start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
Task: {2D91188D-1E5B-4212-916A-E99D2549D2F6} - System32\Tasks\R@1n-KMS\Windows64Professional => wmic path SoftwareLicensingProduct where (ID="2de67392-b7a7-462a-b1ca-108dd189f588") call Activate
S2 wtfast.Service; C:\Program Files (x86)\WTFast\service\wtfast.Service.exe [102912 2018-02-21]
2020-09-22 14:31 - 2020-09-22 14:31 - 000000000 ____D C:\WINDOWS\system32\Tasks\R@1n-KMS
FirewallRules: [{41266141-5EB8-4760-94AA-982123F73A53}] => (Allow) C:\Windows\KMS-R@1n.exe => No File
FirewallRules: [{832C3E12-54C0-47E2-A64F-835A7F8D443B}] => (Allow) C:\Windows\KMS-R@1n.exe => No File
EmptyTemp:
cmd: ipconfig /flushdns
cmd: netsh winsock reset
cmd: DISM /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
end::