AMSI
Named by 3 kept items in this workspace.
2 items name it under tools and 1 under classification.key entities.
Search every workspace for AMSI. It matches the name as written, so it can find other things that share it.
The items that name it 3
Windows interface used by AV providers to scan scripts for malicious content; flagged the testing code as malicious in this case
Windows anti-malware scanning interface; patched/disabled by the malware to evade detection
All technologies in this workspace.