The would be a proactive monitoring layer that ensures the "WAT-removed" state remains stable and invisible to the OS's self-repair mechanisms.
sppsvc.exe: It kills the software protection service and prevents it from restarting.%SystemRoot%\System32\spp\tokens\.Shell32.dll and related system files to eliminate the "Build 7601 – Windows is not genuine" text overlay on the desktop.: It makes the OS appear "Genuine" to the user, though it is technically just "un-activated" but silent. Critical Risks & Downsides Security Vulnerabilities RemoveWAT 2.2.6 -Windows 7-