jessica

START::
Task: {093747DF-12B6-421A-887E-08C6AEDA7404} - System32\Tasks\ZpEVDmIlefcqtj => rundll32 "C:\Program Files (x86)\ulQXJxdiHxSU2\iubiwSBgqMTtv.dll",#1
Task: {214DA309-B93A-4CA2-8B63-D1EBEA976A8B} - System32\Tasks\fNuIyawitAoDEGu2 => rundll32 "C:\Program Files (x86)\omepHXTcU\uiSgMt.dll",#1
ask: {7C16EB70-E5B3-41C6-9D90-15BCFCBBE3A7} - System32\Tasks\wgPoVvFawHYrCSXOC2 => rundll32 "C:\Program Files (x86)\PrRHHpsGxQEuyNXpirR\NhVVWjq.dll",#1
Task: {7DFB8387-310A-4B66-9B87-0FA4CE7D6C2D} - System32\Tasks\rNfsrCYQpNqfOcrfNNU2 => rundll32 "C:\Program Files (x86)\BayioKoEHcCpC\RJEmUKf.dll",#1
RemoveDirectory: C:\Program Files (x86)\ulQXJxdiHxSU2
RemoveDirectory: C:\Program Files (x86)\vsJnmafXoMUn
RemoveDirectory: C:\Program Files (x86)\PrRHHpsGxQEuyNXpirR
RemoveDirectory: C:\Program Files (x86)\omepHXTcU
RemoveDirectory: C:\Program Files (x86)\BayioKoEHcCpC
2022-05-13 13:50 - 2022-05-13 13:50 - 000248375 ___SH () C:\Users\Właściciel\AppData\Roaming\cvrberc
2022-05-13 13:50 - 2022-05-13 13:50 - 000042064 ___SH (Microsoft Corporation) C:\Users\Właściciel\AppData\Roaming\fietvws
EmptyEventLogs: 
HKU\S-1-5-18\...\Run: [] => [X]
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (Brak pliku)
HKLM-x32\...\Run: [Backup] => C:\Program Files (x86)\Wondershare\drfone\Addins\Backup\DrFoneBackup.exe /hide (Brak pliku)
HKLM\...\Run: [WSVCUUpdateHelper.exe] => C:\Program Files\Wondershare\UniConverter 13\WSVCUUpdateHelper.exe (Brak pliku)
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log:F107EE40EF [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log_backup1:2DD1EC5C91 [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer2.log:CCB2353F35 [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer2.log_backup1:0544EFE2DB [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer3.log:8A1F56CED6 [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer3.log_backup1:A473474DD2 [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer4.log:3B2EC2BDEF [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer4.log_backup1:DC5D04D24A [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer5.log:84BD5AAA09 [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer5.log_backup1:038079845B [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer6.log:4C1811BCCA [10]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer7.log:2C973AF0F1 [10]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [10]
FirewallRules: [TCP Query User{B1A6C29C-820D-46D7-8E4C-1E412E481957}C:\program files\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_51\bin\javaw.exe => Brak pliku
FirewallRules: [UDP Query User{17646151-8747-4BA9-8E57-BB8B554C807A}C:\program files\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_51\bin\javaw.exe => Brak pliku
FirewallRules: [TCP Query User{D3DE6175-A695-4FA0-9E4E-004E0797774D}C:\program files\epic games\gtav\gta5.exe] => (Block) C:\program files\epic games\gtav\gta5.exe => Brak pliku
FirewallRules: [UDP Query User{0B8661BC-1946-4002-A56C-563EDDE79F1A}C:\program files\epic games\gtav\gta5.exe] => (Block) C:\program files\epic games\gtav\gta5.exe => Brak pliku
FirewallRules: [TCP Query User{2FF5EF83-8968-4FA3-8DC5-516D224C6010}C:\program files\java\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_281\bin\javaw.exe => Brak pliku
FirewallRules: [UDP Query User{92115BD4-1717-4598-832D-1B08004CA0C1}C:\program files\java\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_281\bin\javaw.exe => Brak pliku
FirewallRules: [{8DDA269F-8D60-454E-856C-ADF9FB336BC2}] => (Allow) C:\Program Files (x86)\HackShield\launcher.exe => Brak pliku
FirewallRules: [{0C4C7300-61E9-42D0-B52A-099980651FCB}] => (Allow) C:\Program Files (x86)\HackShield\launcher.exe => Brak pliku
FirewallRules: [{F6E7A53F-965B-406B-985D-7A66EA69E085}] => (Allow) C:\Program Files (x86)\HackShield\client\1.8\1.8.9\HackShield.exe => Brak pliku
Task: {A5061DD0-6BAD-4767-9156-44B8939F72B3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler (Brak pliku)
Task: {B4370969-FEDE-4295-9452-027EF6CED26A} - System32\Tasks\AdLock Update Task-S-1-5-21-1154914137-4129568212-3990700504-1001 => "%WINDIR%\System32\msiexec.exe" /i "C:\Users\Właściciel\AppData\Local\Programs\AdLock\163f640756.msi" /quiet CHROME=1
Task: {BA776AB7-4BEC-4469-876B-153B4E4A96F8} - System32\Tasks\TaskbarX DESKTOP-M8N9LEJWłaściciel => explorer.exe taskbarx:"-tbs=3 -color=0;0;0;0 -tpop=0 -tsop=100 -as=elasticeaseinout -obas=cubiceaseinout -tbr=0 -asp=1000 -ptbo=0 -stbo=0 -lr=400 -oblr=400 -sr=0 -sr2=0 -sr3=0 -ftotc=1 -rzbt=1 -dtbsowm=1 "
AutoConfigURL: [{6FAD7336-3A26-4D51-BCD6-CF978C77D5BF}] => hxxp://35.236.159.79/win.pac <==== UWAGA
AutoConfigURL: [S-1-5-21-1154914137-4129568212-3990700504-1001] => hxxp://35.236.159.79/win.pac <==== UWAGA
S2 DFWSIDService; C:\Program Files (x86)\Wondershare\drfone\WsidService.exe [X]
S2 ElevationService; C:\Program Files (x86)\Wondershare\drfone\Addins\Recovery\ElevationService.exe [X]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 HPPrintScanDoctorService; "C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe" [X]
S2 Mobizen plugin; C:\Program Files (x86)\RSUPPORT\MobizenService\MobizenService.exe [X]
S4 VBoxGuest; VBoxGuest [X]
S4 VBoxMouse; VBoxMouse [X]
S4 VBoxService; VBoxService [X]
S4 VBoxSF; VBoxSF [X]
S4 VBoxVideo; VBoxVideo [X]
S4 VBoxWddm; VBoxWddm [X]
EmptyTemp:
END::

START::
Task: {86233FC3-A90A-4360-8C0D-8F3F2DAAA459} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {CEEECE0F-14D0-47CD-AE4A-47CA4DF0D28E} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
RemoveDirectory: C:\Users\48518\Downloads\FRST-OlderVersion
EmptyEventLogs: 
EmptyTemp:
END::

START::
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
HKU\S-1-5-21-614208263-3186417995-3815510634-1001\...\Run: [utweb] => "C:\Users\x\AppData\Roaming\uTorrent Web\utweb.exe" /MINIMIZED (Brak pliku)
HKU\S-1-5-21-614208263-3186417995-3815510634-1001\...\Run: [AdobeBridge] => [X]
Task: {1F4852D7-AC42-4E53-B26D-20CB4E5B0F03} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
S3 NMIndexingService; "C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
EmptyEventLogs:
EmptyTemp:
END::

==================== Konta użytkowników: =============================

(Załączenie wejścia w fixlist spowoduje jego usunięcie.)

Administrator (S-1-5-21-455781161-1035688843-1390599507-500 - Administrator - Disabled)
Gość (S-1-5-21-455781161-1035688843-1390599507-501 - Limited - Disabled)
Konto domyślne (S-1-5-21-455781161-1035688843-1390599507-503 - Limited - Disabled)
raf (S-1-5-21-455781161-1035688843-1390599507-1005 - Administrator - Enabled)
WDAGUtilityAccount (S-1-5-21-455781161-1035688843-1390599507-504 - Limited - Disabled)

START::
HKLM-x32\...\Run: [] => [X]
Unlock: HKLM\SYSTEM\ControlSet001\Services\MpKsl6e89fc6e
C:\Users\rafałkubiak\downloads\external-content.duckduckgo.com.jpg
Reboot:
END::

START::
Task: {78412279-4621-49EF-9DE0-2FF28DD177AA} - System32\Tasks\{9C106694-7543-4EE1-A42F-468CF5DF012A} => C:\Program Files (x86)\Origin Games\The Sims 3\Game\Bin\Sims3Launcher.exe (Brak pliku)
EmptyEventLogs:
EmptyTemp:
END::

START::
FF Extension: (DuckDuckGo Privacy Essentials) - C:\Users\RafałKubiak\AppData\Roaming\Mozilla\Firefox\Profiles\ke6sep4l.default-release\Extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi [2022-08-04]
C:\Users\RafałKubiak\AppData\Roaming\Mozilla\Firefox\Profiles\ke6sep4l.default-release\Extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi
Task: {6F0AF8D7-49F8-43C3-A03B-1BF98B8BCC75} - System32\Tasks\CorelUpdateHelperTask-D4F2250D57A03796C361945D6E693D65 => c:\Program Files (x86)\Corel\CUH\v2\CUH.exe -resume (Brak pliku)
Task: {781AD0B9-7305-44E5-9756-0FC305A7A3EE} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe --automatic (Brak pliku)
RemoveDirectory: C:\Users\RafałKubiak\Downloads\FRST-OlderVersion
EmptyEventLogs:
EmptyTemp:
END::

START::
FF ExtraCheck: C:\Program Files\mozilla firefox\bd_config.cfg [2020-12-01] <==== UWAGA
FF Plugin HKU\S-1-5-21-1702512430-1667816713-2583525857-1705: msview -> C:\windows\system32\npmsview.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-2951668450-138919431-2350860387-1001: msview -> C:\windows\system32\npmsview.dll [Brak pliku]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\bd_js_config.js [2020-12-01] <==== UWAGA (Linkuje do pliku *.cfg)
S3 ax_pvi; \??\c:\Program Files\HP\Sure Click\bin\ax_pvi.sys [X]
S3 QDrive; \??\C:\Users\B707D~1.OST\AppData\Local\Temp\QDrive.sys [X] <==== UWAGA
AV: Kaspersky Endpoint Security for Windows (Disabled - Up to date) {4F76F112-43EB-40E8-11D8-F7BD1853EA23}
FW: Kaspersky Endpoint Security for Windows (Disabled) {774D7037-0984-41B0-3A87-5E88E680AD58}
EmptyEventLogs:
EmptyTemp:
END::

START::
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ograniczenia <==== UWAGA
S2 HitmanPro38CrusaderBoot; "C:\Users\Mateusz\Desktop\HitmanPro_x64.exe" /crusader:boot [X]
C:\Users\Mateusz\AppData\Roaming\msregsvv.dll
AlternateDataStreams: C:\ProgramData:945BFEFAADF6C425 [1]
AlternateDataStreams: C:\Users\All Users:945BFEFAADF6C425 [1]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:945BFEFAADF6C425 [1]
EmptyEventLogs:
EmptyTemp:
END::

START::
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend]
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"==dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000000

EndRegedit:

HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-1108289569-963966695-2365604164-1000\...\Run: [ASRock A-Tuning] => [X]
HKU\S-1-5-21-1108289569-963966695-2365604164-1000\...\Run: [VScan] => C:\Users\Mateusz\AppData\Roaming\Microsoft\VScan.exe [409152 2021-02-03] () [Brak podpisu cyfrowego] <==== UWAGA
GroupPolicy: Ograniczenia ? <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
Task: {0C27D9C4-33C4-4212-9008-37AEB81D8D81} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (Brak pliku)
Task: {108610E4-ED20-481E-8A60-BDA8266D06BB} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (Brak pliku)
Task: {295CCA96-1298-44A2-BF43-ACB5FE6636E1} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -SqlLiteRecoveryTask (Brak pliku)
Task: {30EF0E39-EFB5-4B8E-B51D-DFC8ACA2A820} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (Brak pliku)
Task: {3789F4AA-46CF-4550-80AB-E6AF4F7924D5} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe -PvrSchedule (Brak pliku)
Task: {3C7F4418-776F-4F20-B55F-0819C7861B7F} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe -pscn 0 (Brak pliku)
Task: {4226AF7E-A84F-43FF-BDE4-F7072F3A1BC7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe /RestartRecording (Brak pliku)
Task: {49AA6B2D-1DA9-4DF8-9F45-72CFEEC4EE71} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -ObjectStoreRecoveryTask (Brak pliku)
Task: {58216583-27D4-4D62-9253-29C0B45C1E11} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -PvrRecoveryTask (Brak pliku)
Task: {698DF0AE-3A21-434B-9175-9EEC3829151C} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (Brak pliku)
Task: {81AA9806-216A-4228-95DA-0B0C76F6B58F} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoActivateWindowsSearch (Brak pliku)
Task: {88A4D914-8432-4F60-8870-50CF8E1F690A} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe /OCURActivate (Brak pliku)
Task: {8B0AD5C3-1404-4220-BF83-C6377EF52734} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (Brak pliku)
Task: {8CF06E3D-1625-4E0D-8B91-723C9DC653BA} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe /DoReindexSearchRoot (Brak pliku)
Task: {9532E561-1719-4EC5-A157-711ADEE487A5} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (Brak pliku)
Task: {B59B64F1-0F0D-41AC-AF84-2F9BE00D91F4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe $(Arg0) (Brak pliku)
Task: {B823AF58-453E-4D87-B4D7-B36A41722535} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -MediaCenterRecoveryTask (Brak pliku)
Task: {C99138B5-72F4-461C-85AE-F2A9F954083E} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe /DRMInit (Brak pliku)
Task: {CE110F17-8341-4E9A-BCCE-A18C2A63991C} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (Brak pliku)
Task: {D72B298D-4091-46A8-90A5-21DACE4A8AEB} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /PBDADiscovery (Brak pliku)
Task: {D83BF4AD-11AE-4E23-A16A-C61DF5455FAA} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (Brak pliku)
Task: {E2393490-C6C0-446D-BF58-EFD4F1012215} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe /StartRecording (Brak pliku)
S3 WinRing0_1_2_0; \??\C:\Users\Mateusz\AppData\Local\Temp\tmp3464.tmp [X] <==== UWAGA
C:\Users\Mateusz\AppData\Roaming\Microsoft\VScan.exe
HKU\S-1-5-21-1108289569-963966695-2365604164-1000\...\StartupApproved\Run: => "VScan"
EmptyEventLogs:
EmptyTemp:
END::

START::
HKLM-x32\...\Run: [StereoLinksInstall] => "C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstlink.exe" /install1 (Brak pliku)
Task: {39D50EB2-DB26-413E-A690-80A8E5783194} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe -runmode=checkupdate (Brak pliku)
AV: Kaspersky Anti-Virus (Disabled - Up to date) {4F76F112-43EB-40E8-11D8-F7BD1853EA23}
EmptyEventLogs:
EmptyTemp:
END::

START::
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-1842294854-3454898761-1950445386-1001\SOFTWARE\Classes\mscfile\shell\open\command]
""=-

[HKEY_USERS\S-1-5-21-1842294854-3454898761-1950445386-1001\SOFTWARE\Classes\mscfile\shell\open\command]
""="C:\WINDOWS\System32\rundll32.exe"
EndRegedit:

C:\Users\WALDEMAR\AppData\Roaming\GWGiyQ.inf
C:\Users\WALDEMAR\AppData\Roaming\hWaJxDFId.inf
C:\Users\WALDEMAR\AppData\Roaming\oBrJeUVm.inf
C:\Users\WALDEMAR\AppData\Roaming\swBg.dll
ProxyServer: [S-1-5-21-1842294854-3454898761-1950445386-1001] => 127.0.0.1:1080
Edge HomeButtonPage: HKU\S-1-5-21-1842294854-3454898761-1950445386-1001 -> hxxps://www.yandex.ru/?win=472&clid=2226560
FF Homepage: Mozilla\Firefox\Profiles\nahd6ha2.default -> hxxps://www.yandex.ru/?win=472&clid=2226560
FF SearchPlugin: C:\Users\WALDEMAR\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-20215113.xml [2021-01-13]
EmptyEventLogs:
EmptyTemp:
END::