start::
closeprocesses:
createrestorepoint:
HKU\S-1-5-21-445376762-1068536118-2178264129-1001\Software\Classes\.scr: AutoCADScriptFile => C:\WINDOWS\system32\notepad.exe "%1"
SearchScopes: HKU\S-1-5-21-445376762-1068536118-2178264129-1001 -> DefaultScope {88856714-A077-4633-8FE5-2DCA1B51AE97} URL =
SearchScopes: HKU\S-1-5-21-445376762-1068536118-2178264129-1001 -> {88856714-A077-4633-8FE5-2DCA1B51AE97} URL =
IE trusted site: HKU\S-1-5-21-445376762-1068536118-2178264129-1001\...\webcompanion.com -> hxxp://webcompanion.com
HKLM\...\StartupApproved\Run: => "AvastUI.exe"
HKU\S-1-5-21-445376762-1068536118-2178264129-1001\...\Policies\Explorer: []
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] ->
Task: {1B3C2A15-5914-4641-A764-8E17E877404C} - System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [491520 2023-09-27] (Microsoft Windows -> Microsoft Corporation) -> -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\WINDOWS\mid.ps1
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (Pas de fichier)
Task: {84E03C8E-D503-461C-A1C5-2D37181780AF} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval => %systemroot%\system32\MusNotification.exe Display (Pas de fichier)
Task: {6ECC17BA-2F21-4D1D-A937-AF5B7E29ED7A} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => %systemroot%\system32\MusNotification.exe ReadyToReboot (Pas de fichier)
Task: {7D079BD5-6539-4C71-A78D-BC3B8797F015} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC Reboot (Pas de fichier)
Task: {433E9344-D65D-4479-98DC-C49B9E22E71D} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery Reboot (Pas de fichier)
Task: {2C115D8F-B273-4479-9E06-40D4987A7FFC} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display => %systemroot%\system32\MusNotification.exe Display (Pas de fichier)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (Pas de fichier)
Task: {E1B11FF6-6A5D-46FE-844E-B9C648444759} - System32\Tasks\MSI Task Host - Detect_Monitor => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [491520 2023-09-27] (Microsoft Windows -> Microsoft Corporation) -> -ExecutionPolicy ByPass -WindowStyle Hidden C:\Users\cturc\AppData\Roaming\Winsoft\core.ps1
Task: {1DED127D-42A3-4156-B9D1-10A9FF2128B0} - System32\Tasks\MSI_Help_Desk_Agent => C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe (Pas de fichier)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
Edge HKLM\...\Edge\Extension: [cchfigjcpjmclmmphipdkeocklpnjecm]
Edge HKLM-x32\...\Edge\Extension: [cchfigjcpjmclmmphipdkeocklpnjecm]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR Notifications: Default -> hxxps://app.challengeu.ca; hxxps://lichess.org
CHR HKLM\...\Chrome\Extension: [cchfigjcpjmclmmphipdkeocklpnjecm]
CHR HKLM\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok]
CHR HKU\S-1-5-21-445376762-1068536118-2178264129-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKU\S-1-5-21-445376762-1068536118-2178264129-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [cchfigjcpjmclmmphipdkeocklpnjecm]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [fjoaledfpmneenckfbpdfhkmimnjocfa]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR HKLM-x32\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok]
S3 rsDwf; \SystemRoot\system32\DRIVERS\rsDwf.sys [X]
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
2023-10-01 15:12 - 2023-10-01 17:38 - 000000000 ____D C:\Program Files\Common Files\Autodesk Shared
2023-10-01 15:10 - 2023-10-01 19:31 - 000000000 ____D C:\Program Files\Autodesk
2023-10-01 15:08 - 2023-10-05 13:07 - 000000000 ____D C:\Users\cturc\AppData\Roaming\Autodesk
2023-10-01 15:08 - 2023-10-01 17:37 - 000000000 ____D C:\Users\cturc\AppData\Roaming\UI Launcher
2023-10-01 15:08 - 2023-10-01 15:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2023-10-01 15:07 - 2023-10-01 16:04 - 000000000 ____D C:\ProgramData\Autodesk
2023-10-01 15:07 - 2023-10-01 15:56 - 000000000 ____D C:\Users\cturc\AppData\Local\Autodesk
2023-10-01 15:07 - 2023-10-01 15:14 - 000000000 ____D C:\Autodesk
2023-10-01 15:07 - 2023-10-01 15:07 - 000000000 ____D C:\Users\cturc\AppData\Roaming\Winsoft
emptytemp:
end::