start::
closeprocesses:
createrestorepoint:
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers2: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers2: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
AlternateDataStreams: C:\Users\Utilisateur\Downloads\2022_14_2022029000077_9420_20220802120733.pdf:shield [940]
AlternateDataStreams: C:\Users\Utilisateur\Downloads\2023_26_20233000811_9420_20230921121407 (1).pdf:shield [942]
AlternateDataStreams: C:\Users\Utilisateur\Downloads\2023_26_20233000811_9420_20230921121407 (2).pdf:shield [942]
AlternateDataStreams: C:\Users\Utilisateur\Downloads\2023_26_20233000811_9420_20230921121407.pdf:shield [938]
AlternateDataStreams: C:\Users\Utilisateur\Downloads\3026513567851504_payment.pdf:shield [204]
HKLM\...\StartupApproved\Run: => "BdagentApp"
HKU\S-1-5-21-3742690759-3008749355-349425329-1001\...\StartupApproved\Run: => "Econap"
FirewallRules: [{2298CD8D-5C15-43FE-90F1-E39B436AB7F8}] => (Allow) C:\Windows\System32\DriverStore\FileRepository\asussci2.inf_amd64_cdacbd58a24d27d4\ASUSLinkRemote\LinktoMyASUS_Agent-remote.exe => Pas de fichier
FirewallRules: [{496C91F4-7AB6-4547-807D-89BAEE2F8A8C}] => (Allow) C:\Windows\System32\DriverStore\FileRepository\asussci2.inf_amd64_cdacbd58a24d27d4\ASUSLinkRemote\LinktoMyASUS_Agent-remote.exe => Pas de fichier
FirewallRules: [{E4361EEE-D3A0-4423-842F-960CD3E32528}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe => Pas de fichier
FirewallRules: [{08B632C0-F512-4D2F-A261-6A2F4C0FDE7C}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe => Pas de fichier
FirewallRules: [{A22D5232-A39F-48F8-AB1C-0D7D573642F1}] => (Allow) C:\Users\Utilisateur\AppData\Local\Temp\utorrent\utorrent.exe => Pas de fichier
FirewallRules: [{9A4998E3-1277-4FD7-B0B4-91D8EE4F426C}] => (Allow) C:\Users\Utilisateur\AppData\Local\Temp\utorrent\utorrent.exe => Pas de fichier
FirewallRules: [{C4073D53-364E-407F-85C8-26EB93B3FCEF}] => (Allow) C:\Users\Utilisateur\AppData\Roaming\uTorrent\uTorrent.exe => Pas de fichier
FirewallRules: [{131D4AAC-B1F2-44E0-BB81-14A39EA01D8C}] => (Allow) C:\Users\Utilisateur\AppData\Roaming\uTorrent\uTorrent.exe => Pas de fichier
FirewallRules: [{529AB501-B96F-42BD-A460-DD9E54207E10}] => (Allow) C:\program files (x86)\wondershare\drfone\drfonetoolkit.exe => Pas de fichier
HKLM\...\Run: [BdagentApp] => "C:\Program Files\Bitdefender\Bitdefender Security App\bdagent.exe" (Pas de fichier)
C:\Program Files\Bitdefender
HKU\S-1-5-21-3742690759-3008749355-349425329-1001\...\Run: [Econap] => C:\Users\Utilisateur\AppData\Local\Econap\app-1.3.4\Econap.exe (Pas de fichier)
C:\Users\Utilisateur\AppData\Local\Econap
HKU\S-1-5-21-3742690759-3008749355-349425329-1001\...\Run: [DontSleep] => C:\Users\Utilisateur\AppData\Local\Temp\d1dcca08-bc0a-4d08-b289-c30b792e83ec_DontSleep_x64.zip.3ec\DontSleep_x64.exe [445240 2023-11-10] (Nenad Hrg -> Nenad Hrg (SoftwareOK.com)) <==== ATTENTION
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] ->
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy-Firefox: Restriction <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (Pas de fichier)
Task: {4C122D1A-55BE-4614-83DF-730C564F6184} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => %systemroot%\system32\MusNotification.exe LogonUpdateResults (Pas de fichier)
Task: {D1A21D51-40E1-45FD-9A9E-CDBA7D6AB593} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => %systemroot%\system32\MusNotification.exe ReadyToReboot (Pas de fichier)
Task: {A29D2734-2BDD-4BCC-A3C5-921E397C6AE1} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC ReadyToReboot (Pas de fichier)
Task: {F9A35BB0-54D8-4025-BAAA-55BC48BBF5CC} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery ReadyToReboot (Pas de fichier)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (Pas de fichier)
CHR HKU\S-1-5-21-3742690759-3008749355-349425329-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
S4 BDSafepaySrv; "C:\Program Files\Bitdefender\Bitdefender Security App\Safepay\bdservicehost.exe" "settings/services/configs/bdsafepaysrv_config.json" [X]
S2 ElevationService; C:\ProgramData\Wondershare\wsServices\ElevationService.exe [X]
S2 WirelessBackupService; C:\Program Files (x86)\Wondershare\drfone\Addins\Recovery\WirelessBackupService.exe [X]
S2 Wondershare InstallAssist; C:\ProgramData\Wondershare\Service\InstallAssistService.exe [X]
2023-10-30 16:00 - 2023-11-09 18:40 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\DontSleep
2023-10-29 20:47 - 2023-10-29 20:47 - 000084916 _____ C:\ProgramData\agent.uninstall.1698608827.bdinstall.v2.bin
2023-10-29 20:42 - 2023-11-01 16:43 - 000000000 ____D C:\Users\Utilisateur\AppData\Local\Econap
2023-10-29 20:41 - 2023-11-01 16:43 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Select Code UG (haftungsbeschraenkt)
2023-10-29 20:41 - 2023-10-29 20:41 - 000000000 ____D C:\ProgramData\SelectCode
2023-10-29 15:30 - 2023-10-29 15:30 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2023-10-28 23:06 - 2023-10-28 23:08 - 000264908 _____ C:\ProgramData\cl.1698530781.9412.v2.bin
2023-10-28 23:06 - 2023-10-28 23:08 - 000176048 _____ C:\ProgramData\cl.1698530781.7280.v2.bin
2023-10-28 23:06 - 2023-10-28 23:08 - 000009496 _____ C:\ProgramData\cl.1698530781.24340.v2.bin
2023-10-15 16:54 - 2023-10-15 16:54 - 000090808 _____ C:\ProgramData\agent.update.1697385269.bdinstall.v2.bin
2023-10-29 14:23 - 2022-06-20 14:46 - 000000000 ____D C:\Program Files\Bitdefender
2023-10-28 23:08 - 2022-06-20 14:46 - 000000000 ____D C:\ProgramData\Bitdefender
2023-10-22 22:30 - 2023-06-06 10:59 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\Wondershare
2023-10-22 22:30 - 2023-06-06 10:58 - 000000000 ____D C:\ProgramData\Wondershare
2023-10-11 15:55 - 2023-10-11 15:55 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
R2 DFWSIDService; C:\ProgramData\Wondershare\wsServices\WsidService.exe [4231408 2023-05-29] (Wondershare Technology Group Co.,Ltd -> wondershare)
HKLM\...\RunOnce: [msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}] => C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\Installer\setup.exe [6296008 2023-11-10] (Microsoft Corporation -> Microsoft Corporation)
emptytemp:
end::