﻿<?xml version="1.0" encoding="utf-8"?>
<KaseyaImport>
  <Reports>
    <Report ReportInstanceId="796174431171349" PartitionId="1" ReportId="0" ReportTypeId="5" Name="XMR (Log)" Title="Wanna Cry Report v2" OutputType="PDF" Orientation="Portrait" PageSize="Letter" DefaultSubject="" DefaultMessage="" RequiresApproval="False" HideHeader="N" HasTemporals="True" CoverDefinitionId="-1" FooterDefinitionId="-1" HeaderDefinitionId="-1" StandardReportId="" StandardReportName="" Description="" treeFullPath="myReports - Administrator.XMR" sortOrder="-1" Override="0">
      <Parameters />
      <ParametersGridValue />
      <ReportDataSetInstances>
        <ReportDataSetInstance Name="XMR" ObjectTypeID="0" Row="0" Column="0" ColSpan="2">
          <SerializedObject>PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTE2Ij8+PERhdGFQYXJ0VGFibGUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeG1sbnM6eHNkPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSI+PFNlcmlyYWxpemVkT2JqZWN0IC8+PGRhdGFQYXJ0T2JqVHlwZT5UYWJsZTwvZGF0YVBhcnRPYmpUeXBlPjxQYWdlQnJlYWs+Tm9QYWdlQnJlYWs8L1BhZ2VCcmVhaz48VGl0bGU+WE1SPC9UaXRsZT48U2hvd1RpdGxlT25SZXBvcnQ+dHJ1ZTwvU2hvd1RpdGxlT25SZXBvcnQ+PERlc2NyaXB0aW9uIC8+PFRpdGxlQWxpZ25tZW50PkxlZnQ8L1RpdGxlQWxpZ25tZW50PjxEYXRhc2V0SWQ+OTIwMDQ8L0RhdGFzZXRJZD48U2VsZWN0ZWRDb2x1bW5zPjxEYXRhc2V0SW5zdGFuY2VTZWxlY3RlZENvbHVtbj48SWQ+OTIwMDQwMDI8L0lkPjxDb2x1bW4+Q29tcHV0ZXIgTmFtZTwvQ29sdW1uPjxBbGlhcyAvPjxBZ2dyZWdhdGU+MDwvQWdncmVnYXRlPjxXZWlnaHQ+MTA8L1dlaWdodD48UmVnaXN0cmF0aW9uSWQ+MDwvUmVnaXN0cmF0aW9uSWQ+PENvbHVtbkFsaWdubWVudD5MZWZ0PC9Db2x1bW5BbGlnbm1lbnQ+PC9EYXRhc2V0SW5zdGFuY2VTZWxlY3RlZENvbHVtbj48RGF0YXNldEluc3RhbmNlU2VsZWN0ZWRDb2x1bW4+PElkPjkyMDA0MDExPC9JZD48Q29sdW1uPlByb2NlZHVyZSBTdGVwIERlc2NyaXB0aW9uPC9Db2x1bW4+PEFsaWFzIC8+PEFnZ3JlZ2F0ZT4wPC9BZ2dyZWdhdGU+PFdlaWdodD4xMDwvV2VpZ2h0PjxSZWdpc3RyYXRpb25JZD4wPC9SZWdpc3RyYXRpb25JZD48Q29sdW1uQWxpZ25tZW50PkxlZnQ8L0NvbHVtbkFsaWdubWVudD48L0RhdGFzZXRJbnN0YW5jZVNlbGVjdGVkQ29sdW1uPjwvU2VsZWN0ZWRDb2x1bW5zPjxIZWlnaHQ+MDwvSGVpZ2h0PjxIZWlnaHRVbml0PlBvaW50czwvSGVpZ2h0VW5pdD48V2lkdGg+MDwvV2lkdGg+PFdpZHRoVW5pdD5Qb2ludHM8L1dpZHRoVW5pdD48RGF0ZUZpbHRlckNvbHVtbj45MjAwNDAwOTwvRGF0ZUZpbHRlckNvbHVtbj48VGltZVJhbmdlVHlwZT45PC9UaW1lUmFuZ2VUeXBlPjxOdW1iZXJPZkRheXM+MTwvTnVtYmVyT2ZEYXlzPjxDdXN0b21TdGFydERhdGVUaW1lPjIwMTctMDUtMTdUMTQ6MzQ6NDQtMDQ6MDA8L0N1c3RvbVN0YXJ0RGF0ZVRpbWU+PEN1c3RvbUVuZERhdGVUaW1lPjIwMTctMDUtMThUMTQ6MzQ6NDQtMDQ6MDA8L0N1c3RvbUVuZERhdGVUaW1lPjxSb3dMaW1pdFR5cGU+LTE8L1Jvd0xpbWl0VHlwZT48Um93TGltaXQ+MDwvUm93TGltaXQ+PEFkdmFuY2VkRmlsdGVycz48RGF0YXNldEluc3RhbmNlRmlsdGVyPjxBZHZhbmNlZEZpbHRlckZpZWxkPjkyMDA0MDExPC9BZHZhbmNlZEZpbHRlckZpZWxkPjxBZHZhbmNlZEZpbHRlck9wZXJhdG9yPkxpa2U8L0FkdmFuY2VkRmlsdGVyT3BlcmF0b3I+PEFkdmFuY2VkRmlsdGVyVmFsdWU+U3lzdGVtIEFmZmVjdGVkPC9BZHZhbmNlZEZpbHRlclZhbHVlPjxSZWdpc3RyYXRpb25JZD4wPC9SZWdpc3RyYXRpb25JZD48L0RhdGFzZXRJbnN0YW5jZUZpbHRlcj48L0FkdmFuY2VkRmlsdGVycz48U2VsZWN0RGlzdGluY3Q+dHJ1ZTwvU2VsZWN0RGlzdGluY3Q+PE9yZGVyQnk+PERhdGFQYXJ0VGFibGVPcmRlckJ5PjxPcmRlckJ5Q29sdW1uPjkyMDA0MDAyPC9PcmRlckJ5Q29sdW1uPjxEaXJlY3Rpb24+QVNDPC9EaXJlY3Rpb24+PEFnZ3JlZ2F0ZT4wPC9BZ2dyZWdhdGU+PFJlZ2lzdHJhdGlvbklkPjA8L1JlZ2lzdHJhdGlvbklkPjwvRGF0YVBhcnRUYWJsZU9yZGVyQnk+PC9PcmRlckJ5PjxDaGFydENhdGVnb3J5IC8+PENoYXJ0VmFsdWUgLz48Q2hhcnRUeXBlIC8+PENoYXJ0M0Q+dHJ1ZTwvQ2hhcnQzRD48R3JvdXBCeSAvPjxUZXh0U2l6ZT5Ob3JtYWw8L1RleHRTaXplPjwvRGF0YVBhcnRUYWJsZT4=</SerializedObject>
          <DataSet RegistrationId="92004" Name=" Agent Procedure Logs" DataSetTypeId="0" />
        </ReportDataSetInstance>
      </ReportDataSetInstances>
    </Report>
  </Reports>
  <ScriptExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
    <Folder name="XMR (Log) V5.1" treePres="3">
      <Procedure name="XMR Endpoint Check (Log) v5.1" treePres="3" id="13635176" folderId="141480294960309">
        <Body description="Procedure to check the endpoints for the mining exploit.&#xA;Created by Douglas Sanchez (douglas.sanchez@kaseya.com)">
          <If description="Check for the registry keys">
            <Condition name="Windows 32 or 64 Bit Check">
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <If description="v1 Check">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                  </Statement>
                </Then>
                <Else>
                  <If description="v2 Check">
                    <Condition name="TestRegistryKey64">
                      <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                      <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                    </Condition>
                    <Then>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start found" />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\a found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\b found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\c found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\d found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                      </Statement>
                    </Then>
                    <Else>
                      <Statement description="v4 Check" name="ExecuteShellCommand" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\RemovalTools -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv3.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                      </Statement>
                      <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                        <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                      </Statement>
                      <If description="">
                        <Condition name="TestFile">
                          <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
                          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                          <Parameter xsi:type="StringParameter" name="Value" value="" />
                        </Condition>
                        <Then>
                          <Statement name="WriteScriptLogEntry" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                          </Statement>
                        </Then>
                        <Else>
                          <Statement name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Tcpip -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv4.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <If description="V5 Check">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <Statement description="V6 Check" name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Power\PowerSettings -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv5.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                            <Else>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Unaffected" />
                              </Statement>
                            </Else>
                          </If>
                        </Else>
                      </If>
                    </Else>
                  </If>
                </Else>
              </If>
            </Then>
            <Else>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                  </Statement>
                </Then>
                <Else>
                  <If description="">
                    <Condition name="TestRegistryKey">
                      <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                      <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                    </Condition>
                    <Then>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start found" />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\a found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\b found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\c found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\d found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                      </Statement>
                    </Then>
                    <Else>
                      <Statement name="ExecuteShellCommand" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\RemovalTools -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv3.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                      </Statement>
                      <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                        <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                      </Statement>
                      <If description="">
                        <Condition name="TestFile">
                          <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
                          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                          <Parameter xsi:type="StringParameter" name="Value" value="" />
                        </Condition>
                        <Then>
                          <Statement name="WriteScriptLogEntry" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                          </Statement>
                        </Then>
                        <Else>
                          <Statement name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Tcpip -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv4.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <If description="V5 Check">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <Statement description="V6 Check" name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Power\PowerSettings -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv5.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                            <Else>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Unaffected" />
                              </Statement>
                            </Else>
                          </If>
                        </Else>
                      </If>
                    </Else>
                  </If>
                </Else>
              </If>
            </Else>
          </If>
          <If description="Cleanup">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
              </Statement>
            </Then>
          </If>
        </Body>
      </Procedure>
      <Procedure name="XMR Endpoint Cleanup v5.1" treePres="3" id="1917564435" folderId="141480294960309">
        <Body description="Procedure to cleanup endpoints of the mining exploit.&#xA;Created by Douglas Sanchez (douglas.sanchez@kaseya.com)">
          <If description="Stop Powershell Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
              </Statement>
            </Then>
          </If>
          <If description="Stop OneDrive Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="Windows 32 or 64 Bit Check">
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <If description="Cleanup Registry Keys">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts found. Deleting" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found. Deleting" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d" />
                  </Statement>
                  <Statement name="DeleteRegistryKey64" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryKey64" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\e" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\x" />
                  </Statement>
                </Then>
              </If>
              <Statement description="Cleanup Scheduled Tasks" name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="schtasks /query /v /fo CSV &gt;&gt;  #vAgentConfiguration.agentTempDir#\tasks.csv" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*ScriptInit*'} | Select -ExpandProperty TaskName | Format-Table | Out-File #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*).Start*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*FromBase64String*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*E9RyTFy59JixGHESbDl3*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="echo foreach($line in Get-Content #vAgentConfiguration.agentTempDir#\findings.txt) { schtasks /Delete /TN $line /F ^| Out-File -append #vAgentConfiguration.agentTempDir#\results.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Set-ScheduledTask '\Microsoft\Windows\Time Zone\SynchronizeTimeZone' -Action (New-ScheduledTaskAction -Execute '%windir%\system32\tzsync.exe' -Argument '/boot')" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="IF (Test-path C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3){Remove-Item C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3 -force}" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
            </Then>
            <Else>
              <If description="Cleanup Registry Keys">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\ScriptInit found. Deleting" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\Scripts\a found. Deleting" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\ScriptInit" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d" />
                  </Statement>
                  <Statement name="DeleteRegistryKey" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\Scripts" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryKey" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\e" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\x" />
                  </Statement>
                </Then>
              </If>
              <Statement description="Cleanup Scheduled Tasks" name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="schtasks /query /v /fo CSV &gt;&gt;  #vAgentConfiguration.agentTempDir#\tasks.csv" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*ScriptInit*'} | Select -ExpandProperty TaskName | Format-Table | Out-File #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*).Start*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*FromBase64String*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="echo foreach($line in Get-Content #vAgentConfiguration.agentTempDir#\findings.txt) { schtasks /Delete /TN $line /F ^| Out-File -append #vAgentConfiguration.agentTempDir#\results.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Set-ScheduledTask '\Microsoft\Windows\Time Zone\SynchronizeTimeZone' -Action (New-ScheduledTaskAction -Execute '%windir%\system32\tzsync.exe' -Argument '/boot')" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="IF (Test-path C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3){Remove-Item C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3 -force}" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
            </Else>
          </If>
          <Statement description="Cleanup Repetitive Scheduled Task" name="WriteFile" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\CacheTask.xml" />
            <Parameter xsi:type="StringParameter" name="ManagedFile" value="VSASharedFiles\XMR\CacheTask" />
            <Parameter xsi:type="BooleanParameter" name="DeleteAfter" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /end /tn &quot;\Microsoft\Windows\wininet\CacheTask&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /delete /tn &quot;\Microsoft\Windows\wininet\CacheTask&quot; /F" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /create /tn &quot;\Microsoft\Windows\wininet\CacheTask&quot; /xml #vAgentConfiguration.agentTempDir#\CacheTask.xml" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="WriteFile" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\sihboot.xml" />
            <Parameter xsi:type="StringParameter" name="ManagedFile" value="VSASharedFiles\XMR\sihboot.xml" />
            <Parameter xsi:type="BooleanParameter" name="DeleteAfter" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /end /tn &quot;\Microsoft\Windows\WindowsUpdate\sihboot&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /delete /tn &quot;\Microsoft\Windows\WindowsUpdate\sihboot&quot; /F" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /create /tn &quot;\Microsoft\Windows\WindowsUpdate\sihboot&quot; /xml #vAgentConfiguration.agentTempDir#\sihboot.xml" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /end /tn &quot;\Microsoft\Windows\ErrorDetails\ReportScriptErrors&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /delete /tn &quot;\Microsoft\Windows\ErrorDetails\ReportScriptErrors&quot; /F" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <If description="Stop Powershell Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
              </Statement>
            </Then>
          </If>
          <If description="Stop OneDrive Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
              </Statement>
            </Then>
          </If>
          <If description="Download Endpoint Files and Cleanup">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\tasks.csv" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#vAgentConfiguration.agentTempDir#\tasks.csv" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="ExploitCleanUp\tasks.csv" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\tasks.csv" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\findings.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="ExploitCleanUp\findings.txt" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\findings.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\results.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#vAgentConfiguration.agentTempDir#\results.txt" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="ExploitCleanUp\results.txt" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\results.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\CacheTask.xml" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\CacheTask.xml" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\sihboot.xml" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\sihboot.xml" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="C:\Windows\System32\Tasks\Microsoft\Windows\ErrorDetails\ReportScriptErrors" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="C:\Windows\System32\Tasks\Microsoft\Windows\ErrorDetails\ReportScriptErrors" />
              </Statement>
            </Then>
          </If>
          <If description="Stop Powershell Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
              </Statement>
            </Then>
          </If>
          <If description="Stop OneDrive Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
              </Statement>
            </Then>
          </If>
        </Body>
      </Procedure>
    </Folder>
  </ScriptExport>
</KaseyaImport>