start 
CloseProcesses:
CreateRestorePoint:
C:\Windows\KMS-R@1n.exe
HKLM-x32\...\Run: [] => [X]
FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension => not found
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-04-21]
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-05-15]
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-05-15]
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-05-15]
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-04-21]
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-05-15]
CHR Extension: (No Name) - C:\Users\DELL.CHRISTIAN.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-05-15]
CHR HKLM-x32\...\Chrome\Extension: [epanidpojhpngkkhhbdbddddiecogodf] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
R2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [26112 2016-03-25] () [File not signed]
U2 ERSvc; no ImagePath
FirewallRules: [{50B3C35E-279F-4618-AC96-47F8CFD2F080}] => (Allow) C:\Windows\KMS-R@1n.exe
FirewallRules: [{1001FF4B-FA59-4ABB-B706-F3BD01880BCC}] => (Allow) C:\Windows\KMS-R@1n.exe
FirewallRules: [{59ABAEA6-21DD-4A5E-956D-D0FB0B9BC474}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{E8D5C46E-7E33-4F28-99A7-00B82A389231}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe


EmptyTemp:
end