CreateRestorePoint:
CloseProcesses:
2021-09-02 18:44 - 2021-09-02 18:44 - 000000000 ____D C:\WINDOWS\system32\Tasks\Avira
2021-09-02 19:01 - 2015-07-09 07:25 - 000000000 ____D C:\Program Files (x86)\Avira
2021-09-02 18:46 - 2021-04-29 17:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2021-09-02 18:46 - 2014-07-19 08:06 - 000000000 ____D C:\ProgramData\Avira

StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000000
"DisableBehaviorMonitoring"=dword:00000000
"DisableOnAccessProtection"=dword:00000000
"DisableScanOnRealtimeEnable"=dword:00000000
"DisableAntiVirus"=dword:00000000

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet]
"SubmitSamplesConsent"=-
"SpyNetReporting"=-

[-HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableRealtimeMonitoring"=-
 EndRegedit:
GroupPolicyUsers\S-1-5-21-3110098909-1101332020-947144772-1004\User: Restriction <==== ATTENTION
GroupPolicyUsers\S-1-5-21-3110098909-1101332020-947144772-1001\User: Restriction <==== ATTENTION

c:\windows\temp\*.*
C:\Users\to\AppData\Local\Temp\*.* 
C:\Windows\SoftwareDistribution\Download\*
EmptyTemp: