"powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 502 Bad GatewayServer: mitmproxy 8.1.1Connection: closeContent-Type: text/htmlcontent-length: 137 502 Bad Gateway

502 Bad Gateway

connection closed

"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 13 Apr 2026 06:36:03 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: keep-alivealt-svc: h3=\":443\"; ma=86400api-supported-versions: 3.0, 4.0Cache-Control: public,max-age=604800Repor"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a3c[{\"date\":\"2024-01-01\",\"localName\":\"Neujahr\",\"name\":\"New Year's Day\",\"countryCode\":\"AT\",\"fixed\":false,\"global\":true,\"counties\":null,\"launchYear\":null,\"types\":[\"Public\"]},{\"date\":\"2024-01-06\",\"localName\":\"Heilige Drei K"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "0"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKServer: nginxDate: Mon 13 Apr 2026 06:36:09 GMTContent-Type: application/jsonContent-Length: 12Connection: keep-alive"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "{\"ok\":true}"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5 max=100content-type: application/ziplast-modified: Sun 12 Apr 2026 14:48:49 GMTaccept-ranges: bytescontent-length: 9439702date: Mon 13 Apr 2026 06:36:24 GMTalt-svc: h3=\":443\"; ma=259"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "504b03041400000008002968585b854f575e76ed0b00d87f11000e0000006c696269636f6e762d322e646c6ccc5a0b7853659afe93de4be1a45006b9b6202ce894d2822c1483f69454526ca523208c8080421047014b2ee8ba4b4292b6676b30b833bb8cf26c65701e471d6f2b0b290a262dd21656292da05c9472194d8c8ce05c688b36fb7dff7fcec9c9a54099e79967f240cf39fffffddfff7ef7ef5cca1f769304424822fc0f8508f110f62b2237fe59e1ff80ecbd03c8aeb44f467b54659f8c9efff89a0d39eb2bd7adae5cf154ce632bd6ae5d67cc7974554ea5696dce9ab539bab9f3729e5ab772555efffee963451e152584acacca20dbf6af584d2a32c95418bb4cfe694c3fb5faa764869a90b24c423208c91904131a5cd196a526e2b99ae1c65f1251b3938e4c3ab8e87426c8b55c052bd9b84642ad8938c8a7d64c5204d4c49d498e25c3d19b49fc4970cccf24db8713b26d21cc4f80ebd64c722681f4fa2b1a9a4926c4196fde9a496a54bdafcb33aeda68c4eda6ab19a0190ae1c4df72f897b7728571058a8903156aaa03728f9a11846de7cdab6484ef360d805530df0cc7a218baa2bcf58c6efb70262b1901c7d4cc58ba8d8c4e8776003b912c388e8d43f7e8860d789ed30ffeaccf24f17e56c4b78af12b5231dd5339a6c7e1b786d11d4b66b621a9a89b183a6fdeac07e7e3f922fcf38ac8af380e9df1c90db2cddf15e97471e82a37543e4608f301f00582fbdf17075fe5aa27d73d46984fb432df23653174c5e41ff4a777f5ef5a964902774d51132ebb88f00bf8f90b163e344f6fff76825e38522e7cec6ce39c5540599be40742a797db32116c66f7abf4b523d77299445f3bf16b5b26290809494d4010cce0b27584d4fb4121a1e37aa1732f5af8b29e7b6f905e38a8777a4d17f5b5334b60616d8abd53cd3927a8288a0db0d6ff36a0684aa1b8aaa77870a1de7e60c2e247962de597f04b1bb96c62ef5699bef2e4c34cc1a555abf5b5b0fdfa54407271402629ab1db7149004b3804e5f789073fc171181f0a1637ac18f20a62082f30597f4b5537db0a436d9dea9e21cafa27cc94eaf713a1d303ee3bc647c4a5f9bf4c800948fc01a63ff72c1bf179d452f74855aed49a71ec924aac0a2502844e5d5d70e3e4a89fbef8543533262f7bf93af068519df2cf046895144f62141c00ccb0d743d905427049f77039f358ccf8370f04f458524e3b68135405b9f8d6c3530e8e6b231fd12d95a39608723fd61a5f0a9b08008ed654293b3cdb4bc3669f2236835e33ffb77b4a848a9d059d0a617aef8138fd10be1145e7cdd1ebee08503feab3f8642a0a664d06349c1459dd0d15402c521140229729814208383fa8fff7ee0ea9a15929683f62c77fb775306c606790727ec000385f66b2ae37c18153579c5ff1c4cc096c19744"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "bfc18a6e208c10d70e5eb3fd479b7f72441ad90e5f8be10c809118d4e2f2fd3367da84a0a43415834085df2fb8003e5e7081fed18a1f45113e8a7de023f0fe207c4d829fe2da66610bdeaff6b5029eb4896b2f84511e113d78b0527e9794c362cd6792fbc00affb4bd05febcbdeece39a5a5e59d9fa20f2987fffe3be90ab12e47696d55dd078402b1a0ae3c1824811b10e852f1913ac93f232537f74883abe43a76b15398155c7c73d50955d3755452316a5379e7bd649753de898603fe699fe48a0f36e67a22ce24ffb4b56c1da99f2375d40b74d79953f6407910c31b85efc72157752f134cc1fd49c9ad927259917a5d0f371e53a7b1739aa6fd1f7f014674f425ca8a2d6d4c668034ff5b691bcd346afddf7c90a993c7923af925685b767709a552b1b8c991361af6e4a684571d29b839bb9b8ac5e55b8a256510d7e89f547206d3e8b37816dcea39bcdf10c721fc45287b78ac3e5e1fdf0333ff93f1f57fd238be7ec71b5ff2ff687c4f0efb8bf1fd31e33f195fcfa3c6f12dbefb38e3bbf5b2ffc9f8ba4f3dcef8c648bedc1459d9e150eabd819201f6aca2a42527498db9297dd8be44098ed317bbd202276fd9774268e59d28d55e20a72f4932dcd7d99526a5158e05a70075ab44a484dfb79b4c6593e008f129d95589153830486e01a969051d1f6e36a3c44f913c9eed26eb832109892092f6ab563fe57a7728bf866c04c48ac758f5d518458738c22dd1ea87daa9fa49910456dd4fd56d348cbf994d65b950f1c71e7a695b3190b5f35d8fd6ceb382de4ec6b7d4cedfbb583b615983175478082a5c81152ade661fd6c007161be1f4680ba9bba8857eedac85a8bdc9da69864831b79bff1722c50c3c2652cc0e6b626ca418138f9555cd4757c446f7d6510ea79bb4f328cf9fcfe6bfa193e717c4e507d8325d6ee5cb342a2e3fb583f2bfede1f513b47c0057750f735c2d569cc75660157c88d00a7c1e85dfbe9d0c7e47780bf57402c1e27ba1f836aabf8dc17f177c2021b7726eb47ef53754ff9c0e5edfadd7df1ce1c5b5faf53c7e9d58b9dc80016c86fdcc7c86f97afdfb78fdd20b205119e183a97ccfa4d75dc4b030a59bf7dd27aaafd7e0c74a9cab95f8a127167e87d8e8dfe2d8a36e8ecb37b1f5fbfb9f3cffc5b8fc2236fa55021fbd57cbe7cf4dce35e0b35b8347e5cbd10166b001f6e71b40b571fd2294ffbc87f661e5b668e97d5f53e9d51a3a9dd4a3e921a0bc17d78b96b7395aa3882def9b7ff01adf77ebed07d1dc14d0b5ac80974d6193096a9b1aaf43a0dc8a087b31ff44b4d54347a9e4591adaae62253fc1986118d5a97273b46c0b8b7a74592f2f7b032bbb15463b42882bfb0e9bdf3c0d192f6265ef82b264573a45a35e5f51b9470ef3720358b9bb75083f6268938df5320d410f7451d932469d8cbd2f62ad0ed4"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "bc88f244748897d210cfc65ab3488625d49f40b924d5f2722751b993a837fcfa287d9785cd200f4786b45faab7824630854a17653b7ccbd26447fadec890afa000486e8fd2847a941435cc871119f231cbaa8e4209b251bf11ba6b4d4c7ca0f8f32c9e0877c8befef55b4540a24d92af68a8ec13f881d6db267a3351caf78db1fb6e49b2fb66a5c820157a0609ec3094414f8fd4a7a3f65236a53d4a492e46d9da57300317371f7f1f29402a9244c4af8051117ccd292bb7a56590046a0371dd3fe4abd24884bc1517fafcd82a1c4ff129b3891035175bbb819af012eaf8a032026a02928c7e76df438fd2383a222db2bbd12abb7f159cc536df24d9bb87d981da955d05683b77d0a1a85264e6048902308a1e09d5d430bb2a3c1715fabcda7ee91f6d528ab4d81734c859f5e2ca55bf9b4cb470f55a2f258fdb611e497618788aec1bbf788b48a18f64796ca2e8fdc874fcf3ad3689bf1cfaeb3074d5aefbeb84c1038db33137c8f37e8b44b4d1e34b2092d8f362eca72480ddd03e9a951efa0bdfc5f0f998f97b4d78f18fc5cfd6f05382d51d4aded3421756d323b478fcb9c5e11ba5348b300d6b1ae2c2accc007bb6e1501a6524addd34ef89e82280d64a4ac5a90ef1d933f084940d24f11c59d91569f1064a9c05997030c9cfc502800de7cabef3649a2d6c3d2c2056dd41275f396bb3b872c821225372fa668772aeac9cd7984f76d78df97ac8a959f6b1d634d13b8cb81446cdbc250ef684af0edfa50eea07f96376a1a23a94cec8f409f28290bb27e2bc1e86e4fd45acc2b7d1b2cfadad547fd9f700a7a0d9801159bf882bbdbfe1787eb3a7ffe2502e7528e7697ee1f9b8a01d3e34757eccfaf8100806e68be19a7c97cd40b68bf6d347f271c344684af96cc3dc4bbb7f595a2ef68e9a1e7caaf4e212e4bab7019df0f9f88e29d2770cea1bbc5d3459a8c6e721518052076c1e999a2d407a649c163932ad8e0cb9616294fc36d091fb69833e0120a6d1c74e5cc8e91358c30c80a2171da8c310ce51f23322434e9ea811b8f0fb1cfe50bf1037e3aed09a9f23115ecb43c114a81df51ec60f62464ddce28aa86ac3460056571afb7a3d4b1bb66a8b18be3f909582402f5252985bc8ebfc481ef5f588c67a1df26e8368f0e9823768ec498b07a40a8c2a90fd9558811a527f51aa7fd159aece534afbe6ba7a13c4ca59fa43cb66f6aa454615ee1dfe69db2457fbeda5c9aece42665499bdbb6405ea25cf172bd2d0e2d27a1194fbc4d551cd9e5c4ae294167a7689177f8f04fdb6a491fea923e901665ebdacec1627832cb18b5e62fe79422412751d335b7f5aa9db0b8b352dd9b36b3114ad5850a758d85bcbcf8aabb3f79656f96da65bd5950c5fdd8165d95788950fe92f2212d9148a50bf6bf24fdd88aa3657474e6992bb0e5f4296fd5d5c0b"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "0c97518bf938dc07bab1d04cad7df7815e4c1744d33d981eafa5e54617c18b1480bf0534f9471dccdb83fc4763f2995cf4a746077cf28559728ae83d0b2f4e7cb2835eb7dab2e431a2179b50513d6bb4c796aeae9db5d8648a0a31a1b307c128d237c9bed3720b518af9c5e11f52f139628e0525177931618cf33d1373fcfa95c35f85affb347c5e90e26d5b7aae4fb6dafce513e9dd6ebb507a7aa11272086d76345e0ceeb34e551eb4668c3699f294fbac1346e32608c0c66f2a41c7fed0f6934f22a178210d8bc8c10356e8018986c39ff034c97d0f0ec64ac737309717c8ddd89cecae4b71084159991af2c9edcad443d8fe017bf9668934bc3d42e95087bfff80ddbd11a9368564e4830e657fe8937fa0ab14e457a98eac5f44b7f798780018fe5ccddc23c334e474d5e6f3d00c1cc2bef000e65f3f9062cbca4d2a190c3bcdaeec95ddf5825d99f16dbb9cb5b5e400c6f27562c71ffe821d53480e0ce8f37bc8f60f940dda1dca616557648737503260aaffb61c0107b1b28ac496f1efa2e2c7c757606c22f450be69d6e238912534ecc498f8d931af03e6cbbe9c859789248cfafa18e3c337a1089a2ac3d1f16a64b8efb1ebe9f099d5c89807ca592af3f58ab732c89451f4c472f732cf66cf48aef6534abfa81a08ac793b0879c82b80fccbca1639fd3093257134f6daf3389f76f8ed471c59d211d1731f3124a9ddb918b861aac939166fc57f3ad88b6f32533e45986c2276880e2025a0b11a43c4176221b2d7216f142491519479796c1fd1fb2eb64a960cf3a3d0a967ebd3d967f983d863c9aa06a91dd26a923a3d4aa78acbefecb503c3c437850dd211c08b66155db538fca384c71107c79dfa024ac51fa4214a86fbdbdd9b920ab3fe257a56a048b860701a8cdf017cedbe3b90af95e02d95fa3c6c50bc4bf9680f2c38b12ce7094084073e8a9734c32559d8ae4af84c717e0abe28fd9ffd17b3deb90edfa8bbeda289f49e761f0e6e46da84ccb6d08f7f3799d69f4b400a86843b5814fd5365ff2c01b5a3fbfe4e5bd222bbdbfb8b15a702902343b23f12e99832767d7ff6cadc9a8b9c3588cb352105e7ba34457e94e106d4aa446703e5cbd2c65d343e2343f4d49858aac4593c41f4b4d3912727f33168a1b63f8de2303aea7a4724816ec3c9943fae7592680a0fe4ebe22c96956fed597f2e39cfeeb78d478b5459a997ddfb7ae5d6b02cec841dbbd984fb68f0df712c77b638fc0b0528beb8d53509c9d565d0962cdada114526d8c75ad344af873a6e97dd9b720d3862f72fef17de65d8f1ee65699999a2f7527a269cd373a968e297fd2c9f606257766960095d2a9261479a48728d12ea8dc4f899072ccf04f4edc180186f874e1f00587ceb00c3b2d7c7ad27c907be84214b9100d3329d1d438f222d907bb40c07529424fb729364"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "e6f203e0bd0aae2e1c8e7190ff3fa5b0cde29faae3bbdab7a8bb5fb02d59f97ac9c8d77f73c788af25ce5092992ef725db37cd50fadbdb897346db9206eb181e0deaf3796a44ecb39dbeb6196dba98212daaca43fa281db92c1d731f0cbd6bd6e875dfef206ad712d31b7cf356561ed1b39ef8495eadebf04b9cf351d3cff7291ff04d473f4175bdd8cc5e0a86c6e3d75bb827e174eb70af12c22ae50b66de314ae4872a6df5899e0f42134e502d288b34b9bc7cb5e74bc110bd66149ed1f04155eb3a2f6bc721c63d3ea8585f24f2e810b133bf8d17b51c18c88afd5556ec079b6ef0d877e1c0e48cbef134fe1808caec5f9de035ad924d9db232d0eb3c3e6784722d26f6b0171718edc5a4e756e585422f1e677abd0159d271f76e790ddb01cec746e26546fd4d3cb4f13bfc96f97c889889aa8fefabbb0c62863831229f69274454a5ec6111e1f0622c8fe8d3bec7c157dff218bd57f735b6b7d36978ca4a166aa80fd788af0ae1fa0eb9751ba55f0e0e3acd290a6c8979d007c524ba3f95957db8f3c717c748e26c13e0487de1a33bde49959d1be70cd3cd57d0f94549e12ec87f3a9d6134bb3772b403f30d9d9ab360c0bfc2c1a70a4efb130e85c35d2ded4d59faf323dfc0230c55923b72de12daceccb2cffa81768eafc1317e712542705039d07063f08ff90962388361c1ae0e8f5e0ef744e601328732efa3b9bf7323fe144b0ea62b68c1f375fbded6e72f2c299931e763b1aebbb22174372edddf0add752f9e10289bbae8fb15cceb009c41878cad71b1192db1bf6925ab3fd86f9c303146a29fb0ad03f1b038b67b7a682aebd78f169aae92710bb2404596ecec6cb2cac1f29437f969087894c8a8107efd656fd7ee0f1548c712cafb00c7c31dc713e58eafccb2b23384fb7ca2683cb29208a9b5c9a6101e02d2f72cc9855579fec5be89bd85c19934f490cd220b360b8c5a91c5ce95e7c96c8f9c32797358bfff52743f76cecbced70b94a244e4c0d41479cd382613f650ec9f1c6a12983568b2d2315fb3079246ed0e7711690ebe4a0ccd1128cf6c4e36521e61e9e52a51f89f8c9d3eba277c94f0b784b713ce26bc9cb08eb09cb080f0178403081308f75572dc41b889b093f065c24719aa451e5a89bb1886de66bf78507de86576f91cfb7d82fd2e67bfbf67bf77b3dfa5ec7709fbbd9dfd2e60bf37b1df59ecf76af63b9dfd5ec67e27b1df3af6eb63bf63d96f19fb1dc57e8bd8ef08f63b9cfdfe82fd0e61bfa76002fbb3cb74f66b61bff89d745be808fbddcf7e77b1df6fd8ef76f80d7dc62e3f66bf5dec773dfb7d8ffdbe832c6fb2cb57f0f20576f9145e3ec62e71afb0d03276f95bbc0cb2cbc57879fbf1d8d74bb4abb57fcced79226e8b4dc30ddccaf05c3970fa71f6067d6fb81b6ac840f98dddef3cff377460c4ea81bf6f"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "62ed72ed2aed97da8ddaadda1dda6fb4fbb4df690f6b8f6b4f6bcf6b2f69af6a6f6aef681f689f689f6b7fd5bed1fea125741a1da933ebec3a978ed1f13a9fee135d365d2e5d5e5d3e5d215d315d295d395d255d355d2d5d3d5d435d535d9aaeb5aebdae93ae9bae97ae9f6e906e986ea46eacee33dd14dde7bad9baf9bac5bae5ba55ba2f751b755b753b74dfe8f6e9bed31dd61dd79d8ed39e32338faa33ffc6ebb8fab43af36fbfce7f48bbe0c3fb22f512f5b2b0b522cef62bffe25badfe32ecdba8de82acd98ed83bd599ff92d72e88b347bdff1f11bf531ffa87dd4295ae6aa7eaa0cacceca4eaa6ea15661f557fd540d560d550d570d508d528d518d538d584b07fa26ab22a6b8b69aacf553355b35573559108f3558bc3d6b2f0b222bcac06ef5ad53ad506d526d516d55761cf76d54ed52ed56ed55ed57ed581b03ea83aa23aa63aa13aa53aa38ae6e49cea82eaa2eab2ea4755e65f5ed7543fa91eaa7e56bd52bd5329d57ab5454da9bd6a491d546757e754e75127abf3ab0baa8ba84ba8cbaa2ba82ba9abaa6baa6babebaa53d50dd48dd44dd569ea74751b757b75277577752f751f757ff560f550f570f5887fb39647a9c7aac7ab27aa27ab33ff475ed3c3fb9d195ee6c0feeb7ea89dfaaa26482d3d533e57be54feaa7cadcccc7ca37cabfc43890450122a954aa3d2a9c80f5b1855669555655739552e15ad62546cd8cb871751e55325c4a9f950d8974b95479514667e55a1f07b315589f07b292c6dd90fbabcaa92aaaa2af3a3af1a1fd63d503e467398b95db93346ef52ee5666fe8dd75ee57e65e67ff2754079f06fc738a43cf297b4c79427fee23ba53cf3b7639e53fea0bcacbcaabca1bcfdb7b7b9fbd1949bc26bb6c659bb4a99f92f7ead55aec762ce51ce572e522ec5bc5394d39533111f7efeefabecaf1cf861fd60e5d0ff402e872b47284785b71ba31c075b4fc0a23453b650b654a62bdbfc257abbb0a783b2a3b2b3b26bd8eafe4ff7de53d9fbc3fa546503652365937fa4cd9a91a95668159999a4c2acb02a1c0a4ae1517815bcc2a70884bdb222bb22b722af2245915f515051585154515c514a5146515e5155515bd140d148d154d142d14ad146d15e91a1e8ace8aae8a1e8ade8a718a818a218ae18a918a318a7f84c3159314d3143315b314fb140b148b154b142b14ab156b15eb149b155b15df1b562b7629fe280e2a0e2b0e2a8e284e2b4e29ce207c565c555c50dc56dc51dc57dc523c553c573c52f8ad78a378ab78af70a8250133ac24098091be12028c24d78082fc11122e1273e214244762227919b4824928814223f5190284c14258a132589d24459a23c5191a84c54256a10b589ba442ad180684434219a1169443ad186684764109d89ae4477a227d19be84bf4270612838961c4086234318e984084cf"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "23f502014ff889eb821ebf70c8cfe1ba456cf78b4ed1a05cb100a778383795b04bdaa5ecd27619bb9c5dc1ae685742ae32aa0aaa2aed54e39b35c40d35edda9edbeadaf5c27dcbfa76639a35b19bf24c73c2169e8d5f02b65bdb6d7c4e5ba876414f680fa783ddc9ee0cec6277b3bbdbbdecde765fa87e767f7b0070a03dd81e02fc8d7687511f2eee19618f263e96fa387b3c7002f189e893786eb2efb97f404df1395303de6b9a3d9d3b3338ceb6e788cc5c7b9e273fdfb7bb006a21398becc5f6127b299f2e032ee77c05e16ab1b7166c9dbd21e01d3685fc696cb6b7707f2be1b680d4767b87bdc73e00f730ea987d3cc42d27c83b49fd14f5d3f619fb1cb1f3f645c24bf665e05fc4ff16775c05bb665f47bf61bbe19e9b98dde2f3db217277ec7b70efdb0f68f608fdb1fdd47e4eea85c8bff26dbe16ea8dfd16fcc3276d4771fef1a202a3a1a2731d835071544286aef389c9d10286118fc91dfc6b0e2c96135b68fc8bcd89eb7cc37502c2444e626012c70d79920a3f9993dc9749e1a4844ee5a4464f4393b44e3ac2f42297c1b391d1c9442ab3c7cbe26475b27b740e27b75079c1f23b059c824e21a770c0db15e3baa453da2913302b2b7479a7826f5631c467ace6d4706a06f9b59cdaf0ea3a0df8a4a1d3c869ea4b3513aab9cf6f21d42f9cb5f2cd5b3b6d9c764e07781d9d4e4e673eeb42d835e83dba39dd83bc9e4e2f78fd84df5fb001ceafce20a8c1a821bebda1420df3f9c3498da03e2ae849a3839cb1dc19173099e04c24679233d59906363d68730639b3d067a3e6935a80bec8935c1ce2e7b3d4e72d27b5d2e7ad25b50e7d3db18de89b826edae6b8119cedce0e67a727b1cbd9cdd51ec2bdd4f773ef20c743c023a8a3a8e3ce49f4d3a833a87394384ffd82efc9973ceab273c5a3fe72aefb92379c9bd0b79cdb11bcf91d9addf525ee71f52068ef7190f38c3bcf9d1760af48bda6fe06fd2dea9df3d171c98914867fd3854509fbbcfb1558d4ff23bd2ac0a446b62e8b0f2ea9a4aa5249e32e83dbe20e0fd7c517f7c1dddd9dc5d9c56d91c5ddd9c51716777777a7dfe552af5e92ee1978ff9fefbbe79e73eeb995a41be69bd1a2291d022c16aa7888f1b50472965065e0079ce29ae6f75cba66288f22e3529b9a50130b99adf9835e3ee527512c19b0144aa5542cb596464b2b553ae8e9a1326a99b4cc5aa8ebf42ca0b23a9cec5a0e543935ff37ae5c5a6e99c9833daf6b239ff6a3965f2ba015d40a69851d93225a31a98a6b25242ba99592ac34f6328865b572ae132ba0aaa85572b895815775a5aa69d5b51a5a4ded27706b69b5715607b1ae564f25eb4bd6007a43e48db4c69e376ea235d55a682d3d6e2bad75904fa60d7a6180eda0da6b1d003b699d01bb685db56e38ed0ed853eb05d847ebabf583de1f6a80361070"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "52b8c925c921e4cb29f4a697c909a4b560be049227b0cfcc2f92a42bfd4892f67d0c466a81911753f4ed134b8fa41c48d9924206ff9e92b293ff227d22fd33a734ba351579a5c8a770928793ab93ab921553d8b2df2c8d713bf03b133e9236c9d6fbebcc7f55a7245f48ce4a6e2777a448b3f929656045600f5278c93529352909a46672b7cc76a5f4a5305336c70da70ca5dc1b7993329eb23f6a43cfcf9413a8c359df52a83bf92333518dec83287f4a40eaca304c2a31d594ba2cd526d528ec56cf4aaa7df3c3a66d949e1ca5544bcadc548754d5d4da8e15142fca9e542c883d2d4f2eb85ebb3755074496a99b5237a68644e05213112174ed548aacca9de49d6c415b98ba00c42b403c03f4eacd910373c951fc659a57eaacd4f3e6a728b1058d0d58f36330797804fc04a5aff178aa51f861a0ae0c1d8808a1e4508653a5cf852e00bf69edcdf695e6d349d2fbf0f10c874a51ea606a522acbb221839d7a7fbc8a3294ba26ee11a8fcb0d679dd584751eaf979c1f312e675cf8bc9cf4da5a5b627b1539fa0c2a322a3c240656c54716a02aa05809e1a1ff51cc5b55834981af58252967a09951ef520358c52053a85a40a5305a9f753afa02e82355c41fd05fc9b54215b7ad525c2febaea5a66fe6d32fe2e8b6f718797dfd91cb12d6e5bfcb6846d69ec8335d5f9ea3673b2362540a1b743d5cc2ba2527db27cacfaf4d274d3d4a3e7a4b9585a952fa3daa4b9a511d2e0697669f6962bd3e6a52d4c5b90361f3062e47c4bfb344c9a659a47da9a342b8a74df4f618fd7ac4f5b67a9e86f3dfcaec9cb7245f166001fcb2d965bd3bc27adcfa4dd92e69bb6cd32b623306d47dae1b41c6a27efa7f9ed9ca0b4a1508979b2e5b0b020cd1bf64118622962a75b665be6a405a73db07cbfcd70805b79226c779856f436de65594c330f4d6b4586a7d1cc1f01ff242db601066fe8dc11ae89bfda2b31bf033f91f62afc625a75789ee551abacf48ba0d345cbecb42c597426ad3aad2a2d37a322f4c3ac6f19b719e7d31f531a32c2d231e997329451d267ecd9e9b631f6192db33e67acced893919ab13b23277d76c6d2b007e9f73336a42349e8e4e134df746594c0323a7dd8eaa80ddd75d475118d9dd19ce1990e653aa557234ad267a613d267a26fa59f4235b016b498665cb18a4dafcbc8b2ccb3cc4a1f481f852fc14a5ffbdb96c1cf9897f13d3dc1ea6dfabbf4de34aed5d20cdd59f3330e81eabfafe55ae3b6a7cb5719a57784c9cf7aca18670ea535cae69e957ec8ea4afa593072147e1cf40ac8f8927124234936c7d1f437694ae99fb9d588b5e991565ec29be8dbe8c8f19f3054d131597562fa82f40b60ae1f199b32de65dccc9891b1799657c6cb0cff8cb35609e9e7d2913d67d2d57b9f5a3d65a83979d6065bcdcfd89d3eab5294ee9a71"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "0d1d8d1d9517bd1af515ed13258dfeddeb8ca87054ba2f9b44a5bb2b464f8b6689e68b1a4651a279a2f2d1c6d1ba3d902877f4e768db68d7a870b4737474747094333a32da373a34fa06ec2473943f6a27fa30da31ba45a42ad21605893e8f4e172988f4c1aa4f80fdd214e989d44472a2a522c9285c640df6842cb200e78a17c144334436227b51b4c74ad1aabdaae30b4473448ea285a20da2b57bd789368a3c45074401a29d227f910b09261e458844707145a0ead888082de644a0c448711d0f2fb600daa8e8f83eacb87b1f466c259e23b611cfd86f2da68897ef9b2526882dc56471e1dab4315bf17c71d5d802f162f1b7b145623bf142316ccc41bc4cec245e224e1c5b29debacf51bc0560b97895d845ec2e5e23761377f29cc56aa0f35a71f43e5771d23ea2d843ec29ee0f945e6fad166f16af176f146f109f1ff316fb88378f5d03791c988b34b66dea4ac87da7f44a88c9f3156f176f12fb8bbdc03f3ff156b1cd587fe03dd0853ed630563fb6455c3bb653bc43ac05ce609e38483c57bc5bbc4ebc4bdc59b147fc61df0af17b80bde283e285fbf689678bd5c507c492b143e2c2f6c362f07b7c37e9b7d9b2f705888f8a03c58cc023e299634bc5f66217125724104967ab1efb24fa207a27d2dad73da6b6eff858f298ca98f2180aac3b69cc506c31663e861dd31b838dcd1c9b3ef673cc708c3bd63b66396635b6746cf6d8b2b1c563e6e205636bc6d68ecd147b8cf98e6dd9b775cc73ecfdbe0f633e63dbc70e8f3d1adb3d767eecc0d8deb1fd6337c66e8e9d181b1d7b3e1631f672ac68ece958d9bef2b198b184b1c6b1cab1ccb182b1c2b18ab1e2b1dfd76d24ee1a3313b78f31c6c6c77863efc6be8c7d1b53117f1d9b26d6164f179b88035027e24faccc5879569c8fbe3b785e7ca25e1a9d14efb268a93d2dbe228e168788ef89af8917991f485c53f5cce5b238561c234ede9f2fae75f1dbf9eb4a53ca12652c01e84a51efe626bb48dfb52bf569fb0b26f349b27cf2a49a3da5e688df39be779cdd29fd7e9c2b9412f12f5f2cae167f5b59256e1637889f37b7895bc5bde21ef15bb10bbea0fc93784cec15f159fc4ecc1133c542b1dac8a058204eed9910ff14efdba3313e6dbcb7cb7a6fb368d5deaebda1e39ae312b1fcb8dab8eeb8d678c4709e53716d7244f0ce1b238871f8f825d6fcf1d9e33531d2ef25b83967cdf8ad3977733efbb8f6bddbe931fe4b731e7fb7d37dfcc0820be3ebc6d71e081ebf387e69fccaf8c1f16be321e357c7fd0e5c1edf0ef02de2fab8f41b11db6393a30f1db8397e63dc6b7cf7f8adf17dadb7c1584f3076fdf8c6f16da0d66f7cf3b8efb8cf78e0f85e507178fcc438cbf9e18117e3f7a3425359ce77007b39fed7b8f41dea8fc79f8c079b878d4bdf4dbfa651fa480e367f352efd7696"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "-6"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "85411150141407254049501a9401654139501e540495411570fe2aa801d66d5007d403f54103d0101c3702f361d00dd0b3c1f60c98cf053d0ff442d08b402f06bd14f432d0cb41af02bd06f45ad0eb408f825e0f7a23e82da0b782de067a3b68165ce61c984fbdd9df3901fcdb010a814e402fccdc3d730c7d70e6a1996b3390993741df0cfd10209d5904c433bf9d91cc9c42cfa06f81be153a09fd25f936e8edd03ba027d0fbee80de71cf8c70e632f4fe3b8233e83b50773c70c7b3eeb87cc7953ba667cecddc077d065430239a09cc8466a6a1e7a07742cf432f40ef82de0dbd070a85de0b3d3f73f1dcfb811f03fbc09599e8b9cb335767d2e732e7ae9e639e93df25bdeb7d00fd0ec61d93d3bf9f999a79ea77e7b7cd4ccedc3e73e7ccf5997701b7df75db5ddfb8f01f17be7de12b17be7c61f6c2db2f7cf0c2072e7cfac2a72e08eeb8087dd5f42ba65f39fdeae94bd03b662666ee9a09cf30a04c280b2a800aa14f42df069d3e77fedcf3ce3dffdcb3cfcd9cc39fc39d7bceb9e79e7bd1b9179f3b77eeb673b7dd79fb9d9873d8734bc0f7a67f300d9c9b3cf7da73af3bf7e839d439f4b9c84c74e601e8b3a0f7439f09bd7e6ee1dcc53b27cedd712e76ce7e2e7fae70eec173a27357ceb1ce11ce11cfc5cf29cea9ce69cfb5cf75cebd669a304dbda37257e9aefc5dd7ef80ddf111a07c57e1aee25db9bbd62f7cf4c2472e7ceec263171e9d7efdf4eba6df30fdc5e927a6ff30fdc7e93f4d33ef61dd039db977e6e2cca599fb669e3173ffcc33671e9879d6cc67eff9da051154fd6cd5b3ff70017e076c063e839841cea066d0339819ec0c6e063f439821ce9066c8339419ea0c6d863ec39861ceb066d8339c19ee0c6f863f73e91c6bfa9ee96f5cba348d9996cdc8671433ca19d58c7a4633a39dd1cde8670c33c619d38c79c632639db1cdd8671c33ce19d78c7bc633e39df1cdf867de0ebd74c7d13dc7f7c8a072a802aa84aaa06aa806aa85eaa07aa8016a849aa066a8056a85daa076a803ea84baa06ea807ea85faa07e68001a8486a06168041a85c6a07168029a84a6a06968069a85e6a07968015a8496a06568055a85d6a0756803da84b6a06d6807da85f6a07de8003a848ea063e8c3d01bd047a0cf86ce409f037d2ef479d0e7435f007d21f445d017435f027d29f465d097435f017d25f455d057435f037d2df475d0bf3f19fceb300b7d07740e3a0f5d80be13fa2ee822f4ddd0f740df0b5d822e4357a0abd0f741df0ffd00f483d00f413f0cfd08f4a3d08f413f0efd04f493d04f413f0dfd0cf4b3d0c7a09f837e1efa05e817a15f827e19fa15e857a15f837e1dfa0de837a1df827e1bfa1fd0ef40bf0bfd1ef4fbd01f407f08fd11f4c7d09f407f0afd19f4e7d05f407f09fd4fe8afa08f437f0dfd0df4b7d0df417f0ffd"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "e10ce102e112e17ae13ee151e171e159e13de10be127612d510b51a028584416b1446c914ca410a94539a2dea271a225a21ba25eb123761162d9b19c586eac2136399651b03216b9bb30f64eeccb58207e17db5a8c12fb8903c5cc025601494c16b30b3805d1053231b7a04541cb826c31af20a6a055c124f12af146f141f161b165cf59f135f163f153b1bb845f1026914b92248282fe925992bd7bd748b6488e4b1e4b4a250da5bda411528a942d554a93a429d254e90ca9b0e082f4921426f393b59579c90264c1326d87d907c4b22459b66ca46c9c6c966cabec9cec92ac4856435e53de48de46de51ee27c7c9a9f218b94c9e23ef2b1f2a9f255f20df2d3f2a3f2fbf2d1715748dab19d720ae499cb88012c78b53c50d891b1e4751480a462b262a76288e2bae28ae2b9e288a151f15d282c6caceca2065883252795879417943f94ad95c455729557a954195a4daa23aac3aa1baa09215c474927652aad3d565a747a867abe7aae7a917ab97ab37a8b7ab77a8f7abcfa94bd50e35d0c0346a4d074d2f4db886a0a168b81a81c6ae19a019a399a459a859acd9a1d9a939a039a139a5b9a979a4816911da5a5a450155abd09ab569dafeda19da15dab5dacdda9ddadd5aec597f5d5b5d479d8f4eacd3eada1514ea7274c374237573742b754774c7754f750de3cb74f0788ff8faf1e9e79bc7778b0f8d17c54be3837babe3a77b27c667c44f8adf18ff31fe537c697c6dbd453f503f48bf4c5fa85fa77fe47d5eff448f30d432d4373436b4334c322c311c361c37f4bbf8c6d0daa82c686e6c616c69ec62f435fa1bc38c58e338a3aae0acf1aef1adb1a1a989a98329c44431b14d7293ca9461ca362d349d345d37bd36bd3575285017680ac809fc04718231617a022dd190a82db899f83af17da2235157d030a955d28aa4e349a7922e247925774c8e4a3627db92ad37772613bb7e4c6e9bd22b2538859fc2bab520655dca9d940729c52935cdbdccfa8241e6f1e689e6c9e6a9e639e635e6ede6bde67de603e60be622f335f333f36b73e782c6962696a6960e968e962e161f8b9f25d01265a15aa496be96199665965596ad960b9612cb1dcb5dcb53cb0b4b8dd4faa9a1a961a9e1a991a9d854422a27352b7550eaeed423a94753cfa4de482d4b85a7b54b6b9fe6edaae44077555730a599d3a6a6cd4ddb9cb63fed5adaf534787a695a403a3d5d939e906e494f4d1f9131336341c6e28c6519eb33b6651cc9389971266365b7cb19d7326233fb655eed3d3d735ee6fcccd399d7320d050f339f65065823ac2c2bdbcab14aacc9d634eb78eb72eb66eb2eeb21eb35eb15eb6babb1a05656dbac1e59be59a6025e564c96304b9425ce92649decadcb4accda9c7530eb7e566cf68c6cb71cf79c4e39bd725039a139f41c760e2f677dceae9c3d39c7"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "780a123fbe03e30e3980895303f6e9494398636f6bd833477758596918acac8c062b3b21821573d4b04f8e1458d9f53cd8b3b2e1b032c734e8de32e8de66e8de3ed89b4fa7608e67d7a17bc5d0bd5258b1a396dba7b2e66e65655ddd4a9f04ba39ae62dd9e9571dcca3ec9a16b496e65cf72a1e7616e658ea9d0f352e8de66b794d203d0eb0b6e6527eeba159f78e196bdeca39ba39fbbfb89e27aee9c4f2ddd973b3abb5f2b0b742f2b23ba973de1ba3bf64aa17b7a774e699a7b715981fbb36723dd1d6533dc4b9f2c71779c5de7feac78b77b59e929e8fd37ddcb9e3d772fe694b8973a3ce1658ee6f013c59de09c525fb8a30c037ff68c053dcbe065c526b8e36c06fc59711ff8b3d25170a8cfe067cb16c1cbca36c2cb12f7c23f9d3d0efddc65e8e7ee41f75ec2f79e2881eed586b0d7d2a3acacbbc7897b411e9c4f588f270ea6c7d967220fa8cf3ca03e83eee57b9c281eeac1299d08dd9beb71edd94ae8da4e8f52c7710f475991c7b3b227d0f79fa07b3511679f35421497b547943a7c1065d7d18813c57404a75488287668108e136644f1ff63ef4aa0a3a8b276f5be5477d29d7407111045046409c2af802c01548c2050e2c0283b0c4b1002018382882cc33e8018411d44701b9641164176d969084b42416802f31b882b8e63f9ca0514335deffdafea55755775aa3a099be7fc879cf34e27fd5edd7bdf77d7577dabc34eb60b68be1da165786e359efbc4ce45f6da436cbe1d3045f6082cc5d7013c0ff148727065d51d21b68e03304d1c0268ed407c67070f9f712094e5e060ae23fcfd2b0e881638b01ef07b1fe1b99d8ea9423e7eafd881d8aff175bc438002becee3e4510d27428d9c1c6ce92ce11f7502fe29a790ddd7597679b89307b94e164dc7730b9de1456f3a3730ef394bb8b54e18da82df3f88af2bc2e34b27627f74623d38239cdd05c37e170fee72b191862e085bb9aeb08fb900c3b804d8df854ab35d084dc663810ba0b75d88ffa70b0cdcea42d9075c65e1132e1efdaf0b09dfe1f9dff19cd30d72026e04eab86171ba9b076ddc0c7ac28dd0b36ec40e7703669c5be05e715f0ccf71b360b19b89ac7043b4de5d8a76e335056ec4fdcb5d16fe0acff16e46f8af9b830e3ac4fb69507a178db846f4c5f0437421e8404f15bad31cea4b9f63b36830309716c0341a5e5948b360293d5a584903b899bec8eea5012aa005ee3c0dc35fe1399ece112274e388cd13fe21d903d81a1e81abef81e1e69e647db736992d569bdde174b9a3fd9181605ab53baa4b9ff0df57afbed4b9d824bde903cd9a8b9d8b2d5b3ddc21fa1d255d9ed4bbde380f95af5c95ebd59cefac2176666af91b55be9449cd597b7d79c95bb769db2ea3bd22bf98fbf4f75f9ebf42457dbddefe8df3b091fc668b91fc0a7fe3cadf48feb46aeaebf550"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "24b0af944ee52a603e95b09f12da5241ba06540be35805f3b99a8e6c345b0bba96ee495f0fba1ef6db406f8636d1039965d07639dd75c44e7a38b107e67c2f5d177b10e6ea107da9878e4ea71ea713cc93f48e4d0cb05f3d4c749a8e6c30cfd091e739b01bc0cfc39c5da0331c2ec358aed091f61afd17c62dba1fba4367a6dc87bc0750ee01e8433afa012df108fafa18c6f8844e259fd1198c1a381ecfe924f912d25f41997a08f49a8e1a20d11bfa92c08f30d6cfe07fa6e3d85728fb8d5e888c743a618679b7d0910da615cad6d9164d70a062b803dc0b3bb8ebec1d70374707b8ce3830e88d1c6210036c8603865c1d10d9c481444d1d747e2d1de0dc7340369afc0a762b87c278a68390eae980a85e0e42d411eaebec40d0ba429dbe0e88d1cd8181fc1ce8a8bb0393ea0fe57b3ae0586fd8bfb70383ec0b7e3f0764c36e8003e131c801ee5dc11f0cfb100e9e28d081700e8576c3202dcc81a0468046383096463960588c0395887520b7253a20fa3007e43502f20066326832ec33d2218a1c0bf65807261ae78033c6435f521d50603a94c980fe4c009d08f913213fd321d635db2181980aed4f83becc70e8e83ac7a1199ae740230ba0ad850e5168b1039db9d401a52c877d80e04287de68a503c28a1d3a220ecc1117d2b90e6e98c081ea2676a052a53067320707a470407f02474a50a50346a8a14f1a072a7395431c5aeb801695427a298c7b8303b2c1d80863dc0cf666072adae28031cb41b73aa0df21b781fe3d14e64e07c26d0fd87b1c98f83e687bbf034e1c84b93c0c633de2c04447e1381c83711c77209927a1dc498774d20079a71dba13e7c13fefc04517a12f97a0bf571cfcc8eb0e5af216a4df826377db8149de85b1df03ff1e1cb3fba0f71d0a9995605741dd8fe0383c765844ab7668829e3b68f15750cf6b8740f416cabd85bc770ee87718ef1d90e347b8747d7640f81748fb02f95fa11fdfc0fee6e0ca3039c07739a8d7ea806c50eb8086406e0ccc1191b8239cc3a05447ba9fbd235cbe1ca9b823e43b3ae2c8c911a33776c49033a4bb405a3d7013e388fe021cb93aa21f296c0af537031b6036778ca5bb3922c75f1d97a2d68e74b7768eb4ee9e90f713a85ed08e37d8de8e04de11b423bcc13a3b32501747d4004e740505bcfca07c774782f4071fc07a3aae26fa42bffb81dfcf91640e700c600c72a41304940b706cc60c86ba431c910d3c14fa150665c31d716a24ccc910471d110379f5d0d150477714e758336e9423de6cac23464d8174001f0feda4423d69e0a73916a20cd877822381263a36616441da0f04643b227a0ef47d8a23fa17e0f1d31c49341dfa3bcb11c5ce8134009feb48d0e7c3fef930c6058e4cb4d011052f827a9740ff963aa2c62b1c998c22c72688edc85cc571a486f3a10e816393c512"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "b7d1ed9635ffe562f2dd31893739379b7dcc704cb8d962acf4e6e19bf16383c6c6ae6835767460dcd8a26d97e0bbc4f3b1c76f5d5be0587ec839ff4ed485eaa8d7e3be8ca3a45c4b4b4ec949797a37feded3144abae66decdc8f299d5b3f78f8dbfd016bfa767fa4e8375ef87ae003ecfed3125da396e7668f1f78ffc8f555e3b3ef9fbd5f335ef0809a3ae1c19bf17046a5fa396f4c3d99ba25c6ffa103db39ede1a080b4d4b47e7b2d791595a35637aa1ab5f7fd7c9ff4c9e955952fab388194ae8f2a9f5666b40e4e7b55d5ef515dd5f4f45119e671cb26944ef0ced04ef812b0bff93cde8807031795af79d87af4a0f913c513b39bad99d8fcdcaf3df74cfc1c595979786223ef55adbf9dee399d7b3cf7c9ba27715b87ad6029bb67e2237a67bab4f9cd6d99dba4ad330317756d9569c9133d1d9ec9eabaf9e9b84caf0c46fb3ef281f2a24c4de6f6cc2399bacc2b999599d97bde64b60efdf8143ea533ef3f9d778dd7a6e724ff4943264d9814e3bcfb421c63db2c65e9f27d6726ed9d6498a49f74b4cdc4334d97bdeb5035e9d9a45793e6a4f7cbda58dea3edcdea65359fb31a4d1e30993179c4e475fba88e539f0c7b5139f9d164bb179f265f68db2cbb6bb6eefe0c8f9ed9997a4a238b2c369bc8b6be58e6b3667949367b3d9e5397dd28a7e3abc4297d5e5f79f3f28dfb9bb437edde5a73285366bc299962e81f3c45517cf54dcadbf92ba6bfdd9f53fb7ad75b466ef3dcb6b91eb99fda75ceed96bb764340aed6d9ab711bc63477ab6397478b730b7393da7a663c3a23c9b5e4edcf7dd8f14cc753b9fbb2863cf990b930e951eef3dc7b51ce792d8217b4fd5c36a07c76d09cf2c20d97cbd52177aafaafd00c59f0b0f7e349e91fd3832b5fa52d4a3f9b9efdb07663cbe097aed32282a22e05eedcd877e382a06ecbd7045a97cbd47ad753cbbbede9bb3cd571c0b2b9cbdd1d772d735d71f6489a235aa6e8b4aefcc8e2cc45cb17cf5a42195eaab1e40d4b6a56beeec2f635f7f60c58cb3fffa9e51b4d9be713cef5eb3fdd71984b35634be7d415b1fd87371dac752f3dbb6e68e9f8d34e1d1e749c7af24a47cd82cc79e7f32bd29b5629d3fbba4f6e9fec346ba399e93573f00cb6fb19f7cb7b37f84c9ec69e71bbd199e9d766ccb49fe44e4edff9b8d7f491a3cf4dbbc56cdc3ebafd23f720f792f2336b16bb4ff1d8e271cca391879787d46360fbdf3f83661122f5fe35756b760c3eb9fcf49a9af614cf9459f75ba6cd8c9f1937f3c05865a5f36c99e713cf8fb3dde16e7fde2f2b83ce6da89ce753be76a1ebc0fbf996bc07aeb2d066a149a1d29098b603b79e5fc7f03e4977097628fdd4c16e46e30ecbe78de93426edd3c409e96d3a9fef74b4d30207a72eb77d422bfb2fdbba2c7659b6cfb72e9cb4233e2e5de37d6807fc0b572d"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "dc03e60781de0bd6f341f0b83c0cfa7c04b47b0cb47b0accff0bd0ee19307c762b007b1eb47b19b47b6d2bb4edd7e0317b732b06f8dd56e0078ebfb7b51df31168f767d0ee7350fb6a2b03db04b5e6d636a00586adadd84dc0b6f3ed9ddbc063bd0d03eddf063b3fb8ad1db21eecfcaedf86856dde76be6d3ba88d6c8343c7c0b4b16d6d90896d1000b90d0aa0c07d14a84d8176f86d3080086ae46dc03005b4638076ac6d3008771b042bd806c3ce6f6b0324607e09a829404db36db0ddb88d817580febca0bf00681704f51f19ec8c815a16d44adbda60d56d00b4b60d0a5900b505d0dfae6d98a1fd601d0e6c0320cb60da32a81ddab6d876184c3bb20dc01e05ed4e80753905da9dde0605ce8079ce8076576d4340afdd0683deb0adedf82ddb3a57dfb10d0abb6b1b16b807d4eedf86493dba4d7dfea96d88c1e7b74118af80e9af6d03fe0decafc132dfdad63ef8ee3608e643d0eea36dd8f63f6f8340feb2ad17fb25a87d03fafb07d8860698ff4760400bf4ffed36d839603b70bc637b27a6773b1458bd1d68ebdb0e0020d035db612bb0ed601f653b04b5613b14b679fb79e087f9b620d84bb6c3ce8f6e6f1b446e8763a6b76361f8ede7db29db210075fb3040db0efcc0e02c582617d484dbcfb749b60f4214db1950dd76d8b011d42ca09d6b3b1ee6dfbed816dc3e0844b623b189edb07399ed6db0fc76486f09b4ab6d3fd6b6b81d06d9bd1d8e5dda0e030e80fe2edd0ec11c03b513db57da4e6f7fadfddc76ccc04fb6c3b0b780da4f41edbfebff96db0fceec6acff00eb403c3cbed1dab0fb74f7e7c793bfb83b3ed00f2caf667d8d7b4f3cd37b653e6ef682f941f6867773cd47e7cf2f1f62fae7bae9d0abcd0fe54cfabed6d9fbdd9de0efcb61d587cbb5d457abffd99f73e69476cffa21dd8f5d7f6f927ffd16eb91dd2c145757500177a3a5c8bab3bb60a611d67aedfd8d17e616b07ba13dec1478f77087f33ddf1d61cb503e8a175ecdfcdec181ee2740c03dc8e1444d8011f9eef686b9775005845c76d6c6dc7f03e6387876feb3837ecec00963d1ddab66047c762b8a3ad23dab16728d9d1aad63a3aa00b1dd7efd8dff13eec700767f458c7f5c0e51df0a1d31d1786afe850d1afed00523774b4013fe9e04ddcdef1ace09e8e5dc3f77560850f773cb6f6898efdb3cf76a8902f74b4ed7ba563f4dcaf3bf623deeae8daff4ec7a6fe0f3b00f61f3a6e19f97387efcf5f776c05fede817ce1fb8ee16bda3adf6bebee5cbda7af13d8d5df79766243e755ba4b3a393b119d779f437742014c67cfde994ef730a113e82176f6ccd03b5fee6176327f3edfb916a2e8dcf8776367fb4db64e4eafabb3c71ae8ece80c77b601914ea033d689a6663a39aa42270428764237553b7be00b9d83edbb3b016077e7887b7f6747c772e7cbec"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "c7bde0b772253343dc3a9e88679c33cd0dcc511786006d423c10040283802008c8043682b112395406452b915814b69e70cf9c43ca25d5991bccf566bd4d67bb4635d8104e144dc320b3523814960de012e1244aa802aa824ec15532b50ca3c4a0d0d8064282d10ee8003800ed4212b0074800128170905b382684811cc261a147e8128e0aa120a7705c3822b4813de051f084c82b9a11b9c0b3222b784ae404fb444f440ef0b46818ac865ac093a211d100f809785ce4170d81ede051915be41179c123e071f098680c6c060f82dd601b9421214906a13e285e4295d0244c8907da2b214846a164094b6284d2250ea81dda23d1430d501df409d4051d826aa0148915aa858e4027a01ad93094283141cd500b741cea858e419d503774003a0d37c92e20e6e18bf048844bb602c72ab1a84b08bdcc2a5b855b64033287cc299b832fc12f22f0a821d902fc32c2285b86e350b3709dcc2cd3ca0cb241194e1985b0c9ecb261d90c9c8d62289928168aa0e42a7b50455abe92a5242985fff65b40b56be94a068a88122b994a328aac242a7b9414144f2951f6a268ca5e651f8a8322a0a8283aaa5fc951925078a548c956f62905ca622d092bc68ab04c6cb3b65e7b4f0bd252b1386ca31642e8c1766a255821b6557b57db8fedd6966ae95836b64b5babe56069d8126d1301a8add10ab0755a80968fbd65c463abb4646c1f96816dd2566acbb51d5a0c968b25601b096d5a22168b65617bb1146cb59687add0b6681bb449c6446399b6c0d842b86b4c33161b1bcded843263a5b18d9061ac30961b3b08c9c6664237a193506acc360209d5c612638d114980138a8c85c67c63a61140e8225094b78d24738ab1950023349b41043021d558656c32e718d38d5042ae31cb88225493dacc58738f19662e27f59a4b492de656731ea98c04305792aa484033ce4c36df251590bacded66aa1962869a3bcc0433dc4c3423cd8524a3ad845444a298316684b9d39c48459b2b486033c85c4cca273db1e1cd287397d96d33d99cb6715b021541f0d862a837a893b601dba86dd036628ba38ed9f28c7e9bc3768b4a75a26913369f2d898a74626828a7d5366433dbec368b6dca164bc5d2e2a9c9549bcd6b73d9b0ceeb54020de6ee71129d2427c149a4f5d2c8340a0dedc439694e368d49c33bef1871348a13e3e4d0c8ce9b54126dd846a531682c1a9d46a3f5d07a9d785a1fcdc03032a06e3bc3cad031cc0cb87b80a1650c3220ee5e969e616150596037c83dc4b031806e809bc642b94d0c849bcee2b03ce3e3e34c9677dc3d3e36ce62f5b146c7192c362b8d8374a772b2381a5f062793a3f7a97d77384a5f599fd6a7f3a97ce99c8bfecbfe2bfe28ff557f79df257fec7401f7e674ccf48de97c6e21573a63e7dab8b6d9a159c7ac9857cf33cfd96707e7a43c09", "Alertable": "1", "Timeout": "00a22f4dffffffff", "ByteOffset": "00046710", "$name": "\\Device\\Afd", "$status": "103"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "0fd50b02a1c6e1fa9d674f96ec7f70e471796971f9f1ee93dd17cacf9797945f2c3fd1cdaf1454f22abbaab8950f5ddd55e7bca0be437523f5c2803430d6200abc6f186d90053e344802aa60a861b4b16d74d7d98ad22ba597ca8bba4f7597963f71492a85958f5de2ca472e5165a7abdafdacea82175f53ec25d4106bce7b4935e03e40dde13a501db4ef481da40f5877b46eccffc11faa7fef1fad1ff587fc8a803cf0b14119880abe6fd406d5c1b1464d30327860f8e0707313b4993f026e86340b462e3797358b427b5bee8eee6fb933da3ebaaf0539563cb6fbacb4b2c65de205d741eaf69c25d77c68bc580cad7bd97ca9f8e8e3d3dd67bbcf743f733d75c92ae5955dae6e579dbbd9fdbcaad65defbee16e745f7737fdef186871f754957a2f7aa935949a4b5e5a0da20fde07ab83f57df48ffb77f6efe81fabffe42f087c6ad0060a03e30d9a40542032a00aec6854070a82c78285c143c387878523579acb9b81a3a0d1032df746d92da5c597cb6fb96fbacbbc97bdefeb77f7efea3f1138163819381ef8d8783c78227832281a1187ee8f5e2e46f6ede92f2b7655a1fa76369e0a7c6a3c327c7418d60c1e2d2fae2abd560a785c565e5e7eaefb4ab9ba32b2b2c7e5723d77292a95959a4a5565abfb45d5cbaa6b5e66cd156fb9b7ca4bafc1d65578abbd57bd955e460dba0ed307afc3f6a1fb5075883a4c1db26e6fffa1fe7dfd07fb3fd43f7877a07f7fff9ec65d8d7b1b773716054e07ce04f6359e09ee682a0aee6c3a153c1d1c6f040f038681c3a061f108a219de2c0d494215cdbdcd075b482da8b1f36317c6ae141777bf70dd76b7b97babdc55355e56cdc7fab381fd8dc5c15d4de782e7836783b211c83074b8a5493a221991854ac62a8a2b8b4f951c78007c5c515e555e597ebebbbafc6af9b5f2a8ca97ae5e579d575b5950595879d77dc7fdaaea7555bbbbd6ebad62d778aa7075f55e4e4d444d83b7d9dbe86df2726bc875c43a421dbe8f5487eb3bdc4fe8c3d711fb00fd47fa8ff643fa0f3782fb61fdd07e503fb0ff53fdf94071e050e381c6838de7021783bb9b4a8217827b9a50c3c861f8306cf846d3f526f4b03c54d9ac184136cb4710c38a90bb99dc821ebb3876b518f418de5f557cdf7dcf4dea43f623fa8f345e0a96066f365d1a2b2aa92daf2977bb5ebb8e57be721dab3c51e9713d703f723f743f76bfa9ea7477b89fb86f7bef7aef79af7b5bbd37bcfc1a518da4e6a6f796575cd3e66df7def14a6b84352d5e5e8da0865ac7e8a3f551fbd87dac3e661fa58f5247eea3f7d1ea30fd847e6c3fbe1fd78fee27f653fa49fde4fe1d0de3f5a87e6a7f69a03c5011b812b818280b94042e058e365e085c0ed405cb827b9bf6355d0e56066b83578235c1aae0d5ffd9bd8a6079f05a90344c18bed5841fa60e93875b"}