start::
closeprocesses:
createrestorepoint:
Avast Update Helper (HKLM-x32\...\{19C3AB22-3718-4E4D-B203-242F5001565B}) (Version: 1.8.1206.2 - AVAST Software) Hidden
virustotal: C:\Program Files (x86)\Common Files\RoyalCortinaBY\RoyalCortinaBY.exe
AlternateDataStreams: C:\Users\leocc:Heroes & Generals [38]
AlternateDataStreams: C:\Users\leocc\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\leocc\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\leocc\AppData\Local\Temp:$DATA​ [16]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [8816]
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\webcompanion.com -> hxxp://webcompanion.com
HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\StartupApproved\Run: => "Web Companion"
C:\Program Files (x86)\Common Files\RoyalCortinaBY
HKLM-x32\...\Run: [Genshin Impact_Launcher] => [X]
HKLM-x32\...\Run: [Weather] => C:\Users\leocc\AppData\Roaming\Weather\Weather.exe --CNplo6AkQ (Pas de fichier)
HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [8296032 2020-09-12] (LAVASOFT SOFTWARE CANADA INC -> Lavasoft)
C:\Program Files (x86)\Lavasoft
HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\Run: [Steam] => "D:\Steam\steam.exe" -silent (Pas de fichier)
HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\Run: [Free Download Manager] => "D:\Free Download Manager\fdm.exe" --hidden (Pas de fichier)
HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\Run: [RestMinder] => C:\Users\leocc\AppData\Local\Programs\RestMinder\RestMinder.exe (Pas de fichier)
HKU\S-1-5-21-1085649042-2849050333-4173249748-1001\...\RunOnce: [Application Restart #0] => C:\Users\leocc\AppData\Roaming\Weather\Weather.exe --cnplo6akq --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --enable-widevine-cdm --register-pepper-plugins=widevinecdmadapte (l'élément de données a 458 caractères en plus). (Pas de fichier)
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {13E31529-02CC-45E0-9DE5-4A1E47C80BED} - System32\Tasks\FreeDownloadManagerHelperService => D:\Free Download Manager\helperservice.exe (Pas de fichier)
Task: C:\WINDOWS\Tasks\Driver Easy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2022-04-22] [UpdateUrl:hxxps://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [mfhcmdonhekjhfbjmeacdjbhlfgpjabp]
R2 RoyalCortinaBY; C:\Program Files (x86)\Common Files\RoyalCortinaBY\RoyalCortinaBY.exe [6967536 2022-04-08] (LushScethil -> DeepPinkInt Co) [Fichier non signé] [Fichier en cours d'utilisation]
S3 HnGSteamService; D:\Steam\steamapps\common\Heroes & Generals\hngservice.exe [X]
cmd: netsh advfirewall reset
emptytemp:
end::