Encoded PowerShell to Open Attachments?

[albchen 0]

Hi,

I noticed in my PowerShell logs that there is a base-64 encoded command run by evernote.exe to open an image saved in C:\Users\myusername\Appdata\Local\Temp\Attachments\<unique id>\<another id>\image.png. I investigated the image and my system logs, and it appears that this command is just opening the image, and not executing any embedded scripts. However, the command caught my eye since it appears extremely suspicious. Would the EverNote team be able to kindly confirm this is normal behavior?
 

Thank you.

 

The encoded command was preceded with suspicious use of PowerShell:

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell -NoProfile -NonInteractive –ExecutionPolicy Bypass -EncodedCommand 

[gazumped 12,070]

21 hours ago, albchen said:

Would the EverNote team be able to kindly confirm this is normal behavior?

Hi.  The Evernote team might be able to,  but most of us here are users,  not developers.  You could try https://twitter.com/evernotehelps

[Guest]

We do several powershell commands in the installer to detect and uninstall legacy Evernote clients.

For example: "powershell.exe /c Get-AppxPackage Evernote.Evernote | Remove-AppxPackage"

For external file opens we use https://www.electronjs.org/docs/api/shell#shellopenpathpath

There is some older code that is being replaced that still uses it.  You should see it the next version or two.