File name: | 0.jpeg |
Full analysis: | https://app.any.run/tasks/d47b4466-a38a-4045-8a20-5a4eceaadd63 |
Verdict: | Malicious activity |
Analysis date: | March 30, 2020, 20:21:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | image/jpeg |
File info: | JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 193x193, frames 3 |
MD5: | E36A2CB45C8544CB690F3A19A5B56B9B |
SHA1: | 370D5A3ED2A64DCD83C6AF1215FCFCAE33EDC20E |
SHA256: | FEB3B34430D1920F34911A9DE45BCB0651CBFD8367BD32E6752CF34ACF05BAEC |
SSDEEP: | 192:7MfBV9lfbaqmG0D6AvQ4DddJ31HFEGcoHuULKb7jju3F:QfBzlfLmhms7J315rOULy7vu1 |
.jpg | | | JFIF JPEG bitmap (50) |
---|---|---|
.jpg | | | JPEG bitmap (37.4) |
.mp3 | | | MP3 audio (12.4) |
Megapixels: | 0.037 |
---|---|
ImageSize: | 193x193 |
YResolution: | 1 |
---|---|
XResolution: | 1 |
ResolutionUnit: | None |
JFIFVersion: | 1.01 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3052 | "C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\AppData\Local\Temp\0.jpeg.jpg | C:\Windows\System32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3464 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3684 | C:\Windows\system32\cmd.exe /c C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoExit -EncodedCommand aQBmACAAKABHAGUAdAAtAE0AbwBkAHUAbABlACAALQBMAGkAcwB0AEEAdgBhAGkAbABhAGIAbABlACAALQBOAGEAbQBlACAAUABTAFIAZQBhAGQATABpAG4AZQApACAAewAgAFMAZQB0AC0AUABTAFIAZQBhAGQAbABpAG4AZQBPAHAAdABpAG8AbgAgAC0ASABpAHMAdABvAHIAeQBTAGEAdgBlAFMAdAB5AGwAZQAgAFMAYQB2AGUATgBvAHQAaABpAG4AZwAgAH0AOwAgACQAaABvAHMAdAAuAFUASQAuAFIAYQB3AFUASQAuAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBIAG8AcwB0AC4AUwBpAHoAZQAoADEALAAgADEAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AQgB1AGYAZgBlAHIAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIANwA2ADYAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AVwBpAG4AZABvAHcAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIAKQA7ACAAYwBkACAAIgAkAGUAbgB2ADoAdABlAG0AcAAiADsAJABIAE8ATQBFAEQAUgBJAFYARQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgB0AGUAbQBwACkALgBQAFMARAByAGkAdgBlAC4ATgBhAG0AZQAgACsAIAAiADoAXAAiADsAJABIAE8ATQBFAFAAQQBUAEgAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAdABlAG0AcAApAC4ARgB1AGwAbABOAGEAbQBlAC4AUgBlAG0AbwB2AGUAKAAwACwAIAAzACkAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgATwBNAEUAIAAiACQASABPAE0ARQBEAFIASQBWAEUAJABIAE8ATQBFAFAAQQBUAEgAIgAgAC0ARgBvAHIAYwBlADsAKABnAGUAdAAtAHAAcwBwAHIAbwB2AGkAZABlAHIAIAAnAEYAaQBsAGUAUwB5AHMAdABlAG0AJwApAC4ASABvAG0AZQAgAD0AIAAkAEgATwBNAEUARABSAEkAVgBFACAAKwAgACQASABPAE0ARQBQAEEAVABIADsA (Decoded: if (Get-Module -ListAvailable -Name PSReadLine) { Set-PSReadlineOption -HistorySaveStyle SaveNothing }; $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(1, 1); $host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size(79, 32766); $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(79, 32); cd "$env:temp";$HOMEDRIVE = (Get-Item $env:temp).PSDrive.Name + ":\";$HOMEPATH = (Get-Item $env:temp).FullName.Remove(0, 3);Set-Variable HOME "$HOMEDRIVE$HOMEPATH" -Force;(get-psprovider 'FileSystem').Home = $HOMEDRIVE + $HOMEPATH;) | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 4294770688 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1928 | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoExit -EncodedCommand aQBmACAAKABHAGUAdAAtAE0AbwBkAHUAbABlACAALQBMAGkAcwB0AEEAdgBhAGkAbABhAGIAbABlACAALQBOAGEAbQBlACAAUABTAFIAZQBhAGQATABpAG4AZQApACAAewAgAFMAZQB0AC0AUABTAFIAZQBhAGQAbABpAG4AZQBPAHAAdABpAG8AbgAgAC0ASABpAHMAdABvAHIAeQBTAGEAdgBlAFMAdAB5AGwAZQAgAFMAYQB2AGUATgBvAHQAaABpAG4AZwAgAH0AOwAgACQAaABvAHMAdAAuAFUASQAuAFIAYQB3AFUASQAuAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBIAG8AcwB0AC4AUwBpAHoAZQAoADEALAAgADEAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AQgB1AGYAZgBlAHIAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIANwA2ADYAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AVwBpAG4AZABvAHcAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIAKQA7ACAAYwBkACAAIgAkAGUAbgB2ADoAdABlAG0AcAAiADsAJABIAE8ATQBFAEQAUgBJAFYARQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgB0AGUAbQBwACkALgBQAFMARAByAGkAdgBlAC4ATgBhAG0AZQAgACsAIAAiADoAXAAiADsAJABIAE8ATQBFAFAAQQBUAEgAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAdABlAG0AcAApAC4ARgB1AGwAbABOAGEAbQBlAC4AUgBlAG0AbwB2AGUAKAAwACwAIAAzACkAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgATwBNAEUAIAAiACQASABPAE0ARQBEAFIASQBWAEUAJABIAE8ATQBFAFAAQQBUAEgAIgAgAC0ARgBvAHIAYwBlADsAKABnAGUAdAAtAHAAcwBwAHIAbwB2AGkAZABlAHIAIAAnAEYAaQBsAGUAUwB5AHMAdABlAG0AJwApAC4ASABvAG0AZQAgAD0AIAAkAEgATwBNAEUARABSAEkAVgBFACAAKwAgACQASABPAE0ARQBQAEEAVABIADsA (Decoded: if (Get-Module -ListAvailable -Name PSReadLine) { Set-PSReadlineOption -HistorySaveStyle SaveNothing }; $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(1, 1); $host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size(79, 32766); $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(79, 32); cd "$env:temp";$HOMEDRIVE = (Get-Item $env:temp).PSDrive.Name + ":\";$HOMEPATH = (Get-Item $env:temp).FullName.Remove(0, 3);Set-Variable HOME "$HOMEDRIVE$HOMEPATH" -Force;(get-psprovider 'FileSystem').Home = $HOMEDRIVE + $HOMEPATH;) | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 4294770688 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2156 | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoExit -EncodedCommand aQBmACAAKABHAGUAdAAtAE0AbwBkAHUAbABlACAALQBMAGkAcwB0AEEAdgBhAGkAbABhAGIAbABlACAALQBOAGEAbQBlACAAUABTAFIAZQBhAGQATABpAG4AZQApACAAewAgAFMAZQB0AC0AUABTAFIAZQBhAGQAbABpAG4AZQBPAHAAdABpAG8AbgAgAC0ASABpAHMAdABvAHIAeQBTAGEAdgBlAFMAdAB5AGwAZQAgAFMAYQB2AGUATgBvAHQAaABpAG4AZwAgAH0AOwAgACQAaABvAHMAdAAuAFUASQAuAFIAYQB3AFUASQAuAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBIAG8AcwB0AC4AUwBpAHoAZQAoADEALAAgADEAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AQgB1AGYAZgBlAHIAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIANwA2ADYAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AVwBpAG4AZABvAHcAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIAKQA7ACAAYwBkACAAIgAkAGUAbgB2ADoAdABlAG0AcAAiADsAJABIAE8ATQBFAEQAUgBJAFYARQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgB0AGUAbQBwACkALgBQAFMARAByAGkAdgBlAC4ATgBhAG0AZQAgACsAIAAiADoAXAAiADsAJABIAE8ATQBFAFAAQQBUAEgAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAdABlAG0AcAApAC4ARgB1AGwAbABOAGEAbQBlAC4AUgBlAG0AbwB2AGUAKAAwACwAIAAzACkAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgATwBNAEUAIAAiACQASABPAE0ARQBEAFIASQBWAEUAJABIAE8ATQBFAFAAQQBUAEgAIgAgAC0ARgBvAHIAYwBlADsAKABnAGUAdAAtAHAAcwBwAHIAbwB2AGkAZABlAHIAIAAnAEYAaQBsAGUAUwB5AHMAdABlAG0AJwApAC4ASABvAG0AZQAgAD0AIAAkAEgATwBNAEUARABSAEkAVgBFACAAKwAgACQASABPAE0ARQBQAEEAVABIADsA (Decoded: if (Get-Module -ListAvailable -Name PSReadLine) { Set-PSReadlineOption -HistorySaveStyle SaveNothing }; $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(1, 1); $host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size(79, 32766); $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(79, 32); cd "$env:temp";$HOMEDRIVE = (Get-Item $env:temp).PSDrive.Name + ":\";$HOMEPATH = (Get-Item $env:temp).FullName.Remove(0, 3);Set-Variable HOME "$HOMEDRIVE$HOMEPATH" -Force;(get-psprovider 'FileSystem').Home = $HOMEDRIVE + $HOMEPATH;) | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 4294770688 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1696 | "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" | C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 3221225786 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3524 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2932 | C:\Windows\system32\cmd.exe /c C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoExit -EncodedCommand aQBmACAAKABHAGUAdAAtAE0AbwBkAHUAbABlACAALQBMAGkAcwB0AEEAdgBhAGkAbABhAGIAbABlACAALQBOAGEAbQBlACAAUABTAFIAZQBhAGQATABpAG4AZQApACAAewAgAFMAZQB0AC0AUABTAFIAZQBhAGQAbABpAG4AZQBPAHAAdABpAG8AbgAgAC0ASABpAHMAdABvAHIAeQBTAGEAdgBlAFMAdAB5AGwAZQAgAFMAYQB2AGUATgBvAHQAaABpAG4AZwAgAH0AOwAgACQAaABvAHMAdAAuAFUASQAuAFIAYQB3AFUASQAuAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBIAG8AcwB0AC4AUwBpAHoAZQAoADEALAAgADEAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AQgB1AGYAZgBlAHIAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIANwA2ADYAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AVwBpAG4AZABvAHcAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIAKQA7ACAAYwBkACAAIgAkAGUAbgB2ADoAdABlAG0AcAAiADsAJABIAE8ATQBFAEQAUgBJAFYARQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgB0AGUAbQBwACkALgBQAFMARAByAGkAdgBlAC4ATgBhAG0AZQAgACsAIAAiADoAXAAiADsAJABIAE8ATQBFAFAAQQBUAEgAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAdABlAG0AcAApAC4ARgB1AGwAbABOAGEAbQBlAC4AUgBlAG0AbwB2AGUAKAAwACwAIAAzACkAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgATwBNAEUAIAAiACQASABPAE0ARQBEAFIASQBWAEUAJABIAE8ATQBFAFAAQQBUAEgAIgAgAC0ARgBvAHIAYwBlADsAKABnAGUAdAAtAHAAcwBwAHIAbwB2AGkAZABlAHIAIAAnAEYAaQBsAGUAUwB5AHMAdABlAG0AJwApAC4ASABvAG0AZQAgAD0AIAAkAEgATwBNAEUARABSAEkAVgBFACAAKwAgACQASABPAE0ARQBQAEEAVABIADsA (Decoded: if (Get-Module -ListAvailable -Name PSReadLine) { Set-PSReadlineOption -HistorySaveStyle SaveNothing }; $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(1, 1); $host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size(79, 32766); $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(79, 32); cd "$env:temp";$HOMEDRIVE = (Get-Item $env:temp).PSDrive.Name + ":\";$HOMEPATH = (Get-Item $env:temp).FullName.Remove(0, 3);Set-Variable HOME "$HOMEDRIVE$HOMEPATH" -Force;(get-psprovider 'FileSystem').Home = $HOMEDRIVE + $HOMEPATH;) | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 4294770688 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3848 | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoExit -EncodedCommand aQBmACAAKABHAGUAdAAtAE0AbwBkAHUAbABlACAALQBMAGkAcwB0AEEAdgBhAGkAbABhAGIAbABlACAALQBOAGEAbQBlACAAUABTAFIAZQBhAGQATABpAG4AZQApACAAewAgAFMAZQB0AC0AUABTAFIAZQBhAGQAbABpAG4AZQBPAHAAdABpAG8AbgAgAC0ASABpAHMAdABvAHIAeQBTAGEAdgBlAFMAdAB5AGwAZQAgAFMAYQB2AGUATgBvAHQAaABpAG4AZwAgAH0AOwAgACQAaABvAHMAdAAuAFUASQAuAFIAYQB3AFUASQAuAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBIAG8AcwB0AC4AUwBpAHoAZQAoADEALAAgADEAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AQgB1AGYAZgBlAHIAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIANwA2ADYAKQA7ACAAJABoAG8AcwB0AC4AVQBJAC4AUgBhAHcAVQBJAC4AVwBpAG4AZABvAHcAUwBpAHoAZQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEgAbwBzAHQALgBTAGkAegBlACgANwA5ACwAIAAzADIAKQA7ACAAYwBkACAAIgAkAGUAbgB2ADoAdABlAG0AcAAiADsAJABIAE8ATQBFAEQAUgBJAFYARQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgB0AGUAbQBwACkALgBQAFMARAByAGkAdgBlAC4ATgBhAG0AZQAgACsAIAAiADoAXAAiADsAJABIAE8ATQBFAFAAQQBUAEgAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAdABlAG0AcAApAC4ARgB1AGwAbABOAGEAbQBlAC4AUgBlAG0AbwB2AGUAKAAwACwAIAAzACkAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEgATwBNAEUAIAAiACQASABPAE0ARQBEAFIASQBWAEUAJABIAE8ATQBFAFAAQQBUAEgAIgAgAC0ARgBvAHIAYwBlADsAKABnAGUAdAAtAHAAcwBwAHIAbwB2AGkAZABlAHIAIAAnAEYAaQBsAGUAUwB5AHMAdABlAG0AJwApAC4ASABvAG0AZQAgAD0AIAAkAEgATwBNAEUARABSAEkAVgBFACAAKwAgACQASABPAE0ARQBQAEEAVABIADsA (Decoded: if (Get-Module -ListAvailable -Name PSReadLine) { Set-PSReadlineOption -HistorySaveStyle SaveNothing }; $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(1, 1); $host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size(79, 32766); $host.UI.RawUI.WindowSize = New-Object System.Management.Automation.Host.Size(79, 32); cd "$env:temp";$HOMEDRIVE = (Get-Item $env:temp).PSDrive.Name + ":\";$HOMEPATH = (Get-Item $env:temp).FullName.Remove(0, 3);Set-Variable HOME "$HOMEDRIVE$HOMEPATH" -Force;(get-psprovider 'FileSystem').Home = $HOMEDRIVE + $HOMEPATH;) | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 4294770688 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4I57XZKGTK14WJNTZQCP.temp | — | |
MD5:— | SHA256:— | |||
2156 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AEIM3P3TNR8P7TWHGOJS.temp | — | |
MD5:— | SHA256:— | |||
1696 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E5T8BKTFN48ZT0HS1L61.temp | — | |
MD5:— | SHA256:— | |||
3848 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PGQSSHN428MVLASMJPQ1.temp | — | |
MD5:— | SHA256:— | |||
3848 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa9e7d9.TMP | binary | |
MD5:3B712DE36DC1672EC51A90C5EE31744F | SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1 | |||
2156 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3B712DE36DC1672EC51A90C5EE31744F | SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1 | |||
1696 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa8bb5f.TMP | binary | |
MD5:55D97CA8F38CAE571B9924AB32DEE546 | SHA256:81171B65E13D7FF50827EDB1665B8B152C0C8045118EAA1374F11C998F6DA37C | |||
2156 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa82828.TMP | binary | |
MD5:3B712DE36DC1672EC51A90C5EE31744F | SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1 | |||
3848 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3B712DE36DC1672EC51A90C5EE31744F | SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1 | |||
1928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa71d20.TMP | binary | |
MD5:3B712DE36DC1672EC51A90C5EE31744F | SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1 |