24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 672a0eb7482e… — Score 100/100 — Sample aaa7799edfd8…","description":"Malicious verdict for sandbox report 672a0eb7482e…. Threat score 100/100. 2 malicious and 7 suspicious behavioral indicators across 241 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9/672a0eb7482e9dcfd20466c7","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9"],"about":{"@type":"SoftwareApplication","name":"Ransomware Akira","applicationCategory":"PE32+ executable (GUI) x86-64, for MS Windows","identifier":"aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":2,"suspicious":7,"totalSignatures":241},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tbf0,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Ransomware Akira") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Ransomware Akira") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "Ransomware Akira") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "Ransomware Akira") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Ransomware Akira") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Ransomware Akira") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "Ransomware Akira") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Ransomware Akira") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Ransomware Akira") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp")26:T43f,Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "Ransomware Akira") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Ransomware Akira") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Ransomware Akira") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp")27:T806,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp")28:T132e,"RansomwareAkira.exe" renamed original file"C:\bootTel.dat" to "C:\bootTel.dat.akira" "RansomwareAkira.exe" renamed original file"C:\BOOTNXT" to "C:\BOOTNXT.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\contentdeliverymanager.utilities-replacement.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\contentdeliverymanager.utilities-replacement.man.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\gpbase-replacement.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\gpbase-replacement.man.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\devicedirectory-devicedirectoryclient-desktop-replacement.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\devicedirectory-devicedirectoryclient-desktop-replacement.man.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\microsoft-windows-advertisingid-replacement.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\microsoft-windows-advertisingid-replacement.man.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml" to "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml" to "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\microsoft-windows-geolocation-replacement.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\microsoft-windows-geolocation-replacement.man.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml" to "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\microsoft-windows-ie-internetexplorer-repl-2.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\microsoft-windows-ie-internetexplorer-repl-2.man.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\onecore_speechcommon-rep.man" to "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\onecore_speechcommon-rep.man.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml" to "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\uninstall.xml" to "C:\$WINDOWS.~BT\DUDownload\Setup\uninstall.xml.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml" to "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\upgrade_bulk.xml" to "C:\$WINDOWS.~BT\DUDownload\Setup\upgrade_bulk.xml.akira" "RansomwareAkira.exe" renamed original file"C:\$WINDOWS.~BT\DUDownload\Setup\appraiser.sdb" to "C:\$WINDOWS.~BT\DUDownload\Setup\appraiser.sdb.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml" to "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.akira" "RansomwareAkira.exe" renamed original file"C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL" to "%COMMONPROGRAMFILES%\DESIGNER\MSADDNDR.DLL.akira" "RansomwareAkira.exe" renamed original file"C:\TorService\data\geoip" to "C:\TorService\data\geoip.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab" to "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab" to "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml" to "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.akira" "RansomwareAkira.exe" renamed original file"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml" to "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.akira" "RansomwareAkira.exe" renamed original file"C:\TorService\tor\pluggable_transports\bridges_list.obfs4.txt" to "C:\TorService\tor\pluggable_transports\bridges_list.obfs4.txt.akira"29:T1980,Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-436-000000014005F510 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-436-000000014005F510 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-436-000000014005F510 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-436-000000014005F510 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-4032-00000001400AB9E6 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-4032-00000001400AB9E6 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2890-0000000140042C52 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2890-0000000140042C52 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2890-0000000140042C52 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2890-0000000140042C52 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2730-000000014003619E Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2730-000000014003619E Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2438-0000000140041E00 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2438-0000000140041E00 Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor rax rcx in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor eax ecx in Stream UID: 46586-5200-000000014008D89D Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-3863-000000014009D7A2 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-3863-000000014009D7A2 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-4148-00000001400B57E8 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-4148-00000001400B57E8 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2453-0000000140038010 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2453-0000000140038010 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2453-0000000140038010 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2453-0000000140038010 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2441-0000000140041880 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2441-0000000140041880 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2441-0000000140041880 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2441-0000000140041880 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2510-00000001400363F0 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2510-00000001400363F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2510-00000001400363F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2510-00000001400363F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-4149-0000000140040310 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-4149-0000000140040310 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-3176-000000014005C464 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-3176-000000014005C464 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-4090-00000001400AF731 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-4090-00000001400AF731 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2449-00000001400409F0 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2449-00000001400409F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2449-00000001400409F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2449-00000001400409F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-3459-000000014007A1A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-3459-000000014007A1A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2365-00000001400573A0 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2365-00000001400573A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-3669-000000014008E530 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-3669-000000014008E530 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2854-00000001400407C2 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2854-00000001400407C2 Assembly shows XOR instruction xor rax rbp in Stream UID: 46586-3549-0000000140082672 Assembly shows XOR instruction xor eax ebp in Stream UID: 46586-3549-0000000140082672 Assembly shows XOR instruction xor rcx rbp in Stream UID: 46586-3549-0000000140082672 Assembly shows XOR instruction xor ecx ebp in Stream UID: 46586-3549-0000000140082672 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2381-00000001400559B0 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2381-00000001400559B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2381-00000001400559B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2381-00000001400559B0 Assembly shows XOR instruction xor byte ptr [rax-75h] cl in Stream UID: 46586-2851-0000000140040681 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-3667-000000014008E42C Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-3667-000000014008E42C Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-4085-00000001400AF4E9 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-4085-00000001400AF4E9 Assembly shows XOR instruction xor rax rsp in Stream UID: 46586-2267-0000000140079C20 Assembly shows XOR instruction xor eax esp in Stream UID: 46586-2267-0000000140079C20 Assembly shows XOR instruction xor rcx rsp in Stream UID: 46586-2267-0000000140079C20 Assembly shows XOR instruction xor ecx esp in Stream UID: 46586-2267-0000000140079C202a:T13d8,"RansomwareAkira.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006236) "RansomwareAkira.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006236) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007320) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007320) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0aca3e38c020000000000000000000051ed88acfc7f0000000000008c020000000000000000000037211548c08500002a0000000000000030dc22c98c0200008fec88acfc7f0000e0aca3e38c020000e0aca3e38c020000000000000000000000000000fc7f0000ffffff7fe3a3000000000000000000000000000000000000d8ce97e38c0200002a0000000000000069c350e38c0200003100000000000000c003000000000000c4030000000000001100011000000000a0d12f0faa00000003a30aacfc7f0000a0d12f0faa00000000000000000000002b00000000000000000000000000000020b056e38c020000b43f55e38c020000e0ce97e3 (UID: 00000000-00007320) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004000000000000000000033c98c0200000b8e86acfc7f0000000033c98c020000020000008c02000038000000000000004000000000000000300333c98c02000068e20010aa000000010000000000000003000000000000000100000000000000160000000000000020100dc98c020000000000000000000000000dc98c020000b869f6e48c02000000000000000000007e000000010000000000000000000000800000000000000004000000000000000000000000000000a887f6e48c02000004000000000000003800000000000000f09809acfc7f000038000000000000003800000000000000e0e30010aa000000c00cd67efc7f000000000000 (UID: 00000000-00007320) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0bd95fc7f000007000000000000000000000000000000010000000000000090df33c98c02000000000000000000007071e6e48c0200004c9809acfc7f00006095e6e48c020000b3cecc7efc7f00005075e6e48c020000004fbd95fc7f0000d0b0bd95fc7f0000000000000000000000000000000000005075e6e48c02000090df33c98c02000020ace6e48c02000038e40010aa0000004c9809acfc7f0000010000000000000038e40010aa00000020ace6e48c0200005075e6e48c020000010000000000000002bccc7efc7f00005078e6e48c0200002043e5e48c020000feffffff040000007df0bc95fc7f000000aae6e4 (UID: 00000000-00007320) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000090df33c98c02000000000000000000007071e6e48c0200004c9809acfc7f0000e08ce6e48c020000b3cecc7efc7f0000a076e6e48c020000384fbd95fc7f0000d0b0bd95fc7f000000000000000000000000000000000000a076e6e48c02000090df33c98c02000020ace6e48c02000030e40010aa0000004c9809acfc7f0000010000000000000030e40010aa00000020ace6e48c020000a076e6e48c020000010000000000000002bccc7efc7f000000000000000000002043e5e48c0200005078e6e404000000feffffffffffffff90df33c98c0200007df0bc95fc7f000000000000 (UID: 00000000-00007320)2b:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000000000000000000000010000002f0000000000000006000006f322000010a114c9 (UID: 00000000-00007320) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000060b0358afc7f000000000000000000002e4d928dfc7f00000000000000000000000000000000000020142ccb8c02000000000000000000000300000000000000c46752a1fc7f00001000000000000000100000000000000040eb1410aa00000080000000000000001000000000000000a169348afc7f00001f000000 (UID: 00000000-00007320) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f8b435e38c020000f8b435e38c0200000000000000000000c4e00010aa000000b8e10010aa000000060000000000000014e10010aa0000000000000000000000c46752a1fc7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169348afc7f0000380544e3 (UID: 00000000-00007320) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000400000008c020000d0a7fae48c02000006000000000000000300000000000000c0d5aecb8c02000020142ccb8c0200000000000000000000c46752a1fc7f000010000000000000001000000000000000030000000000000040e20010aa0000001000000000000000a169348afc7f000000000000 (UID: 00000000-00007320)2c:T664,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "Ransomware Akira") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "Ransomware Akira") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "Ransomware Akira") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "Ransomware Akira") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "Ransomware Akira") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "Ransomware Akira") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp")2d:T598,"RansomwareAkira.exe" queries volume information of "C:\Log-05-11-2024-12-25-59.txt" at 00000000-00006236-00000C15-663267238 "RansomwareAkira.exe" queries volume information of "C:\share\network_original.pcapng" at 00000000-00006236-00000C15-665855694 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007320-00000C15-658369377 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007320-00000C15-659094991 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007320-00000C15-660428917 "powershell.exe" queries volume information of "C:\" at 00000000-00007320-00000C15-660814251 "powershell.exe" queries volume information of "C:\share" at 00000000-00007320-00000C15-660816102 "powershell.exe" queries volume information of "C:\share" at 00000000-00007320-00000C15-660913920 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007320-00000C15-6616261502e:T6b8,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")2f:T5dd,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB")30:T3366,"RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006236) "RansomwareAkira.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007320) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007320)31:Tbecb,"RansomwareAkira.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00006236) "RansomwareAkira.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006236) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007320) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007320)32:Tb94d,Found reference to API (Indicator: "GetStdHandle"; File: "Ransomware Akira") Found reference to API (Indicator: "GetDriveTypeW"; File: "Ransomware Akira") Found reference to API (Indicator: "CancelIoEx"; File: "Ransomware Akira") Found reference to API (Indicator: "GetFileAttributesA"; File: "Ransomware Akira") Found reference to API (Indicator: "SetEvent"; File: "Ransomware Akira") Found reference to API (Indicator: "SetEndOfFile"; File: "Ransomware Akira") Found reference to API (Indicator: "EncodePointer"; File: "Ransomware Akira") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "Ransomware Akira") Found reference to API (Indicator: "GetFileAttributesW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetProcessId"; File: "Ransomware Akira") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Ransomware Akira") Found reference to API (Indicator: "GetCurrentProcess"; File: "Ransomware Akira") Found reference to API (Indicator: "GetConsoleMode"; File: "Ransomware Akira") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "Ransomware Akira") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Ransomware Akira") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Ransomware Akira") Found reference to API (Indicator: "InitializeSListHead"; File: "Ransomware Akira") Found reference to API (Indicator: "GetLocaleInfoW"; File: "Ransomware Akira") Found reference to API (Indicator: "SetStdHandle"; File: "Ransomware Akira") Found reference to API (Indicator: "GetCPInfo"; File: "Ransomware Akira") Found reference to API (Indicator: "WriteFile"; File: "Ransomware Akira") Found reference to API (Indicator: "WaitForSingleObject"; File: "Ransomware Akira") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Ransomware Akira") Found reference to API (Indicator: "HeapReAlloc"; File: "Ransomware Akira") Found reference to API (Indicator: "GetStringTypeW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetOEMCP"; File: "Ransomware Akira") Found reference to API (Indicator: "LocalFree"; File: "Ransomware Akira") Found reference to API (Indicator: "SetWaitableTimer"; File: "Ransomware Akira") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "Ransomware Akira") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "Ransomware Akira") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "Ransomware Akira") Found reference to API (Indicator: "FindClose"; File: "Ransomware Akira") Found reference to API (Indicator: "TlsGetValue"; File: "Ransomware Akira") Found reference to API (Indicator: "FormatMessageA"; File: "Ransomware Akira") Found reference to API (Indicator: "SetFileAttributesW"; File: "Ransomware Akira") Found reference to API (Indicator: "SetLastError"; File: "Ransomware Akira") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Ransomware Akira") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Ransomware Akira") Found reference to API (Indicator: "HeapAlloc"; File: "Ransomware Akira") Found reference to API (Indicator: "QueueUserAPC"; File: "Ransomware Akira") Found reference to API (Indicator: "RaiseException"; File: "Ransomware Akira") Found reference to API (Indicator: "WakeConditionVariable"; File: "Ransomware Akira") Found reference to API (Indicator: "InitializeConditionVariable"; File: "Ransomware Akira") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Ransomware Akira") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "Ransomware Akira") Found reference to API (Indicator: "LoadLibraryExW"; File: "Ransomware Akira") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Ransomware Akira") Found reference to API (Indicator: "SetFilePointerEx"; File: "Ransomware Akira") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "Ransomware Akira") Found reference to API (Indicator: "CreateThread"; File: "Ransomware Akira") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetExitCodeThread"; File: "Ransomware Akira") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Ransomware Akira") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "Ransomware Akira") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; File: "Ransomware Akira") Found reference to API (Indicator: "ExitThread"; File: "Ransomware Akira") Found reference to API (Indicator: "DecodePointer"; File: "Ransomware Akira") Found reference to API (Indicator: "TerminateProcess"; File: "Ransomware Akira") Found reference to API (Indicator: "WriteConsoleA"; File: "Ransomware Akira") Found reference to API (Indicator: "GetModuleHandleExW"; File: "Ransomware Akira") Found reference to API (Indicator: "ReadConsoleW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Ransomware Akira") Found reference to API (Indicator: "SleepEx"; File: "Ransomware Akira") Found reference to API (Indicator: "WriteConsoleW"; File: "Ransomware Akira") Found reference to API (Indicator: "AreFileApisANSI"; File: "Ransomware Akira") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Ransomware Akira") Found reference to API (Indicator: "HeapFree"; File: "Ransomware Akira") Found reference to API (Indicator: "EnterCriticalSection"; File: "Ransomware Akira") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Ransomware Akira") Found reference to API (Indicator: "TerminateThread"; File: "Ransomware Akira") Found reference to API (Indicator: "FreeLibrary"; File: "Ransomware Akira") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Ransomware Akira") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "Ransomware Akira") Found reference to API (Indicator: "TlsAlloc"; File: "Ransomware Akira") Found reference to API (Indicator: "FlushFileBuffers"; File: "Ransomware Akira") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "Ransomware Akira") Found reference to API (Indicator: "RtlUnwind"; File: "Ransomware Akira") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "Ransomware Akira") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "Ransomware Akira") Found reference to API (Indicator: "OpenProcess"; File: "Ransomware Akira") Found reference to API (Indicator: "GetDateFormatW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetStartupInfoW"; File: "Ransomware Akira") Found reference to API (Indicator: "CreateDirectoryW"; File: "Ransomware Akira") Found reference to API (Indicator: "DeleteFileW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "Ransomware Akira") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "Ransomware Akira") Found reference to API (Indicator: "GetProcessHeap"; File: "Ransomware Akira") Found reference to API (Indicator: "GetTimeFormatW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetFileSizeEx"; File: "Ransomware Akira") Found reference to API (Indicator: "FindNextFileW"; File: "Ransomware Akira") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Ransomware Akira") Found reference to API (Indicator: "ResetEvent"; File: "Ransomware Akira") Found reference to API (Indicator: "FindFirstFileW"; File: "Ransomware Akira") Found reference to API (Indicator: "IsValidLocale"; File: "Ransomware Akira") Found reference to API (Indicator: "FindFirstFileExW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetProcAddress"; File: "Ransomware Akira") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "Ransomware Akira") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "Ransomware Akira") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "Ransomware Akira") Found reference to API (Indicator: "CreateEventW"; File: "Ransomware Akira") Found reference to API (Indicator: "CreateFileW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetFileType"; File: "Ransomware Akira") Found reference to API (Indicator: "TlsSetValue"; File: "Ransomware Akira") Found reference to API (Indicator: "ExitProcess"; File: "Ransomware Akira") Found reference to API (Indicator: "LCMapStringEx"; File: "Ransomware Akira") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Ransomware Akira") Found reference to API (Indicator: "GetLastError"; File: "Ransomware Akira") Found reference to API (Indicator: "LCMapStringW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetSystemInfo"; File: "Ransomware Akira") Found reference to API (Indicator: "CompareStringW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Ransomware Akira") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "Ransomware Akira") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "Ransomware Akira") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Ransomware Akira") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "Ransomware Akira") Found reference to API (Indicator: "GetCommandLineW"; File: "Ransomware Akira") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Ransomware Akira") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "Ransomware Akira") Found reference to API (Indicator: "HeapSize"; File: "Ransomware Akira") Found reference to API (Indicator: "GetCommandLineA"; File: "Ransomware Akira") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Ransomware Akira") Found reference to API (Indicator: "TlsFree"; File: "Ransomware Akira") Found reference to API (Indicator: "ReadFile"; File: "Ransomware Akira") Found reference to API (Indicator: "RtlCaptureContext"; File: "Ransomware Akira") Found reference to API (Indicator: "CloseHandle"; File: "Ransomware Akira") Found reference to API (Indicator: "GetACP"; File: "Ransomware Akira") Found reference to API (Indicator: "GetModuleHandleW"; File: "Ransomware Akira") Found reference to API (Indicator: "GetFileAttributesExW"; File: "Ransomware Akira") Found reference to API (Indicator: "IsValidCodePage"; File: "Ransomware Akira") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "Ransomware Akira") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Ransomware Akira") Found reference to API (Indicator: "Sleep"; File: "Ransomware Akira") Found reference to API (Indicator: "CompareStringEx"; File: "Ransomware Akira") Found reference to API (Indicator: "WNetGetConnectionW"; File: "Ransomware Akira") Found reference to API (Indicator: "SysFreeString"; File: "Ransomware Akira") Found reference to API (Indicator: "VariantInit"; File: "Ransomware Akira") Found reference to API (Indicator: "VariantClear"; File: "Ransomware Akira") Found reference to API (Indicator: "SysAllocString"; File: "Ransomware Akira") Found reference to API (Indicator: "CommandLineToArgvW"; File: "Ransomware Akira") Found reference to API (Indicator: "WSAStartup"; File: "Ransomware Akira") Found reference to API (Indicator: "WSACleanup"; File: "Ransomware Akira") Found reference to API (Indicator: "WTSFreeMemory"; File: "Ransomware Akira") Found reference to API (Indicator: "WTSEnumerateProcessesW"; File: "Ransomware Akira") Found reference to API (Indicator: "CoUninitialize"; File: "Ransomware Akira") Found reference to API (Indicator: "CoInitializeEx"; File: "Ransomware Akira") Found reference to API (Indicator: "CoCreateInstance"; File: "Ransomware Akira") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "Ransomware Akira") Found reference to API (Indicator: "FlsAlloc"; File: "Ransomware Akira") Found reference to API (Indicator: "FlsFree"; File: "Ransomware Akira") Found reference to API (Indicator: "FlsGetValue"; File: "Ransomware Akira") Found reference to API (Indicator: "FlsSetValue"; File: "Ransomware Akira") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "Ransomware Akira") Found reference to API (Indicator: "GetDateFormatEx"; File: "Ransomware Akira") Found reference to API (Indicator: "GetTimeFormatEx"; File: "Ransomware Akira") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "Ransomware Akira") Found reference to API (Indicator: "IsValidLocaleName"; File: "Ransomware Akira") Found reference to API (Indicator: "LCIDToLocaleName"; File: "Ransomware Akira") Found reference to API (Indicator: "LocaleNameToLCID"; File: "Ransomware Akira") Found reference to API (Indicator: "ShowWindow"; File: "Ransomware Akira") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp, 00000000-00006236.00000000.105648.ABB50000.00000004.mdmp, 00000000-00006236.00000000.105648.AD550000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WTSEnumerateProcessesW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00006236.00000000.105648.56ABC000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp, 00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp")33:T146b,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006236.00000000.105648.ABB50000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00006236.00000000.105648.ABB50000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp "CHINE\Software\W" in Source: 00000000-00007320.00000000.105743.C9130000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007320.00000000.105743.C9130000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007320.00000000.105743.C9130000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007320.00000000.105743.C9130000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007320.00000000.105743.C9130000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007320.00000000.105743.E3350000.00000004.mdmp34:Tce1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135]35:T31dc,"RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "KERNEL32" at base 7ffcabb20000 "RansomwareAkira.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc8d920000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffc9ea30000 "RansomwareAkira.exe" loaded module "RPCRT4.DLL" at base 7ffca9d10000 "RansomwareAkira.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffc9ce60000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffca97b0000 "RansomwareAkira.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffc9c3b0000 "RansomwareAkira.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffca8c00000 "RansomwareAkira.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffca7210000 "RansomwareAkira.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffca9680000 "RansomwareAkira.exe" loaded module "KERNEL32.DLL" at base 7ffcabb20000 "RansomwareAkira.exe" loaded module "NTDLL.DLL" at base 7ffcac840000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffca97b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffca97b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffca97b0000 "powershell.exe" loaded module "KERNEL32" at base 7ffcabb20000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc8d920000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffcabb20000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffcaba70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc95c50000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffcac290000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffca8c00000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffc9f3e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc7fc70000 "powershell.exe" loaded module "USER32.DLL" at base 7ffcabd30000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffca97b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffc95d00000 "powershell.exe" loaded module "NTDLL" at base 7ffcac840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffcab2e0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffca9d10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffc77a50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffcabbd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffcab2e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffcac2f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffc7f000000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffc76fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffc81b20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffca7fd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffca9680000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffc74f60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffcab2e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffcab2e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffcac840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 28ce3450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffcab790000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffca8d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffca8d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 28ce4890000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ffc95be0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc9f3e0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc95bc0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 28ce4890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\9WYDOK3Z.DLL" at base 7ffc8d860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffc88c40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffc819b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffc81840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffc746b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffc8a370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffc73d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffc814d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffca97b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc7eeb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffc97ac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffc813f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc7ed70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffc97a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffc9f4f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffca8ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffca7bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffca7210000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffc7ec90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffcabb20000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffca8a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffcaba70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffcab2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffc73b00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffc93ee0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffca97b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffc9c330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffc9ea30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffc8a340000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffc97a50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffc923d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffca4c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffca8420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffca1410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffca2530000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffca16d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffc9ce60000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffca97b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffca97b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffc9c3b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffca86f000036:Tffb,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp")37:T4cf,"RansomwareAkira.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "RansomwareAkira.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "RansomwareAkira.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "RansomwareAkira.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "RansomwareAkira.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "RansomwareAkira.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}") "powershell.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")38:Tfd1,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007320-00000C28-654847535] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007320-00000C28-655156548] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007320-00000C28-655275546] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007320-00000C28-655363524] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007320-00000C28-655611487] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007320-00000C28-655664746] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007320-00000C28-655726922] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007320-00000C28-655792434] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007320-00000C28-655882249] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007320-00000C28-655978377] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007320-00000C28-656083238] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007320-00000C28-656413687] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007320-00000C28-656542585] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007320-00000C28-656809903] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007320-00000C28-656842396] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007320-00000C28-657344528] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007320-00000C28-657875947] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007320-00000C28-657924937] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007320-00000C28-657974170] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007320-00000C28-658043682] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007320-00000C28-658047660] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007320-00000C28-658204300] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007320-00000C28-658544587] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00007320-00000C28-658586777] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00007320-00000C28-658660486]39:T820,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp")3a:T34f7,"akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "Log-05-11-2024-12-25-59.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\Log-05-11-2024-12-25-59.txt]- [targetUID: 00000000-00006236] "c255366b801509a34d603fc61fd62f79.arika" has type "data"- Location: [C:\TorService\data\c255366b801509a34d603fc61fd62f79.arika]- [targetUID: 00000000-00006236] "74cc718391507614c9a3d103718c64bb.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\74cc718391507614c9a3d103718c64bb.arika]- [targetUID: 00000000-00006236] "e0ab6679f54a95168d634f7a8952f5f6.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\e0ab6679f54a95168d634f7a8952f5f6.arika]- [targetUID: 00000000-00006236] "68f899e50ac479b17223ff9c277910ed.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\68f899e50ac479b17223ff9c277910ed.arika]- [targetUID: 00000000-00006236] "cbe848a7be7a5f807d4f31988c393758.arika" has type "MIPSEB MIPS-II ECOFF executable not stripped - version 44.71"- Location: [C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\cbe848a7be7a5f807d4f31988c393758.arika]- [targetUID: 00000000-00006236] "c7921b27be802a5196f0e25a2d767f0f.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\c7921b27be802a5196f0e25a2d767f0f.arika]- [targetUID: 00000000-00006236] "e0ab6679f54a95168d634f7a8952f5f6.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\e0ab6679f54a95168d634f7a8952f5f6.arika]- [targetUID: 00000000-00006236] "465ce1d315a25020498475cd0e470c2b.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\465ce1d315a25020498475cd0e470c2b.arika]- [targetUID: 00000000-00006236] "32b82f726d1ee58f991922a10045a43a.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\32b82f726d1ee58f991922a10045a43a.arika]- [targetUID: 00000000-00006236] "3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika]- [targetUID: 00000000-00006236] "1e796c058d62e356b07523c734204691.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\1e796c058d62e356b07523c734204691.arika]- [targetUID: 00000000-00006236] "e0ab6679f54a95168d634f7a8952f5f6.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\e0ab6679f54a95168d634f7a8952f5f6.arika]- [targetUID: 00000000-00006236] "abb341de59578cc2eefc8b95d451142b.arika" has type "MIPSEL-BE ECOFF executable not stripped - version -58.89"- Location: [C:\TorService\data\abb341de59578cc2eefc8b95d451142b.arika]- [targetUID: 00000000-00006236] "65f18c22a26d786d58baf03327b3a4b6.arika" has type "MIPSEL-BE ECOFF executable not stripped - version 79.98"- Location: [C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\65f18c22a26d786d58baf03327b3a4b6.arika]- [targetUID: 00000000-00006236] "4e0b2678720cbea7115590fd585dcb1d.arika" has type "data"- Location: [C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\4e0b2678720cbea7115590fd585dcb1d.arika]- [targetUID: 00000000-00006236] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007320] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\Config.Msi\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%LOCALAPPDATA%\Microsoft\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%COMMONPROGRAMFILES%\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\$WINDOWS.~BT\DUDownload\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%LOCALAPPDATA%\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%COMMONPROGRAMFILES%\DESIGNER\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\TorService\data\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%USERPROFILE%\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%COMMONPROGRAMFILES%\microsoft shared\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\TorService\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\History\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%LOCALAPPDATA%\Microsoft\InputPersonalization\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%USERPROFILE%\AppData\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%PROGRAMFILES%\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%COMMONPROGRAMFILES%\microsoft shared\ClickToRun\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\$WINDOWS.~BT\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\tempdir\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\found.000\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\Users\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%LOCALAPPDATA%\Microsoft\InputPersonalization\TrainedDataStore\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\TorService\tor\pluggable_transports\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%PROGRAMFILES%\(x86)\Adobe\Reader 11.0\Esl\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%PROGRAMFILES%\(x86)\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%PROGRAMFILES%\(x86)\Adobe\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\PerfLogs\Admin\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%ALLUSERSPROFILE%\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\PerfLogs\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\Recovery\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [%PROGRAMFILES%\(x86)\Adobe\Reader 11.0\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\found.000\dir0000.chk\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\TorService\tor\akira_readme.txt]- [targetUID: 00000000-00006236] "akira_readme.txt" has type "ASCII text with very long lines (435) with CRLF CR line terminators"- Location: [C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\akira_readme.txt]- [targetUID: 00000000-00006236]3b:T4fc,"RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\RANSOMWAREAKIRA.EXE"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "RansomwareAkira.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "")3c:Tcfb,"RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0001"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGSVCS0000"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGPROCS0000"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000602XX"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN-US"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "RansomwareAkira.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "")3d:T806,"RansomwareAkira.exe" trying to access non-existent file "C:\MPR.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\NCRYPT.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\BCRYPT.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\NTASN1.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\FLTLIB.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\WINSTA.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\WINSTA.dll" "RansomwareAkira.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "RansomwareAkira.exe" trying to access non-existent file "C:\CLDAPI.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\CLDAPI.dll" "RansomwareAkira.exe" trying to access non-existent file "C:\AEPIC.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\AEPIC.dll" "RansomwareAkira.exe" trying to access non-existent file "C:\PROPSYS.DLL" "RansomwareAkira.exe" trying to access non-existent file "C:\PROPSYS.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL"3e:Tdcd,"RansomwareAkira.exe" trying to access non-existent file "C:\F251F2764BCF24DFB2B7B3659F3822E4.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\B46B17C2494A934449488EFD940AE644.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\114EA80A20E24BFA5DEEB4A57A3D210D.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\F968CAA55EF5F6E564ECEB201BE735CD.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\6296595754E07C446C9B94FD1A4A8D58.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\found.000\dir0000.chk\1A0E631A599433D67500078DE7C6564D.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\3A6EE2FDC0DE095D3DC7FD9F61F1DF5B.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\93350BDA2D3F6B8D09BF6B20588A8A07.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\D2A8ECB5C6D74CB324138C74CADA6F4A.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\6A48325204DCDED4D7A552E8FEC68239.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\DB4DE6E1FBB309DF3E84E694DE09A8B8.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\74CC718391507614C9A3D103718C64BB.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\FE6E3E4D6DC1B39F4B64A6FADF7E54CF.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\65F6AA8A9714500C87B32B523F3E9137.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\882AE1A2B4E10916699D2D1B2085CECA.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\09B673F6E37D2B12C6807A45094C17E2.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\F27E58EDE16D43D9F433CE1671643930.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\465CE1D315A25020498475CD0E470C2B.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\replacementmanifests\F738F84AE3FDE924B9D6D925474265CD.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\882AE1A2B4E10916699D2D1B2085CECA.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\32992CD7E0604564CB3C7B596C1DC459.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\0D640AE810CB7CBEB891DF0330CA24E7.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\$WINDOWS.~BT\DUDownload\Setup\E126403F882AD3D649FB8D6F4FB4F053.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\C7921B27BE802A5196F0E25A2D767F0F.ARIKA" "RansomwareAkira.exe" trying to access non-existent file "C:\Program Files\Common Files\DESIGNER\AFE14A9B3E382C4353377DD4F6FF95E3.ARIKA"3f:T4a4,"RansomwareAkira.exe" writes file "c:\log-05-11-2024-12-25-59.txt" "RansomwareAkira.exe" writes file "c:\boottel.dat" "RansomwareAkira.exe" writes file "c:\$windows.~bt\akira_readme.txt" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\akira_readme.txt" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\setup\akira_readme.txt" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\setup\replacementmanifests\akira_readme.txt" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\setup\replacementmanifests\contentdeliverymanager.utilities-replacement.man" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\setup\3a6ee2fdc0de095d3dc7fd9f61f1df5b.arika" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\setup\appraiser.sdb" "RansomwareAkira.exe" writes file "c:\$windows.~bt\dudownload\setup\replacementmanifests\microsoft-windows-advertisingid-replacement.man" "RansomwareAkira.exe" writes file "c:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml" "RansomwareAkira.exe" writes file "c:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\74cc718391507614c9a3d103718c64bb.arika"40:T1a16,"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ3. Use this code - 9683-QE-ETXZ-GHWN - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-xtbij3. use this code - 9683-qe-etxz-ghwn - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: Ransomware Akira "Hi friends,Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ3. Use this code - 9683-QE-ETXZ-GHWN - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "hi friends,whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. moreover, we have taken a great amount of your corporate data prior to encryption.well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. we're fully aware of what damage we caused by locking your internal sources. at the moment, you have to know:1. dealing with us you will save a lot due to we are not interested in ruining your financially. we will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. if you have an active cyber insurance, let us know and we will guide you how to properly use it. also, dragging out the negotiation process will lead to failing of a deal.2. paying us you save your time, money, efforts and be back on track within 24 hours approximately. our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. if you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-xtbij3. use this code - 9683-qe-etxz-ghwn - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: akira_readme.txt41:T51c,"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ3. Use this code - 9683-QE-ETXZ-GHWN - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-xtbij3. use this code - 9683-qe-etxz-ghwn - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: Ransomware Akira42:T14f8,"Hi friends,Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ3. Use this code - 9683-QE-ETXZ-GHWN - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "hi friends,whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. moreover, we have taken a great amount of your corporate data prior to encryption.well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. we're fully aware of what damage we caused by locking your internal sources. at the moment, you have to know:1. dealing with us you will save a lot due to we are not interested in ruining your financially. we will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. if you have an active cyber insurance, let us know and we will guide you how to properly use it. also, dragging out the negotiation process will lead to failing of a deal.2. paying us you save your time, money, efforts and be back on track within 24 hours approximately. our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. if you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-xtbij3. use this code - 9683-qe-etxz-ghwn - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: akira_readme.txt43:T51c,"2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ3. Use this code - 9683-QE-ETXZ-GHWN - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-xtbij3. use this code - 9683-qe-etxz-ghwn - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: Ransomware Akira44:T14f8,"Hi friends,Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ3. Use this code - 9683-QE-ETXZ-GHWN - to log into our chat.Keep in mind that the faster you will get in touch, the less damage we cause." (Indicator: "hi friends,whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. moreover, we have taken a great amount of your corporate data prior to encryption.well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. we're fully aware of what damage we caused by locking your internal sources. at the moment, you have to know:1. dealing with us you will save a lot due to we are not interested in ruining your financially. we will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. if you have an active cyber insurance, let us know and we will guide you how to properly use it. also, dragging out the negotiation process will lead to failing of a deal.2. paying us you save your time, money, efforts and be back on track within 24 hours approximately. our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. if you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.3. the security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since no full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.4. as for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5. we're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.if you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:1. install tor browser to get access to our chat room - https://www.torproject.org/download/.2. paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-xtbij3. use this code - 9683-qe-etxz-ghwn - to log into our chat.keep in mind that the faster you will get in touch, the less damage we cause.") in Source: akira_readme.txt45:T19b5,Pattern match: "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u" Pattern match: "https://www.torproject.org/download/.2" Pattern match: "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.5" Pattern match: "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "6299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: ".wsf;.ws" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "ft.cn" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "0www.entrust.net/cps" Heuristic match: "-23.cr" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623636" Heuristic match: "## all the types of access rights understood by .net"46:T21e3,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006236.00000000.105648.ABB50000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007320.00000000.105743.95BD2000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007320.00000000.105743.C9330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007320.00000000.105743.C9330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]ic" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007320.00000000.105743.E3350000.00000004.mdmp")47:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp")48:T620,"RansomwareAkira.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter akira_readme.txt (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter 663124692 (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter found.000 (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter DUDownload (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter Log-05-11-2024-12-25-59.txt (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter dir0000.chk (UID: 00000000-00006236) "RansomwareAkira.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00006236)49:Ta64,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.0FFAA000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007320.00000000.105743.C9130000.00000004.mdmp, 00000000-00007320.00000000.105743.E3350000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00007320.00000000.105743.CB2C0000.00000004.mdmp") Found string "[-WindowStyle