com
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) [Fichier non signé]
C:\Program Files (x86)\QuickTime
HKU\S-1-5-21-559369465-1132258585-3779535369-1001\...\Run: [effla] => cmd.exe /c start www.dinoraptzor.org
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {28B8ED4F-B4DE-4207-87EF-8AEE5D1ADD7E} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
C:\Program Files (x86)\AVAST Software
Task: {5ED71966-FE2B-455F-99A9-0409FBCFA951} - System32\Tasks\effla => cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v effla /t REG_SZ /d "cmd.exe /c start www.dinoraptzor.org"
Task: {9925C16C-6468-4740-885E-BB928C0AF3E7} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
ProxyServer: [S-1-5-21-559369465-1132258585-3779535369-1001] => p.speedproxies.net:31112
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
FF Extension: (Avast Online Security) - C:\Users\effla\AppData\Roaming\Mozilla\Firefox\Profiles\m6aatc2i.default\Extensions\wrc@avast.com.xpi [2021-05-27]
C:\WINDOWS\nl.exe
cmd: netsh advfirewall reset
emptytemp:
end::