start::
closeprocesses:
createrestorepoint:
virustotal: C:\Windows\System32\ux003lm.dll
virustotal: C:\Windows\system32\ssb3ml6.dll
CHR NewTab: Default -> Not-active:"chrome-extension://kbmkambfpkcpoaalgilkfdgjenkjfhio/ntp1.html", Active:"chrome-extension://mallpejgeafdahhflmliiahjdpgbegpk/ntp1.html"
CHR DefaultSearchURL: Default -> hxxps://search.tb.ask.com/search/GGmain.jhtml?searchfor={searchTerms}&enableSearch=true&rdrct=no&redirect=CPC
CHR DefaultSearchKeyword: Default -> askwebs
CHR DefaultSuggestURL: Default -> hxxps://ss.search.ask.com/ss?li=ff&sstype=prefix&limit=10&hl=en&q={searchTerms}&enableSearch=true&rdrct=no
C:\Users\ordi\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbldcomffojmkkjbblhcebeicbncmjpf
C:\Users\ordi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmkambfpkcpoaalgilkfdgjenkjfhio
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [54736 2017-02-14] (SurfRight B.V. -> )
S3 MBAMFarflt; \??\C:\Windows\system32\drivers\farflt.sys [X]
S3 MBAMProtection; \??\C:\Windows\system32\drivers\mbam.sys [X]
emptytemp:
end::