Start::
CreateRestorePoint:
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
FF Notifications: Mozilla\Firefox\Profiles\yapsf61k.default -> hxxps://medicinec-news.net
CHR Notifications: Default -> hxxps://33102.alexsoff.com; hxxps://58208.alexsoff.com; hxxps://a-zaim.com; hxxps://argomax-rf-ru.spacepush.ru; hxxps://borisof.site; hxxps://deposit-protection.com; hxxps://dodopizza.ru; hxxps://first-bank.ru; hxxps://leo.cash; hxxps://login.sendpulse.com; hxxps://moybiznes.club; hxxps://msg.push4me.ru; hxxps://notifyday.com; hxxps://www.facebook.com; hxxps://www.searchengines.ru
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=821272"
CHR DefaultSearchKeyword: Default -> mcafee
CHR HKU\S-1-5-21-2627650050-1078057636-3999159325-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ibknafobnmndicojahlppolcaaibngjf]
2020-09-07 11:43 - 2020-01-04 03:07 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVG
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
AlternateDataStreams: C:\ProgramData\TEMP:41ADDB8A [145]
AlternateDataStreams: C:\ProgramData\TEMP:A064CECC [141]
AlternateDataStreams: C:\Users\kolyan\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\kolyan\Application Data:fbd50e2f7662a5c33287ddc6e65ab5a1 [394]
FirewallRules: [{08A204DB-7A73-4CED-89DE-2201A5B6EEEE}] => (Allow) C:\Users\kolyan\AppData\Roaming\BitTorrent\BitTorrent.exe => No File
FirewallRules: [{5A56684D-FA0B-4583-85B6-644B5634C56D}] => (Allow) C:\Users\kolyan\AppData\Roaming\BitTorrent\BitTorrent.exe => No File
CMD: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer
Reboot:
End::