C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\10_BLOCK.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3516,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4012,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5284,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5428,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5440,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5864,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5672,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10_OBSOL.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\STARTDNS.cmd"

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG DNSCache START= auto

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE START DNSCache

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 START DNSCache

C:\Windows\SYSTEM32\ipconfig.exe

C:\Windows\SYSTEM32\IPCONFIG.EXE /flushdns

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.cmd"

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG DNSCache START= auto

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE START DNSCache

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 START DNSCache

C:\Windows\SYSTEM32\ipconfig.exe

C:\Windows\SYSTEM32\IPCONFIG.EXE /flushdns

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP DNSCache

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP DNSCache

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG DNSCache START= disabled

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.cmd"

C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE

ELEVATE.EXE E10BLOK.CMD

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD"

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\ELEVAT64.EXE" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\ELEVAT64.EXE" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\cacls.exe

"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GetAdm!.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.cmd"

C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE

ELEVATE.EXE E10BLOK.CMD

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD"

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\ELEVAT64.EXE" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\ELEVAT64.EXE" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\cacls.exe

"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GetAdm!.vbs"

C:\Users\Admin\AppData\Local\Temp\ELEVAT64.exe

"C:\Users\Admin\AppData\Local\Temp\ELEVAT64.exe"

C:\Users\Admin\AppData\Local\Temp\ELEVATE.exe

"C:\Users\Admin\AppData\Local\Temp\ELEVATE.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4084,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\E10BLOK.cmd"

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\ELEVAT64.EXE" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\E10BLOK.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\10_BLOCK.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\ELEVATE.EXE" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\ELEVAT64.EXE" /t REG_DWORD /d 1 /f

C:\Windows\system32\cacls.exe

"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP diagtrack

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP diagtrack

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE config diagtrack START= disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP diagnosticshub.standardcollector.service

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP diagnosticshub.standardcollector.service

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE config diagnosticshub.standardcollector.service START= disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP dmwappushservice

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP dmwappushservice

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE config dmwappushservice START= disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP RetailDemo

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP RetailDemo

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE config RetailDemo START= disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP Wecsvc

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP Wecsvc

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG Wecsvc START= disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP RemoteRegistry

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP RemoteRegistry

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG RemoteRegistry START= disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP OneSyncSvc

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP OneSyncSvc

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG OneSyncSvc START= disabled

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE add"HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc_Session1" /v "Start" /t REG_DWORD /d 4 /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\cacls.exe

C:\Windows\SYSTEM32\CACLS.EXE C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl /d SYSTEM

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger" /v "AutoLogger-Diagtrack-Listener" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger" /v "SQMLogger" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "RotatingLockScreenEnabled" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "RotatingLockScreenOverlayEnabled" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "AITEnable" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableUAR" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\WcmSvc\WifiNetworkManager" /v "WifiSenseCredShared" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\WcmSvc\WifiNetworkManager" /v "WifiSenseOpen" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /d 2 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "IncludeRecommendedUpdates" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "EnableFeaturedSoftware" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Policies\Microsoft\Office\15.0\OSM" /v "EnableFileObfuscation" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Policies\Microsoft\Office\16.0\OSM" /v "EnableFileObfuscation" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy" /v "EnableQueryRemoteServer" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Control\Diagnostics\Performance" /v "Disable Performance Counters" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\ScheduledDiagnostics" /v "EnabledExecution" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Services\DnsCache\Parameters" /v "MaxCacheTtl" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Services\DnsCache\Parameters" /v "MaxNegativeCacheTtl" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "LaunchTo" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v "DODownloadMode" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "link" /t REG_BINARY /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v "DisableFileSyncNGSC" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Application Experience\AitAgent" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Autochk\Proxy" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Maintenance\WinSAT" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\ActivateWindowsSearch" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\ConfigureInternetTimeService" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\DispatchRecoveryTasks" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\ehDRMInit" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\InstallPlayReady" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\mcupdate" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\MediaCenterRecoveryTask" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\OCURActivate" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\OCURDiscovery" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\PBDADiscovery" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\PBDADiscoveryW1" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\PBDADiscoveryW2" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\PvrRecoveryTask" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\PvrScheduleTask" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\RegisterSearch" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\ReindexSearchRoot" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\SqlLiteRecoveryTask" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Media Center\UpdateRecordPath" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\gwx\launchtrayprocess" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\gwx\refreshgwxconfig" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Setup\GWXTriggers\Time-5d" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\PI\Sqm-Tasks" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /DISABLE

C:\Windows\SYSTEM32\schtasks.exe

C:\Windows\SYSTEM32\SCHTASKS.EXE /change /TN "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /DISABLE

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\Gwx" /v "DisableGwx" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gwx.exe" /v "Debugger" /t REG_SZ /d "systray.exe" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ElevateNonAdmins" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DisableOSUpgrade" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade" /v "AllowOSUpgrade" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade" /v "ReservationsAllowed" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade\State" /v "OSUpgradeState" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade\State" /v "OSUpgradeStateTimeStamp" /t REG_SZ /d "2015-09-09 09:09:09" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AutoInstallMinorUpdates" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoRebootWithLoggedOnUsers" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAUAsDefaultShutdownOption" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Policies\Microsoft\Windows\DriverSearching" /v "DontSearchWindowsUpdate" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\DriverSearching" /v "SearchOrderConfig" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v "DisableFileSync" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v "DisableFileSyncNGSC" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM OneDrive.exe /T /F

C:\Windows\SYSTEM32\PING.EXE

C:\Windows\SYSTEM32\PING.EXE 127.0.0.1 -n 5

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /cusid:S-1-5-21-1337824034-2731376981-3755436523-1000

C:\Windows\SysWOW64\OneDriveSetup.exe

C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe

"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall

C:\Windows\SYSTEM32\PING.EXE

C:\Windows\SYSTEM32\PING.EXE 127.0.0.1 -n 5

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE delete "HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Internet Explorer\Geolocation" /v "BlockAllWebsites" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main" /v "EnableAutoUpgrade" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "EnableAutoUpgrade" /t REG_DWORD /d 0 /f

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_134.170.30.202" dir=out action=block remoteip=134.170.30.202 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_137.116.81.24" dir=out action=block remoteip=137.116.81.24 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_157.56.106.189" dir=out action=block remoteip=157.56.106.189 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_184.86.53.99" dir=out action=block remoteip=184.86.53.99 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_2.22.61.43" dir=out action=block remoteip=2.22.61.43 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_2.22.61.66" dir=out action=block remoteip=2.22.61.66 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_65.39.117.230" dir=out action=block remoteip=65.39.117.230 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_65.52.108.33" dir=out action=block remoteip=65.52.108.33 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_64.4.54.254" dir=out action=block remoteip=64.4.54.254 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_vortex.data.microsoft.com" dir=out action=block remoteip=191.232.139.254 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_telecommand.telemetry.microsoft.com" dir=out action=block remoteip=65.55.252.92 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_oca.telemetry.microsoft.com" dir=out action=block remoteip=65.55.252.63 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_sqm.telemetry.microsoft.com" dir=out action=block remoteip=65.55.252.93 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_watson.telemetry.microsoft.com" dir=out action=block remoteip=65.55.252.43,65.52.108.29 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_redir.metaservices.microsoft.com" dir=out action=block remoteip=194.44.4.200,194.44.4.208 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_choice.microsoft.com" dir=out action=block remoteip=157.56.91.77 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.7 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_reports.wes.df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.91 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_wes.df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.93 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_services.wes.df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.92 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_sqm.df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.94 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.9 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_watson.ppe.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.11 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_telemetry.appex.bing.net" dir=out action=block remoteip=168.63.108.233 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_telemetry.urs.microsoft.com" dir=out action=block remoteip=157.56.74.250 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_settings-sandbox.data.microsoft.com" dir=out action=block remoteip=111.221.29.177 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_vortex-sandbox.data.microsoft.com" dir=out action=block remoteip=64.4.54.32 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_survey.watson.microsoft.com" dir=out action=block remoteip=207.68.166.254 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_watson.live.com" dir=out action=block remoteip=207.46.223.94 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_watson.microsoft.com" dir=out action=block remoteip=65.55.252.71 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_statsfe2.ws.microsoft.com" dir=out action=block remoteip=64.4.54.22 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_corpext.msitadfs.glbdns2.microsoft.com" dir=out action=block remoteip=131.107.113.238 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_compatexchange.cloudapp.net" dir=out action=block remoteip=23.99.10.11 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_cs1.wpc.v0cdn.net" dir=out action=block remoteip=68.232.34.200 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_a-0001.a-msedge.net" dir=out action=block remoteip=204.79.197.200 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_statsfe2.update.microsoft.com.akadns.net" dir=out action=block remoteip=64.4.54.22 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_sls.update.microsoft.com.akadns.net" dir=out action=block remoteip=157.56.77.139 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_fe2.update.microsoft.com.akadns.net" dir=out action=block remoteip=134.170.58.121,134.170.58.123,134.170.53.29,66.119.144.190,134.170.58.189,134.170.58.118,134.170.53.30,134.170.51.190 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_diagnostics.support.microsoft.com" dir=out action=block remoteip=157.56.121.89 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_corp.sts.microsoft.com" dir=out action=block remoteip=131.107.113.238 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_statsfe1.ws.microsoft.com" dir=out action=block remoteip=134.170.115.60 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_pre.footprintpredict.com" dir=out action=block remoteip=204.79.197.200 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_i1.services.social.microsoft.com" dir=out action=block remoteip=104.82.22.249 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_feedback.windows.com" dir=out action=block remoteip=134.170.185.70 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_feedback.microsoft-hohm.com" dir=out action=block remoteip=64.4.6.100,65.55.39.10 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_feedback.search.microsoft.com" dir=out action=block remoteip=157.55.129.21 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_rad.msn.com" dir=out action=block remoteip=207.46.194.25 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_preview.msn.com" dir=out action=block remoteip=23.102.21.4 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_dart.l.doubleclick.net" dir=out action=block remoteip=173.194.113.220,173.194.113.219,216.58.209.166 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_ads.msn.com" dir=out action=block remoteip=157.56.91.82,157.56.23.91,104.82.14.146,207.123.56.252,185.13.160.61,8.254.209.254 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_a.ads1.msn.com" dir=out action=block remoteip=198.78.208.254,185.13.160.61 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_global.msads.net.c.footprint.net" dir=out action=block remoteip=185.13.160.61,8.254.209.254,207.123.56.252 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_az361816.vo.msecnd.net" dir=out action=block remoteip=68.232.34.200 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_oca.telemetry.microsoft.com.nsatc.net" dir=out action=block remoteip=65.55.252.63 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_reports.wes.df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.91 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_df.telemetry.microsoft.com" dir=out action=block remoteip=65.52.100.7 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_cs1.wpc.v0cdn.net" dir=out action=block remoteip=68.232.34.200 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_vortex-sandbox.data.microsoft.com" dir=out action=block remoteip=64.4.54.32 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_pre.footprintpredict.com" dir=out action=block remoteip=204.79.197.200 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_i1.services.social.microsoft.com" dir=out action=block remoteip=104.82.22.249 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_ssw.live.com" dir=out action=block remoteip=207.46.101.29 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_statsfe1.ws.microsoft.com" dir=out action=block remoteip=134.170.115.60 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_msnbot-65-55-108-23.search.msn.com" dir=out action=block remoteip=65.55.108.23 enable=yes

C:\Windows\SYSTEM32\netsh.exe

C:\Windows\SYSTEM32\NETSH.EXE advfirewall firewall add rule name="telemetry_a23-218-212-69.deploy.static.akamaitechnologies.com" dir=out action=block remoteip=23.218.212.69 enable=yes

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Policies" /v "LongPathsEnabled" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "LongPathsEnabled" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{48981759-12F2-42A6-A048-028B3973495F}Machine\System\CurrentControlSet\Policies" /v "LongPathsEnabled" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\takeown.exe

C:\Windows\SYSTEM32\TAKEOWN.EXE /f "C:\Windows\SYSTEM32\DRIVERS\ETC" /r /d y

C:\Windows\SYSTEM32\icacls.exe

C:\Windows\SYSTEM32\ICACLS.EXE "C:\Windows\SYSTEM32\DRIVERS\ETC" /grant:r Admin:F Administrators:F SYSTEM:F "Authenticated Users":F /t /c /q

C:\Windows\SYSTEM32\attrib.exe

C:\Windows\SYSTEM32\ATTRIB.EXE /D /S -A -H -R -S -I "C:\Windows\SYSTEM32\DRIVERS\ETC\*.*"

C:\Windows\SYSTEM32\attrib.exe

C:\Windows\SYSTEM32\ATTRIB.EXE /S +A -H -R -S -I "C:\Windows\SYSTEM32\DRIVERS\ETC\*.*"

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0001.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0002.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0003.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0004.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0005.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0006.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0007.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0008.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a-0009.a-msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a.ads1.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a.ads2.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a.ads2.msads.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "a.rad.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ac3.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ad.doubleclick.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ads.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ads1.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ads1.msads.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "adnexus.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "adnxs.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "aidps.atdmt.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "aka-cdn-ns.adtech.de" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "apps.skype.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "az361816.vo.msecnd.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "az512334.vo.msecnd.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "b.ads1.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "b.ads2.msads.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "b.rad.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "bs.serving-sys.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "c.atdmt.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "c.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "cdn.atdmt.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "cds26.ams9.msecn.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "choice.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "choice.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "compatexchange.cloudapp.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "corpext.msitadfs.glbdns2.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "cdnjs.cloudflare.com.cdn.cloudflare.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "cs1.wpc.v0cdn.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "cdp1.public-trust.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "corp.sts.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "db3aqu.atdmt.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "df.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "diagnostics.support.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "e2835.dspb.akamaiedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "e8218.ce.akamaiedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "e7341.g.akamaiedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "e7502.ce.akamaiedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ec.atdmt.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "feedback.windows.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "feedback.microsoft-hohm.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "feedback.search.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "fe2.update.microsoft.com.akadns.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "fe2.ws.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "flex.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "g.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "h1.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "hostedocsp.globalsign.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "i1.services.social.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "i1.services.social.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "li581-132.members.linode.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "lb1.www.ms.akadns.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "live.rads.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "m.adnxs.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "m.hotmail.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "msedge.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "msftncsi.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "msnbot-65-55-108-23.search.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "msntest.serving-sys.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "oca.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "oca.telemetry.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "pre.footprintpredict.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "preview.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "pricelist.skype.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "rad.live.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "rad.msn.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "redir.metaservices.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "reports.wes.df.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "s.gateway.messenger.live.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "schemas.microsoft.akadns.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "secure.adnxs.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "secure.flashtalking.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "services.wes.df.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "settings-win.data.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "settings-sandbox.data.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "sls.update.microsoft.com.akadns.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "sO.2mdn.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "sqm.df.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "sqm.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "sqm.telemetry.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "static.2mdn.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "statsfe1.ws.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "statsfe2.ws.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "statsfe2.update.microsoft.com.akadns.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "survey.watson.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "telecommand.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "telecommand.telemetry.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "telemetry.appex.bing.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "telemetry.appex.bing.net:443" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "telemetry.urs.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "ui.skype.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "view.atdmt.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "vortex-bn2.metron.live.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "vortex-cy2.metron.live.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "vortex.data.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "vortex-win.data.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "vortex-sandbox.data.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "watson.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "watson.telemetry.microsoft.com.nsatc.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "wes.df.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "watson.ppe.telemetry.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "watson.live.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "watson.microsoft.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "www.go.microsoft.akadns.net" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\find.exe

C:\Windows\SYSTEM32\FIND.EXE /C /I "www.msftncsi.com" C:\Windows\SYSTEM32\DRIVERS\ETC\HOSTS

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM GWX.exe /T /F

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM GWXUXWorker.exe /T /F

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM GWXConfigManager.exe /T /F

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM consent.exe /T /F

C:\Windows\SYSTEM32\takeown.exe

C:\Windows\SYSTEM32\TAKEOWN.EXE /f "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy" /r /d y

C:\Windows\SYSTEM32\icacls.exe

C:\Windows\SYSTEM32\ICACLS.EXE "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy" /grant:r Administrators:F /t /c /q

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM ShellExperienceHost.exe /T /F

C:\Windows\SYSTEM32\takeown.exe

C:\Windows\SYSTEM32\TAKEOWN.EXE /f "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy" /r /d y

C:\Windows\SYSTEM32\icacls.exe

C:\Windows\SYSTEM32\ICACLS.EXE "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy" /grant:r Administrators:F /t /c /q

C:\Windows\SYSTEM32\taskkill.exe

C:\Windows\SYSTEM32\TASKKILL.EXE /IM SearchUI.exe /T /F

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:971033 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:2952664 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:2990214 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3012973 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3021917 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3022345 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3035583 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3044374 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3068708 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3075249 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3080149 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3112343 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3083711 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3083325 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3075853 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3072318 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3065988 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3064683 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3058168 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3050267 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:2976978 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:2977759 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3081954 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3123862 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3138612 /quiet /norestart

C:\Windows\SYSTEM32\wusa.exe

C:\Windows\SYSTEM32\WUSA.EXE /uninstall /KB:3172605 /quiet /norestart

C:\Windows\system32\timeout.exe

TIMEOUT /T 5 /NOBREAK

C:\Users\Admin\AppData\Local\Temp\ELEVAT64.exe

"C:\Users\Admin\AppData\Local\Temp\ELEVAT64.exe"

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.cmd"

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_SZ /d "RUNASADMIN" /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STOP!DNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\reg.exe

C:\Windows\SYSTEM32\REG.EXE ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /v "C:\Users\Admin\AppData\Local\Temp\STARTDNS.CMD" /t REG_DWORD /d 1 /f

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG DNSCache START= auto

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE START DNSCache

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 START DNSCache

C:\Windows\SYSTEM32\ipconfig.exe

C:\Windows\SYSTEM32\IPCONFIG.EXE /flushdns

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"

C:\Windows\SYSTEM32\net.exe

C:\Windows\SYSTEM32\NET.EXE STOP DNSCache

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 STOP DNSCache

C:\Windows\SYSTEM32\sc.exe

C:\Windows\SYSTEM32\SC.EXE CONFIG DNSCache START= disabled

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10_BLOCK.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10_OBSOL.vbs"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8