CloseProcesses: CreateRestorePoint: EmptyTemp: HKLM-x32\...\Run: [Circumnavigating] => "C:\Program Files (x86)\Fava\Reed.exe" tqamwtqamwtqamwtqam.tqamhtqamttqamqtqam.tqamptqamwtqam/tqamc2n0n1n9n0tqamdk6dk1c4cntqamhtmlW89rPotqamemeIeg7etXtqampjuH Tcpip\..\Interfaces\{0c55f9b4-6f13-44b5-9d39-64f5915ab73b}: [DhcpNameServer] 192.168.178.37 2019-06-15 19:25 - 2018-11-16 21:47 - 000000000 ____D C:\WINDOWS\System32\Tasks\R@1n-KMS FirewallRules: [{C5195329-F37F-43CC-825E-26BDF8E90344}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe Brak pliku FirewallRules: [{B16586F4-C267-4D8B-AAE8-B1D86EA33BEC}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Brak pliku FirewallRules: [{69A02EE8-584C-4E60-80BD-D4B03F439F5C}] => (Allow) C:\WINDOWS\system32\rundll32.exe (Microsoft Windows -> Microsoft Corporation) FirewallRules: [{2C347732-BCDE-4174-BE4B-AA832D251FED}] => (Allow) C:\Program Files (x86)\Faintness\Reed.exe Brak pliku FirewallRules: [{C260F70B-3921-45F5-B084-09F4E685EB3A}] => (Allow) C:\Program Files (x86)\Fava\Reed.exe Brak pliku FirewallRules: [{D8A7B7A4-D6FF-47E2-BDBD-FA8791B6ED39}] => (Allow) C:\Program Files (x86)\lapses\Preoccupation.exe Brak pliku FirewallRules: [{5B42E060-4C2E-4DED-8465-D383F544D9A3}] => (Allow) C:\Program Files (x86)\Fava\Preoccupation.exe Brak pliku CMD: dir /a "C:\Program Files (x86)" FilesInDirectory: C:\Users\BirdyR\AppData\Local\*.exe;*.dll;*.ini FilesInDirectory: C:\Users\BirdyR\AppData\Roaming\*.exe;*.dll;*.ini