3eb771800e37cb2db597d3f84f62763de207f3575e45fb8f20f1b585e6b6129d

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Size

633KB
MD5

0606d7404ffa4106ce0d09690b30c260
SHA1

6cea45ff61c3714a824108e00c9bc49642329317
SHA256

3eb771800e37cb2db597d3f84f62763de207f3575e45fb8f20f1b585e6b6129d
SHA512

4ca5d8e69b5e3ed601a0f84131a1f28d575c890f83c2e8eaa0d21cadb65afd9878f02f988330ed9bf12a2f0ca91535bca1530295ddac2303b1a648f31911a484
SSDEEP

12288:hrMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V35Hlmdu:3ZyCA8CBmn+RrNj9ay5IpH0

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\SPADES\SHVLZM.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Mail\gwab.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\gChess.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\gjmap.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre7\bin\gjabswitch.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\gcrashreporter.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Defender\gMpCmdRun.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\gchrome.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\gsetup.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\RCXA05D.tmp	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\RCXA8FE.tmp	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\RCXB37D.tmp	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT GAMES\SOLITAIRE\SOLITAIRE.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\gmip.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\CHECKERS\CHKRZM.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA497.tmp	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\gjavaw.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Mail\RCXBAAC.tmp	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\gjavap.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\gMahjong.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\gjavaw.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\gbckgzm.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\gFlickLearningWizard.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\gchrome_proxy.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\gjstatd.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\gmip.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Journal\gJournal.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\guninstall.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\gwab.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\gjavac.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT GAMES\FREECELL\FREECELL.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\gOSPPSVC.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\gjstatd.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INKWATSON.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\RCXB7B9.tmp	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\BFSVC.EXE	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Windows\bfsvc.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File opened for modification	C:\Windows\gbfsvc.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Windows\bfsvc.exe	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
File created	C:\Windows\gbfsvc.ico	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeRestorePrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
Token: SeBackupPrivilege	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 372	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	3
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 384	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	4
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 420	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	5
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 468	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	6
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 476	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	7
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 484	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	8
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 584	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	9
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 664	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	10
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 744	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	11
PID 2216 wrote to memory of 804	2216	0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:468
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:584
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:792
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:664
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:744
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:804
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1316
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:980
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:300
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:108
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:532
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1224
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:3056
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1992
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:476
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1364
- C:\Users\Admin\AppData\Local\Temp\0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\0606d7404ffa4106ce0d09690b30c260_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2216

C:\Users\Admin\AppData\Local\Temp\3141615810\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\3141615810\zmstage.exe
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7zFM.exe

Filesize
633KB

MD5
0606d7404ffa4106ce0d09690b30c260

SHA1
6cea45ff61c3714a824108e00c9bc49642329317

SHA256
3eb771800e37cb2db597d3f84f62763de207f3575e45fb8f20f1b585e6b6129d

SHA512
4ca5d8e69b5e3ed601a0f84131a1f28d575c890f83c2e8eaa0d21cadb65afd9878f02f988330ed9bf12a2f0ca91535bca1530295ddac2303b1a648f31911a484

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\gjavaws.ico

Filesize
4KB

MD5
38b41d03e9dfcbbd08210c5f0b50ba71

SHA1
2fbfde75ce9fe8423d8e7720bf7408cedcb57a70

SHA256
611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5

SHA512
ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9

Download Submit
\Program Files\7-Zip\g7z.exe

Filesize
571KB

MD5
1a383a5d59c5bbdb01c6b8718f37224c

SHA1
8183feb4aee60c873be4875e1d8b0e833f1ccd67

SHA256
13ad6eaa1dc9e2dff761ef2144cd74034cfcac9d443b9afde48ccd8b808bb3b1

SHA512
9b0810c6462d86d1def0b318b918f2eb49f611af01ced8f1f8b23cf125736907d712003a00dd80fdb1734334c076e238a0f3e08d443a78431e971813483d5f70

Download Submit
\Program Files\7-Zip\g7zFM.exe

Filesize
957KB

MD5
20aab3dfe188f1d9c97a7c485278e721

SHA1
6bb074b102c0498b280bc7a48cbc9ed756be70e6

SHA256
2bbcfc072d11268cc5b9ac84ce9c94ac91a1b1cbe100a6965e69a0449284a47f

SHA512
5de67067a8b1a0355ea37b3deb6d78f3a0614df5a6d300f252c43e9a2e9feb45c30ec8dfe1a37ca47d1ab9d1603b07f238524bd939affbe7a57d681e202ced77

Download Submit
\Program Files\7-Zip\g7zG.exe

Filesize
711KB

MD5
9098c1aff95ef61a0c316028eec9745d

SHA1
360d29dc58689b1a62805717ac497192e5d509e1

SHA256
a5bafcaad4bc5f2c85525cd07803a5e30286d4779a87e84d0de4b56284fdece9

SHA512
40bd8cf24e7cd8947ae4acbf7f2cb39f8929dbd696864583ba99e0e84a4dba8f7a225f3552b37a72f5c622cf4ccb701691a3cb08b76b484330197534f5d27488

Download Submit
\Program Files\7-Zip\gUninstall.exe

Filesize
41KB

MD5
8186aa23be99e11f352315223449f5ab

SHA1
531aeb3b8ede5793aff3204496d36ad118be31e4

SHA256
a0ac5c07af64aff1e39a55cdf32a2d2ee5620ec5d947aa9c8f0f84237418f704

SHA512
8158806b70da6a8d0679d03c09325bb203838167bcb8070e074d9a9d07c37519399cce49f424263a104cd990d79f4e63adfa716e884d0dceda4c30c44f545627

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\gmsinfo32.exe

Filesize
397KB

MD5
9f08c06deb4a89f260a0f3e539b85b40

SHA1
bd2cda3bf4243da762a01a952426d69889588b7d

SHA256
047d150412c811ec9d8cfa7d31be325220f7f4eced27d2e2ffd285c2b49ee559

SHA512
200cbbb49145b34a729c01ea8b29058634e453ccaf48991c8b1d2a96a5afbf223b48d9544541015d24cf6c14ba77d636b249d86d7914a775bd1901ae093c4a51

Download Submit
\Program Files\Common Files\Microsoft Shared\OFFICE14\gMSOXMLED.EXE

Filesize
118KB

MD5
f45a7db6aec433fd579774dfdb3eaa89

SHA1
2f8773cc2b720143776a0909d19b98c4954b39cc

SHA256
2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

SHA512
03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

Download Submit
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\gOSPPSVC.EXE

Filesize
4.7MB

MD5
61bffb5f57ad12f83ab64b7181829b34

SHA1
945d94fef51e0db76c2fd95ee22ed2767be0fe0b

SHA256
1dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846

SHA512
e569639d3bb81a7b3bd46484ff4b8065d7fd15df416602d825443b2b17d8c0c59500fb6516118e7a65ea9fdd9e4be238f0319577fa44c114eaca18b0334ba521

Download Submit
\Program Files\Common Files\Microsoft Shared\VSTO\10.0\gVSTOInstaller.exe

Filesize
97KB

MD5
2abe4614a5d80878832fc7e91c8a3146

SHA1
3808489961c56e3cf49f8791c152c7db1085107a

SHA256
259be6f52760b376a5b8b53211e5405fbf4bf2339b63d341df2dd9d7a7bcf041

SHA512
f461297fde475649eb6becf576a932b6eb65f102c3674cfbcd5d4c8027d23e38c46dc8abef0d53d0b6441f5630930d34ffb5706bdaf0c19ee6c4f2cb2e59edc5

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gConvertInkStore.exe

Filesize
215KB

MD5
01ae51f531478a71beb193823b0283d0

SHA1
41b76a4d37bb3aabe07fe826eb99ca75d60093f0

SHA256
c30e3078b7d83391e8fd8334d96ef59a846ba08dd399a1d8ebcb95967eb92440

SHA512
7a517ad1db20735cd49419cad40676130a7109b36df2731f3eaec6166ab25116925c505fdc91766f52eb03a3b4075f130d72540c8f0ffbb2095039aa52716396

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gFlickLearningWizard.exe

Filesize
933KB

MD5
a3af0dfc32e45366483a17fc1c449953

SHA1
0bef8c2970964dff77336951ef720538f1965c76

SHA256
4e4986ad3fb7f0d0ea80989e4d06460f1021ab5bcdc41e755c1b7c6081efaa2a

SHA512
a35ce72408be6062e2d7b0830cd7f82efb630b7a4bdb50520e9cf4f1fccc4edc74b8b973a75c85ce10821a2f33a5902889b8e383291051a0f29d485b19818383

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gInkWatson.exe

Filesize
415KB

MD5
6271eabc1437c413e95f96c4f7eed329

SHA1
b285191a71ef6bb4d5f003083219ee82b656860d

SHA256
2c8e7a3364a0ce5be42067fd370eeb5c741b3fb73254acf61112b633ae4acab9

SHA512
4a525d0e6c17d3d279cc1ad824212e767ec384e57a62883a9d34fdcd99d1d3afac1358327d9bb5bc857e8d2ef3c3b54fd741b5fe29339c865e8b2ef7bc752fcc

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gInputPersonalization.exe

Filesize
401KB

MD5
3f4851525b0f1fd5fb19aab4915109ae

SHA1
558a4149319917915badec2aad2b59cb7c121f5f

SHA256
e08e4b16cf0df5b806909b6d87e59b0dd2799125c2d583cc2ae749e03549d977

SHA512
f468f3ad94b0bc467e61729e4ff31ec567e214f1dbaa29fb8b59cc079f1d191f238e3968f7cca007643579d3ed527fd078fd0c863c0a8eca37e0f82e275b5a57

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gShapeCollector.exe

Filesize
706KB

MD5
972271f39707cb493b27b78db20a8dfe

SHA1
fab410b370aa3b0476baaf934afcd4f8d7434757

SHA256
7e2efb743e3b7ba5d849425db8a591da457724602313898568f5c0d4097307f8

SHA512
6689538b3184f2294254a718cebbee001d6f9a6e358cf0627ef19093f4d8b39933ff3310dea6d5b69a1a8644dd912d4a889d3b2f5b3a46ddaefbe46e788b0a11

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gTabTip.exe

Filesize
246KB

MD5
ce51034d3a3faa8922953015e8dc1e1f

SHA1
d03c69b2520545bc4fefc6b3aa3bb8466cef1d58

SHA256
be8f6c533179a100e75806565715c74d87293f9cd7f67d3075a8631136cf5994

SHA512
6fe53ce5bc13f8ce91c7ef7f4d16ae5c75e05135db34191f6082ac45786f4a5f5eec65e536cfaf9f78951dbb98e34f88a4bf7aa8f14a740a43028eafaf97d7bd

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\gmip.exe

Filesize
1.5MB

MD5
3fd4eba745194d242971b517882addd5

SHA1
cfc41cec3affb0085bf7f25778c9f265f341eb63

SHA256
ed30127695ee1d488d9381610b0ade3c8b1a3538d4bac8f15bf871a3d1b239d8

SHA512
cab109609f10cd719741efe0bd24b36052c6bf6bcdb6727dcfdb118a0e317ad618e19b88c801b1d7e3d51e25df14b5cbb1fdea190e8ef4376fa6c31e08dcbf9e

Download Submit
\Program Files\DVD Maker\gDVDMaker.exe

Filesize
2.2MB

MD5
534c3018f78d42c9bc1af94b0758b6e8

SHA1
43b4fdd09ba3a85eb88996c5ef087e1c32a7f909

SHA256
401c742742db02a9b57b59fbd000bdd75c3915c9215f197704da23f5cfd21a51

SHA512
09c2f54fc0d3cb88a7d501482db2892da1a8ad60820be643b83aac353662b19974006a926ad139f4f87fd942abe1b225d84d2e4fe60faa5fcd4fa624b021a1e2

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\gchrmstp.exe

Filesize
4.3MB

MD5
2161730a7ae00a1fb8c5020a43be949f

SHA1
8db6b820472cdfa266c874e0d3a9395412995aa1

SHA256
07e7896b2304e3b9966294a02d2ed32f41994ee7bd0a284e4160743edaeb9e15

SHA512
aa3659b6184f4273b7fcf1f7d2cd0a5a9129b8856d15e4ca8904b709e85cd432538ce0510ca9777760a1a9d5391671232a79908860e7d665260a54910f6fea5a

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\gchrome_pwa_launcher.exe

Filesize
1.6MB

MD5
527e039ba9add8a7fac3a6bc30a6d476

SHA1
729a329265eda72cada039c1941e7c672addfc19

SHA256
4b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94

SHA512
9e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\gelevation_service.exe

Filesize
1.6MB

MD5
ec6386b63c3a5ffe0577905e94262c3a

SHA1
8f8c428d0e7f32c9d733ca28384ded413a060588

SHA256
302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4

SHA512
ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\gnotification_helper.exe

Filesize
1.2MB

MD5
81664a918656ecd5e8eca90cedba1150

SHA1
580d0eb98bb2c838ff89eb54efd86535ee8882f6

SHA256
2f664c756727c321a3a0fb6c6e68842ca1a5f20575a02312ea10675dbd5dc40e

SHA512
7a211a01c674aaa5e8052dd339b412892c452309b651e835f0b8e27f15ee3fed42c58f43910a202150ca90704f522499deb7bca055451f1e6c8515b2d491df3d

Download Submit
\Program Files\Google\Chrome\Application\gchrome.exe

Filesize
2.8MB

MD5
095092f4e746810c5829038d48afd55a

SHA1
246eb3d41194dddc826049bbafeb6fc522ec044a

SHA256
2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

SHA512
7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

Download Submit
\Program Files\Google\Chrome\Application\gchrome_proxy.exe

Filesize
1020KB

MD5
b65d7344b0a7faa207d2e1a7adaafb60

SHA1
755ad15b1745b0e730d658d4a92e2b754425b7db

SHA256
f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92

SHA512
f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22

Download Submit
\Program Files\Internet Explorer\gieinstal.exe

Filesize
496KB

MD5
9001432e859a470a1b0754a7b14df566

SHA1
28c2a1a93ef8720ce6000c11d7411793018fc3a5

SHA256
2f810a506d0cc8c5501f1d0b347fe34dbcc6926bf7c2858146ea1998e1e2404e

SHA512
f00a33bd784c1ada7aa3306e0e441145f49834a0f85b31ecd06e43e5011f9e4f7340fc2fbb195100a4f3ec0993ac760d16795b590d7dbeeabecc97a182f42041

Download Submit
\Program Files\Internet Explorer\gielowutil.exe

Filesize
245KB

MD5
bd753218fe1632e7f34eaf28bfa9b178

SHA1
bab0a395d682fb311ca717e4d7dccfd62bca0d11

SHA256
13bf86da641347bcc5a4c2ef803fd529cc2a8849c2d39f15c3d6275e907f9117

SHA512
a13900b18256c777ab886f8dbf8098ee01d7531235939ca5725a37ca052483a2388d6b330aaaef3bfbec9d276291fc9a76e3603f914a509a064773438558be36

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gappletviewer.exe

Filesize
15KB

MD5
c9aaf1247944e0928d6a7eae35e8cdc4

SHA1
af91d57336d495bb220d8f72dcf59f34f5998fd3

SHA256
05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

SHA512
bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gapt.exe

Filesize
15KB

MD5
407d2d7dab36cdea871d4c6b9c62b258

SHA1
86cd158ad810c6772c22a5799c7acf4b9d7c9f57

SHA256
3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

SHA512
dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gextcheck.exe

Filesize
15KB

MD5
1cb4c95888edfdedb61628680fffd415

SHA1
3336670c701c61bb8062d7620c4244dbc01756d1

SHA256
182d8ab5ec2ee2ec57d60c2d2d75df6c852810e74c50289aa9c2c99a6b050fc6

SHA512
24c8c05baef516fba5aa763c0abc603065a75e5816501c713b24ec8baddad4fc290b3973dad89ac65f09d0277c2fa72d8b00f0eb2871170dbd89a8d9062bacf3

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gidlj.exe

Filesize
15KB

MD5
26b70aa2ab871a72a3fd30829f2f1f29

SHA1
73934bad6bf5ca22484a88e1a4b1263ae278c419

SHA256
4e11bf944fb0a34c5cf1871fec3c8f7473e1944642cadf89a86db2eed874d35f

SHA512
40cacfff6c7f47aa0703e8cb3186f8bacbff1d56dc0547d67c44e716fc0d28705995a439a88a02ce8a262628b33cf2f6ec6f0586cdc2fc86597e3da4fb6a1d84

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjabswitch.exe

Filesize
54KB

MD5
502e87232756dfacda7d1686d4bc9ea4

SHA1
6e40897d0a957783b8b88f2a6487dba028954b22

SHA256
d230ada81f3add58fd8a646d25b8f25fe6271b3eed5edef9fdc8945baabd5631

SHA512
96366e76942f6da30c02e9f6cf7cdf0cb7550455c8cbaaae7358d15a2258e1f0b2bfa960d52cb774039f2070dc8c383c3df187805f4910d40601b853e4309d9b

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjar.exe

Filesize
15KB

MD5
3eeb342d48cfaa4c568a93ffdfc847d0

SHA1
ed5fd565c4a1867ca554314f038fc20c7de01b90

SHA256
29e65344e34c2354da05e8de64b106aa0ec99d8c5c22b58797d0047e227879ff

SHA512
db5b84233d40139c44cb8fd1a43e1c8a41c967358641e1488cc19474a8de381c5aa2c84f61b10d69d019f0d7170177cccea47ce9460d409a480c8537232a2ef0

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjarsigner.exe

Filesize
15KB

MD5
2f7770a34bb22b99f8f6966851331d82

SHA1
2a2860cde1482df656544e1983e957f815be4193

SHA256
f873c02b69408f905c2c0b35b188d2c0b0a7cccc98a59d18dd0c297f761d2ef7

SHA512
8611f8bace081711d6f5dcd41177f594314970c5b2f328755027383e4ad2a239bbd85e0cedf6d1a76d9d1f54afbd340c9bd4ab119bb87cfd5a11149a0cb71dfc

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjava-rmi.exe

Filesize
15KB

MD5
a5f4cccc602a42b4ddbd8acbcf34f158

SHA1
5f26277884b2f6cdac26267f9b582ac5a5d21b08

SHA256
2d9044e9265fc09680d5f0c054c4ccac7d8d14b3a4a42e803a2097108e0f1acc

SHA512
3cb0d0028468edb1687c6142ce3ed6b594428bd209bf8b85ab2315e7992af12c4d622f26e652d6be0718d51d0d6a171c0a881b36d2e67a199998442e91621149

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjava.exe

Filesize
185KB

MD5
641b4ed6ab90a6f52ee512ea88a64cd1

SHA1
28d014900accc98e6089d83d0b2a8cb8735ed101

SHA256
13590945a04037dfd15d61166e0771682c7809674fca42f53fdb3afdcbe21410

SHA512
00a588556196e305dbf1714e573a5c5516c2988356b984a7284ba017a78bacb8d576b590da35be40171d6dca73580c5b9ab06808c7246c2e13c8d9b816f2ca09

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavac.exe

Filesize
15KB

MD5
000b77a2ed92887856174641dfb6f485

SHA1
7872d9768f3a4b0601b91bd0b55f08c8992819e6

SHA256
1100a8d298426491aeb34288f7d6e600622f2d94fc01bfeb093fcea3ac32a8e4

SHA512
cec8642269bee8162b8d317ba61777b4005cb2dae8e9837bfd336bc6fd633066cd52b878160f4496113c147a7d0374619367e9bb451e82f7a5a39f0db3fde152

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavadoc.exe

Filesize
15KB

MD5
516f6320ae4d755b9ea0c7c8347f5801

SHA1
bfce7c2869725ec8f327b083be57d20671fcb2a2

SHA256
9e696aa5772e8cba27545b47b00be4a3b8fc888f8c83ca11939b753850feab14

SHA512
0e12bc2f01f2897df41e56cee150177a3cc09ca5e889b61fcb9dbe07391a6f2537454401a2ca2ad93c652303a8e5782fd9860ca83734401393e314570175a6f0

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavafxpackager.exe

Filesize
78KB

MD5
cace8f27a66ffec4f9823aa258c307a9

SHA1
dc515d29aa43d2b6b7e157f05e97e87d5f785884

SHA256
3cf626dac6e91a03f688bf5ab674871a3e0411314f261bb2c69346a1c46bc733

SHA512
4a5d5b564bd483e1949826d388e41c63a7b056236c5972c76721fd98c9b704a79622ed4c1b045080e4470340a9953595df955148999e15677f0e38e529a6a5f7

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavah.exe

Filesize
15KB

MD5
8ffd9b7406e8aecf1d6117606d2bd149

SHA1
edf1f0f2f1024cd0fb6b39dadca251c99ccdedcc

SHA256
dd6b65e78cb194055494bbb7736ef917d3d6da1863567afe50b8abfc8e51267d

SHA512
ee54a1bec20608477053e87c641cc59dfe3c5a77061395c9d41759c3c559d6d5e8761b75327f3a05e62c602031650ec0be375a1b2235a944048ab340efce7397

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavap.exe

Filesize
15KB

MD5
95cf3bf094a35c9e7434bc402c09630c

SHA1
2b4d21ee55666f0664a644ec443502a942b9e7d4

SHA256
4973b97a274648d53977499891b919f98684fdbebce10751d71ce4d2754f6622

SHA512
09db399afec354ab699701f4196e93178db613421beda9e695bc36414698f83084d05b70595d2b31fe2a0d757ba98640f7e3953defb8dd71df03e4c01391fe8e

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavaw.exe

Filesize
185KB

MD5
0266d98252b6beee2e842d5e876031a8

SHA1
8d57c6d94835ac6b1b0f9a657af6baa4be25779d

SHA256
c5d59069dcaf86222c9c189c8ba8932ced66ab77b4baad485e1f0ac715e6037c

SHA512
7eebbff75a67a0408ff2f507d9f1b387dcfbe6765ccd4247fd78a64c2ea6090e88fd30f561e30f48bc107dd9378364fd18dba4ea22eedee76a1f993fbb1e9f32

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjavaws.exe

Filesize
312KB

MD5
bf91501c9b39c728ade2cf3788b647c8

SHA1
fbcb53c4ca9836f5bbfbb2b63e7a1a00a6bf10c6

SHA256
d602330327fd3630d625c9023131fd2318f677c67aa421631b8a4080dba38578

SHA512
01a6639a580bd418cc4d1dd2bd8794f356c08b6f7fa801245e9200c883d32c6b103aeac2615195868a8e63e3515911de2a9afcced21f62fc41edefdd0a66001c

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjcmd.exe

Filesize
15KB

MD5
36e8cb42bbfc16e1395a88d183caed83

SHA1
ca1c513aaa7d49adfe0f43ceec81e6d0c0ae67d8

SHA256
40ea55ebd7ef975135dafffb396871a8ab728abc24b42eaab76f08859994e996

SHA512
f7620b06a5d43d21a0d492b66b0e5bacea6918f1490fb0504e9440524b7ef02ba83d2ae3c2211113b478b8325a3a6b6c8f65939ef5a01b835451cce2e72de00f

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjconsole.exe

Filesize
16KB

MD5
805f6272e5e3a80aac3540cc5b42b08e

SHA1
437bee3476647f7b55a49630cb86ed4befc34293

SHA256
910dbe44d17bd60a295a956e98e18347080cc879ed7ef7241cd2d0edfc060551

SHA512
319f8f50dfca4adf148edf878fa7c83bc6e4f1053da0c7d412645fcae9c63e67b838c876838805d9a33b28067947d3844479c9ddab11eb9e760b9df285f27041

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjdb.exe

Filesize
15KB

MD5
0b5681808a793728fc658f1e9b94ec52

SHA1
05763b10f153447edcc08afeeeee71fa2f221033

SHA256
d18fab0d0e24e8f1d9551e2667f6b2c34fcd75232c39e85ce50660588174079f

SHA512
65e64980a30285b29888b9eeb66ec1c27c98a15effd67d761c3c62358e3ec008fbda61feda4fada8f9af8bce740b8f38236495c6f1b274d98c14209cd56b414c

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjhat.exe

Filesize
15KB

MD5
1dbd51882c2b82a5496106c31db425f1

SHA1
f47bee48a7d0da0c4930cccc6fe7a8d8600d4b05

SHA256
659fecc81e846405613c2080ac81a567df17c97449a9c2ba179ac216280223db

SHA512
81418b0510b58f782b843312069842aeeede8d35feb8f393807169398464896f281dc13bc82d51279a07adfbe97758b82143218cf9a56d653b3a9d11da62f50f

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjinfo.exe

Filesize
16KB

MD5
f499825b88d200d9348b5f97ff297ec7

SHA1
366adce5911c160fa26d6fdb4d65af357cf0e3bc

SHA256
8b2d599efa66da695e503b480f355fc5f22347fcf5c294100abaeb3e9a20c1f6

SHA512
3017bf630ba53ee0855d1e657df197732e4fe2fa6455fabad2085e5a24918589d487362fc2819fff85b3fcf7e684376d4b7a5bbc6e71ea57cc62ab397a87dba9

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjmap.exe

Filesize
16KB

MD5
30989429490b9ccbde4fae1fc6df84e4

SHA1
64c8cf20ebb4e8dc31521f0084eb046a9e3f0500

SHA256
aa98634e3668beae535738d25c2094a7ef0d855ebd9d945b484368f9e543bc0d

SHA512
9a78ed9cd8dcf333ea240ff309e24a2e5de39bbeba4e9291b55d51fdbc10ee672c674a9f4393b13819562a0d9bc99667eb03519cefed0218444874f15729eefe

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjmc.exe

Filesize
314KB

MD5
c8db7998995218d59addc586ce9679d6

SHA1
694f18eef5aa6dfe1aa607ad5a08980f9656ed07

SHA256
e3712cd917e4d41696165a98233443d63dbfb28560967de92ca4e707c50d7df2

SHA512
ba7bdfae350c4b98067a2875295a20fbee1b7e9cb1f1afde1a299ca1b8d6aab3996dec59119cd83214461018e5e4ff91894ad3f0e909359382cf5183811d3d12

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjps.exe

Filesize
15KB

MD5
4ce9dbe70ae911f1fef704e2c5594214

SHA1
3431c1d6fa21e04e79f0b2f48cd30b037ab009cb

SHA256
e45733934ff8c01f79a98ea2fd6b2a78fc5f0164e5d4fea7aef5119c7218a5fd

SHA512
291420138d84108ebbb8f3dc81bc4595206144b8eac0a459ae63754aa137a3d6789330dc764c6dafb5cecc76908166d93cccaecbcb3987d4cbba662980ee6359

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjrunscript.exe

Filesize
15KB

MD5
c77fa8599058f2f08f6f028ad1ba3d29

SHA1
ea42e7eed011b8b71f32d4d47827a5b56198d134

SHA256
db2beff59876773d223f4813c05c65a1e582604c420ae6d7f6f3844a0a060398

SHA512
f2834be1925ca448884877e7236d2febb72190ebf43a2dab29a76b71c4976360d56df17879966ec74c60b3d62dadd81d577e3034961ed64418c0300f9710f43f

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjsadebugd.exe

Filesize
15KB

MD5
da1c77dc8b88afc927144ac6814ffecc

SHA1
ff50b5fefd7275f3972f2e3f228384816fe22e63

SHA256
78d50c2ca489676456b3a0ccd1696dda0f1e1e144baacd26cdbc472869578b30

SHA512
02fbc972c889a71947b2671bcc7e22f9a0edce3e0462f332753d974d73035315aef7b4ae1069e309aa560f98065b792447b2ef8f1e8be1874969de916b2f3e25

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjstack.exe

Filesize
16KB

MD5
095d24917473c666b8906e45852378f7

SHA1
2ca5842715ad03982eb9094786832775926e4b4d

SHA256
3289a0fb8c701e7eae9fc792329c0eff6cd2a42ffbf1845f4e630a3e1a019529

SHA512
fba9fe4ca6498c9fcf0d251906b537286f2e7bdb2399293c71f9b0bce379c2684da14212231535a81889928fcbe0adf7354bc83e272a3f6d9082f125494cc50c

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjstat.exe

Filesize
15KB

MD5
f9ae41a829d457685c00b08ea9185e1d

SHA1
54eeb13931bfdd989decb7e807996b46b75f1cd6

SHA256
d122b3df7c2b81c5eee0d3165a6741fffbc2298a8eb41740dbe0092eecf3cd47

SHA512
fef83f2670a11536b57dc3a1d86d014b49b83c720976a5592bf6fef2ec45aeb62e269ce0759b150accfc77a94a28423c833b4ad0fbec6a7e0a4132a2b152a538

Download Submit
\Program Files\Java\jdk1.7.0_80\bin\gjstatd.exe

Filesize
15KB

MD5
d33a2ad454c698dc6cc87ff9e484229d

SHA1
cdf4c8db79f2530bdfec32a1909be5d129a23058

SHA256
bf9aef8af2046c69ccc29ab1f9fa0f4b31cfcb1892158877c01e7b3a8c4eadb3

SHA512
682e0b292f0f0cb1613c634a99df53d242ba465f1f754058d508ba8506654ebcb35f79e6e6714a288c2018ab9cdb929ef48a544071bc3ffbf3d362bf3478a818

Download Submit
\Program Files\Java\jdk1.7.0_80\jre\bin\gjabswitch.exe

Filesize
54KB

MD5
529a2a19485ba337e8c0b6970583e94e

SHA1
1cc15db40d7bbef978b74ada8aa308e2f1731c77

SHA256
e9c0f8e00e3f884edfb0b776e4d9bb336dd7fba12f0c6d5604b4530d7016861a

SHA512
30598f68560ce73d02a8683555bbba0c316c5f04f05543dc30a273e51fda19567f375d1855d33fb7b2aa66d0faec8d8b43b064cfb5debe4f0d3f06996a416158

Download Submit
\Program Files\Java\jdk1.7.0_80\jre\lib\glauncher.exe

Filesize
44KB

MD5
db9c946a0f96b6971d8c206b763a12f9

SHA1
f489499793ec2089d4fa8155f0dce9cce3224a01

SHA256
dcfb9c195b17ad00722e50c3f28181e12e3de6f209e756bdde8f137950ab5b89

SHA512
eb23828b588ace5e3468d0f5aedc1cdc5b0c7c362d76481fa53a5b881ddd459661b6cd6b4e3179b16960538b0ea1103ea02174cb5a26a8227fc0ec06837ea98e

Download Submit
\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\gnbexec.exe

Filesize
154KB

MD5
2d721aa8133aae9cedce6601b08344d7

SHA1
2d7d17947fc92e4908e43d5b235bd387890f29aa

SHA256
5dbf3b499d387e4a811f75c79a3e8671aa27eb35cdbbedb28429092e48c2e685

SHA512
669a7acd991438de338862439f8f8acf8f163620e3a4ed2b9972c8e6b1c7c2c0f478f078e3750197bd1c0ad0500de1c7e474c505d33098690014e674553f0567

Download Submit
\Program Files\Java\jre7\bin\gjabswitch.exe

Filesize
54KB

MD5
e795eb03297dd66d2efac2c33920a69f

SHA1
bf41799164d6ab2690c39afa458122ed82f2d0a8

SHA256
133afb441f29c697a5232752483ef2eecc297446f6db941bd68af7ed056cecf1

SHA512
6a334a07afadcd5c29c30add22142392bdc70d8ae0f36140f2ba7c9b4e70a9efd87b7fbd8b3ef862cea7aebdddfd18bb0521308d9a69070ae4a84432f522c4ef

Download Submit
\Program Files\Microsoft Games\Chess\gChess.exe

Filesize
3.1MB

MD5
29017809583aeb8f4e1259b95413d9f2

SHA1
6f22d9008e50b63564f067be16b5691a9a8e6bf1

SHA256
ba75fe5a48d03c50f1ef630267a2ca66c10a50e189294961e62c7bd94ed43cf1

SHA512
4dd13bfeb0af1b3b5c9fa5fc61ba8502507f7147f00d10633f65a78b4dd2ad2a846b036c6f39c5906670091e4183a04981ee7baefb77118c3f9840d40f9cc77b

Download Submit
\Program Files\Microsoft Games\FreeCell\gFreeCell.exe

Filesize
856KB

MD5
ce2ea819c3a5a879e523c16d41a34e03

SHA1
afa726c716eabffeeb0fa7d9af096239c4075293

SHA256
691e95a09c7b1e04331d8ec881f2ae8f1eb4f83d4ea6e40a452f398ce7dd4c58

SHA512
fbf9a460c839c3d140d58f309bedb8ddff0c24d6786ae0692dbf6e6e32deaf6b8ebab8c598754e75a86ecd1b2c354817da13ba41378c9e4f90bad60b9b283a3a

Download Submit
\Program Files\Microsoft Games\Hearts\gHearts.exe

Filesize
777KB

MD5
d5c734db943ec8a3ab2ff46941dbe139

SHA1
2149ef64f14f133626801a83c9ffe902c9be2a28

SHA256
35d6be917a4c5a6e9cb8f2d6efe89d7649b1a298fd0198c20b50300735448987

SHA512
dbdfa2b827041a886757a1967a34ee5365edcc23398b3fb45e9bab575aa3c22baec632cfbb4dba9d2698f7c36790ace3a87d63fe97d8323f491e6dc9be02b377

Download Submit
\Program Files\Microsoft Games\Mahjong\gMahjong.exe

Filesize
827KB

MD5
e97139589c56edb044cfa23801aa91f6

SHA1
4517bb9fceed09196482c699719b9fabc3c02173

SHA256
2f2e5af3b45ad98eef42ef8b4330a7d12dfe18afd46a7cd7a9535acdd859ba9e

SHA512
429965b22625a57654ba0421dbbf35071418cbbe336037dd957731466c10b2983ca764aff9d731780fb2bb743bebd6fdaeb555e8363b4850d90e13f5e88ee84e

Download Submit
\Program Files\Microsoft Games\Minesweeper\gMineSweeper.exe

Filesize
875KB

MD5
80966295cbfc4f41829896241947f63a

SHA1
40034feafe516fb2fed9e0d7ec643b431d4db053

SHA256
3aa2f43648e7ae781a99bddcb25aea50bc2b4a3660f250c59111136f722fd8d9

SHA512
d7a80d68f1432ec4162223862496e1988117ab4e1043e74004bcf8004c6824114e66d590fbec2b6bc26273b6c96d83ada29a86809dbe3239b5fe66f1daa02d5f

Download Submit
\Program Files\Microsoft Games\Multiplayer\Backgammon\gbckgzm.exe

Filesize
118KB

MD5
4889f92f186776af98ec2b6b3243fa8d

SHA1
bbb6fd6a7def01f029ee2022c0f078be72874f72

SHA256
a193e5be65779c2f6e8bd1e6bd09ebb694a223f232c1b847f22da236af337ec3

SHA512
da65d0ffb855d41ddd4d7f3e8a4900a552162ed63a54e8f15cd305eeb9c2fb9f59c4fc2128bc8c3d34e353ddc32a60624414c70864bad0e000c34df952420762

Download Submit
memory/2216-370-0x0000000003250000-0x0000000003574000-memory.dmp

Filesize
3.1MB

Download
memory/2216-432-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/2216-3-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2216-1-0x00000000773FF000-0x0000000077400000-memory.dmp

Filesize
4KB

Download
memory/2216-2-0x0000000077400000-0x0000000077401000-memory.dmp

Filesize
4KB

Download
memory/2216-8-0x00000000031D0000-0x0000000003265000-memory.dmp

Filesize
596KB

Download
memory/2216-15-0x00000000031D0000-0x00000000032C5000-memory.dmp

Filesize
980KB

Download
memory/2216-34-0x0000000003250000-0x0000000003309000-memory.dmp

Filesize
740KB

Download
memory/2216-46-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/2216-49-0x0000000002150000-0x000000000218B000-memory.dmp

Filesize
236KB

Download
memory/2216-52-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2216-57-0x0000000003250000-0x000000000333D000-memory.dmp

Filesize
948KB

Download
memory/2216-70-0x0000000003250000-0x00000000032BD000-memory.dmp

Filesize
436KB

Download
memory/2216-80-0x0000000003250000-0x00000000032B8000-memory.dmp

Filesize
416KB

Download
memory/2216-343-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2216-344-0x0000000003250000-0x000000000333D000-memory.dmp

Filesize
948KB

Download
memory/2216-79-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2216-93-0x0000000003250000-0x00000000033D4000-memory.dmp

Filesize
1.5MB

Download
memory/2216-106-0x0000000003250000-0x0000000003303000-memory.dmp

Filesize
716KB

Download
memory/2216-120-0x0000000002150000-0x0000000002190000-memory.dmp

Filesize
256KB

Download
memory/2216-119-0x00000000031D0000-0x0000000003265000-memory.dmp

Filesize
596KB

Download
memory/2216-133-0x00000000031D0000-0x00000000032C5000-memory.dmp

Filesize
980KB

Download
memory/2216-362-0x0000000003250000-0x00000000032BD000-memory.dmp

Filesize
436KB

Download
memory/2216-164-0x0000000003250000-0x0000000003482000-memory.dmp

Filesize
2.2MB

Download
memory/2216-372-0x0000000003250000-0x00000000032B8000-memory.dmp

Filesize
416KB

Download
memory/2216-383-0x0000000003250000-0x000000000332E000-memory.dmp

Filesize
888KB

Download
memory/2216-134-0x0000000003250000-0x00000000032BB000-memory.dmp

Filesize
428KB

Download
memory/2216-246-0x0000000003250000-0x0000000003292000-memory.dmp

Filesize
264KB

Download
memory/2216-396-0x0000000003250000-0x0000000003317000-memory.dmp

Filesize
796KB

Download
memory/2216-245-0x0000000002150000-0x000000000218B000-memory.dmp

Filesize
236KB

Download
memory/2216-410-0x0000000003250000-0x0000000003326000-memory.dmp

Filesize
856KB

Download
memory/2216-399-0x0000000003250000-0x0000000003303000-memory.dmp

Filesize
716KB

Download
memory/2216-226-0x0000000003250000-0x00000000032D0000-memory.dmp

Filesize
512KB

Download
memory/2216-413-0x0000000002150000-0x0000000002190000-memory.dmp

Filesize
256KB

Download
memory/2216-418-0x0000000003250000-0x0000000003332000-memory.dmp

Filesize
904KB

Download
memory/2216-0-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2216-431-0x0000000003250000-0x00000000032BB000-memory.dmp

Filesize
428KB

Download
memory/2216-153-0x0000000003250000-0x0000000003309000-memory.dmp

Filesize
740KB

Download
memory/2216-451-0x00000000003D0000-0x00000000003F4000-memory.dmp

Filesize
144KB

Download
memory/2216-462-0x0000000003250000-0x00000000032D0000-memory.dmp

Filesize
512KB

Download
memory/2216-463-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/2216-470-0x0000000003250000-0x0000000003292000-memory.dmp

Filesize
264KB

Download
memory/2216-477-0x0000000003250000-0x0000000003391000-memory.dmp

Filesize
1.3MB

Download
memory/2216-488-0x0000000003250000-0x0000000003332000-memory.dmp

Filesize
904KB

Download
memory/2216-501-0x0000000003250000-0x0000000003332000-memory.dmp

Filesize
904KB

Download
memory/2216-527-0x0000000002150000-0x000000000218A000-memory.dmp

Filesize
232KB

Download
memory/2216-537-0x0000000003250000-0x0000000003317000-memory.dmp

Filesize
796KB

Download
memory/2216-539-0x0000000003250000-0x000000000346B000-memory.dmp

Filesize
2.1MB

Download
memory/2216-526-0x0000000003250000-0x000000000332E000-memory.dmp

Filesize
888KB

Download
memory/2216-551-0x0000000003250000-0x0000000003326000-memory.dmp

Filesize
856KB

Download
memory/2216-552-0x0000000003250000-0x00000000032D9000-memory.dmp

Filesize
548KB

Download
memory/2216-564-0x0000000003250000-0x0000000003332000-memory.dmp

Filesize
904KB

Download
memory/2216-565-0x0000000003250000-0x0000000003458000-memory.dmp

Filesize
2.0MB

Download
memory/2216-567-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/2216-579-0x0000000003250000-0x00000000036BA000-memory.dmp

Filesize
4.4MB

Download
memory/2216-590-0x0000000003250000-0x00000000033C5000-memory.dmp

Filesize
1.5MB

Download
memory/2216-593-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/2216-592-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/2216-594-0x0000000003250000-0x0000000003391000-memory.dmp

Filesize
1.3MB

Download
memory/2216-595-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2216-596-0x0000000003250000-0x0000000003332000-memory.dmp

Filesize
904KB

Download
memory/2216-597-0x0000000003250000-0x0000000003332000-memory.dmp

Filesize
904KB

Download
memory/2216-598-0x0000000002150000-0x000000000218A000-memory.dmp

Filesize
232KB

Download
memory/2216-599-0x0000000003250000-0x000000000346B000-memory.dmp

Filesize
2.1MB

Download
memory/2216-600-0x0000000003250000-0x00000000032D9000-memory.dmp

Filesize
548KB

Download
memory/2216-602-0x0000000003250000-0x0000000003458000-memory.dmp

Filesize
2.0MB

Download
memory/2216-603-0x0000000003250000-0x00000000036BA000-memory.dmp

Filesize
4.4MB

Download
memory/2216-604-0x0000000003250000-0x00000000033C5000-memory.dmp

Filesize
1.5MB

Download
memory/2216-605-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/2216-616-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download