CS0-003 Web TestEngine demo

Delete only the ransomware executable from the first affected host

Restore user files while keeping the compromised token active for monitoring

Block the original command server and assume all internal footholds are gone

Remove persistence, reset trust, and fix the exploited weakness