start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKU\S-1-5-21-2329423879-699262184-2287041894-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr
CHR HKLM\...\Chrome\Extension: [bhdinjalofclbacjijgifpahcnjapclb]
CHR HKLM\...\Chrome\Extension: [pfnciekpafndamlomnebbfophenfehbc]
CHR HKU\S-1-5-21-2329423879-699262184-2287041894-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bhdinjalofclbacjijgifpahcnjapclb]
CHR HKU\S-1-5-21-2329423879-699262184-2287041894-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pfnciekpafndamlomnebbfophenfehbc]
S3 dg_ssudbus; \SystemRoot\system32\DRIVERS\ssudbus.sys [X]
S3 ssudmdm; \SystemRoot\system32\DRIVERS\ssudmdm.sys [X]
SearchScopes: HKU\S-1-5-21-2329423879-699262184-2287041894-1001 -> DefaultScope {bce42d98-b1cd-493f-a64c-107aae7521be} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-7230d19c9876c516&q=
SearchScopes: HKU\S-1-5-21-2329423879-699262184-2287041894-1001 -> {bce42d98-b1cd-493f-a64c-107aae7521be} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-7230d19c9876c516&q=
SearchScopes: HKU\S-1-5-21-2329423879-699262184-2287041894-1001 -> {e5badea7-e1c2-fbf1-87ac-061d1440d15b} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
HKU\S-1-5-21-2329423879-699262184-2287041894-1001\...\StartupApproved\Run: => "Chromium"
EmptyTemp:
cmd: ipconfig /flushdns
cmd: netsh winsock reset
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-image /Restorehealth
end::