start::
closeprocesses:
createrestorepoint:
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3306]
AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhioihinfh [0]
AlternateDataStreams: C:\ProgramData\WnHqYU0nH4:D39ABDACE2 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2018.lnk:3A5A51F5D9 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk:7661CCE9BF [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk:B026C77744 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:8096E45125 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MovieStarPlanet.lnk:34A1592758 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk:F20EF51E1F [3306]
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
C:\Program Files (x86)\Digital Communications
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (Pas de fichier)
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact
HKLM-x32\...\Run: [Discord] => C:\ProgramData\SquirrelMachineInstalls\Discord.exe [61370712 2019-12-09] (Discord Inc. -> Discord Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (Pas de fichier)
Task: {98F76838-4D88-4B26-907F-6FA25AD1E472} - System32\Tasks\Opera scheduled Autoupdate 1622824200 => C:\Users\ACER\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Pas de fichier)
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
CHR HomePage: Default -> hxxps://homesearchdesign.com/tab?session=y6bdVFVIsvuYsgEClQfz8JM4Fo34kHre1h3N85MX8sa%2FKnVvQT62XiF7k6SfUW%2Fd7vq%2BcO%2BoCNObv7%2FqMtQuOmGiOypoXawhFof5YtiU5UWiHESdvxaa2mqL5AFCJdPFoj3F7qb9RKXeW5s0rlWQ2d0oJkAUOSxhZZmuT7kps5uqetHhXZnsZStp8zI%2FhMXYI9Z9x%2BgtUBuhlRFvQ4CjydF4plaVPt%2BTpTffUlz3eWkyErHzOTSFGpMv%2FVWXG0kUKZbcOrnjP4fyWs7msN9bCWL2pTvbFFkqYU1XYjBPBdO1HV2xc%2BwKGfsDONWgWV7uIG4fsPe16j3Q2T1D9uLvj%2FsAxxwpJ7IgKKs4LxsChp3VP5mWJs4klRD9YLIRib4Rvt%2BsEwH%2FJWfQTWx8CmSndQ%3D%3D
CHR StartupUrls: Default -> "hxxps://homesearchdesign.com/tab?session=y6bdVFVIsvuYsgEClQfz8JM4Fo34kHre1h3N85MX8sa%2FKnVvQT62XiF7k6SfUW%2Fd7vq%2BcO%2BoCNObv7%2FqMtQuOqGBskgMtpGgPCftPUJEDNfWGQPljypu%2BaBiwvKBM3kjfIeX8x%2F5VymMJ07n8q4Lr8dcuwXmGUadF96fHDwyhW6Rna88%2FwidotAKO%2BeOQHQooN3NrBycWx3WxTMnxR5ih%2Fg5oabe1yvC9SphtmEwWzTipipZNWhZNWEWLoqWxMZDfnDuX9XRQ3bOlKI13ZqkAfc%2FCs7z441WqGVVBhKd2e%2FbeHmZbz7pBzzP6NEsDVXFrSyKGRREqlp%2Bm8xD5voBskviXnD2THiTzDbYpKBdFd1uaqXES%2FC0lBUKuecvFOAx4nKJ1hvJZNPnq2ceFBoN5Q%3D%3D","hxxps://homesearchdesign.com/tab?session=y6bdVFVIsvuYsgEClQfz8JM4Fo34kHre1h3N85MX8sa%2FKnVvQT62XiF7k6SfUW%2Fd7vq%2BcO%2BoCNObv7%2FqMtQuOqGBskgMtpGgPCftPUJEDNfWGQPljypu%2BaBiwvKBM3kjd3RglmPKEHkWZUZr434iYzO7MlxTZCl2WfUJIOd8VRegL9lHmyRyz91FmwtXPzxFURdIrIoUl3iRpr%2FpcUF5uNtVGHq46Rw6IKZEcEWrhYZQ0gLJPkA43gDTgovLDnngb%2FpM17nUjIi6Oel4fIEXgYfr47kYjVlmcVxFjU06sLk1LSGk%2BwKK2rEC7Zgwf%2FbKvHP7jzyGmoJFXWDrTnxngLesdgyAkyrPaEgd9W06v1XQngs%2B2K8fByDMSlQXrLnioOAV5wXqq5ATcgbeaT9QWg%3D%3D"
C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Guest Profile
C:\Users\ACER\AppData\Local\Google\Chrome\User Data\System Profile
cmd: netsh advfirewall reset
emptytemp:
end::