Start::
CreateRestorePoint:
CloseProcesses:
Task: {0BE7ED79-C834-4869-B043-156B0914ECB6} - System32\Tasks\Potelacah\{4BAA4907-A87E-BAD1-1D2A-1209E20EEE68} => C:\Users\vanhi\AppData\Roaming\Rosasufogoca\Potelacah.exe [2371072 2013-04-15] () [Bestand niet getekend]
CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
2019-12-16 16:18 - 2019-12-16 16:19 - 000000000 ____D C:\Users\vanhi\AppData\Local\chromium
C:\Users\vanhi\AppData\Local\{881BBE47-ACB3-D2FF-C12B-F717E5430B8F}
2019-12-16 16:18 - 2019-12-16 16:18 - 000002441 _____ C:\Users\vanhi\Desktop\Goodgame Empire.lnk
2019-12-16 16:18 - 2019-12-16 16:18 - 000001366 _____ C:\Users\vanhi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HowToRemove.lnk
2019-12-16 16:18 - 2019-12-16 16:18 - 000000000 ____D C:\WINDOWS\system32\Tasks\Potelacah
2019-12-16 16:18 - 2019-12-16 16:18 - 000000000 ____D C:\Users\vanhi\AppData\Roaming\Rosasufogoca
2019-12-16 16:18 - 2019-12-16 16:18 - 000000000 ____D C:\Users\vanhi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Goodgame Empire
2019-12-16 16:18 - 2019-12-16 16:18 - 000000000 ____D C:\Users\vanhi\AppData\Roaming\Goodgame Empire
C:\ProgramData\{8E3BB207-A613-CA7F-FE4B-E25716A33A8F}
2019-12-16 16:07 - 2019-12-16 16:07 - 000590136 _____ (Reimage) C:\Users\vanhi\Downloads\ReimageRepair.exe
2019-12-16 16:07 - 2019-12-16 16:07 - 000000099 _____ C:\WINDOWS\Reimage.ini
EmptyTemp:
End::