CloseProcesses:
CreateRestorePoint:
EmptyTemp:
HKU\S-1-5-21-3334915921-3535408841-3332393144-1003\...\MountPoints2: {c518636a-171a-11e8-9979-aced5cb07173} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-3334915921-3535408841-3332393144-1003\...\MountPoints2: {efb72ed1-6bb2-11e8-999e-f430b9a6ea7b} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-3334915921-3535408841-3332393144-1003\...\MountPoints2: {f3a92670-5eb3-11e8-999c-f430b9a6ea7b} - "G:\HiSuiteDownLoader.exe" 
Tcpip\..\Interfaces\{707683ca-2c05-470d-bc61-e2a285c6faf5}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{ac9c02ef-9e7f-4170-ad81-5ec7ff40eb8a}: [DhcpNameServer] 192.168.0.1
C:\ProgramData\Microsoft\Windows\GameExplorer\{47386638-2A30-4804-B563-BD94F542BD45}\PlayTasks\3\Revoke License.lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{47386638-2A30-4804-B563-BD94F542BD45}\PlayTasks\2\Benchmark GTA IV.lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{47386638-2A30-4804-B563-BD94F542BD45}\PlayTasks\1\Play (Safe Mode).lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{47386638-2A30-4804-B563-BD94F542BD45}\PlayTasks\0\Play.lnk
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
C:\Users\Marcin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> Brak pliku
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Brak pliku
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
CMD: ipconfig /flushdns