CloseProcesses:
CreateRestorePoint:
EmptyTemp:
VirusTotal: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\start.cmd
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\start.cmd [2017-03-21] ()
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx