start::
closeprocesses:
createrestorepoint:
virustotal: C:\Program Files (x86)\Altruistic\Altruistic.exe
Avast Update Helper (HKLM-x32\...\{19C3AB22-3718-4E4D-B203-242F5001565B}) (Version: 1.8.1579.3 - AVAST Software) Hidden
AlternateDataStreams: C:\ProgramData\rsEngine.config.backup:CF02139FF4 [7706]
AlternateDataStreams: C:\ProgramData\settings.ini:27EB0451C1 [7706]
AlternateDataStreams: C:\ProgramData\settings.ini:AD57220027 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks 5 Multi-Instance Manager.lnk:35C0D57199 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:C8B6D970BF [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Audio Switch.lnk:BD4A45E559 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Documentation.lnk:92B3809DA8 [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LastPass.lnk:F32536EEBE [7706]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk:E77773B271 [7706]
BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2022-07-20] (McAfee, LLC -> McAfee, LLC)
BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2022-07-20] (McAfee, LLC -> McAfee, LLC)
C:\Program Files\McAfee
IE trusted site: HKU\S-1-5-21-1208516395-2477601555-1121720189-1001\...\webcompanion.com -> hxxp://webcompanion.com
FirewallRules: [{F96F40AA-85AE-4251-8A36-5A09ED05B484}] => (Allow) C:\Users\Lily\AppData\Local\Programs\Opera\79.0.4143.22\opera.exe => Pas de fichier
FirewallRules: [UDP Query User{C8B1C708-986B-4AB1-AAE4-3BDD43E1EDFD}C:\users\lily\appdata\local\discord\app-1.0.9008\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9008\discord.exe => Pas de fichier
FirewallRules: [TCP Query User{20EF0AD2-85E1-4DCC-AAC1-B6A9FFC800B9}C:\users\lily\appdata\local\discord\app-1.0.9008\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9008\discord.exe => Pas de fichier
FirewallRules: [UDP Query User{E0DE9C1B-2EC9-4B28-8221-C7DE9FC17927}C:\users\lily\appdata\local\discord\app-1.0.9007\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9007\discord.exe => Pas de fichier
FirewallRules: [TCP Query User{6E95A337-6A84-42A0-BA8A-5BFB9C01A5BC}C:\users\lily\appdata\local\discord\app-1.0.9007\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9007\discord.exe => Pas de fichier
FirewallRules: [UDP Query User{B8716BD5-7FE5-4EEA-9077-81206D50121B}C:\users\lily\appdata\local\discord\app-1.0.9006\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9006\discord.exe => Pas de fichier
FirewallRules: [TCP Query User{86DE1FBA-E14B-4160-B91F-BC8C2D0B8C8C}C:\users\lily\appdata\local\discord\app-1.0.9006\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9006\discord.exe => Pas de fichier
FirewallRules: [UDP Query User{5061F2D2-29E4-4BC2-945C-6251841B637C}C:\users\lily\appdata\local\discord\app-1.0.9004\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9004\discord.exe => Pas de fichier
FirewallRules: [TCP Query User{7BA22FED-D624-4C03-9EF8-1F48990CB74E}C:\users\lily\appdata\local\discord\app-1.0.9004\discord.exe] => (Allow) C:\users\lily\appdata\local\discord\app-1.0.9004\discord.exe => Pas de fichier
FirewallRules: [{0E2D94D9-59D8-4894-A208-5A9251B2B95E}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{00246090-D56F-4951-B154-B284BA4CE045}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{76D3DBE4-31C2-417A-B74D-9E1DAE5F29EB}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{082E9227-9F18-420C-B77B-5B869CA79FD3}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{0D95985E-25C3-4533-B2A1-C7108EF72570}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{2A3A2A9D-6DFB-49EF-AC21-C97264C523AF}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{93C04BD6-376A-40AA-9D33-0FC478B3C601}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
FirewallRules: [{431AF4FA-03C9-42C3-8057-D5183E520FFE}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.165.643.0_x86__zpdnekdrzrea0\Spotify.exe => Pas de fichier
C:\Program Files (x86)\Altruistic
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] ->
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {7DE10C1B-B8BE-48CE-9E26-723EB7575050} - System32\Tasks\Opera scheduled Autoupdate 1673455595 => C:\Users\Lily\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Pas de fichier)
Task: {BAEC2A13-2A39-4E3C-BE21-15BC0AB65003} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => C:\WINDOWS\system32\MusNotification.exe /RunOnAC RebootDialog (Pas de fichier)
Task: {C9D56B67-70B1-45FC-BCAD-828F0D7EAB40} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => C:\WINDOWS\system32\MusNotification.exe /RunOnBattery RebootDialog (Pas de fichier)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (Pas de fichier)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => C:\WINDOWS\system32\MusNotification.exe (Pas de fichier)
CHR Notifications: Default -> hxxps://aternos.org; hxxps://www49.davisonbarker.pro
C:\Users\Lily\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fheoggkfdfchfphceeifdbepaooicaho
C:\Users\Lily\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\fheoggkfdfchfphceeifdbepaooicaho
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
R2 AltruisticsService; C:\Program Files (x86)\Altruistic\Altruistic.exe [18362432 2023-01-11] (ALT Dev Group -> ) [Fichier non signé] [Fichier en cours d'utilisation]
R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [856472 2023-03-02] (McAfee, LLC -> McAfee, LLC)
2023-03-10 10:41 - 2023-03-10 10:41 - 000000000 ___HD C:\$AV_ASW
2023-03-10 10:29 - 2023-03-10 10:29 - 000263008 _____ (AVAST Software) C:\Users\Lily\Downloads\avast_one_free_antivirus.exe
2023-03-10 11:06 - 2022-06-28 22:04 - 000000000 ____D C:\Users\Lily\AppData\Local\Avast Software
2023-03-10 11:06 - 2022-06-28 21:31 - 000000000 ____D C:\ProgramData\Avast Software
2023-03-10 10:28 - 2023-01-11 17:47 - 000000000 ____D C:\Program Files (x86)\Altruistic
2023-03-10 13:02 - 2023-02-05 10:10 - 000000000 ____D C:\ProgramData\Altruistic
2023-03-10 12:20 - 2023-02-05 10:10 - 000000000 ____D C:\Users\Lily\AppData\Local\Altruistic
2023-03-10 11:06 - 2022-06-28 22:04 - 000000000 ____D C:\Users\Lily\AppData\Local\Avast Software
2023-03-10 11:06 - 2022-06-28 21:31 - 000000000 ____D C:\ProgramData\Avast Software
emptytemp:
end::