CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-1661028992-1607426224-620655208-18616\...\Run: [TIAPortalCloudConnector] => [X]
HKU\S-1-5-21-1661028992-1607426224-620655208-18616\...\MountPoints2: {86f44148-e3cc-11e7-9624-f894c2082d42} - "G:\Start.exe" 
HKU\S-1-5-21-1661028992-1607426224-620655208-18616\...\MountPoints2: {9a08aaab-e010-11e7-95fc-f894c2082d42} - "F:\Start.exe" 
Tcpip\..\Interfaces\{144fd59a-1af4-4d4b-82d8-fb3c2a48664d}: [NameServer] 192.168.10.4
Tcpip\..\Interfaces\{249db7c9-c93c-4bf7-840e-e2f4200607f9}: [NameServer] 192.168.10.4,192.168.1.1,8.8.8.8,213.199.225.14
Tcpip\..\Interfaces\{249db7c9-c93c-4bf7-840e-e2f4200607f9}: [DhcpNameServer] 192.168.1.1 8.8.8.8 213.199.225.14
Tcpip\..\Interfaces\{8e3baa83-e0be-4a5b-a011-9858307f86ae}: [NameServer] 192.168.10.4
HKU\S-1-5-21-1661028992-1607426224-620655208-18616\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell17win10.msn.com/?pc=DCTE
HKU\S-1-5-21-1661028992-1607426224-620655208-18616\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\S-1-5-21-1661028992-1607426224-620655208-18616 -> {9E19A7AC-E860-4736-ABA0-FF2F692257B4} URL = 
C:\Users\user\Desktop\aoe2\Support\The Conquerors - MFill.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - MSync.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - NoMusic.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - NormalMouse.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - NoSC.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - NoSound.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - NoStartup.lnk
C:\Users\user\Desktop\aoe2\Support\The Conquerors - NoTerrainSound.lnk
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberGhost 6.lnk
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram.lnk
C:\Users\Precision3520\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Brak pliku
EmptyTemp:
CMD: ipconfig /flushdns
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}