c:\windows\system32\dtsgaincompensatordll64.dll

c:\windows\system32\hmapo.dll

c:\windows\system32\dtsgfxapo64.dll

c:\windows\system32\dtsgfxapons64.dll

c:\windows\system32\hmeq_voice.dll

c:\windows\system32\hmlimiter.dll

c:\windows\system32\dolbydax2apov201.dll

c:\windows\system32\ddpd64af3.dll

c:\windows\system32\dax3apov251.dll

c:\windows\system32\ddpo64a.dll

c:\windows\system32\ddpa64.dll

c:\windows\system32\r4eep64a.dll

c:\windows\system32\ddpp64af3.dll

c:\windows\system32\dolbydax2apoprop.dll

c:\windows\system32\hifidax2api.dll

c:\windows\system32\coneqmsapoguilibrary.dll

c:\windows\system32\audiolibvc.dll

c:\users\you have\downloads\frst.txt

c:\users\has\downloads\esetonlinescanner.exe

c:\programdata\sophos 2023-03-06 10:04 - 2023-03-06 10:04 - 000004032 _____ c:\windows\system32\tasks\postponedevicesetuptoast_s-1-5-21-1905558373-745742369-245519911-1001_8 2023-03-02 07:18 - 2023-03-02 07:18 - 000057890 _____ c:\users\has\downloads\fv_2023-03-02_07_17_41.pdf

c:\users\has\downloads\fv_2023-03-02_07_15_55.pdf

c:\users\your\downloads\fv_2023-02-17_09_48_21.pdf

c:\windows\system32\perfh015.dat

c:\windows\inf 2023-03-08 13:38 - 2020-10-22 14:38 - 000000006 ____h c:\windows\tasks\sa.dat

c:\windows\syswow64\abbakconfig.dat

c:\windows\system32\config\bbi 2023-03-08 12:58 - 2018-10-25 06:48 - 000000000 ____d c:\users\you\appdata\local\d3dscache 2023-03-08 12:57 - 2019-12-07 10:14 - 000000000 ___rd c:\windows\immersivecontrolpanel 2023-03-08 12:57 - 2019-12-07 10:14 - 000000000 ____d c:\windows\systemresources 2023-03-08 12:57 - 2019-12-07 10:14 - 000000000 ____d c:\windows\system32\oobe 2023-03-08 12:57 - 2019-12-07 10:14 - 000000000 ____d c:\windows\bcastdvr 2023-03-08 12:57 - 2019-12-07 10:14 - 000000000 ____d c:\windows\appreadiness 2023-03-08 12:52 - 2019-12-07 10:03 - 000000000 ____d c:\windows\cbstemp 2023-03-08 12:41 - 2017-07-17 08:10 - 000000000 ____d c:\windows\syswow64\rtcom 2023-03-08 11:50 - 2019-12-07 16:10 - 000000000 ____d c:\windows\system32\fxstmp 2023-03-08 11:50 - 2018-03-05 07:50 - 000000000 ____d c:\users\your\desktop\scan invoices 2023-03-08 11:43 - 2014-12-16 13:08 - 000000000 ____d c:\users\your\appdata\roaming\macrobase 2023-03-08 09:43 - 2017-06-07 07:14 - 000000000 ____d c:\programdata\aomeibr 2023-03-08 09:20 - 2017-06-07 07:14 - 000001024 ____h c:\systag.bin

c:\windows\system32\mrt.exe

c:\users\masz\desktop\sm attachment to rebates.xlsx

c:\windows\syswow64\printconfig.dll

onedrivesetup.exe

c:\program files\windowsapps\microsoft.mpeg

x64.dll

vcomp.dll

c:\program files\microsoft office 15\root\vfs\programfilesx64\microsoft office\office15\grooveex.dll

c:\windows\web\wallpaper\windows\img0.jpg

c:\macrologic\system\jterm\ miscw\jrew\bin\javaw.exe

c:\program files\microsoft office 15\root\office15\outlook.exe

c:\merit\system\jterm\ miscw\jrew\bin\javaw.exe

msedgewebview2.exe

thunderbird.exe

c:\users\you\appdata\roaming\10130.vbs

c:\users\have\appdata\roaming\1752.vbs

c:\users\have\appdata\roaming\9435.vbs

c:\users\you have\appdata\roaming\9784.vbs

c:\users\you have\appdata\roaming\9572.vbs

c:\users\you have\appdata\roaming\1896.vbs

com-1.pl

jpeg.exe

zubby.exe

zaplata_112020.jpeg

a1909296681c7acefe45687d3a64758c8659bf46

8.8.8.8

32.0.0.89

3.70.0.0

1.19.0.0

102.8.0.0

KB5001716

https://www.garneczki.pl

https://go.microsoft.com/fwlink/?linkid=37020&name=trojan:win32

HKLM\...\Run

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

HKLM\...\Print\Monitors\423SeriesPCL-8

HKLM\...\Print\Monitors\PDF-XChange5-ABBYY-FR

HKLM-x32

HKLM-x32\...\MP

HKLM\...\IrfanView64

HKLM-x32\...\Macrologic

HKLM\...\HomeBusinessRetail

HKLM\...\Microsoft

HKLM-x32\...\Mozilla

HKLM-x32\...\WinLiveSuite

HKU\S-1-5-21-1905558373-745742369-245519911-1001_Classes\CLSID

HKU\S-1-5-21-1905558373-745742369-245519911-1001\Control

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

microsoft.net

www.garneczki.pl

intel-webapi.intel.com

king.com

go.microsoft.com

detail.zip

explorer.exe

c:\program files\realtek\audio\hda\rtkngui64.exe

c:\windows\system32\igfxem.exe

dmwakeup.exe

services.exe

armsvc.exe

jhi_service.exe

c:\program files\intel\icls client\heciserver.exe

c:\program files\microsoft office 15\clientx64\officeclicktorun.exe

msmpeng.exe

lmsrvnt.exe

svchost.exe

phoneexperiencehost.exe

c:\windows\system32\smartscreen.exe

tiworker.exe

mfssecprt.exe

c:\windows\system32\panewm64.dll

c:\windows\system32\pcmfsfxlmon.dll

c:\users\masz\appdata\roaming\microsoft\windows\start menu\programs\startup\x.vbs

c:\windows\browserchoice\browserchoice.exe

adobearm.exe

google.pl

npctrl.dll

npintelwebapiipt.dll

c:\program files\microsoft office 15\root\office15\npspwrap.dll

c:\windows\system32\ambakdrv.sys

c:\windows\system32\amwrtdrv.sys

c:\windows\system32\drivers\bthhfenum.sys

c:\windows\system32\drivers\wd\wdboot.sys

c:\windows\system32\drivers\wd\wdnisdrv.sys

c:\windows\system32\yamahaae.dll

c:\windows\system32\sltech64.dll

c:\windows\system32\tosade.dll

c:\windows\system32\sl3apo64.dll

c:\windows\system32\tosasfapo64.dll

c:\windows\system32\srstsx64.dll

c:\windows\system32\toseaeapo64.dll

c:\windows\syswow64\srcom.dll

c:\windows\system32\srstsh64.dll

c:\windows\system32\srswow64.dll

c:\windows\system32\tepeqapo64.dll

c:\windows\system32\sfss_apo.dll

c:\windows\system32\secomn64.dll

c:\windows\syswow64\secomn32.dll

c:\windows\system32\rtlcpapi64.dll

c:\windows\system32\sfcom64.dll

c:\windows\syswow64\sfcom.dll

c:\windows\syswow64\rltkapo.dll

c:\windows\system32\rtdataproc64.dll

c:\windows\system32\rteep64a.dll

c:\windows\system32\rp3dht64.dll

c:\windows\system32\r4eel64a.dll

c:\windows\system32\rteel64a.dll

c:\windows\system32\r4eeg64a.dll

c:\windows\system32\dtss2speakerdll64.dll

c:\windows\system32\dtsboostdll64.dll

c:\windows\system32\dtsbassenhancementdll64.dll

c:\windows\system32\dtsvoiceclaritydll64.dll

c:\windows\system32\dtsneopcdll64.dll