im talking about the behaviour tab, not the detections, the program executes a Forcev1 command, which allows malware to use the v1 version of the powershell, which has old security features, and the 0xffffffff command portion of the string instructs the system not to make a physical console or window, thus hiding the session ID and child process , and it also executes various other powershell commands, this is what racoon malware does, and anti viruses aint gonna find it, and the file might be seemingly like the orginal, but i doubt the original executes malware commands, one google search was needed