Baylen Orr

File Analysis - 2023:10:19

Network indicators on this page are defanged (e.g. example[.]com) so they can't be clicked by accident.

Samples can be downloaded here

Files

  1. "PermissionType.exe" A22F38C26DC96FA285EFD4C0732A22E9BB81B105AD65C75C609A478DD551AC13
  2. "Krovassgu.dll" D3E7F61EE60925C34C235F9A63040DCD96E22C91D303061524FD511D51AFE43C

SUMMARY

"PermissionType.exe" (Qoanvmyp.exe) is a 64-bit .NET PE executable that contains a second payload as an encoded array. Qoanvmyp.exe decodes the array and loads is as an assembly into memory as Krovassgu.dll and executes a function within via a function delegate. Krovassgu establishes persistence and contains all the malicious working code. This sample leverages Microsoft .NET framework directory binaries and scheduled tasks to maintain persistence. This sample is likely a Remote Access Trojan (RAT) based on our trace analysis.

ANALYSIS

Qoanvmyp.exe is a 64-bit .NET executable image that contains a second stage DLL, Krovassgu.dll as an array that is obfuscated using a compressed and reversed order routine. To de-obfuscate, a function decompresses the data with standard Gzip methods and then reverses the byte array into a resulting assembly. The second assembly can be dumped using DnSpy after it is loaded into memory. This obfuscated assembly is called
"Krovassgu.dll" and has it's entry resolved and invoked with Delegate.CreateDelegate(_args_).DynamicInvoke(_objectArgs_). Krovassgu.dll uses the Costura platform[1] to embed other assemblies into the resources section and employes effective code obfuscation.

Krovassgu.dll

Entry loads to: ccAGoqL0xc7ieapKyva class. The obfuscation employed is a routine of method invoking in the format below. A copied example from the disassembled binary is included (appendix A). A pseudo code definition is provided below for ease of reading:

internal sealed class name : MulticastDelegate
    {
      public extern Invoke(object);

      public static obfuscated_name(object A_0, obfuscated_name_a A_1)
      {
        return A_1(A_0); <-A-1 is an object that contains method base
      }

      public extern obfuscated_name_a(object, IntPtr);

      static obfuscated_name_a()
      {
        entryClass.obfuscated_name_b(typeof(obfuscated_name_a).TypeHandle);
      }

      internal static obfuscated_name_a obfuscated_name_c;
    }

Persistence

Krovassgu creates a hidden directory called "Hash" in the \AppData\Roaming\ directory and places a copy of Qoanvmyp.exe there but renamed to "PermissionType.exe". Execution is then set by creating a scheduled task. On our machine the scheduled tasks condition continuously ran every 4-6 minutes. The task simply starts PermissiontType.exe from the Roaming directory.

Evasion (Process Injection)

Defenses from EDR and hardened persistence is achieved through Living-off-the-Land (LOLB) execution. Qoanvmyp.exe appears to infect binaries found in the executable Microsoft.NET framework that executed it. The scheduled task persists despite the success of infecting a Windows binary, suggesting that Krovassgu checks if there is an active virus before attempting to infect another binary. On our machine, executables appeared to be chosen at random from the C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ directory. We did not install other .NET versions to see if the results differed. From our analysis, it appears that any PE executable within said directory is a target for infection.

Evasion (Windows Defender)

The command powershell.exe Set-Memory Exclusion path -ExecutionPolicy Bypass -WindowStyle hidden -noProfile Set-MpPreference -ExclusionPath D:\ is decrypted and run, which attempts to set the D:/ drive as an exclusionary from Windows built-in anti-virus engine.

MEMORY ANALYSIS

Due to the complexity of the obfuscation, we opted to trace functions that handled string arguments or objects to try and decrypt the programs runtime strings. We have included the trace log in the appendix section below. Based on a cursory look at the strings and the persistence methods outlines above, this sample appears to be a type of RAT. Most of the strings decrypted appear to be useful for maintaining persistence on a system during logon/logoffs, reboots, user-profile switches, network changes, and so on. Without further analyzing the sample we cannot concretely say whether other functionality exists.

We traced functions using DnSpyEx's built in 'Class Tracepoint' utility. We identified string return types from the programs aforementioned pseudo-code and enabled trace logging on these functions. Furthermore we observed the infected Microsoft binaries' memory strings and observed the same patterns seen in our tracing report and the Qoanvmyp.exe metadata strings. Note that these strings were in reverse order (not big-endian), as a simple measure to make string identification more difficult during dynamic analysis.

IMPACT

At the time of our analysis, PermissiontType.exe (Qoanvmyp.exe) was detected by only 4 vendors on VT. However at the time of our report publication this number had increased to 55/71. The full extent of the capabilities of the second stage has not been ascertained as the effort to de-obfuscate it is tremendous. We therefore relied mostly on runtime information and dynamic analysis and were able to extract fewer indicators of compromise or complete malware configurations. Though the first stage loader is simple, it is assumed that Krovassgu.dll is more advanced in that it creates a scheduled task to persist, interferes with Windows Defender, and is able to enumerate and inject into binaries in the infected systems .NET path.

IOCs

URLS

  1. remotes1338.hopto[.]org
  2. hxxps://filebin[.]net:443/Jgrdeboxh/Ioopbyta.dll

Files

  1. "PermissionType.exe" (A22F38C26DC96FA285EFD4C0732A22E9BB81B105AD65C75C609A478DD551AC13)
  2. "Krovassgu.dll" (D3E7F61EE60925C34C235F9A63040DCD96E22C91D303061524FD511D51AFE43C)
  1. C:\Users\%User%\AppData\Roaming\Hash\PermissionType.exe

Tasks

  1. Start a program: C:\Users\Tim\AppData\Roaming\Hash\PermissionType.exe: After triggered, repeat every 00:04:45 indefinitely

Strings

  1. "F3YuHXHK2VXREyTy5p.yXSMF0tUjkHvIYTa6x"
  2. "Cpk9FEhjo"
  3. "Qoanvmyp"

REFERENCES

  1. https://github.com/Fody/Costura

APPENDIX

  1. Figure A:
internal sealed class kOjwWWRnWLTBWQZHgd4 : MulticastDelegate
    {
      public extern TaskSettings Invoke(object);

      public static TaskSettings Le7w9LlkV1(object A_0, kOjwWWRnWLTBWQZHgd4 A_1)
      {
        return A_1(A_0); <-A-1 is an object that contains method base
      }

      public extern kOjwWWRnWLTBWQZHgd4(object, IntPtr);

      static kOjwWWRnWLTBWQZHgd4()
      {
        ccAGoqL0xc7ieapKyva.wJeBkAovAJ(typeof(kOjwWWRnWLTBWQZHgd4).TypeHandle);
      }

      internal static kOjwWWRnWLTBWQZHgd4 q8rRJmCFfr;
    }
  1. Figure B:
17:25:20.477 a22f3.exe (CLR v4.0.30319: DefaultDomain): Loaded 'C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll'.
    17:25:20.537 a22f3.exe (CLR v4.0.30319: DefaultDomain): Loaded 'C:\Users\Tim\Desktop\a22f3.exe'.
    17:25:20.577 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll'.
    17:25:20.583 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll'.
    17:27:45.939 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'Krovassgu'.
    18:18:35.732 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded '10ab4da7-fb7b-4e3b-b142-90193587d885'.
    18:18:35.771 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'protobuf-net'.
    18:18:35.773 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll'.
    18:18:35.786 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'Anonymously Hosted DynamicMethods Assembly'.
    18:18:36.022 RHLLZBXhuOQSRC3mv4a.RHLLZBXhuOQSRC3mv4a() returns <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:36.048 RHLLZBXhuOQSRC3mv4a.Le7w9LlkV1(object, RHLLZBXhuOQSRC3mv4a) returns {RHLLZBXhuOQSRC3mv4a}
    18:18:36.082 fp8YtcwCBx7d7qpRWKO.fp8YtcwCBx7d7qpRWKO() Process: <<<error CS0103: The name 'A_0' does not exist in the current context>>>
    18:18:36.096 fp8YtcwCBx7d7qpRWKO.Le7w9LlkV1(fp8YtcwCBx7d7qpRWKO) Process: {fp8YtcwCBx7d7qpRWKO}
    18:18:36.122 rB6lctwzTGME9NB52nf.rB6lctwzTGME9NB52nf() returns <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:36.135 rB6lctwzTGME9NB52nf.Le7w9LlkV1(object, rB6lctwzTGME9NB52nf) returns {rB6lctwzTGME9NB52nf}
    18:18:36.159 ioJL3rX2rfNG6HZjURL.ioJL3rX2rfNG6HZjURL() returns <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:36.173 ioJL3rX2rfNG6HZjURL.Le7w9LlkV1(object, ioJL3rX2rfNG6HZjURL) returns {ioJL3rX2rfNG6HZjURL}
    18:18:36.187 b5VPKMI0V1JGMxKZQoI.b5VPKMI0V1JGMxKZQoI() returns string <<<error CS0103: The name 'A_0' does not exist in the current context>>>
    18:18:36.245 b5VPKMI0V1JGMxKZQoI.Le7w9LlkV1(b5VPKMI0V1JGMxKZQoI) returns string {b5VPKMI0V1JGMxKZQoI}
    18:18:36.267 ioJL3rX2rfNG6HZjURL.Le7w9LlkV1(object, ioJL3rX2rfNG6HZjURL) returns {ioJL3rX2rfNG6HZjURL}
    18:18:36.294 a22f3.exe (CLR v4.0.30319: a22f3.exe): Loaded 'Microsoft.Win32.TaskScheduler'.
    18:18:36.327 fp8YtcwCBx7d7qpRWKO.Le7w9LlkV1(fp8YtcwCBx7d7qpRWKO) Process: {fp8YtcwCBx7d7qpRWKO}
    18:18:36.338 rB6lctwzTGME9NB52nf.Le7w9LlkV1(object, rB6lctwzTGME9NB52nf) returns {rB6lctwzTGME9NB52nf}
    18:18:36.349 ioJL3rX2rfNG6HZjURL.Le7w9LlkV1(object, ioJL3rX2rfNG6HZjURL) returns {ioJL3rX2rfNG6HZjURL}
    18:18:36.391 SmpYOOxXNOQQLYmREcT.SmpYOOxXNOQQLYmREcT() returns <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:36.409 SmpYOOxXNOQQLYmREcT.Le7w9LlkV1(object, SmpYOOxXNOQQLYmREcT) {XpQeOyaIdNlSxa9iH8r.Ncbg3AawybD40rwbsNc}
    18:18:36.449 v4UtPWx0hCdNUUd9Qj5.v4UtPWx0hCdNUUd9Qj5() contains string args <<<error CS0103: The name 'A_2' does not exist in the current context>>>, <<<error CS0103: The name 'A_1' does not exist in the current context>>>, <<<error CS0103: The name 'A_0' does not exist in the current context>>>
    18:18:36.481 v4UtPWx0hCdNUUd9Qj5.Le7w9LlkV1(string, string, string, v4UtPWx0hCdNUUd9Qj5) contains string args "PermissionType", "Hash", @"C:\Users\Tim\AppData\Roaming"
    18:18:36.491 ioJL3rX2rfNG6HZjURL.Le7w9LlkV1(object, ioJL3rX2rfNG6HZjURL) returns {ioJL3rX2rfNG6HZjURL}
    18:18:36.534 qQtSiEgdlfrgXayXaAT.qQtSiEgdlfrgXayXaAT() contains string arg: <<<error CS0103: The name 'A_0' does not exist in the current context>>>
    18:18:36.561 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args @"c:\users\tim\desktop\a22f3.exe" and @"c:\users\tim\appdata\roaming\hash\permissiontype"
    18:18:37.134 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MicrosoftEdgeUpdateTaskMachineCore1d7b5d880876446" and "PermissionType"
    18:18:37.140 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MicrosoftEdgeUpdateTaskMachineUA" and "PermissionType"
    18:18:37.149 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "npcapwatchdog" and "PermissionType"
    18:18:37.164 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "OneDrive Reporting Task-S-1-5-21-1866265027-1870850910-1579135973-1001" and "PermissionType"
    18:18:37.172 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "OneDrive Standalone Update Task-S-1-5-21-1866265027-1870850910-1579135973-1001" and "PermissionType"
    18:18:37.182 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args ".NET Framework NGEN v4.0.30319" and "PermissionType"
    18:18:37.195 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args ".NET Framework NGEN v4.0.30319 64" and "PermissionType"
    18:18:37.209 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args ".NET Framework NGEN v4.0.30319 64 Critical" and "PermissionType"
    18:18:37.220 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args ".NET Framework NGEN v4.0.30319 Critical" and "PermissionType"
    18:18:37.227 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "AD RMS Rights Policy Template Management (Automated)" and "PermissionType"
    18:18:37.235 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "AD RMS Rights Policy Template Management (Manual)" and "PermissionType"
    18:18:37.244 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EDP Policy Manager" and "PermissionType"
    18:18:37.253 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "PolicyConverter" and "PermissionType"
    18:18:37.260 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SmartScreenSpecific" and "PermissionType"
    18:18:37.268 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "VerifiedPublisherCertStoreCheck" and "PermissionType"
    18:18:37.276 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Microsoft Compatibility Appraiser" and "PermissionType"
    18:18:37.284 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "PcaPatchDbTask" and "PermissionType"
    18:18:37.292 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ProgramDataUpdater" and "PermissionType"
    18:18:37.300 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "StartupAppTask" and "PermissionType"
    18:18:37.308 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "appuriverifierdaily" and "PermissionType"
    18:18:37.317 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "appuriverifierinstall" and "PermissionType"
    18:18:37.327 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CleanupTemporaryState" and "PermissionType"
    18:18:37.339 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "DsSvcCleanup" and "PermissionType"
    18:18:37.346 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Backup" and "PermissionType"
    18:18:37.355 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Pre-staged app cleanup" and "PermissionType"
    18:18:37.364 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Proxy" and "PermissionType"
    18:18:37.374 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "BitLocker Encrypt All Drives" and "PermissionType"
    18:18:37.397 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "BitLocker MDM policy Refresh" and "PermissionType"
    18:18:37.404 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UninstallDeviceTask" and "PermissionType"
    18:18:37.413 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "BgTaskRegistrationMaintenanceTask" and "PermissionType"
    18:18:37.425 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "AikCertEnrollTask" and "PermissionType"
    18:18:37.434 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CryptoPolicyTask" and "PermissionType"
    18:18:37.443 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "KeyPreGenTask" and "PermissionType"
    18:18:37.454 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SystemTask" and "PermissionType"
    18:18:37.462 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UserTask" and "PermissionType"
    18:18:37.471 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UserTask-Roam" and "PermissionType"
    18:18:37.482 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ProactiveScan" and "PermissionType"
    18:18:37.489 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SyspartRepair" and "PermissionType"
    18:18:37.498 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "License Validation" and "PermissionType"
    18:18:37.506 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CreateObjectTask" and "PermissionType"
    18:18:37.514 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CULauncher" and "PermissionType"
    18:18:37.523 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Consolidator" and "PermissionType"
    18:18:37.529 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UsbCeip" and "PermissionType"
    18:18:37.539 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Data Integrity Check And Scan" and "PermissionType"
    18:18:37.546 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Data Integrity Scan" and "PermissionType"
    18:18:37.557 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Data Integrity Scan for Crash Recovery" and "PermissionType"
    18:18:37.566 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ScheduledDefrag" and "PermissionType"
    18:18:37.574 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Device" and "PermissionType"
    18:18:37.580 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Device User" and "PermissionType"
    18:18:37.589 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Metadata Refresh" and "PermissionType"
    18:18:37.599 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "HandleCommand" and "PermissionType"
    18:18:37.607 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "HandleWnsCommand" and "PermissionType"
    18:18:37.617 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "IntegrityCheck" and "PermissionType"
    18:18:37.623 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "LocateCommandUserSession" and "PermissionType"
    18:18:37.633 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceAccountChange" and "PermissionType"
    18:18:37.643 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceConnectedToNetwork" and "PermissionType"
    18:18:37.652 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceLocationRightsChange" and "PermissionType"
    18:18:37.661 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDevicePeriodic1" and "PermissionType"
    18:18:37.668 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDevicePeriodic24" and "PermissionType"
    18:18:37.679 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDevicePeriodic6" and "PermissionType"
    18:18:37.685 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDevicePolicyChange" and "PermissionType"
    18:18:37.691 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceProtectionStateChanged" and "PermissionType"
    18:18:37.700 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceScreenOnOff" and "PermissionType"
    18:18:37.708 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceSettingChange" and "PermissionType"
    18:18:37.716 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterDeviceWnsFallback" and "PermissionType"
    18:18:37.724 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegisterUserDevice" and "PermissionType"
    18:18:37.732 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RecommendedTroubleshootingScanner" and "PermissionType"
    18:18:37.743 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Scheduled" and "PermissionType"
    18:18:37.749 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "DirectXDatabaseUpdater" and "PermissionType"
    18:18:37.759 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "DXGIAdapterCache" and "PermissionType"
    18:18:37.767 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SilentCleanup" and "PermissionType"
    18:18:37.778 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Microsoft-Windows-DiskDiagnosticDataCollector" and "PermissionType"
    18:18:37.787 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Microsoft-Windows-DiskDiagnosticResolver" and "PermissionType"
    18:18:37.794 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Diagnostics" and "PermissionType"
    18:18:37.800 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "StorageSense" and "PermissionType"
    18:18:37.812 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "dusmtask" and "PermissionType"
    18:18:37.818 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EDP App Launch Task" and "PermissionType"
    18:18:37.827 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EDP Auth Task" and "PermissionType"
    18:18:37.833 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EDP Inaccessible Credentials Task" and "PermissionType"
    18:18:37.842 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "StorageCardEncryption Task" and "PermissionType"
    18:18:37.850 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MDMMaintenenceTask" and "PermissionType"
    18:18:37.856 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EnableErrorDetailsUpdate" and "PermissionType"
    18:18:37.862 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ErrorDetailsUpdate" and "PermissionType"
    18:18:37.871 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ExploitGuard MDM policy Refresh" and "PermissionType"
    18:18:37.880 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "DmClient" and "PermissionType"
    18:18:37.890 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "DmClientOnScenarioDownload" and "PermissionType"
    18:18:37.897 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Property Definition Sync" and "PermissionType"
    18:18:37.907 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "File History (maintenance mode)" and "PermissionType"
    18:18:37.918 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ReconcileFeatures" and "PermissionType"
    18:18:37.927 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UsageDataFlushing" and "PermissionType"
    18:18:37.934 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UsageDataReporting" and "PermissionType"
    18:18:37.943 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RefreshCache" and "PermissionType"
    18:18:37.954 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "FODCleanupTask" and "PermissionType"
    18:18:37.962 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "LocalUserSyncDataAvailable" and "PermissionType"
    18:18:37.970 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MouseSyncDataAvailable" and "PermissionType"
    18:18:37.978 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "PenSyncDataAvailable" and "PermissionType"
    18:18:37.990 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "TouchpadSyncDataAvailable" and "PermissionType"
    18:18:37.998 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ScanForUpdates" and "PermissionType"
    18:18:38.020 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ScanForUpdatesAsUser" and "PermissionType"
    18:18:38.031 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SmartRetry" and "PermissionType"
    18:18:38.038 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WakeUpAndContinueUpdates" and "PermissionType"
    18:18:38.048 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WakeUpAndScanForUpdates" and "PermissionType"
    18:18:38.058 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Synchronize Language Settings" and "PermissionType"
    18:18:38.066 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Installation" and "PermissionType"
    18:18:38.074 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ReconcileLanguageResources" and "PermissionType"
    18:18:38.081 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Uninstallation" and "PermissionType"
    18:18:38.092 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "TempSignedLicenseExchange" and "PermissionType"
    18:18:38.100 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Notifications" and "PermissionType"
    18:18:38.109 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WindowsActionDialog" and "PermissionType"
    18:18:38.120 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WinSAT" and "PermissionType"
    18:18:38.128 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Cellular" and "PermissionType"
    18:18:38.136 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Logon" and "PermissionType"
    18:18:38.145 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Retry" and "PermissionType"
    18:18:38.154 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RunOnReboot" and "PermissionType"
    18:18:38.159 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MapsToastTask" and "PermissionType"
    18:18:38.169 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MapsUpdateTask" and "PermissionType"
    18:18:38.177 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ProcessMemoryDiagnosticEvents" and "PermissionType"
    18:18:38.185 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RunFullMemoryDiagnostic" and "PermissionType"
    18:18:38.194 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MNO Metadata Parser" and "PermissionType"
    18:18:38.201 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "LPRemove" and "PermissionType"
    18:18:38.208 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SystemSoundsService" and "PermissionType"
    18:18:38.220 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "GatherNetworkInfo" and "PermissionType"
    18:18:38.229 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WiFiTask" and "PermissionType"
    18:18:38.239 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Background Synchronization" and "PermissionType"
    18:18:38.246 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Logon Synchronization" and "PermissionType"
    18:18:38.255 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Secure-Boot-Update" and "PermissionType"
    18:18:38.263 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Sqm-Tasks" and "PermissionType"
    18:18:38.271 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Device Install Group Policy" and "PermissionType"
    18:18:38.279 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Device Install Reboot Required" and "PermissionType"
    18:18:38.285 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Plug and Play Cleanup" and "PermissionType"
    18:18:38.294 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Sysprep Generalize Drivers" and "PermissionType"
    18:18:38.301 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "AnalyzeSystem" and "PermissionType"
    18:18:38.310 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EduPrintProv" and "PermissionType"
    18:18:38.316 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "LoginCheck" and "PermissionType"
    18:18:38.324 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Registration" and "PermissionType"
    18:18:38.332 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MobilityManager" and "PermissionType"
    18:18:38.343 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "VerifyWinRE" and "PermissionType"
    18:18:38.350 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RegIdleBackup" and "PermissionType"
    18:18:38.359 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RemoteAssistanceTask" and "PermissionType"
    18:18:38.367 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "StartComponentCleanup" and "PermissionType"
    18:18:38.375 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "BackgroundUploadTask" and "PermissionType"
    18:18:38.383 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "NetworkStateChangeTask" and "PermissionType"
    18:18:38.391 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SetupCleanupTask" and "PermissionType"
    18:18:38.398 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SnapshotCleanupTask" and "PermissionType"
    18:18:38.406 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Account Cleanup" and "PermissionType"
    18:18:38.417 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CreateObjectTask" and "PermissionType"
    18:18:38.426 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "FamilySafetyMonitor" and "PermissionType"
    18:18:38.432 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "FamilySafetyMonitorToastTask" and "PermissionType"
    18:18:38.441 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "FamilySafetyRefreshTask" and "PermissionType"
    18:18:38.449 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "IndexerAutomaticMaintenance" and "PermissionType"
    18:18:38.459 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UpdateUserPictureTask" and "PermissionType"
    18:18:38.469 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UninstallSMB1ClientTask" and "PermissionType"
    18:18:38.476 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UninstallSMB1ServerTask" and "PermissionType"
    18:18:38.482 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SvcRestartTask" and "PermissionType"
    18:18:38.488 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SvcRestartTaskLogon" and "PermissionType"
    18:18:38.497 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SvcRestartTaskNetwork" and "PermissionType"
    18:18:38.504 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SpaceAgentTask" and "PermissionType"
    18:18:38.512 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SpaceManagerTask" and "PermissionType"
    18:18:38.518 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SpeechModelDownloadTask" and "PermissionType"
    18:18:38.527 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MaintenanceTasks" and "PermissionType"
    18:18:38.534 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Storage Tiers Management Initialization" and "PermissionType"
    18:18:38.541 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Storage Tiers Optimization" and "PermissionType"
    18:18:38.549 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "EnableLicenseAcquisition" and "PermissionType"
    18:18:38.557 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "LicenseAcquisition" and "PermissionType"
    18:18:38.564 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "HybridDriveCachePrepopulate" and "PermissionType"
    18:18:38.573 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "HybridDriveCacheRebalance" and "PermissionType"
    18:18:38.582 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ResPriStaticDbSync" and "PermissionType"
    18:18:38.592 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WsSwapAssessmentTask" and "PermissionType"
    18:18:38.601 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SR" and "PermissionType"
    18:18:38.609 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Interactive" and "PermissionType"
    18:18:38.617 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RemoteFXvGPUDisableTask" and "PermissionType"
    18:18:38.629 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RemoteFXWarningTask" and "PermissionType"
    18:18:38.639 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MsCtfMonitor" and "PermissionType"
    18:18:38.648 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ForceSynchronizeTime" and "PermissionType"
    18:18:38.657 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SynchronizeTime" and "PermissionType"
    18:18:38.664 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "SynchronizeTimeZone" and "PermissionType"
    18:18:38.673 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Tpm-HASCertRetr" and "PermissionType"
    18:18:38.680 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Tpm-Maintenance" and "PermissionType"
    18:18:38.688 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "RunUpdateNotificationMgr" and "PermissionType"
    18:18:38.695 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "AC Power Install" and "PermissionType"
    18:18:38.701 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Maintenance Install" and "PermissionType"
    18:18:38.711 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "MusUx_UpdateInterval" and "PermissionType"
    18:18:38.720 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Reboot" and "PermissionType"
    18:18:38.730 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Reboot_AC" and "PermissionType"
    18:18:38.738 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Reboot_Battery" and "PermissionType"
    18:18:38.748 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Report policies" and "PermissionType"
    18:18:38.757 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Schedule Maintenance Work" and "PermissionType"
    18:18:38.767 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Schedule Scan" and "PermissionType"
    18:18:38.776 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Schedule Scan Static Task" and "PermissionType"
    18:18:38.784 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Schedule Wake To Work" and "PermissionType"
    18:18:38.791 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Schedule Work" and "PermissionType"
    18:18:38.799 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UpdateAssistant" and "PermissionType"
    18:18:38.805 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UpdateAssistantCalendarRun" and "PermissionType"
    18:18:38.813 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UpdateAssistantWakeupRun" and "PermissionType"
    18:18:38.828 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UpdateModelTask" and "PermissionType"
    18:18:38.838 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "USO_Broker_Display" and "PermissionType"
    18:18:38.846 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "USO_UxBroker" and "PermissionType"
    18:18:38.856 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UPnPHostConfig" and "PermissionType"
    18:18:38.863 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Usb-Notifications" and "PermissionType"
    18:18:38.873 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "HiveUploadTask" and "PermissionType"
    18:18:38.883 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "PerformRemediation" and "PermissionType"
    18:18:38.890 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WiFiTask" and "PermissionType"
    18:18:38.899 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "ResolutionHost" and "PermissionType"
    18:18:38.908 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Windows Defender Cache Maintenance" and "PermissionType"
    18:18:38.916 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Windows Defender Cleanup" and "PermissionType"
    18:18:38.926 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Windows Defender Scheduled Scan" and "PermissionType"
    18:18:38.934 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Windows Defender Verification" and "PermissionType"
    18:18:38.945 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "QueueReporting" and "PermissionType"
    18:18:38.957 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "BfeOnServiceStartTypeChange" and "PermissionType"
    18:18:38.966 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "UpdateLibrary" and "PermissionType"
    18:18:38.973 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Calibration Loader" and "PermissionType"
    18:18:38.983 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Scheduled Start" and "PermissionType"
    18:18:38.996 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "sih" and "PermissionType"
    18:18:39.002 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CacheTask" and "PermissionType"
    18:18:39.013 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "CDSSync" and "PermissionType"
    18:18:39.024 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WIM-Hash-Management" and "PermissionType"
    18:18:39.031 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "WIM-Hash-Validation" and "PermissionType"
    18:18:39.040 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Work Folders Logon Synchronization" and "PermissionType"
    18:18:39.050 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Work Folders Maintenance Work" and "PermissionType"
    18:18:39.059 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Automatic-Device-Join" and "PermissionType"
    18:18:39.071 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Device-Sync" and "PermissionType"
    18:18:39.082 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Recovery-Check" and "PermissionType"
    18:18:39.092 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "NotificationTask" and "PermissionType"
    18:18:39.102 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "OobeDiscovery" and "PermissionType"
    18:18:39.110 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "XblGameSaveTask" and "PermissionType"
    18:18:39.119 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "XblGameSaveTaskLogon" and "PermissionType"
    18:18:39.126 qQtSiEgdlfrgXayXaAT.Le7w9LlkV1(string, string, qQtSiEgdlfrgXayXaAT) contains string args "Firefox Default Browser Agent 308046B0AF4A39CB" and "PermissionType"
    18:18:39.166 QjaxasXN3sstiS3ps5F.QjaxasXN3sstiS3ps5F() returns <<<error CS0103: The name 'A_0' does not exist in the current context>>>
    18:18:39.181 QjaxasXN3sstiS3ps5F.Le7w9LlkV1(QjaxasXN3sstiS3ps5F) returns {QjaxasXN3sstiS3ps5F}
    18:18:39.216 cH37jOxu7wy9xFvPmPj.cH37jOxu7wy9xFvPmPj() returns <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:39.235 cH37jOxu7wy9xFvPmPj.Le7w9LlkV1(object, cH37jOxu7wy9xFvPmPj) returns {System.Security.Principal.WindowsIdentity}
    18:18:39.364 fp8YtcwCBx7d7qpRWKO.Le7w9LlkV1(fp8YtcwCBx7d7qpRWKO) Process: {fp8YtcwCBx7d7qpRWKO}
    18:18:39.372 rB6lctwzTGME9NB52nf.Le7w9LlkV1(object, rB6lctwzTGME9NB52nf) returns {rB6lctwzTGME9NB52nf}
    18:18:39.386 NEo0nLXIV2Nx8oSQLZy.NEo0nLXIV2Nx8oSQLZy() returns <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:39.412 NEo0nLXIV2Nx8oSQLZy.Le7w9LlkV1(string, NEo0nLXIV2Nx8oSQLZy) returns {NEo0nLXIV2Nx8oSQLZy}
    18:18:39.434 zk7brsIFYL36kYAa99L.zk7brsIFYL36kYAa99L() contains string args <<<error CS0103: The name 'A_0' does not exist in the current context>>> and <<<error CS0103: The name 'A_1' does not exist in the current context>>> and returns <<<error CS0103: The name 'A_2' does not exist in the current context>>>
    18:18:39.469 zk7brsIFYL36kYAa99L.Le7w9LlkV1(string, string, zk7brsIFYL36kYAa99L) contains string args "Set-MpPreference -ExclusionPath " and @"C:\" and returns {zk7brsIFYL36kYAa99L}
    18:18:39.490 cpeR8hbrhtMDPVjChJK.cpeR8hbrhtMDPVjChJK() returns string from byte <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:39.523 cpeR8hbrhtMDPVjChJK.Le7w9LlkV1(byte[], cpeR8hbrhtMDPVjChJK) returns string from byte {byte[0x00000046]}
    18:18:39.535 zk7brsIFYL36kYAa99L.Le7w9LlkV1(string, string, zk7brsIFYL36kYAa99L) contains string args "-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc " and "UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==" and returns {zk7brsIFYL36kYAa99L}
    18:18:39.555 Tf22lDXu8CyeLoAbaQx.Tf22lDXu8CyeLoAbaQx() Task function string <<<error CS0103: The name 'A_1' does not exist in the current context>>>
    18:18:39.570 Tf22lDXu8CyeLoAbaQx.Le7w9LlkV1(object, string, Microsoft.Win32.TaskScheduler.TaskDefinition, Tf22lDXu8CyeLoAbaQx) Task function string "bunsn"
    18:18:49.609 cH37jOxu7wy9xFvPmPj.Le7w9LlkV1(object, cH37jOxu7wy9xFvPmPj) returns {System.Security.Principal.WindowsIdentity}
    18:18:49.619 SmpYOOxXNOQQLYmREcT.Le7w9LlkV1(object, SmpYOOxXNOQQLYmREcT) {XpQeOyaIdNlSxa9iH8r.Ncbg3AawybD40rwbsNc}
    18:18:49.625 zk7brsIFYL36kYAa99L.Le7w9LlkV1(string, string, zk7brsIFYL36kYAa99L) contains string args "PermissionType" and ".exe" and returns {zk7brsIFYL36kYAa99L}
    18:18:49.635 v4UtPWx0hCdNUUd9Qj5.Le7w9LlkV1(string, string, string, v4UtPWx0hCdNUUd9Qj5) contains string args "PermissionType.exe", "Hash", @"C:\Users\Tim\AppData\Roaming"
    18:18:49.648 fp8YtcwCBx7d7qpRWKO.Le7w9LlkV1(fp8YtcwCBx7d7qpRWKO) Process: {fp8YtcwCBx7d7qpRWKO}
    18:18:49.657 rB6lctwzTGME9NB52nf.Le7w9LlkV1(object, rB6lctwzTGME9NB52nf) returns {rB6lctwzTGME9NB52nf}
    18:18:49.673 SmpYOOxXNOQQLYmREcT.Le7w9LlkV1(object, SmpYOOxXNOQQLYmREcT) {XpQeOyaIdNlSxa9iH8r.Ncbg3AawybD40rwbsNc}
    18:18:49.718 zjs2O6X4SkvMebcx19O.zjs2O6X4SkvMebcx19O() returns <<<error CS0103: The name 'A_4' does not exist in the current context>>>
    18:18:49.736 zjs2O6X4SkvMebcx19O.Le7w9LlkV1(string, string, string, string, zjs2O6X4SkvMebcx19O) returns Invoke ( @"Microsoft\Windows\" )
    18:18:49.741 Tf22lDXu8CyeLoAbaQx.Le7w9LlkV1(object, string, Microsoft.Win32.TaskScheduler.TaskDefinition, Tf22lDXu8CyeLoAbaQx) Task function string @"Microsoft\Windows\Hash\PermissionType"
    18:18:49.831 The program '[0x1464] a22f3.exe' has exited with code 0 (0x0).