Attention: We have transitioned to a new AAD or Microsoft Entra ID from the week of May 20, 2024. In case your tenant requires admin consent, please refer to this document located at Overview of user and admin consent - Microsoft Entra ID | Microsoft Learn and grant access to App ID: 6ba09155-cb24-475b-b24f-b4e28fc74365 with graph permissions for Directory.Read.All and User.Read for continued access. While the app may appear unverified, you can confirm its legitimacy by verifying the App ID provided.
You should also run a full scan. A full scan might find hidden malware.
Use cloud protection
The Microsoft Active Protection Service (MAPS) uses cloud protection to help guard against the latest malware threats. It’s turned on by default for Microsoft Security Essentials and Windows Defender for Windows 10.
In subkey: HKLM\System\CurrentControlSet\Control\Session Manager Sets value: "PendingFileRenameOperations" With data: "c:\users\admini~1\appdata\local\temp\bfa9c<eos>"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\Pqrstu Bcdefghi Klm Sets value: "Description" With data: "pqrstu bcdefghi klmnopqr tuab"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance Sets value: "First Counter" With data: "0x00001e2a"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance Sets value: "First Help" With data: "0x00001e2b"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance Sets value: "Last Counter" With data: "0x00001ed0"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance Sets value: "Last Help" With data: "0x00001ed1"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance Sets value: "Object List" With data: "7722 7728 7738 7748 7768 7812 7822 7860 7866 7882"
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance Sets value: "PerfIniFile" With data: "wmiaprpl.ini"
