Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/07/2024, 10:46

General

  • Target
    GrandCrabV5.0.1.exe
  • Size 2.7MB
  • Sample240716-mvb1ts1fre
  • SHA256 b4902aa2802656f873111b272c03ad93ca2dd53c0c612b9d310c982f4afa497b
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (2243) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe"
    1⤵
    • Drops file in Program Files directory
    PID:424

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        msvcp140.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll
        • Size 558KB
        • SHA256 d52b5ed8a491a579ffdd5c7c262a8a515bd53d370fbbaa4bd21e71b1d6499eda
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll
        • Size 95KB
        • SHA256 5c5da4ab4d661c838654dfa8cb19a592953937dc92b73f6c3212cbd6d4514cec
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140_1.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll
        • Size 36KB
        • SHA256 bd1bdf0dbf36acc39831f27e5b3d5ea19d5e9fa28c2f03390a8b6dca92192043
        • MD5 SHA1 SHA512 SSDEEP

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 3b76f2390c6f1568d2a7133ffc20b32475999865a449051c822b3bd908764b45
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 7845cdd9fdfe4cea34059efbcece3a33d48ad60c3d5fe2b30ea8a0d778a9bc1e
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 bf7cd336d7174a7bc861b5d443775ef69c92c4d6a54dcf9e5e8385435bfac68f
        • MD5 SHA1 SHA512

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll
        • Size 11KB
        • SHA256 701d62f266cb0240513d5321fb7377f10bf85f7fc6231e83361a8ed2437bef05
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-console-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll
        • Size 11KB
        • SHA256 21f8715920b12d21d160d30d8ddb6c0da6c0ca5f52e172b934fc164d76c9ac74
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll
        • Size 11KB
        • SHA256 5e94d294e16c8d245627fd8154a35ca55b97c3b1b365957db989229ff5a3f473
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll
        • Size 11KB
        • SHA256 4965bd8b72c8986f023ae59a96fe5f155a535e7ba5745ffe9310c4b0493a367e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 11KB
        • SHA256 ba473cce159550c67407c09a9a46d0932d0b0a30effc5ef069954673cb4b573e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll
        • Size 14KB
        • SHA256 67925aa503fde97190fde358a8840dfc01507cb00d07017328189f084dc96d2d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll
        • Size 11KB
        • SHA256 1a82c0f66c14451d0ff645722db29678eac0ef7e9ca9f4eddb8f92d1e1bc951b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll
        • Size 11KB
        • SHA256 5a7c10254e6f9753f7d7640705684eb49b3c04e8aacf0c955f6128c45dd8978a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll
        • Size 11KB
        • SHA256 eee6d53c60934a2a08b5675b76400f9f97bf9d028325d8382248c52c33d34210
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll
        • Size 11KB
        • SHA256 6932906cff59614b6b56f52324d6c528af429b4cdad039d22ed973ee2394a913
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 11KB
        • SHA256 404700b223a15dadcf108525f8e08f8971e89b90195c313f3fe36835b190acc7
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 12KB
        • SHA256 51f074f540c70144e4edf046ac905bdda8e45651b5e32dbbefc232b4f55a825f
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll
        • Size 14KB
        • SHA256 0c53a93f7f09dfdd4b62a3cb1849cce670e38a56c82bc20d102531f36d78769d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll
        • Size 11KB
        • SHA256 67407c2a28a1f05e75d8e1bdf5ee8d2ea97e9e11a5cb14806d136e8720c45be4
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 11KB
        • SHA256 38642d6ede4dd00e27604621479c6681328f8ea1b0e96e75133df73f63a9d5aa
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 12KB
        • SHA256 a231618604198c39fe8999e473f28c9c01fbaeb4e12b978386822dfe3e4e604b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 13KB
        • SHA256 3992947a43fff9bce875d56568f31918828582b97d60d518e8aee5e91fb4c567
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 11KB
        • SHA256 a87328d1cadc6bc864eb4e1c18e1e5c6a056e1a80f426b0e799bd3a36f488d6b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-profile-l1-1-0.dll.anonymous

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.anonymous
        • Size 11KB
        • SHA256 fefb43d871f11973000421a27f7db2218b4d58bec990854815350b773102438d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 11KB
        • SHA256 a27e232253682c74d363a95506d31283d1a573425a8f0654274c9877bdbe0a9e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-string-l1-1-0.dll.anonymous

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.anonymous
        • Size 11KB
        • SHA256 799da6a72dfd9a021491faceeef5b12b3d2ae64d85b1c1049c01d9bce0fb9fca
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll
        • Size 13KB
        • SHA256 05b3e21cc5cc3da1dd4a73f49b9dfc1adcd89985703d6575e51d2e5df11b26a7
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll
        • Size 11KB
        • SHA256 be895d9d8347cdecb4a95ad2f5f7f2de7496c7600f2f669a15a6a95d08bcfcf9
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 12KB
        • SHA256 684eeb3d7d72ddefc827b3a8c6afdb79f996b4a144b456055137b8ce9fc678d6
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll
        • Size 11KB
        • SHA256 a0e95f25bec05e3e0e903b7b2d2973dfc4c200bfa73d85db82ae8a6ced031896
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll
        • Size 11KB
        • SHA256 ce26e6c2f7f01fc8b98324b8869ceb8ab16b9c96643cb563828af6f3fbbee33b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll
        • Size 12KB
        • SHA256 b398f0053eb1422fddbc7513049bce9316058f39f1bcda761606a4942b1d77f0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll
        • Size 15KB
        • SHA256 fcbb3e6371e73c0ebeda38daf33248d38e28200bcdfd0c4a5116ea524880e203
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll
        • Size 11KB
        • SHA256 9e088632bdb1b7383cc8b216cc2cbaf522f8bea09f477ff5c08246d715f755b0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 13KB
        • SHA256 a2b6d5be305f099669b5449aa92966a2ba19b51249e07895a71b04d406761193
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll
        • Size 12KB
        • SHA256 377112f6217ec1f74fd73cf35c0c42c7c0474b78fb9dca41f4cad307afb2af6b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll
        • Size 11KB
        • SHA256 5f21fb948fef9cd075cdc324f231a86816397afdeb2e888caf79dce520d73548
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll
        • Size 20KB
        • SHA256 fc67114837d41be54f8ec61a44fcf709be53645023181a36cd6856fdcc6204fe
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 19KB
        • SHA256 edef69b699706894dd1a88ac5a88033f85265fad6a905266c69cf9fbeb849a76
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll
        • Size 62KB
        • SHA256 490fb4cde29c12f8ab83ba6ee7db2afd7b37febef11fd1016baa140e8ff3f30e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll
        • Size 12KB
        • SHA256 0e42802bd9e7d8c522d28f7710319f0843401b36f79b780ab02b27a2311b9961
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 15KB
        • SHA256 af4e791629c890ac14d14d2fc5ad5fda6d457f1ec246f397bb85f897a2d4a0c0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 17KB
        • SHA256 4fc16cdf62ac23c7c171878b1a1160c3bf3002e561304941d1342a1001d15bca
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll
        • Size 17KB
        • SHA256 d52d18069e9eff236ded4c9e44cbd08ad73387ec0bfdd59dfbbb20c17fe2aa3a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll
        • Size 13KB
        • SHA256 19dd492f04369e0750486106c6e6f42c200927878431b9a89fc1b564ea7bdc1b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll
        • Size 11KB
        • SHA256 f63742ba24d0292106755a8c4a62589ac77cce08e56616a8bb64da06179a8be2
        • MD5 SHA1 SHA512 SSDEEP

        ucrtbase.dll

        • Path C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll
        • Size 1011KB
        • SHA256 df97e017950182e8c3e567875c096a9fceffa47f7205215646f028df047da47c
        • MD5 SHA1 SHA512 SSDEEP

        OfficeClickToRun.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.1MB
        • SHA256 f44941bcfe25db775a72673213ee4809a47f100e59524d01e95bc9ca03dfa988
        • MD5 SHA1 SHA512 SSDEEP

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 353e1f23e6487eaf4a4b580a2bd96ccf5be15a328cc3ab96fd8c6054860c469c
        • MD5 SHA1 SHA512

        Localytics.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll
        • Size 16B
        • SHA256 7dc447dd9b8575bde4629b90b9e216928002a5d2610bd1b657966d2d29b89d3d
        • MD5 SHA1 SHA512

        zlibwapi.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll
        • Size 274KB
        • SHA256 1fa5c1429dffc5a563b6b0a15bc798e738f06cd240754dcc8c910a19242061a5
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll
        • Size 18KB
        • SHA256 b533441b028857529b86f76cc64d701433ef4b893ca257e10dc7beb26a7dd5e7
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll
        • Size 18KB
        • SHA256 9ef7b39bf62a70fb0aa81acaafa944b321ca56c70878a86590eae62888212442
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 7d0a5fcf9dcb85a20b00fbc11ee20193821dfdafb75a8f338b6498e3a5eda03c
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 4662db8b424b402cac576b702980413d78e5913c26d5a2c92df70245ae97c83d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 ddb33fa96ced041fbb1d85acd4e705c6dd32c43f6a461e0c9300c846b07d0458
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll
        • Size 18KB
        • SHA256 dda690c56f33a08e6800c622cbe6cc9b7bbf481facdd21faca18323ef09aa7b2
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-xstate-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll
        • Size 11KB
        • SHA256 4fc0a73f8565b1dc42a40f96899b9d5aaabc4a7b28343b8db08238094576bb73
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll
        • Size 19KB
        • SHA256 9582ffb1a7dd7f3c72706940d5a9c778eda4e9fc0466a6cf39f20457521161d8
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll
        • Size 22KB
        • SHA256 607579f9eec76477839ff72616fa366ade5f80be377849e729a0ef4b5f951eb7
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 ee3ab82b11a6db6eb81174fcbb30a534d765b8d4b028983adba1598880fdbaf0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 267f035a44a679009beb4303c18a04a989b3936bd8f374b1591d37d7c84c3f95
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll
        • Size 19KB
        • SHA256 6c2dfd93e899522663e51826f5c209687d4a495126cb5d24b26b69ddae873174
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 6f2082e49ad78bed8e6ac3da93ae157d24022fa0e336f04978685b74b0696e9e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll
        • Size 27KB
        • SHA256 ec63ffb3067955aa09c3d09fac6b7d1229301fd3217c40589e6f017a6a504c60
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 26KB
        • SHA256 ad936ab97453a45f614cc9fb411d695e9e3be68c92c5d993600ec8ce98502990
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll
        • Size 69KB
        • SHA256 604f3e9d9247e102941ba2ce2f0b985a32a4888ebff744a0fe8723f54a29fb57
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll
        • Size 19KB
        • SHA256 2c7a02f3140c8f1436c753a1a147cf2140419d6d5dabcfad03c1be162990d031
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 ec1ddc8b3acb8a4cc2e6f3c08d11067be68ba0be811ee7ab2994ee1dd5230007
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 5d5c7cebae5f776cde1934b7a43f5d7b2b2b9931c33c8bbd33b2d1df0258321d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 1ab0217f0f5aa1b75ad264e6c1018b4a85f845c71d558d20f895f017d16cac9a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 015a15388e66809d3848fe42aa793b6a6fc88ddc3143d4e1b900d1cc743391d0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 c56ec013201a630063964f9b2d91ecc23132a532a43c9b62bb1b8050ecaee38c
        • MD5 SHA1 SHA512 SSDEEP

        concrt140.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\concrt140.dll
        • Size 324KB
        • SHA256 0fee6d35a1ed9375391783a24ff6b95331315387e2e80ba89855f3d1229afec8
        • MD5 SHA1 SHA512 SSDEEP

        vccorlib140.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll
        • Size 358KB
        • SHA256 8bf295deeca240cb136ab0d1b02e2d3f6c5a21e54e92b658dc3f52052d6f3122
        • MD5 SHA1 SHA512 SSDEEP

        mfc140u.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll
        • Size 5.6MB
        • SHA256 cb44be2f6aa9f0a62a0d77bdba43bd8e27c95010061d594880be877f1b8fbfa2
        • MD5 SHA1 SHA512 SSDEEP

        msvcp120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll
        • Size 644KB
        • SHA256 a62cc458622b402414b227b2670ca452b2811061622c32aa1220fbeaa3246589
        • MD5 SHA1 SHA512 SSDEEP

        msvcp140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
        • Size 613KB
        • SHA256 a68d709c792aa44aa6d6bc0d6403659d472840e4e4078f9d148a594e7f479295
        • MD5 SHA1 SHA512 SSDEEP

        msvcr120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll
        • Size 940KB
        • SHA256 5860538eb35353e1aa51077d052e1f5fe0ff457729c1d2b14850ebcc4dbd2f41
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll
        • Size 18KB
        • SHA256 cf94528acae107db75e5e0fa2ef8793915de7ed00393012cca9ce30b75f6025d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll
        • Size 18KB
        • SHA256 cfa5d4b17761292d0c48305ee8e437e929376667a759442178c6313d0c9e5805
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 3550a59c1b54c50c3a9b9bc452a5608cb91ad70bad505daa639bb39bf7897b9b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 1e8fdc39cb44b5bf408bce30eea383714dfd454be5712c357999147eeeb399c8
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 b4f2063e1bf6b71a7135d244232c3eb0038b077ef9621d827a707c829d2aea8b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll
        • Size 18KB
        • SHA256 c5f06caba2b92cda4d2e1a4c825c7c23d55713b73101edbffd8c9f21a713ee3a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-xstate-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll
        • Size 11KB
        • SHA256 217a1ba4af6082c803a6a836ce13e06714dd6bd99a887a50e2880c54d991a708
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll
        • Size 19KB
        • SHA256 4c43807c9cd2e34263db1f5e816436578ad2552e3928212d433d2852d754dc4b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll
        • Size 22KB
        • SHA256 297b3e78726fdacf375d082e249dbd092e5edfeeeca1f0a32f5773fb75090035
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 deb558b4f33f69e4f60608ec7063d1e2422be5dcce7b0eff9d6b674894b1c578
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 69290b08ce5e3ecf0a4214af8a2d21f661cc00f4adbd8582f89f8a93f34fbca9
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-heap-l1-1-0.dll.anonymous

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll.anonymous
        • Size 19KB
        • SHA256 7e104c891bdbb49fe7ce68adff151076930323f320032bfee679a0acc98d80b0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 31e411a374e039e19445a58c3d1753f4e095f44523851bb6715b077ae2de0af6
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll
        • Size 28KB
        • SHA256 17be6e63c44e309c8f512bb57a08defd02fcbb5deaaca278752126b09f673f3f
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 26KB
        • SHA256 fc5e6937714e9b7ac8a4171d8224bda3054a4d1b8f4db218191656f43705e269
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll
        • Size 71KB
        • SHA256 753724ce653c5e202096dbdfdd458cefad6757b2be93b86493f52805299efe75
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll
        • Size 19KB
        • SHA256 fda8e8ffcec70d9a926ea0f41ddca7694d5ff6ac75c96b97bc7f0f6a1b1974ed
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 e6bfcfe0840301202e1f46d0039a5dc3ac79ce59483921766f32bf3bf2f9399d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 f75d853386bd17fe51d4858d369a47059a8dbc84995131d228a35c7659da5c25
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 a6e886a5296739e1c48fab7471ea4125159a29f922ea4ed9dde69d8342b3427e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 e21f3ab9a97211665d318b2dfe3f01d9a84999cc8d217fc2367cf7ae4e6e92d9
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 a0376458ec71a933256fa27d80042307185b244f639e7f81742a3f9309b13f7a
        • MD5 SHA1 SHA512 SSDEEP

        concrt140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll
        • Size 244KB
        • SHA256 9b2a17d049844e20f7dde840f5438e77d1460368cdae94f9eff78c635cfa6688
        • MD5 SHA1 SHA512 SSDEEP

        mfc140u.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll
        • Size 4.8MB
        • SHA256 0645363e7c472bc0514747feeaecf89f8ad1d68e322bd7ce43fcf79ed7453b22
        • MD5 SHA1 SHA512 SSDEEP

        msvcp120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll
        • Size 444KB
        • SHA256 88f9fa0514dc0356fb78d0c40776a024badafc50e2f7ef3438ad05c200a5be5c
        • MD5 SHA1 SHA512 SSDEEP

        msvcp140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll
        • Size 439KB
        • SHA256 755d1d083d20091c8be4d287925ab057456791ed556192ed7ffb3330af77c352
        • MD5 SHA1 SHA512 SSDEEP

        msvcr120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll
        • Size 946KB
        • SHA256 fa14dfb69e1911be118194adbf73c01fea8781d3de7de940aa9dfc5b60c8a635
        • MD5 SHA1 SHA512 SSDEEP

        ucrtbase.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll
        • Size 879KB
        • SHA256 2af9e6a07c22ca5b05445ab81daad5bae6b132ece25b1e34d0334b29ceb05a9b
        • MD5 SHA1 SHA512 SSDEEP

        vccorlib140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll
        • Size 263KB
        • SHA256 2081fb96107e08f9c399983b8925483ee031dd093bb9483c18468a5f5e1d786e
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll
        • Size 79KB
        • SHA256 2236fb3f830318dc58dd275721b0ee7028cda2f2ff71dcba561d5c2b0a680af2
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll
        • Size 83KB
        • SHA256 33a0e01aeaf5b41c3936030b29f2ca60b80dfbc30d91624cdf23912f04359c51
        • MD5 SHA1 SHA512 SSDEEP

        misc.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 1014KB
        • SHA256 fde4200f9859ddb0b1e5a93ea596547262a16158f03c145453b687aa8a182e69
        • MD5 SHA1 SHA512 SSDEEP

        memory/424-1198-0x00007FFF29BE0000-0x00007FFF2A5CC000-memory.dmp

        memory/424-1005-0x00007FFF29BE0000-0x00007FFF2A5CC000-memory.dmp

        memory/424-944-0x00007FFF29BE3000-0x00007FFF29BE4000-memory.dmp

        memory/424-3-0x00007FFF29BE0000-0x00007FFF2A5CC000-memory.dmp

        memory/424-2-0x00007FFF29BE0000-0x00007FFF2A5CC000-memory.dmp

        memory/424-1-0x000002527EBC0000-0x000002527EE72000-memory.dmp

        memory/424-0-0x00007FFF29BE3000-0x00007FFF29BE4000-memory.dmp