Start::
CloseProcesses:
CreateRestorePoint:
cmd: powershell Get-ComputerRestorePoint
Removeproxy:
Hosts:
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
SearchScopes: HKU\S-1-5-21-4048530393-2322815272-907176374-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {03cf0c9a-0e41-11eb-b80a-806e6f6e6963} - E:\DriverPackSolution.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {0c268523-2076-11eb-9658-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {0c2685ce-2076-11eb-9658-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {0c26861d-2076-11eb-9658-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {0c268714-2076-11eb-9658-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {0c268796-2076-11eb-9658-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {524b91d7-30ce-11eb-92a5-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {524b956c-30ce-11eb-92a5-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {a275d2c8-1c83-11eb-8453-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {a275d378-1c83-11eb-8453-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {a275d3d2-1c83-11eb-8453-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {a275d496-1c83-11eb-8453-e840f235cff2} - F:\AutoRun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {a275d503-1c83-11eb-8453-e840f235cff2} - F:\autorun.exe
HKU\S-1-5-21-4048530393-2322815272-907176374-1000\...\MountPoints2: {a275d565-1c83-11eb-8453-e840f235cff2} - F:\autorun.exe
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"BVTConsumer\"",Filter="__EventFilter.Name=\"BVTFilter\"::
WMI:subscription\__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99]
WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate]
ShortcutWithArgument: C:\Users\ibra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Applications Chrome\AliExpress.lnk -> C:\Program Files\Google\Chrome\Application\chrome_proxy.exe (Google LLC) -> --profile-directory=Default --app-id=kldgknjegghfgnflppnjfmbhcbidilne
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
cmd: netsh winsock reset
cmd: sfc /scannow
Emptytemp:
End::