@echo off
echo Function Enable-Privilege { > defowner.ps1
echo   param($Privilege) >> defowner.ps1
echo   $Definition = @' >> defowner.ps1
echo using System; >> defowner.ps1
echo using System.Runtime.InteropServices; >> defowner.ps1
echo public class AdjPriv { >> defowner.ps1
echo   [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] >> defowner.ps1
echo   internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, >> defowner.ps1
echo     ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr rele); >> defowner.ps1
echo   [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] >> defowner.ps1
echo   internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); >> defowner.ps1
echo   [DllImport("advapi32.dll", SetLastError = true)] >> defowner.ps1
echo   internal static extern bool LookupPrivilegeValue(string host, string name, >> defowner.ps1
echo     ref long pluid); >> defowner.ps1
echo   [StructLayout(LayoutKind.Sequential, Pack = 1)] >> defowner.ps1
echo   internal struct TokPriv1Luid { >> defowner.ps1
echo     public int Count; >> defowner.ps1
echo     public long Luid; >> defowner.ps1
echo     public int Attr; >> defowner.ps1
echo   } >> defowner.ps1
echo   internal const int SE_PRIVILEGE_ENABLED = 0x00000002; >> defowner.ps1
echo   internal const int TOKEN_QUERY = 0x00000008; >> defowner.ps1
echo   internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; >> defowner.ps1
echo   public static bool EnablePrivilege(long processHandle, string privilege) { >> defowner.ps1
echo     bool retVal; >> defowner.ps1
echo     TokPriv1Luid tp; >> defowner.ps1
echo     IntPtr hproc = new IntPtr(processHandle); >> defowner.ps1
echo     IntPtr htok = IntPtr.Zero; >> defowner.ps1
echo     retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES ^| TOKEN_QUERY, >> defowner.ps1
echo       ref htok); >> defowner.ps1
echo     tp.Count = 1; >> defowner.ps1
echo     tp.Luid = 0; >> defowner.ps1
echo     tp.Attr = SE_PRIVILEGE_ENABLED; >> defowner.ps1
echo     retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); >> defowner.ps1
echo     retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, >> defowner.ps1
echo       IntPtr.Zero); >> defowner.ps1
echo     return retVal; >> defowner.ps1
echo   } >> defowner.ps1
echo } >> defowner.ps1
echo '@ >> defowner.ps1
echo   $ProcessHandle = (Get-Process -id $pid).Handle >> defowner.ps1
echo   $type = Add-Type $definition -PassThru >> defowner.ps1
echo   $type[0]::EnablePrivilege($processHandle, $Privilege) >> defowner.ps1
echo } >> defowner.ps1
echo.  >> defowner.ps1
echo do {} until (Enable-Privilege SeTakeOwnershipPrivilege) >> defowner.ps1
echo $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey( >> defowner.ps1
echo   'SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions', >> defowner.ps1
echo   'ReadWriteSubTree', 'TakeOwnership') >> defowner.ps1
echo $owner = [Security.Principal.NTAccount]'Administrators' >> defowner.ps1
echo $acl = $key.GetAccessControl() >> defowner.ps1
echo $acl.SetOwner($owner) >> defowner.ps1
echo $key.SetAccessControl($acl) >> defowner.ps1
echo.  >> defowner.ps1
echo $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey( >> defowner.ps1
echo   'SOFTWARE\Microsoft\Windows Defender\Exclusions', >> defowner.ps1
echo   'ReadWriteSubTree', 'TakeOwnership') >> defowner.ps1
echo $owner = [Security.Principal.NTAccount]'Administrators' >> defowner.ps1
echo $acl = $key.GetAccessControl() >> defowner.ps1
echo $acl.SetOwner($owner) >> defowner.ps1
echo $key.SetAccessControl($acl) >> defowner.ps1

echo \registry\machine\SOFTWARE\Microsoft\Windows Defender\Exclusions[1 10] >> defperm.ini
echo \registry\machine\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions[1 10] >> defperm.ini
echo \registry\machine\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths[1 10] >> defperm.ini

Powershell.exe -executionpolicy remotesigned -File ./defowner.ps1
regini defperm.ini

del defowner.ps1
del defperm.ini

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "asf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "avi" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "bmp" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "btr" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "db" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "dbf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "dif" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "idx" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "jpg" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "ldb" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "ldf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "log" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mdf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mdw" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mdx" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mov" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mp2" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mp4" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "mxf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "ndx" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "omf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "rtin" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "sbf" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "ts" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v "wmv" /t REG_DWORD /d 0 /f"

Reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\XOS Technologies" /t REG_DWORD /d 0 /f"

pause