start::
closeprocesses:
createrestorepoint:
C:\Program Files\KMSpico
FirewallRules: [{3AA9A776-43C8-4F40-ADE7-4E73CD8AB229}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe => Pas de fichier
FirewallRules: [{74664C6C-CDC5-4ED8-B588-29D6F0BC6B2C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe => Pas de fichier
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
Task: {832CD762-AA09-4FF4-881A-78586C2EB8DB} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [740544 2015-11-01] (@ByELDI -> @ByELDI) [Fichier non signé]
Task: {2AA56BE9-3BD9-4271-910B-9600F1FD22A3} - System32\Tasks\Microsoft\Windows\termsrv\RemoteFX\RemoteFXvGPUDisableTask => %windir%\System32\RemoteFXvGPUDisablement.exe Disable (Pas de fichier)
Task: {2F00CBA9-FD28-4E1B-8830-E69BA3C62FED} - System32\Tasks\Microsoft\Windows\termsrv\RemoteFX\RemoteFXWarningTask => %windir%\System32\RemoteFXvGPUDisablement.exe Warning (Pas de fichier)
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
C:\Windows\SECOH-QAD.exe
C:\Windows\SECOH-QAD.dll
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=dword:00000001
EndRegedit:
emptytemp:
end::