start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
CustomCLSID: HKU\S-1-5-21-3180636465-1759058900-3088226854-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\NEW\AppData\Local\Google\Update\1.3.35.302\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3180636465-1759058900-3088226854-1001_Classes\CLSID\{EF076C91-DC9E-43E3-84ED-3D219E065A4F}\InprocServer32 -> C:\Users\NEW\AppData\Local\Google\Update\1.3.35.302\psuser_64.dll => No File
FirewallRules: [{190B7B5A-F8DE-47AB-958A-C93FE409DCD3}] => (Allow) E:\DRP\DriverPack 17.10.13\bin\tools\aria2c.exe No File
FirewallRules: [{B53AA246-0F00-4477-925A-0EC5F8811A04}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe No File
FirewallRules: [{B802FA3B-89E1-439A-A14D-0F616A5B170A}] => (Allow) C:\Users\NEW\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe No File
FirewallRules: [{B0E58763-EDEE-4815-85A5-706F3F0FDA8A}] => (Allow) C:\Users\NEW\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe No File
FirewallRules: [{8BEADF13-969B-4614-A209-D32AE70D61C4}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe No File
FirewallRules: [{8C01753B-246E-4CA1-A423-CA1AD0282FA0}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\OxygenPanelDaemon.exe No File
FirewallRules: [{CDC6A36D-8593-4D3F-AB51-B5A411CF6D14}] => (Allow) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{42376118-D468-45EA-B02B-237E11CED9DB}] => (Allow) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {364E8620-BA32-4C01-8540-791EB863C339} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe /NOUACCHECK
Task: {F7DC9BF0-9AAD-45AF-9793-5654DDD30C72} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [1873288 2019-09-19] (AVAST Software s.r.o. -> AVAST Software)
C:\Program Files\Common Files\AVAST Software
HKU\S-1-5-21-3180636465-1759058900-3088226854-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
FF Plugin HKU\S-1-5-21-3180636465-1759058900-3088226854-1001: @tools.google.com/Google Update;version=3 -> C:\Users\NEW\AppData\Local\Google\Update\1.3.35.302\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-3180636465-1759058900-3088226854-1001: @tools.google.com/Google Update;version=9 -> C:\Users\NEW\AppData\Local\Google\Update\1.3.35.302\npGoogleUpdate3.dll [No File]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2019-07-01] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2019-07-01] <==== ATTENTION
CHR HKLM\...\Chrome\Extension: [amkpcclbbgegoafihnpgomddadjhcadd] - hxxps://chrome.google.com/webstore/detail/amkpcclbbgegoafihnpgomddadjhcadd
CHR HKU\S-1-5-21-3180636465-1759058900-3088226854-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension: [amkpcclbbgegoafihnpgomddadjhcadd] - hxxps://chrome.google.com/webstore/detail/amkpcclbbgegoafihnpgomddadjhcadd
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth9.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth8.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth7.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth6.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth5.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth4.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth3.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth2.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth12.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth11.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth10.bin
2019-10-04 23:15 - 2019-10-04 23:15 - 000000315 _____ C:\Windows\system32\DrtmAuth1.bin
EmptyTemp:
cmd: ipconfig /flushdns
end::