Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2023 07:12

General

  • Target

    malware_sample_1.exe

  • Size

    6.5MB

  • MD5

    a32eeaba767a13b7e0393ba3d2d321a2

  • SHA1

    5d32333358d94655c5da06febe2d4a90c41130c6

  • SHA256

    f651132897ef5dacc40ea8f34d3427003e119685b6bed93ed4a411f84f4795d0

  • SHA512

    b392db6153b4f5a553d7e85f414be59e219ad9d18fdf44fd90b6b97f0bbfd92376ccc2eb96be47e865c27474447e71401bb594b679a14a6e38bd6da1ec0e2ee7

  • SSDEEP

    98304:pH7CgqLPRPYv7cZuwYx72XPo0+Xv6zV470d7pz7dTH3OHMNsZlQUafCyr3Ey6Nh1:d+gqLKB2pscuopz7dTeNmfCyk+2OPhi

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

185.215.113.39/7vlcKuayFx.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\malware_sample_1.exe
    "C:\Users\Admin\AppData\Local\Temp\malware_sample_1.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\malware_sample_1.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1703142551 " AI_EUIMSI=""
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:2156
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0039FE920748E15D9C3CE3324C285DC C
      2⤵
      • Loads dropped DLL
      PID:2844
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 57533276D4F3ADFC1543AA045D17ADD7
      2⤵
      • Loads dropped DLL
      PID:2264
    • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11\evreporter.exe
      "C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11\evreporter.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f766730.rbs
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    d3b79de4c2851adfef02ea14cc9d6afc

    SHA1

    ae7c9f8848b8634483544c68da8125d6fa784222

    SHA256

    5bc1b003b0158b2ae654a8ceee985bd77b8b6db6812f0c51fa400f90eff26612

    SHA512

    55b8fe47377f87ecdb4a0b053b3b81635ffa38d4af08a90e9a16cf96b0119acc1cd4301a921d87470b4c57d04242d252069a3654f025628c4c29658da14e3bbb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1867b2737cb5af6bc216039b9b9c8fcb

    SHA1

    7344e24bc8034e55aba09f71b82a5b27dac0e0fb

    SHA256

    033bd92dd54e4ccd9dd0b42c118e2c755b9cfbfc583d7d15c5a9be9e9488430b

    SHA512

    cf2172fad0aad939b3d3f816b6dc9139191d5311230175dd3d11c54afebdd10cd4e6deea805bb23f009c9c0b29ef7be0d685330462505f480ea0f56136bbf3de

  • C:\Users\Admin\AppData\Local\Temp\Cab5CF1.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\MSI60D0.tmp
    Filesize

    391KB

    MD5

    a32decee57c661563b038d4f324e2b42

    SHA1

    3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

    SHA256

    fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

    SHA512

    e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

  • C:\Users\Admin\AppData\Local\Temp\MSI6247.tmp
    Filesize

    864KB

    MD5

    4e2e67fc241ab6e440ad2789f705fc69

    SHA1

    bda5f46c1f51656d3cbad481fa2c76a553f03aba

    SHA256

    98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

    SHA512

    452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

  • C:\Users\Admin\AppData\Local\Temp\Tar5D71.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\FileHelpers.DLL
    Filesize

    92KB

    MD5

    c4fd9a7da22a25848bd93dce9ff86d27

    SHA1

    72a18b181f44eb3efee01a2d29f993b560b17727

    SHA256

    29e02874cc24bfb987d733710dfc97c1692529a98cfe2b32fcb1589de991eb14

    SHA512

    165b543a2d02fba5ba815faebf031b6c108ec834fb5568eca3ce64874df06aa0b9c480bf038e519170741989de0308ae4668c5b187f7d602bf7c18b914b74c46

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\License.txt
    Filesize

    17KB

    MD5

    cab5d95bb20bd0f36241edd276851797

    SHA1

    31848479ee67d58a013f018bc165ce1674166c3f

    SHA256

    4cba25dfea9f5cf0454c4cfee27091740f8e556196330c010d1fbe35235dc59e

    SHA512

    c73db59553c69cf1d0cc1e945b2dfe38c59781c1d638bd8e044493732f255cb5f5b992a9db06086853608d81d7572f716922aa6a9042cf99ab1fc38c579ba478

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\Microsoft.ReportViewer.ProcessingObjectModel.dll
    Filesize

    52KB

    MD5

    253bc53169ad46b1eafb92982ba7268e

    SHA1

    3f2f8c6324480b1f39c7bc06b8503feedfe5def4

    SHA256

    ca513f09b64f8e3dc8ee09663854adf7e4e84544133d07a3a2ef55701abfad4c

    SHA512

    ab6847f2b7e07e85d555b313d63f74d4e74e50ea09ef32fe427822a25eca12264a49347428d32f42ed65c669c28dac426310bbd401a21c03177bd9729cfb5e08

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\Qt5TextToSpeech.dll
    Filesize

    114KB

    MD5

    99f5b275115a749309c0febb2c553a2a

    SHA1

    c3383e554c5c8d66ab1656603ff4f6d23568a520

    SHA256

    f4f008cec54534178cfd7164871adf4962c269e2b44d22491c580d2d589358ae

    SHA512

    f80ad1e94ae58ac5404e8a548200ec01e4941dd2460fa470fb6508c2d9a036d7d12f4547731999bd7dfa7ecd8b4bdf8a6ee4ad3d32ff07e39f6fb99ce1cb1f69

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\README.TXT
    Filesize

    3KB

    MD5

    2f271a2d2d92de5579f58b32f59993b2

    SHA1

    7582831fc25e3ce9c327706fd6d27f8a19e7abb0

    SHA256

    c3ffeaf3b4ee2c949c398e65dfeed95f8ef56da140b9a132c6d12d93d83dde2d

    SHA512

    7a0535c46553e39b507a994186b48c4d110296488306d6756fd42489dee5d317c238f725e44f167bb3f993d04fef996bad9956b40e86f42cd02b6de53b229681

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\adv.msi
    Filesize

    2.1MB

    MD5

    919a835b8e81091002c2ad83bf92c1b8

    SHA1

    296ea4111479c6eafa6d37d61c113269c210ab78

    SHA256

    0722015f9db6e41d8aba1cec9c6d24b10ac82e2d89af63e31fddcb180ef09282

    SHA512

    966eca3372ef5dab6d6b735bbbe834ae269d6fbab47d4ded49ab39fe083a95768439ed4fe2717696c2ae4f6daefcfcd936125c3ee730a0e9870242dba021830f

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\evreporter.exe
    Filesize

    1.8MB

    MD5

    8a63a7d64cb5d3ce994b1b17acd61920

    SHA1

    54604ca37104d4e3d07ff7e218577b31fc6d9788

    SHA256

    1236296ffea3ee626dae909885aeb60d5925ce1a93408beee124715aa91b434d

    SHA512

    155bf61313333eeb8a7d187173860422461174570d820181dfc93bba5da60d4f3e55b042f5a1215eeea15088e1de45a293e96bc0c0e1c67412298ddd614957c4

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\icuin30.dll
    Filesize

    2KB

    MD5

    29996eb0439c502823efb816d9e07cd3

    SHA1

    0af216ecb75ba7bfb781be66963a2638da6d0ad7

    SHA256

    d75236a76475944659a0c96debf19358ab032856e662959cdbf40e2a3509e5e6

    SHA512

    05e1f0115aee05da6542ba1a372cb15618a9fe813a8ac74204de6c7ec4952706843d680a68f5dedae44703743eeb2faf7c4942ad246fdae880f8779ac100f64b

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libEGL.dll
    Filesize

    67KB

    MD5

    2874582e39562af961a6d1c59447459c

    SHA1

    3cf7d154637aac69913b1f549938a21c7c4b16ba

    SHA256

    b1070d55627c2899d5928eff2f2e3187537162e93e189458fadd7ccfd6a2ca3d

    SHA512

    eeca63a7020346bda9a399b83f4e57b6b54bbb222c4a3cf7191ab7fe0271f6473bcc58f0e60ce5f7d5cbd57298b858ffa042b62ed9a9be0806e08e4c6f5c7091

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libbson-1.0.dll
    Filesize

    179KB

    MD5

    e9644e54c403dd5c0ef89c85ada3e295

    SHA1

    a42708b2837dba534e4cb866266e4959b28da452

    SHA256

    72ecd276b372487af75c67877eccc0ed4d15f2c07ffa7f631d8056038d0e8122

    SHA512

    22411a9e8a9f7082b4cf90c3c906e414b62b4bd2b9b10ea1694ec5651e3dec8d2e4716354f5b09d6396f4c094555f5f08b26534647a98dfa7b3039d6c1e219f7

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libgcc_s_seh-1.dll
    Filesize

    74KB

    MD5

    534b365361004828059600f05b34006d

    SHA1

    d8ff411b0939a021f47c845c6a90f1240bab5268

    SHA256

    438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b

    SHA512

    1ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libgmodule-2.0-0.dll
    Filesize

    41KB

    MD5

    4d233a220f91de3b1510d017b5481942

    SHA1

    c59f449b0d09127d18268e7b07da3f7d749b2720

    SHA256

    08336089e280805c8ac89f7476526f944b5868c014748b6dc29f65167e9e3ab0

    SHA512

    a86a1f9b5d160813c6e2f771962f303428604057b9613021bf7844c1204cfca0a18571a28d950d7999acc4ecde0605095f9a460a9b79fe2bbe02f080c2683923

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libgthread-2.0-0.dll
    Filesize

    35KB

    MD5

    cf2571c125fa1d2ec55b9977054f380a

    SHA1

    91014dd50f0eeb0d3d1faed77541c76a05b712b8

    SHA256

    02b817b6db18db2dfccefdd08eed64a696e2bf326f4120ee7e93ae6aa73bccb3

    SHA512

    a95bf3436ea2fac443924c5fc31fcd4337a44702ef38ca82d744474301e53f14721eaeb0f21e515ccff8569e7b7d81107fb5a4cf2ae485cd4a5d2dc95dae8f9b

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libmongoc-1.0.dll
    Filesize

    227KB

    MD5

    a80d629d6329dc31d5cb1157d853afab

    SHA1

    a2fa781452106cdf17a83e3e59c6fe50d557e62c

    SHA256

    500ee04865dbb7beb9474e0c2aebd6713df4407c849ec134457c7d0ca289faf0

    SHA512

    4e0253615d4c3c418b93547370f416edf5326bf66e3a5872c687b129e65e5967dc3d4ae97cf524ca5e77327b0ce07d93ba63470d541614a6685ebd26e0c7427b

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libogg-0.dll
    Filesize

    45KB

    MD5

    84e8e72572d53558d52403011fa0d388

    SHA1

    865160da7dbfaaea224541eb44e9430e1a7b7b20

    SHA256

    ca717b5cf2a7b0e047aabad985c631278941c58f16e2e9650ca12c3a331fcd4f

    SHA512

    47ee932bfa4ee3c51c3828ef8c6923e5b946966ad8e255bc2c53a60443aa2d4ab17521f21912a6f0469c7898d6543dc4b1783a86ddb5a84568818a7b37ec3992

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\libwinpthread-1.dll
    Filesize

    51KB

    MD5

    db18b7ec5f93127e6099744ea9568c1b

    SHA1

    e9143c76e308a816837e2f1a19dd0c5e2306ed08

    SHA256

    5bbef249a0d00e2d32c699d0bbe89f714ebeb872b3990a5cbeccb1d89f63e5e8

    SHA512

    ee1e645bed0bc3ad9e959d6342153e608ad21a7f5aef60b4cd8cc96fde7aeec4bbbb7474b59cab8ced8f28dc9f66cab32f4825333c891524901dcc40e70a1580

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logohelp.chm
    Filesize

    395KB

    MD5

    4498d1584997d8ee7626b51f23bccdd1

    SHA1

    707c0b366848b51a16be5b858d021d1f687a4a6e

    SHA256

    1d8254bc535746478c18de7613731fbc87c5754126d260c40888d38c56007f81

    SHA512

    4cbb7f9191a39d5de8a8dedc054db71695fd54c292eb5a33657efd4483e6276427f076e9c9d49045282829dad57f04e07364532ed8bf96c3c55747ab66bc867f

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\#
    Filesize

    88B

    MD5

    f0a82f611f562197355d1d8b19de1fcb

    SHA1

    6cc0f96476fa9cf1f92e8d6dbdc3932d2c65c3f3

    SHA256

    ec9546682cb6e9f0cd51acf4e40a21d7e37cc5bf511718bf77857d82839eda5c

    SHA512

    fd4a2e5319ff95712bb663095d3989a21d2291aab1a80fe6edebe3178e6ad919fe3b42005a476f50d823c2224ecfbf5e3a569d360d5f9328cca5d61a999a0ef4

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\+rest
    Filesize

    81B

    MD5

    0b2941110ae4ca1fe0b526f29e939c56

    SHA1

    1abe6e5b101ed5416c4a0e0c3deb6fc116e63fd7

    SHA256

    535bb2947036fd7f97586b91cbe21365758a4f9aface538b19217ed19ad0b144

    SHA512

    17a7fcd9ce467c45ec64f27a0be4fc18f98bf6132ff25d3f689180931e447a3d380a0c8acedcd1332042839cd906f851ba052cdb3bb366d821f1e0032a83d1d5

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\abs
    Filesize

    72B

    MD5

    fb1c3813f0f4da26d0237979837569ab

    SHA1

    ba79adce4d3ddd7c87588851a100880addac43f2

    SHA256

    15ba8dee761da296d10207697dc8bd8a2295d38aec4770c3c1b68b676c552f4a

    SHA512

    191a2fbb2a3dea11dd2eedaf61cb1d3d5ee7a9db0a670baa90737ad6c8a369c4db0ad7f534a8c16d356fe13a3637f4183e12b0fb54f964a2d33f6d1ba27a7836

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\arc
    Filesize

    63B

    MD5

    873b49db14f0f80e4ba9b5917f5a3653

    SHA1

    d1ba078edfed621ed837b7e4916417f9d30fb4ca

    SHA256

    1a77248f9397e3b45526cc47379d10a564447920a755fc1394bf64966969c31b

    SHA512

    20a6fada56bb3db5a1754bd5c00d2a8f4a3e11aea65db79146a1296c735af9ef79a7ffd088601387e0bbe3997eb79b45df70b19b993eb508460ff3efddcfd3bc

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\arc2
    Filesize

    68B

    MD5

    39cfcdabb0e6b9f7f371eba4b5405889

    SHA1

    3fd820d9aad6067438e8d85341b867a3cbcc75d8

    SHA256

    51a3ce10433666626dd5627bf50ff39086f811da2d864ef5eef6ed524c3b6b44

    SHA512

    4c1d857d62801173f12e3d8771e0a761e94115819554f4d810a21caa27a0d0519c61de3ed099054de544a2a170b40239798bde9d8ed9962258562dadce2f3a4f

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\arraytolist
    Filesize

    152B

    MD5

    2018a8ad952f7d4b6ba64620923d72ac

    SHA1

    b7379963becaf5f6d569ef6e412c811d7285f552

    SHA256

    8690cfb18cc9d9fd3836d98c07f75edc896a717f43a45562141d0a731b8842a6

    SHA512

    67d48672047e4f97c2887c6004e71bc484158ff131517a4b84e2c5f90ab86670276e68f5373c785996edc1bda715ed9a60fa3d3f700d18e09dd114b4602d842c

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\ask
    Filesize

    214B

    MD5

    fd6d3b7675dfdef2b722453da8247b2f

    SHA1

    287fc35d34db3fbcba4b35f383feab5277434b9c

    SHA256

    9391b74f28b60795ce5836b33df7b2d5f81f66656bd3129ea4c1c23adfb03e71

    SHA512

    852b01d855cdf845d891a2af3fce0714fb347371a3b7ee489d2b00970acae97dc5c6ca21e1c299aa2404d3578a3514bcd269cc70971fda5737ecdca397ecfe74

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\buryall
    Filesize

    49B

    MD5

    bd9bf87ec8d6d4aa9ab9f9d535a34f4c

    SHA1

    2cf492ce42c91e82680700de727ed27da762cac2

    SHA256

    a6f83189bdd0e12df48b49bc910fd717a6ad5da7360dbe12920a12c061b99a07

    SHA512

    75356ecc85f5245ee163ce9aa03279c6591fb5129f6a45cc4e3d78b70bc0836439b8dda82a4124c4e5c1a358f98dca7cfc8ab21ef6362b7b710b9327ac966b12

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\buryname
    Filesize

    65B

    MD5

    7f7a05a5f61e493345ab342840c9879d

    SHA1

    64ecf20add6004f311ed70b92418787185c33bf4

    SHA256

    e5b76fd54000feefb7be1ff3fdbe2c6f3490a6775f62b55760c7a2879db42b2b

    SHA512

    caddd9c9796cdf31e5301b38c82d5187cf01120a61e987e49137bea4ce131a817a505ca482c978e0dada9cb7c4414a14a6b315a887639a03301c446111617743

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\cascade
    Filesize

    1KB

    MD5

    53e20f4ab9828908753dba465a72bd79

    SHA1

    52c91fd0296ae1d39c9325f02f475929c03ac6d8

    SHA256

    b5c0f94d0bf36b60d9fba313150abfa4487bc43ca134f64ace89c807dbe9bd82

    SHA512

    73e7c03168cc972baf50f6807ae01790de67752fb49fa1febce2a0c4cf59ac7b10b7fe27c11706b976078c45e0b5d11c00cbb1fdc2feef2661c70ac706d4ce2a

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\cascade.2
    Filesize

    95B

    MD5

    8142bd91be08da3714b93bb2b37fae4b

    SHA1

    9c23b285577eff559a57c48ef6375afc14013564

    SHA256

    ca4e0f03d63de19183ba794d8d35ecb65696405e7124ecefd5644dd4dbdc7c2e

    SHA512

    cb9c2df6dfab3af75cec57aefe392a1345d2a0f3b34deb8310c8679defccd88d1d22ae79d3bea4dab2615ceae2dc96a334e57d025692959044ccea8a1151b019

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\circle
    Filesize

    63B

    MD5

    229d7f14c7d16ba67cdb8c2fb8604485

    SHA1

    ed2ac6c11c2eca1a1519fb79cdec24aee6a698f6

    SHA256

    97441322692b3625c444ca5e563c9937dae9bb8f277f10bcac1e896f1fef88af

    SHA512

    916c635373deccf08ef13e94d13c3e58298f878a5eb00dc63ad657e7b0cf3298ebf16438cf59c84b0525e5ebe15d580122a9358607a360294dc1bf76b4e5fea9

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\circle2
    Filesize

    52B

    MD5

    2aad2e06bb97b8f992cc189c9aadb327

    SHA1

    91900c0b26a4bcb0388b962f30fd43c5a9ba8633

    SHA256

    12ed6bbb46c59691e96f4d30b2854f3cf23f80ce6b62a544820ed96d96884711

    SHA512

    b9260a379db29205f4bd7c051b130fea6ea001e03d2cc53a073c40029bf0bdc0ce00478f092f97271232c1546037f8726495af202c5bd8abd421452f600b96eb

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\combine
    Filesize

    117B

    MD5

    f478f18a74102e2b2a593264b5bca68c

    SHA1

    a668f161b19f1d62103f33618015e2824448efa8

    SHA256

    557133617b218042d65fe907f26426a3bcb16cceb280d47a59a7bd2a79e89594

    SHA512

    ca8b645c0b4e5e0a640968153343744cd11c07ce4b11879e143855a5b48d948d8fe3e47348099d5ba512ef883817a612c5f99d90027bc3a3786e359066322708

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\crossmap
    Filesize

    522B

    MD5

    bf45b0e69b139eedebb3044475a2d672

    SHA1

    d9eb81474d99412cf3de762ccf3e6158a23c6f51

    SHA256

    f29aabeb6055e41e103c2a0c39bda14c0d592076de5d0822788d06c8ad4916aa

    SHA512

    380b1f4e744a0c0479c5fdcdf98ef19bb97a57cc556e298a2b515de4a1e4685fa58842848cec7e15be85e395d154c447f0b4e4675977627c89e2651e9128b3df

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\demo
    Filesize

    18KB

    MD5

    8d9a244c414e9b9ba1bfe71666f7ead8

    SHA1

    66a250b57064d290b0aa73e33e4e02acdd416b4e

    SHA256

    a17348301387f93f0b95f6adb5c38c44ffd46e57c82bab3aee08425bcf6b2e82

    SHA512

    001511a731a5997e50f9a847fef2a9a4ddd095a3872fb0f1aa66daaf546182e4f733377adeec421956d5378923570da016092a8cb3703c2c4e4953cacd02089e

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\dequeue
    Filesize

    140B

    MD5

    275536365e2afc69af66b8f56e96375d

    SHA1

    d9a938679abd36796962937f05d5e6a0b5a2bd15

    SHA256

    7b9b26a02d04f8c7e7f5e67e8c50f83e9b896ca211053f9e01ada4b7d0c01136

    SHA512

    94ef304aa1e678f783b73d4623f8d6f551c9c5a533ff372c4a0965eb4c5b82530702f159ab208d0f9caa9340ce4e72ba8b335a9acc664593f4ff1c5102329c8a

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\dir
    Filesize

    155B

    MD5

    a1c721b7815ce9bfd9f4298c5359ebcc

    SHA1

    524f6138863543633e488e2b6b4cb98b47376be4

    SHA256

    148218cdb67e89e2b3cd865385a42851dc2e9b0c0965061f9017da1f30a00ea5

    SHA512

    2b39085dc8a398b6f927f0ee034451c240a262e6c68f0e0b1885501e069b21513ccc56e631d222e9466773bf4b5eeba5c9588bf36286489983e08e8ddb5e23fb

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\distance
    Filesize

    407B

    MD5

    b2a335aa68d9b0275e651dcd3a2bb41b

    SHA1

    53c52a7ffb42a1375e8a813cf694fd03910b1a68

    SHA256

    a202cd1a08e1eae5f0f9ace3dec41dbf74f98a1e17653501c63d31cc2c23fc48

    SHA512

    6c1fe5d30a84a4a0438366bd18529f750e5d0ef941023bf88392ca626166c250aaf518c4d16b0cf8748e26280078ea53ab8f8e7a7269cee97c6d2abf02e4d453

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\distancexyz
    Filesize

    239B

    MD5

    0dfecadc0150620af7758ae2d4c659d5

    SHA1

    db2289a521f4cd728d7968d568584e6ac70f5733

    SHA256

    3f68e28e2bc6b68297d1eb5b855b68ca187cd5539e65c14d549d6b0185cfeef4

    SHA512

    b8fde3c33d79b9f7b7127fff1feaac8d8d3d6c2988d158faba671f32a2b2b8a66864285e828ea76fca1431d9978a76a08eee1b0324520c111ca12c909a29f143

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\do.until
    Filesize

    130B

    MD5

    7ab5b0d1529b0c40e448632b307deb36

    SHA1

    39ebec1a0f2e4a8221dbe48fb0dbbb592be2844a

    SHA256

    2cdaa81ce9cf2ba392967da387e18553bc742bb2c58f365f2e284a4839724177

    SHA512

    e2d83fbcf80d4e35c54a2cc6efe1456fa760fb5b14ce6e4c4da01389a26ac2d4160ba261cfb123ad707208093931daf6ab39aa65d851891806fb58efe2b72e65

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\do.while
    Filesize

    130B

    MD5

    5fd4682fbd067a35adb742ec4a093d6b

    SHA1

    7aaa9e963581a5ed19c5827e4f38d2fc7b6e588f

    SHA256

    72fd7c608dd7d3d4e0263c2130f92ccf42071a039ddd3e41dd5a546dab3635f8

    SHA512

    58678574899cb282d03bee41634d9ee71365ccf307c62527ab69044adc97ac3af0913b0dba4cb2604568adc4ceab171a446773edb2cc06323c662a0f5bca7e63

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\logolib\edall
    Filesize

    45B

    MD5

    06e477a348b6a5a29287918fa241a600

    SHA1

    e0d0957283268bc9cf9681aa4e61120ca79b82ea

    SHA256

    ee7c1d5304e7165638079b546e43961852aa43b8a7f266e354c3099e103dc6c7

    SHA512

    5c4c5546a09d3da9d8ef997b134baa6882335541d1f845c9a9f435d153ae099719b7934086bb27b71523d0654b527851b0ccc3021255e10c7203d7bcc7a2f261

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\mingwm10.dll
    Filesize

    7KB

    MD5

    a5a239c980d6791086b7fe0e2ca38974

    SHA1

    dbd8e70db07ac78e007b13cc8ae80c9a3885a592

    SHA256

    fb33c708c2f83c188dc024b65cb620d7e2c3939c155bc1c15dc73dccebe256b7

    SHA512

    8667904dda77c994f646083ef39b1f69c2961758c3da60cecadfe6d349dd99934c4d8784f8e38ae8b8c9eb9762edd546f2a7b579f02612578f8049e9d10e8da7

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\pthreadGC2.dll
    Filesize

    35KB

    MD5

    928c9eea653311af8efc155da5a1d6a5

    SHA1

    27300fcd5c22245573f5595ecbd64fce89c53750

    SHA256

    6dc4bee625a2c5e3499e36fe7c6ff8ead92adf6aae40c4099fdc8ef82e85b387

    SHA512

    0541d706bb53f8a04c78fcf327c4557553fa901d645ad2fd446e79753b4729f1e36793f42fbdd9b5e92073a30ed9a3dd853773a06ebea8e9302ece91a6c5362c

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\swresample-1.dll
    Filesize

    1.3MB

    MD5

    38f7e266e562225c39da79b77b93feeb

    SHA1

    0a2834039ecfbdb2744a49b3526284ade545b8a0

    SHA256

    1b51d1c0879382499ab97f5da1fe84c703ccee6d60d1629bfcf52b1abbb7d166

    SHA512

    0a532f07b78a513e76a3708b0b6958b5cd1fa96b7ee5d3345961e573d8923e980fba72cb71638bb0ef5dcca359a892b65bd1b4f2b2b8b291a989d2f8769f02bb

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\turtle.bmp
    Filesize

    1KB

    MD5

    8e5bc954263e6706359c06686159d143

    SHA1

    b5cdbfb8d0f200b580116404c6b6433b4df2c9d0

    SHA256

    bae9f06df713100360694f784164649e9595636e7a0ada30177152db0c1a584c

    SHA512

    66716ad105a16796ba27c40098e8bc2639107c858f97c743194a1a2b0076a3ab444547de1c2bd3b3f3923b1d9ce78364ed37a1af49adf297a1ecb33ac37c38dc

  • C:\Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\AC3E5AF\ui
    Filesize

    304KB

    MD5

    95518f5e98099572bede73302c79c7bd

    SHA1

    6168202123dca8fbc4a8e688561b5b18d51a462e

    SHA256

    115a380ecb81d1ddaa1c913c8ac6a1142400d22526ce979ed1a3d0a75ebf2e7a

    SHA512

    a0899e422b550498676b94aa9c9f59dfd5e0f6813e041f3e297698d5daa3501b186fc4a10e292f4ba445f7573d569f99a3916f4ee1f619df41492d4c2efee5e1

  • C:\Windows\Installer\MSI6DD6.tmp
    Filesize

    832KB

    MD5

    7eb12c6ebdcf90b6e8f7829d01ca18e2

    SHA1

    39fc8569c1c75e170e3d337807eba4a2377756ca

    SHA256

    2ab2a9782fe6429083a28194242af99fbafc296024e6c007d940b3e45516bfa7

    SHA512

    e0cd8e3547845253f6800f26de39894a9cd370fc7dd0ac74426f300f8499d07d27ce7f3d5d61e25a8dd49d93975278abd1dd8112273994dd195b64d3191700c4

  • \Users\Admin\AppData\Roaming\AdoptOpenJDK\OpenJDK Security 11 0.0.1.7\install\decoder.dll
    Filesize

    202KB

    MD5

    831e0b597db11a6eb6f3f797105f7be8

    SHA1

    d89154670218f9fba4515b0c1c634ae0900ca6d4

    SHA256

    e3404d4af16702a67dcaa4da4c5a8776ef350343b179ae6e7f2d347e7e1d1fb7

    SHA512

    e5e71a62c937e7d1c2cf7698bc80fa42732ddd82735ba0ccaee28aee7a7ea7b2132650dfd2c483eb6fb93f447b59643e1a3d6d077a50f0cd42b6f3fc78c1ad8f

  • \Windows\Installer\MSI6DD6.tmp
    Filesize

    260KB

    MD5

    0edc4ea5202445e7dd63b26c8bb95b6b

    SHA1

    3d709c27ed4c4d26a6dc3f2f8a186578ae81ee4d

    SHA256

    15634dbb2b2aa4f6514a81dbfa2afab1d9cbb779e285662f9e269a758c3840e1

    SHA512

    a3cef345084730e4f01ddeebff23048fdfa06b65fc78edb4ce170409805587104da8742f977d56ae10d84504c900d8c67bab9801190dd1fa51be76e1ff64e665

  • \Windows\Installer\MSI6F4F.tmp
    Filesize

    569KB

    MD5

    0be7cdee6c5103c740539d18a94acbd0

    SHA1

    a364c342ff150f69b471b922c0d065630a0989bb

    SHA256

    41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14

    SHA512

    f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c

  • memory/2116-598-0x0000000000400000-0x0000000000BBD000-memory.dmp
    Filesize

    7.7MB

  • memory/2116-603-0x0000000000400000-0x0000000000BBD000-memory.dmp
    Filesize

    7.7MB