C:\Users\gosia\AppData\Local\Temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll it was this little blighter, a new detection in combofix. Which was why I asked you to get a new copy, the file is a legitimate name but the location is not
Any further alerts ?