start::
CreateRestorePoint:
CloseProcesses:
Hosts:
AlternateDataStreams: C:\Users\ang3l-san:.repos [4988138]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [486]
HKLM\...\StartupApproved\Run32: => "CTxfiHlp"
HKU\S-1-5-21-2001353660-3922551056-3678344554-1001\...\StartupApproved\Run: => "pxnsrcnd"
HKU\S-1-5-21-2001353660-3922551056-3678344554-1001\...\Run: [pxnsrcnd] => "C:\Users\ang3l-san\edplqakx.exe"
C:\Users\ang3l-san\edplqakx.exe
CHR Extension: (Gotaga Live Extension) - C:\Users\ang3l-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\dklegbbgmbppmbhkplakcehdgjgopell [2018-11-10] [UpdateUrl: hxxps://gotaga.tv/extension/updates.json] <==== ATTENTION
CHR Extension: (Sardalert - alert Live - Sardoche) - C:\Users\ang3l-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\elnpfaoipdfdhikjacbpcfhpnehjjaii [2018-11-10]
CHR Extension: (Corobizar - Alerte Live) - C:\Users\ang3l-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\dflnhmchphajjkfadohcpiobjdhnfaed [2018-11-10]
CHR Extension: (Squeezie) - C:\Users\ang3l-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\mplamgaojjgfaelahmmmbmhnlfhcfamb [2018-11-10] [UpdateUrl: hxxps://extensionsqueezie.fr/updates.json] <==== ATTENTION
S2 amdacpksd; \??\C:\WINDOWS\system32\drivers\amdacpksd.sys [X]
S1 hpmkzdlx; \??\C:\WINDOWS\system32\drivers\hpmkzdlx.sys [X]
S1 nqyohfbj; \??\C:\WINDOWS\system32\drivers\nqyohfbj.sys [X]
S1 ratmthim; \??\C:\WINDOWS\system32\drivers\ratmthim.sys [X]
S1 vttxkvry; \??\C:\WINDOWS\system32\drivers\vttxkvry.sys [X]
S1 ygyfytcj; \??\C:\WINDOWS\system32\drivers\ygyfytcj.sys [X]
2018-10-27 10:46 - 2018-11-11 09:13 - 000055704 _____ (Wellbia.com Co., Ltd.) C:\WINDOWS\xhunter1.sys
2018-10-17 01:30 - 2018-10-17 08:58 - 000000000 ____D C:\Users\ang3l-san\AppData\Roaming\4gtbl1ekled
2018-10-17 01:25 - 2018-10-17 09:05 - 000000000 ____D C:\Users\ang3l-san\AppData\Roaming\ggsgrigxg3u
2018-11-10 00:33 - 2018-11-11 09:13 - 000000069 _____ () C:\Users\ang3l-san\AppData\Local\Temp\ce43c49723e20be2ee9336f22099ad20.dll
2018-11-08 21:27 - 2018-11-11 09:50 - 000000000 _____ () C:\Users\ang3l-san\AppData\Local\Temp\d4f5d244a0909d75573750c06e9db24d.dll
RemoveProxy:
EmptyTemp:
cmd: ipconfig /flushdns
end::