start::
closeprocesses:
createrestorepoint:
virustotal: C:\Users\N ZEBAZE\AppData\Roaming\DRPSu\DrvUpdater.exe
C:\Users\N ZEBAZE\AppData\Roaming\DRPSu
2021-02-20 08:16 - 2011-04-14 01:38 - 000000000 ___HD C:\boots
HKU\S-1-5-21-725134468-1706680386-3302500958-1000\...\Run: [DrvUpdater] => C:\Users\N ZEBAZE\AppData\Roaming\DRPSu\DrvUpdater.exe [195256 2012-12-23] (Kuzyakov Artur Vyacheslavovich IP -> )
HKU\S-1-5-21-725134468-1706680386-3302500958-1000\...\MountPoints2: {4d870530-a930-11ea-a0a7-0022fb05f74a} - H:\.\Setup.exe AUTORUN=1
HKU\S-1-5-21-725134468-1706680386-3302500958-1000\...\MountPoints2: {5e84f290-a776-11ea-bbd7-002170e19f37} - H:\AutoRun.exe
HKU\S-1-5-21-725134468-1706680386-3302500958-1000\...\MountPoints2: {ae40cb08-a730-11ea-83f4-0022fb05f74a} - H:\AutoRun.exe
HKU\S-1-5-21-725134468-1706680386-3302500958-1000\...\MountPoints2: {ae40cb14-a730-11ea-83f4-002170e19f37} - H:\AutoRun.exe
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll [2013-02-27] (Adobe Systems Incorporated -> )
cmd: ipconfig /flushdns
emptytemp:
end::