Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 10:46

General

  • Target
    GrandCrabV5.0.1.exe
  • Size 2.7MB
  • Sample240716-mvb1ts1fre
  • SHA256 b4902aa2802656f873111b272c03ad93ca2dd53c0c612b9d310c982f4afa497b
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (3653) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4792

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        msvcp140.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll
        • Size 558KB
        • SHA256 725898a9fad3ff390f936859741aabe39e6e1e56dc69fa566edb6f521b1f1279
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll
        • Size 95KB
        • SHA256 4ffb2d3d9668525e3c61375c683527781cfc46ecb6eda42c236546fa85f36fb0
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140_1.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll
        • Size 36KB
        • SHA256 e92c870b90542f9d6b0913ad504194055c3f8e16cf0839cf5d8b792e719bfa58
        • MD5 SHA1 SHA512 SSDEEP

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 df5e3e216a3c74c2358a065a3bba93a993845aea403cb077475fd2386aab74ce
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 c4f4cd9fc73ee8a9b2bc57d7fed13ce0662a646d69b11789b287be5fd35b3383
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 07cea30c73fe97239d0c76ac23d149741210a5377cd7a635ab1fc424631984e5
        • MD5 SHA1 SHA512

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll
        • Size 11KB
        • SHA256 44eea1201c3842dbad25a73135295ddbb42b50f7c7be2351df6c7f5c00675504
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-console-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll
        • Size 11KB
        • SHA256 df397b2fc947f0c406e0f52244b0218d81d94bc69d1ea8840d28d4d12567d85e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll
        • Size 11KB
        • SHA256 c4634b1cb04aa4c33c0b39e362a91c1eccdc21530421d2d5cce078ce9390d677
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll
        • Size 11KB
        • SHA256 24ae74c2b29cfaef4e9fd57084da0da0053b215fd2d70c1838bf0550092b7398
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 11KB
        • SHA256 5c8f6b14748508ac71287ae029ab7d0a9614797bd9d8aa06f1bb8ef599ae1ee8
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll
        • Size 14KB
        • SHA256 d5f38560e1f73b8d67fdb5b91b57b8f77c3636242d4a0fdb57d311e8734f8234
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll
        • Size 11KB
        • SHA256 6f8568ab9c13c5adae84452fd76d69067b258dbef5a5a1c1e4e108bf2e5bf0f0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll
        • Size 11KB
        • SHA256 a6169dde29f22e166fdcb3ef19921dabfdb73c5a3133d7bcfefdeb8ce2ab1814
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll
        • Size 11KB
        • SHA256 83c9d5d80b472fd3208b66f155a4dbae14d10778ad56f9b356ff9a7c70ea9a8e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll
        • Size 11KB
        • SHA256 ef04fb2a6ec1a3da8551d2e687c9adc294d3952d9bbea9a724da66adcf51e136
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 11KB
        • SHA256 cac5564c58876ab17348e36520f5753b089d65b81e8af638ebbf7a91eb59d1cc
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-libraryloader-l1-1-0.dll.anonymous

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.anonymous
        • Size 12KB
        • SHA256 88e2de5fb1bd798deb284f4945c1a6e43de16a0769fdd72b94a34dda3bb1bd43
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll
        • Size 14KB
        • SHA256 0e31779381b716b80f2e31155fb4a1ff6825b2454384407415ff381a8ea34dda
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll
        • Size 11KB
        • SHA256 b6882e43f9408f1070d9bdc58a8c10c2ff913f0955b1b2ca706f697fc7b3ed96
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 11KB
        • SHA256 2e2e134cfa46d0f65387b908cf73b0f6e1a12b6c89ed021528f997802933aae2
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 12KB
        • SHA256 e8b4ba5f263e3a393731cda0bcb1c46ae11fff368a725e326411ed67fbbdb8c0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 13KB
        • SHA256 c344b746b3bd6f44470846710dd711fba7d2c47f99657190de55838599f901b5
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 11KB
        • SHA256 ce405d9ef2fcc499e88ae379e285b9f6742bbdb34e1a6d1acd17935dcc17d9e7
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll
        • Size 11KB
        • SHA256 8f56050420fef1661ca70b81452c51ea17f73f07cad4ecf5a6587158f6ab8687
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 11KB
        • SHA256 a5a20aec99208bb023a720bce531b6d632279aa28dc4f329b4cf93a85177714a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll
        • Size 11KB
        • SHA256 6b85680e7aaa7107988629ebc97905a20967c8b37ccdf0e37f982622e687fd53
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll
        • Size 13KB
        • SHA256 582a35fccfc51923519a59b9e367bf72b014dad875a7524e9bd3013d359c94d4
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll
        • Size 11KB
        • SHA256 4c21057161268316dbebd78b7e26d63ca5685a6de9b1c823df8b7ab3ec59a157
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 12KB
        • SHA256 d144b193aa08f20f226029398a0c2c60c7dcda6a8a45a82721bac28a8eda3845
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll
        • Size 11KB
        • SHA256 db27d67110130faf3cb58ed744632cad5274e60c00dd3fad109bcaba94ab9b81
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll
        • Size 11KB
        • SHA256 c51566c66deaa95d7f0631062105003ecd425449bc5d57ca5fd8f50539215554
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll
        • Size 12KB
        • SHA256 9e2c0aa7ee1a7334a1a7634d60b62d903952531911068f82d847cb2e20fa2316
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll
        • Size 15KB
        • SHA256 ad37177b99bd8530fd071a8dac84938e41fcedc439044b5eeb902ad27e8da5a3
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll
        • Size 11KB
        • SHA256 d81d47b28ba5f91f0a1ff2d586cfed962fd84936540166baeed4ca515e06eaea
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 13KB
        • SHA256 6660eca54f706392c08f84a0f721da22b9ee4d75721e11ac87ef0c2eb03a6e74
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll
        • Size 12KB
        • SHA256 34558e16728ce548538740c69c85700dd8a3ebde46e3ab035f8064a8c0916139
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll
        • Size 11KB
        • SHA256 16cbf26a94aeb1183dbac0ba0e7d303e89dceb2e693e2e1fd13af9ee21fab0fb
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll
        • Size 20KB
        • SHA256 b7934091608387995566bfb1559ade54c8dd55fedd79a775c40f809d0110f1dd
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-multibyte-l1-1-0.dll.anonymous

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.anonymous
        • Size 19KB
        • SHA256 f859f677ed8465db67656cefb610afa74e03943867678416e7f8b1e5bf44a1a2
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll
        • Size 62KB
        • SHA256 95eadf7bd94f9eb6a9aee2a08b84a7720b1304099f02bd6c083a9b090c652720
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll
        • Size 12KB
        • SHA256 86af2785328d63df30f23e0f1fbcaaa14025fa83a8e8b2690385acc2eb2fdf93
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 15KB
        • SHA256 785e024fda37e1dc62cfa52ea5474c4c4747780e18532aa0faaffb560f7f88e0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 17KB
        • SHA256 58d1e1334a1f43f1678bdae52c57869fe717122481a61425e61a0d4335fbd466
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll
        • Size 17KB
        • SHA256 98ba2e21869aca31ac136a87ff5dba613574617a4c4b3f37884a65d83b2842b4
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll
        • Size 13KB
        • SHA256 5a74f4cb07655b7826a3850dce3ad59df596ecc33f90c9da5a6b00c1c14e2a28
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll
        • Size 11KB
        • SHA256 0cbf9a2a17a4b831341737611b74214fb954022ccbdde1a03b099b0c0a38d7bd
        • MD5 SHA1 SHA512 SSDEEP

        ucrtbase.dll

        • Path C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll
        • Size 1011KB
        • SHA256 2743fd7b422a6f90c0050207f1d03c5d734ea6234d5a8ccc3c6c02896b774a72
        • MD5 SHA1 SHA512 SSDEEP

        OfficeClickToRun.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.1MB
        • SHA256 9c1bb78f1dbbdb116ed2cc236cf72f6405c68a278ce4a95ffb05e5862b9c492d
        • MD5 SHA1 SHA512 SSDEEP

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 f3a77b4e43feb0cbe092ae2ef11bb0731eb2e7ab2ef8960f7364caa77246db02
        • MD5 SHA1 SHA512

        Localytics.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll
        • Size 16B
        • SHA256 b1a9ac365c905724238df3a5df5f609f4255b50297bf48c8155956f56b71b434
        • MD5 SHA1 SHA512

        zlibwapi.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll
        • Size 274KB
        • SHA256 aa013b7d0436bba4b6e9d8ba87083c4370f572ee63ae57ad1f7223dc6aafccdd
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-2-0.dll.anonymous

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.anonymous
        • Size 18KB
        • SHA256 4a09d7ae49344939d59d2bb33e2ee4ba104f6d4e0a1f6aa868dc9ec967a26897
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l2-1-0.dll.anonymous

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.anonymous
        • Size 18KB
        • SHA256 df985c4b780b1700834ddd05472ef41b70125d9995c2da4329a274a7f5126292
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 b6de6b17a086dcac3fed955c26e40b3b02e2dd2df50d3766ef6e1cfc8337c383
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 529c50676ed6e691a816d2a96dbb24cf00d55999dc6a6fbd33b56080e468dae8
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 abb0ecedab37a702247445e1e6921091870e964e13d37981100776e1d292a2ea
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll
        • Size 18KB
        • SHA256 21fb84b2e7894a5a3255a301422fa485f9c3ef5bfdc74c551be3fde2964efb9b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-xstate-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll
        • Size 11KB
        • SHA256 038a740361f02600000b1c30360c9d42707698f2f110af3c8bca697b42b8fb4d
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll
        • Size 19KB
        • SHA256 232a7efad28cf89d20e14b1c62264e22a47c0301cc526fdfa4ca50b09c0076e2
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll
        • Size 22KB
        • SHA256 96c6dbbbfa5780d0e8810a1e27014c261f4bbd725fc645f5f98338a16788861c
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 a65997fa9e7c31415663252118a61db6d4959cb808bf3384e197b5e5358d64b5
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 f476e4f308f46e8dac0920b9f30808ceb15dbfcbeecce3d8082cda5733768510
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll
        • Size 19KB
        • SHA256 66dd28a4ffe768930bbbce628e08ea63c6527bc3d0a785429b30cb099bcee68c
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 ef37cc74990b02306bb23df73fcba7387f1884015dd82fccf7451431866c457c
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll
        • Size 27KB
        • SHA256 af8d24a9373afd690e3f9a28cceb4f0eb292e01edce9ec19394c7478ea111717
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 26KB
        • SHA256 842bef374729b068f992dcf95780003f3dc3894da76098acd070efc36918ee68
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll
        • Size 69KB
        • SHA256 64a93f6bd1d1f792e9199644157737a09bc026655aa049de302f6838fe529b44
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll
        • Size 19KB
        • SHA256 576005ac36e3b3876118001a8e8ab43a595ec7b496c305ad7467185a3fd8ae54
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 5fa4106b23de30a67b508259074be52dca9bf8052dcd0093ab4dfae52254c860
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 cd705652b04057a38bdc304798f7d0ac3a40266d528697c5e396ef72a77ceefd
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 dde72c479153d51c97df12eb58167f5e39f1733b60b407ac26039d987e366178
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 3300e5527646d5019a24bcc055cdbe7b283574b6fddf44092e0aacc48593d1a1
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 4f89091f74b3bd7204c7fdb0755388f067efab38635328b536a604efd0c640f1
        • MD5 SHA1 SHA512 SSDEEP

        concrt140.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\concrt140.dll
        • Size 324KB
        • SHA256 e5ed4768dc8361c3398f899470e8421a00fe672aae329f0c03cf7059af8e7c63
        • MD5 SHA1 SHA512 SSDEEP

        vccorlib140.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll
        • Size 358KB
        • SHA256 d670f3c98d18d7793d099281bb0eb60e2abbe52b21b9d5b6d1b02cf1de842bff
        • MD5 SHA1 SHA512 SSDEEP

        mfc140u.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll
        • Size 5.6MB
        • SHA256 071b56bc8c169dac33b1455877ce287eca7fe573e51134f353ace2520559c6f4
        • MD5 SHA1 SHA512 SSDEEP

        msvcp120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll
        • Size 644KB
        • SHA256 a01b3045066ebff4f2092a8f1c77c409c4bcf0492934f260f9a210e9800a0280
        • MD5 SHA1 SHA512 SSDEEP

        msvcp140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
        • Size 613KB
        • SHA256 e5c4e76661e72b416e98397157fd16784223f4251764e34006c8331f786a9fff
        • MD5 SHA1 SHA512 SSDEEP

        msvcr120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll
        • Size 940KB
        • SHA256 a3378f395bfe26d2de6ba42b9de93cf01d83721dc49786f1d426aa0dc8b2a075
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll
        • Size 18KB
        • SHA256 a7d37eb65d4968066e463c8ee53e0c7a8cb8f64d97dbc756c501d13ac496812f
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll
        • Size 18KB
        • SHA256 e5ab264711536d83921e33e6e90a7dd1e3d966fa5e5acad7271fe8d9586a2aa3
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 a39bc22e4bc3618d2414f93bb565894210234da39785cfe649f0803c869e801b
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 e9de072056d9071e3f202c526768ed81cfa41b3e20fcd9dd8fe8685434b71e6a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 018d343564c1146915a737ac980b890a17c766d8f3451a4f6e7efd18fec67a46
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll
        • Size 18KB
        • SHA256 8e39f190b8b2477e030c5c4fc295f009069762bad827148f581d15c26a8df2ee
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-core-xstate-l2-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll
        • Size 11KB
        • SHA256 e85ed91fa6301fc0f8f6c56bf75756e758ede87bef98bfa16361f675b8f1bf75
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll
        • Size 19KB
        • SHA256 da73ece570f12c8e1cd3c4d03ec6afb054b49be64f892f3cd71849629fa215f3
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll
        • Size 22KB
        • SHA256 d4368644e91b41e5f94950ac8a56ee9514e1330a2ac7a72f7ffa396506d44024
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 81d291d36a7eb9def126c06e918a03dbbea8c70e1c0e75286ad62aebb5b5a5d8
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 24614c8417afbde09537fb991a9473d5b8973260a24998ad10e66c386d061bcb
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll
        • Size 19KB
        • SHA256 0991ddc4f67d12eed9c7b25ef61546d8cb14ee4f08d8f279c6642f257ea323db
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 280b4ac0d2d67bd04aa407a04fdfba939775729810b2fc7275936637211d9b2f
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll
        • Size 28KB
        • SHA256 24a651567ae63b0ad1f41a8135fe184a3f50d0d60d3afb5356927ad3c63f38f0
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 26KB
        • SHA256 06a001ba1a853b6cd453e9abe31d87f16835998a7522e909fae26de1cb7db04f
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll
        • Size 71KB
        • SHA256 fb8d69f574fe4dffa8617c82257eabb6b48e310241c3bcd308483ab651fac54e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll
        • Size 19KB
        • SHA256 6eafe1b55d817616da7216b17bf7a37fb60bdcb55c4faab70a59d89a6d80cd9a
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 97071613f12d7128cde83ea2de9033a32fc58ef762da93ca931a3caa67871b8c
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 0569dfaefcfc421a45947a9987843f8d58fe7984210118636ed0a17feb01f471
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 71808925d1d1c381a9a0531069cb6fa15b9e3f724b0880f95332653098da867e
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 4cd6ec3cf8e8ffcb1b66e587b7db5999adb887b012c298b7d3e0445f15617669
        • MD5 SHA1 SHA512 SSDEEP

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 9c67a4d6ce016f3112ef9269d7c3dfff78d2327cc890876b74a985123fc69e29
        • MD5 SHA1 SHA512 SSDEEP

        concrt140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll
        • Size 244KB
        • SHA256 455b2ae22f738b6e6724155c7ba0ca5f19d27bac70f087b9c6633d21add208e5
        • MD5 SHA1 SHA512 SSDEEP

        mfc140u.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll
        • Size 4.8MB
        • SHA256 34deda4ad8b8c88b8ead58e67f8872043f149a896b4e8bbc02cb9102900021b0
        • MD5 SHA1 SHA512 SSDEEP

        msvcp120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll
        • Size 444KB
        • SHA256 f7382a24b986d62d4b7753194c7b9b714950b321ed364c5d9e3d9fdd9c13ec78
        • MD5 SHA1 SHA512 SSDEEP

        msvcp140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll
        • Size 439KB
        • SHA256 e9cf2656279c4e04f775b8c056975bbd57fd63afee9adc8f18acc7fd1b237283
        • MD5 SHA1 SHA512 SSDEEP

        msvcr120.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll
        • Size 946KB
        • SHA256 8d2ae1787131f4655de79ca190b67e0d8b37f55402722464d0f8cbfd6e056901
        • MD5 SHA1 SHA512 SSDEEP

        ucrtbase.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll
        • Size 879KB
        • SHA256 d50189a168b6e1bd98308c21907a808efbe01439e676991505868434c3862bff
        • MD5 SHA1 SHA512 SSDEEP

        vccorlib140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll
        • Size 263KB
        • SHA256 bed30bd2bd70028144f71c409dae5ef3c1ea00b50f40173a1b23624415799882
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll
        • Size 79KB
        • SHA256 ba6c50c0fbd7d6bc7e2f6f83741316a10a1fd8c6e09f7cab821b6c38f3c23f27
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll
        • Size 83KB
        • SHA256 efd50bd6ab127b517e3aa4ebf8971dd7aa16025f619fd7712bf3c6933deebbf7
        • MD5 SHA1 SHA512 SSDEEP

        misc.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 1014KB
        • SHA256 4bd10ec5aa60002e52187fbf0e11c9c387247f604400b9ca16d3ffc730638825
        • MD5 SHA1 SHA512 SSDEEP

        Microsoft.DiaSymReader.Native.amd64.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll
        • Size 1.8MB
        • SHA256 1e27a56d6a1992d5186a2267090253fd183f51e428a5d6be5bc58cdc3caa62c2
        • MD5 SHA1 SHA512 SSDEEP

        D3DCompiler_47_cor3.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll
        • Size 4.7MB
        • SHA256 7bc7b4567df988deb5c77874c5cea47aa8ce77b340ba8dc2815759bf8fcbdcb0
        • MD5 SHA1 SHA512 SSDEEP

        vcruntime140_cor3.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll
        • Size 116KB
        • SHA256 8bbd3a2947373e8b2ef61b32d423348187020c39f99ecc73adef1cb2ecd271cd
        • MD5 SHA1 SHA512 SSDEEP

        memory/4792-2-0x00007FFABAE00000-0x00007FFABB8C1000-memory.dmp

        memory/4792-1-0x0000029F269D0000-0x0000029F26C82000-memory.dmp

        memory/4792-0-0x00007FFABAE03000-0x00007FFABAE05000-memory.dmp

        memory/4792-5-0x00007FFABAE00000-0x00007FFABB8C1000-memory.dmp

        memory/4792-1618-0x00007FFABAE03000-0x00007FFABAE05000-memory.dmp

        memory/4792-1821-0x00007FFABAE00000-0x00007FFABB8C1000-memory.dmp

        memory/4792-2154-0x00007FFABAE00000-0x00007FFABB8C1000-memory.dmp