WinRM


Password of the scripting account has been decoded; FriendsDontLetFriendsBase64Passwords

Initial Foothold established to the compromised host as the scripting account via WinRM.