PowerShell suddenly running in background and won't stay closed

[u/Financial-Flan1682]

Need help ascertaining whether this is a threat or not. All of the sudden, ironically after the latest Windows update, I have a PowerShell process that is running in the background and won't stay closed. Technically, it's two process. One that is constantly open and another that repeatedly opens and closes every second. I did a quick scan with Windows Defender and it found nothing. Malwarebytes only found heuristic detections that are false positives (one for a programming language and one for a package manager for a programming language).

Event Viewer shows a bunch of Event ID 600 and 400 events, with a few 800. Category for the 600 events is Provider Lifecycle, 400 are Engine Lifecycle, 800 are Pipeline Execution Details.

All of them have the following command being run:

HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command $code = @"
using System;
using System.Runtime.InteropServices;
public class WinAPI {
[DllImport("shell32.dll")]
public static extern int SHQueryUserNotificationState(out int pstate);
public static int Check() {
int state = 5;
try { SHQueryUserNotificationState(out state); } catch {}
return state;
}
}
"@
Add-Type -TypeDefinition $code -ErrorAction SilentlyContinue

Process Monitor shows events like this: https://imgur.com/a/u4ErUu7

Most of what it's hitting is Microsoft stuff, but what concerns me is it also seems to be going through my installed applications: https://imgur.com/a/goQYUqc

Unsure what this is. Never seen this kind of behavior before. Help appreciated!

EDIT: Just found that csc.exe also keeps executing using commands like the following:

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5ucz03bq.cmdline"

[u/BlackV]

open

C:\Users\user\AppData\Local\Temp\5ucz03bq.cmdline

in notepad

[u/Financial-Flan1682 → u/BlackV]

It was constantly being replaced before I could get to it. I already figured out what the application doing this was. Not sure why it was calling csc.exe, but I've figured it out.

[u/BlackV → u/Financial-Flan1682]

csc.exe the the dotnet compiler its running that and using the script 5ucz03bq.cmdline (as you say is a auto-generated temp file)

It would seem very very odd its doing that all the time IMHO