RIP Win7. You did what no other Windows could do. You had functioning components.

Unfortunately the machines that get infected are not fully controlled by us but they get networking and internet from us (space rental in the building), so we isolate them as much as possible and we black hole all the bad traffic on the router level.

Our machines all have EDR and strict security policies. Not much gets past that.

We are seeing on our corporate network lots of browser hikackers that connect to c&c and are used in botnet DDOS as a service. Once you install x software it sets up a persistent service that keeps modding chrome.exe etc

Firewalling the .exe that you installed does nothing to stop the calls to c&c