Run Commands

Hey Guys!

Can someone give me a list of run commands that scammers use a lot so i can re-root them in the System 32 folder? I have already re-rooted a few like syskey runs BonziBUDDY, CMD is the fake Anti Scammer Toolbar CMD, msinfo32 also runs the CMD. I have also disabled the Task manager and system info so if anyone could give me a list of what scammers use and could get details its a VM would be great. Thanks ?

Happy Scamming!

Event viewer.