Analysis
-
max time kernel
47s -
max time network
70s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-05-2021 04:09
Static task
static1
Behavioral task
behavioral1
Sample
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe
Resource
win10v20210408
General
-
Target
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe
-
Size
9.2MB
-
MD5
adb2853e975ca90c74abde777b892bf7
-
SHA1
04a2024ed75eb77b95f66b9b6d39cd23aefe2187
-
SHA256
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061
-
SHA512
7a5d4728c2b09584852e27a0c90ce45c54180b49ba8320b032784ed5f2c7d44c78115e0b052578ca08addb41d8f2d24978259e5d33eecbd456f7b23ff70423d6
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 8 IoCs
Processes:
AppIntegrator64.exe7esrchmn.exe7ebarsvc.exe7ebarsvc.exe7ebarsvc.exe7ebrmon.exe7eHighIn.exe7ebarsvc.exepid process 3992 AppIntegrator64.exe 2924 7esrchmn.exe 2884 7ebarsvc.exe 1124 7ebarsvc.exe 1908 7ebarsvc.exe 3500 7ebrmon.exe 2148 7eHighIn.exe 3432 7ebarsvc.exe -
Loads dropped DLL 64 IoCs
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exeAppIntegrator64.exe7esrchmn.exe7ebrmon.exe7eHighIn.exepid process 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 3992 AppIntegrator64.exe 2924 7esrchmn.exe 3992 AppIntegrator64.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 3500 7ebrmon.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 3500 7ebrmon.exe 3500 7ebrmon.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2148 7eHighIn.exe 2148 7eHighIn.exe 2148 7eHighIn.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HomeworkSimplified Search Scope Monitor = "\"C:\\PROGRA~2\\HOMEWO~1\\bar\\1.bin\\7esrchmn.exe\" /m=2 /w /h" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HomeworkSimplified_7e Browser Plugin Loader = "C:\\PROGRA~2\\HOMEWO~1\\bar\\1.bin\\7ebrmon.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HomeworkSimplified Home Page Guard 64 bit = "\"C:\\PROGRA~2\\HOMEWO~1\\bar\\1.bin\\AppIntegrator64.exe\"" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Program Files directory 64 IoCs
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exedescription ioc process File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\NP7eStub.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edyn.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7efeedmg.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7efeedmg.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\BOOTSTRAP.JS d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\CHROME.MANIFEST d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\CHROME.MANIFEST d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\DPNMNGR.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehttpct.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eregfft.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eSrcAs.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eieovr.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eradio.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eregiet.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8TICKER.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\DPNMNGR.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\LOGO.BMP d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8EXTEX.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehtmlmu.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ereghk.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eSrchMn.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\VERIFY.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\Settings\s_pid.dat d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebarsvc.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehkstub.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eidle.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7emedint.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebar.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7emsg.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eskin.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7euabtn.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8EXTPEX.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehkstub.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eSrcAs.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\CrExtP7e.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eauxstb.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebrmon.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edlghk.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edyn.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8EXTEX.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eradio.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eskin.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\NP7eStub.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebarsvc.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edatact.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edatact.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7esknlcr.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ereghk.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8RES.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7escript.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files\Internet Explorer\msimg32.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\CREXT.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8HTML.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7emlbtn.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eregfft.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eieovr.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7emsg.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ePlugin.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8TICKER.DLL d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\BOOTSTRAP.JS d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\CrExtP7e.exe d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File created C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebrstub.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehttpct.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe File opened for modification C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7etpinst.dll d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bc412c9d-834e-4c3c-bd3c-dfd15b78b3e0}\AppName = "7eSkPlay.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bc412c9d-834e-4c3c-bd3c-dfd15b78b3e0}\AppPath = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\UrlSearchHooks d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5aa5df76-e300-4c73-a38d-4af284865594} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{469f03b7-86ed-412b-a869-99c9f50bfe17} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8f50c11c-cd26-4d13-b94f-6a16dade8546}\AppName = "7eSlSrch.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{3b86c427-928d-4b50-910c-117fa4830443} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8f50c11c-cd26-4d13-b94f-6a16dade8546}\AppPath = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6a60f594-b4bb-466d-a1b8-8c00fb419aa4}\AppPath = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8f50c11c-cd26-4d13-b94f-6a16dade8546} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\CrExtP7e.exe = "0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a411f193-dd5d-4467-9099-9fa0ea6257dd}\AppName = "7emedint.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{182010e5-3682-44b8-8fee-8c91de21f100} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{182010e5-3682-44b8-8fee-8c91de21f100}\Policy = "3" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6a60f594-b4bb-466d-a1b8-8c00fb419aa4}\Policy = "3" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5aa5df76-e300-4c73-a38d-4af284865594} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5aa5df76-e300-4c73-a38d-4af284865594}\Policy = "3" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8f50c11c-cd26-4d13-b94f-6a16dade8546}\Policy = "3" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{182010e5-3682-44b8-8fee-8c91de21f100}\AppName = "AppIntegrator64.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a411f193-dd5d-4467-9099-9fa0ea6257dd}\Policy = "3" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{182010e5-3682-44b8-8fee-8c91de21f100}\AppPath = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bc412c9d-834e-4c3c-bd3c-dfd15b78b3e0} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bc412c9d-834e-4c3c-bd3c-dfd15b78b3e0}\Policy = "3" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bc412c9d-834e-4c3c-bd3c-dfd15b78b3e0} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5aa5df76-e300-4c73-a38d-4af284865594}\AppName = "7eimpipe.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a411f193-dd5d-4467-9099-9fa0ea6257dd} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6a60f594-b4bb-466d-a1b8-8c00fb419aa4} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6a60f594-b4bb-466d-a1b8-8c00fb419aa4}\AppName = "7eSrchMn.exe" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5aa5df76-e300-4c73-a38d-4af284865594}\AppPath = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a411f193-dd5d-4467-9099-9fa0ea6257dd}\AppPath = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe -
Modifies registry class 64 IoCs
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3C3B863-09DD-44F1-BC3B-52930FDA1F4F}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A81616BA-028C-4E2F-A4D0-B24A4C9D8845} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27eb7173-28c3-43c6-8853-afc9395f6ec3}\ d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.SkinLauncher d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EA318C6-990E-4D6C-8A37-2AAE403A6E33}\TypeLib\Version = "1.0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.SettingsPlugin d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ed58d7d-16c8-4d35-9ce4-d7b72c086138}\MiscStatus d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2eb6a406-a081-4468-8a59-06890f8cae92}\ d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37A9B37F-105D-4F98-A7AA-C81C5B70E4F1}\1.0\FLAGS d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3084184F-4D82-4A10-9E89-E1AA367FF523} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B0742D-009A-4B53-960F-E7B88EFCF151}\ProxyStubClsid32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.HTMLPanel.1\CLSID\ = "{5519ace3-3d08-45c3-89af-bde45ad8add2}" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78152F1F-16D1-4AF6-BE3E-F0316E3536B1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{519085a2-5b5f-4b5b-903f-0c67bdd0af6e}\MiscStatus\ = "0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20D5461-3213-4C6A-8D9F-C786B05DAE25}\TypeLib\Version = "1.0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{182010E5-3682-44B8-8FEE-8C91DE21F100}\ = "_ITemplateBarSettingsEvents" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.FeedManager\CurVer\ = "HomeworkSimplified_7e.FeedManager.1" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cb955d9-bf20-4418-93e1-919ee4c46293}\VersionIndependentProgID\ = "HomeworkSimplified_7e.FeedManager" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78152F1F-16D1-4AF6-BE3E-F0316E3536B1}\ProxyStubClsid32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{137eaf98-bc4e-40bf-b9a6-2d0a2811ac7a}\ProgID d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1270339E-D395-438D-971C-8E8FB74048BC}\1.0\FLAGS d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d5888ea6-a162-4fa8-8161-4c9ba32157a3}\InprocServer32\ = "C:\\Program Files (x86)\\HomeworkSimplified_7e\\bar\\1.bin\\7ebprtct.dll" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A41FC8EF-79B1-457C-A3CA-429E80E8FDA6}\TypeLib\Version = "1.0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3585CB12-CDA6-4DB0-B8C5-76AB019C3A6D}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86BD37F5-5A63-41B5-AD68-580E88195218}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78152F1F-16D1-4AF6-BE3E-F0316E3536B1}\ProxyStubClsid32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{519085a2-5b5f-4b5b-903f-0c67bdd0af6e}\VersionIndependentProgID d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93D4485E-5708-446D-A289-E50281F598C9}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.HTMLPanel\ = "HomeworkSimplified_7e HTML Panel" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{718BBF15-E6D5-4955-B1A6-2B78C3E44FEC}\ProxyStubClsid32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}\TypeLib\Version = "1.0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E20B6AAB-0580-4937-B5B9-6B0A7348F7B0} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EA318C6-990E-4D6C-8A37-2AAE403A6E33}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.HTMLPanel.1\CLSID d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{69E2105F-DD4A-4AD3-A2F2-2615912E3BAB}\TypeLib\ = "{1270339E-D395-438D-971C-8E8FB74048BC}" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23119123-0854-469D-807A-171568457991} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3499C76-47AD-4B17-93D1-13B7704D6AFC}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33119133-0854-469d-807A-171568457991} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.UrlAlertButton\CLSID d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{eeb5bac0-4179-4783-af8f-ad58585643a3} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.DynamicBarButton\ = "Bar Button Class" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{519085a2-5b5f-4b5b-903f-0c67bdd0af6e}\InprocServer32\ThreadingModel = "Apartment" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cb955d9-bf20-4418-93e1-919ee4c46293}\InprocServer32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ed58d7d-16c8-4d35-9ce4-d7b72c086138}\MiscStatus d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.HTMLPanel\CLSID\ = "{5519ace3-3d08-45c3-89af-bde45ad8add2}" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A468F9EE-98E2-41CF-A64F-24DE57A3972F}\1.0\ = "RADIOLib" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d5888ea6-a162-4fa8-8161-4c9ba32157a3}\InprocServer32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5519ace3-3d08-45c3-89af-bde45ad8add2}\VersionIndependentProgID d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E082971C-AADF-40A7-9E0E-2FDAB77A1178} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.SkinLauncherSettings\ d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68C673F0-ED30-4F17-9569-E7B43A802916}\1.0\0\win32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E082971C-AADF-40A7-9E0E-2FDAB77A1178}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{182010E5-3682-44B8-8FEE-8C91DE21F100}\TypeLib\Version = "1.0" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{182010E5-3682-44B8-8FEE-8C91DE21F100}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}\1.0 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E8DCE5E-3F96-4C6C-A169-E44594F11A9B}\ProxyStubClsid32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93D4485E-5708-446D-A289-E50281F598C9} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Software\Microsoft d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HomeworkSimplified_7e.RadioSettings\CLSID d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23119123-0854-469D-807A-171568457991}\ProxyStubClsid32 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E082971C-AADF-40A7-9E0E-2FDAB77A1178}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CD1C1EE-3FAF-4824-9E8A-6DF4E60EDCFB}\TypeLib d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46A58D54-3096-40C4-9C87-525B50952F6A} d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{519085a2-5b5f-4b5b-903f-0c67bdd0af6e}\Control d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
7esrchmn.exeAppIntegrator64.exe7ebrmon.exepid process 2924 7esrchmn.exe 3992 AppIntegrator64.exe 3500 7ebrmon.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exedescription pid process target process PID 2988 wrote to memory of 3992 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe AppIntegrator64.exe PID 2988 wrote to memory of 3992 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe AppIntegrator64.exe PID 2988 wrote to memory of 2924 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7esrchmn.exe PID 2988 wrote to memory of 2924 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7esrchmn.exe PID 2988 wrote to memory of 2924 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7esrchmn.exe PID 2988 wrote to memory of 2884 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 2884 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 2884 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 1124 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 1124 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 1124 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 3500 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebrmon.exe PID 2988 wrote to memory of 3500 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebrmon.exe PID 2988 wrote to memory of 3500 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebrmon.exe PID 2988 wrote to memory of 2148 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7eHighIn.exe PID 2988 wrote to memory of 2148 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7eHighIn.exe PID 2988 wrote to memory of 2148 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7eHighIn.exe PID 2988 wrote to memory of 3432 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 3432 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe PID 2988 wrote to memory of 3432 2988 d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe 7ebarsvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe"C:\Users\Admin\AppData\Local\Temp\d9c389ac50fe143348f7ffa390d40c173a2cbf0fca51748697f78bad44319061.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\AppIntegrator64.exe"C:\PROGRA~2\HOMEWO~1\bar\1.bin\AppIntegrator64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7esrchmn.exe"C:\PROGRA~2\HOMEWO~1\bar\1.bin\7esrchmn.exe" /m=2 /w /h /r2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe"C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe" -remove2⤵
- Executes dropped EXE
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe"C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe" -install2⤵
- Executes dropped EXE
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebrmon.exe"C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebrmon.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eHighIn.exe"C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eHighIn.exe" 7etpinst.dll,#52⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe"C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe" -remove2⤵
- Executes dropped EXE
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exeC:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7eSrchMn.exeMD5
fb85f333d10b1475650c4304f99a1ece
SHA18ace75f6c2417666ad9d60837b72d78b394c3944
SHA256bed200cccbab9d0b7f5ff299b74a0ff52731366da956960fc3ea45edaaf9cb10
SHA512715af74edd2b66cad493a7f0c9a72a8ea9984dbc267ea05b4e4f8a7d987eef32779d1574c4ad95f8c00dcb60dd57d10f1a274402618b394ff5b1a185a5edfb20
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exeMD5
622fcf264119f7df127be353f796b319
SHA156cf4f2ac44c6add5cdcd419ba4b99d22dc7a0e3
SHA2566689d8f62f860178685496ef45520967afaeff94cfbcc64cf77074f21577e0a2
SHA51257b261c5b9f30d6fc7da6ee70200c22cd07d11b94bf9107fba7fe793195112ce90b34bcc7774adf87de00b0abbc621602e7e164caf28975056d952d0eb1d7c6c
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exeMD5
622fcf264119f7df127be353f796b319
SHA156cf4f2ac44c6add5cdcd419ba4b99d22dc7a0e3
SHA2566689d8f62f860178685496ef45520967afaeff94cfbcc64cf77074f21577e0a2
SHA51257b261c5b9f30d6fc7da6ee70200c22cd07d11b94bf9107fba7fe793195112ce90b34bcc7774adf87de00b0abbc621602e7e164caf28975056d952d0eb1d7c6c
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exeMD5
622fcf264119f7df127be353f796b319
SHA156cf4f2ac44c6add5cdcd419ba4b99d22dc7a0e3
SHA2566689d8f62f860178685496ef45520967afaeff94cfbcc64cf77074f21577e0a2
SHA51257b261c5b9f30d6fc7da6ee70200c22cd07d11b94bf9107fba7fe793195112ce90b34bcc7774adf87de00b0abbc621602e7e164caf28975056d952d0eb1d7c6c
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebarsvc.exeMD5
622fcf264119f7df127be353f796b319
SHA156cf4f2ac44c6add5cdcd419ba4b99d22dc7a0e3
SHA2566689d8f62f860178685496ef45520967afaeff94cfbcc64cf77074f21577e0a2
SHA51257b261c5b9f30d6fc7da6ee70200c22cd07d11b94bf9107fba7fe793195112ce90b34bcc7774adf87de00b0abbc621602e7e164caf28975056d952d0eb1d7c6c
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebrmon.exeMD5
35d6caaa9e4d82974a74dbdb53801f98
SHA10f78fe90af015b0a511ede007bd1791a341e891e
SHA2565418b7bb40b097da6370ada1194f8b2d2d3eefa3ca36a6eb31d39df7791a25a3
SHA512bdace57d273841bb476289d6fe9803c57a48ab7ce630b8797f848f6eb7816b00b43223fd28c8caa440b1b1d027a2dcf3cc9cee007fcf5905650d15e800c8b245
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebrmon.exeMD5
35d6caaa9e4d82974a74dbdb53801f98
SHA10f78fe90af015b0a511ede007bd1791a341e891e
SHA2565418b7bb40b097da6370ada1194f8b2d2d3eefa3ca36a6eb31d39df7791a25a3
SHA512bdace57d273841bb476289d6fe9803c57a48ab7ce630b8797f848f6eb7816b00b43223fd28c8caa440b1b1d027a2dcf3cc9cee007fcf5905650d15e800c8b245
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ebrstub.dllMD5
d3efe03300caf0fa2215206280d31220
SHA112ff3195bdaca5482034aac3c3e132d5ada421a9
SHA256b67d6eba635dc1cec42eec2d1a1ceee34e43cb3a55e6080b1a17d29af5d9cf08
SHA512a2e32cc4926e017f04a7feb3ed9da4a32741109b75ca845cdadc20b577c4d96f1de4d05e08466559c174b46731e0f8c35f305082c845f298c55779c6058e96a0
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.DLLMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\7esrchmn.exeMD5
fb85f333d10b1475650c4304f99a1ece
SHA18ace75f6c2417666ad9d60837b72d78b394c3944
SHA256bed200cccbab9d0b7f5ff299b74a0ff52731366da956960fc3ea45edaaf9cb10
SHA512715af74edd2b66cad493a7f0c9a72a8ea9984dbc267ea05b4e4f8a7d987eef32779d1574c4ad95f8c00dcb60dd57d10f1a274402618b394ff5b1a185a5edfb20
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\AppIntegrator64.exeMD5
f6dc4156b10629b1bcb37152d3523326
SHA1630d5fc9acc4932c87263895f554f8c3cb6d4b4a
SHA256468546874c24817222da03ae6308005a4ce3243b2d0559d88c5466837e8aadda
SHA512b11deb0863535e0aeb5a9cad6e9add49b3f74020857e4df29cb8755377dd1fd487a66edce1f2a74a2bb521314f72c9430c704a85501b7548618d4e28219f3265
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\AppIntegrator64.exeMD5
f6dc4156b10629b1bcb37152d3523326
SHA1630d5fc9acc4932c87263895f554f8c3cb6d4b4a
SHA256468546874c24817222da03ae6308005a4ce3243b2d0559d88c5466837e8aadda
SHA512b11deb0863535e0aeb5a9cad6e9add49b3f74020857e4df29cb8755377dd1fd487a66edce1f2a74a2bb521314f72c9430c704a85501b7548618d4e28219f3265
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\AppIntegratorStub64.dllMD5
205a514bd9275ac0e837c7ac1a80edf5
SHA1374e378a91209732b48c8416d1e9805e98fdcfa9
SHA256bccb4c112435ac8ef6246d054c6b7e4254ff2532cf5cc3212f910de9d3803708
SHA512c0ed9c41765379e4ca0222825e02b088dd42d0bd9797f6948ca49ee9305aad95215e5a5194f2740347f18a4f8a9df535ad915d4577f3a2928b6ba9c3de9cd3a4
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\HPG64.DLLMD5
6837c7bb84d6c3200117e05b4fe1d147
SHA13d7cd376dfdb97512a376e85fbb7f04344c051b6
SHA256b9e6945ca093d66a37d44c16f0470e301852e62ceaf522b5672254b00f4c4699
SHA512e1e08a3c6052a847af2e45dda747d795fd4ffeb491a2322b8400fbe81c3d6933f058493b4548e6e2ef03fb976a470adc46414b432bbaab928dc3154e4eaddd9d
-
C:\PROGRA~2\HOMEWO~1\bar\1.bin\t8res.dllMD5
db180749d8ee186258c07510ac5a077b
SHA1bd9dcd952552226e2491d62b13b8c9549f2accca
SHA256fa2e50519f5153e522d900af064b7c8f0069d00d835420a5664a168e78df072e
SHA5128aa9106a6d2b39457b43bead3c055275c5523a66701701be5b6005658c9b0db23aae4fa86a5aded5b84b47b3ef00111d03c2d76eb2d56fd4f3bd347f9fec0ff3
-
C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eHighIn.exeMD5
635f5e4b01597d0baf2422245c8ff541
SHA19788294f2b8ab28dbae4c73bb61a6b1200bdd89d
SHA256b1c485330062beb4d02e3e67e68de82c6ffa22b0bbf1eeb6356d2ae15d03249d
SHA512d93fe70d449df96321d30f2ebd725af2cf07f0ebead6ba9db4af47ee513160d1a6a8f78533c642fe685609438a2d1af00089aaee202b820fc7bf7a2cca9ead02
-
C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehighin.exeMD5
635f5e4b01597d0baf2422245c8ff541
SHA19788294f2b8ab28dbae4c73bb61a6b1200bdd89d
SHA256b1c485330062beb4d02e3e67e68de82c6ffa22b0bbf1eeb6356d2ae15d03249d
SHA512d93fe70d449df96321d30f2ebd725af2cf07f0ebead6ba9db4af47ee513160d1a6a8f78533c642fe685609438a2d1af00089aaee202b820fc7bf7a2cca9ead02
-
C:\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7etpinst.dllMD5
cf0646bb879911192c833e314e0afc57
SHA172489280930f183e34fe5af817f207a5eb65f8d4
SHA256d6ac1b4a4cf592a269768f5792cd53be89425ed3eed95223dda9a3ca6b42d428
SHA5120bac280faeffb0c79d1eae260795d94556a81090200d8f59a79dfc09724eee2d0a8ea2e915cb886bd2fa7f74951473a584a68d88a44d6d1c84f714b479a05305
-
\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.dllMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.dllMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.dllMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.dllMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.dllMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
\PROGRA~2\HOMEWO~1\bar\1.bin\7ehkstub.dllMD5
98e56fd43f64538baa9b1f367951091f
SHA19d54baf23397e5f1444bc6471052ad234b76fbd3
SHA256efbae6177e046b2a1b165cc0aeb1cb4812df29de4da48a8286abb9d02460384d
SHA512baf47142fcca94069e2ec71eb00457b4187cad831e215e56539d23d01acc842b8bac090fa8d4827c55e4ad16019fd3310f2506515a3cc47cee0b7609585d23c1
-
\PROGRA~2\HOMEWO~1\bar\1.bin\AppIntegratorStub64.dllMD5
205a514bd9275ac0e837c7ac1a80edf5
SHA1374e378a91209732b48c8416d1e9805e98fdcfa9
SHA256bccb4c112435ac8ef6246d054c6b7e4254ff2532cf5cc3212f910de9d3803708
SHA512c0ed9c41765379e4ca0222825e02b088dd42d0bd9797f6948ca49ee9305aad95215e5a5194f2740347f18a4f8a9df535ad915d4577f3a2928b6ba9c3de9cd3a4
-
\PROGRA~2\HOMEWO~1\bar\1.bin\Hpg64.dllMD5
6837c7bb84d6c3200117e05b4fe1d147
SHA13d7cd376dfdb97512a376e85fbb7f04344c051b6
SHA256b9e6945ca093d66a37d44c16f0470e301852e62ceaf522b5672254b00f4c4699
SHA512e1e08a3c6052a847af2e45dda747d795fd4ffeb491a2322b8400fbe81c3d6933f058493b4548e6e2ef03fb976a470adc46414b432bbaab928dc3154e4eaddd9d
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ePlugin.dllMD5
de7f03c3b7194eecdf0c9af3ae400d7c
SHA1cbf93e0f6ff8ae054c18bdbe477cbfaf9f467cf9
SHA25620c4ee40010959c2b74f5bae90fcf433e25f74de3907173293c3799f8c851c2e
SHA512354d0840f86113dde2d6247ec7830708c3fc79af19df1a676ab5c07f9e83583b628058ffe22742b85fec08b2a09e47ac7d129a7cfa4e414fae17436cc9c2c90d
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eSrcAs.dllMD5
cb31249537d2758f73046888aa02ca7a
SHA1be21d76e502d546b2d88093e13f07923eb59380b
SHA2563d43bed1f03d4b7c744f6dd7031fa98d13ee482b43ee7828a7dc5427cabeb835
SHA512885025a255c2a18000bcd11cf9cf4d3bb2e7c5b4236b5defe881ab1a8c32b09c7a12d458d966adbf575fd46881ba1db5a945ab612bce995175effd1ea81b8d99
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eauxstb.dllMD5
22ae719e91b4bfcdf6122d3e2a0f272e
SHA199df98dfef4b483889fa88162d20ee46340a5dbe
SHA2562529f6465570ac7f0b82613c694181cc10515ee045cfaa48dd7402e9b9d791bf
SHA51261028e30c28501f0c18c00ec8888cec3eade43b823a545608fc6ee9c6c2529723b5bede0cb2d4a016562a8ad4a59b1cf2b6ed00d1f745387ef9f15b05b63ce8f
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebar.dllMD5
55bb146847cf8fc07253de6ab20041a9
SHA1e77ca95e7ad71424d46a74a40a3f8457a3f03291
SHA2561a681302f6f873c2f532504e12cba869e4a58899e92a9cf296aa954bae098e02
SHA51261c56e3e1fffddf65c13b6fb8ae5c20db8aff32ffea5c7a10c7ec102d971b5728787bee4d1c93454aed167460fc10e90d60492d07be0b830f20fa713186d07a6
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebprtct.dllMD5
6c0323f452235446604b1f54341e8bb8
SHA10ff3588ecb69d2b18c6faec012672ca2f60314f6
SHA2560911baadea3a57160214f794034afbe9fa54e633af633e51c73e39a013c629e8
SHA512da777a2030b81dbdf3bfb0c1aa4d937ff0285818872e340b9beb693e84b9632b990d23a135bf24bc2db1023f9e9fa69376e386817bd7da7ded69fc750ef58648
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebrstub.dllMD5
d3efe03300caf0fa2215206280d31220
SHA112ff3195bdaca5482034aac3c3e132d5ada421a9
SHA256b67d6eba635dc1cec42eec2d1a1ceee34e43cb3a55e6080b1a17d29af5d9cf08
SHA512a2e32cc4926e017f04a7feb3ed9da4a32741109b75ca845cdadc20b577c4d96f1de4d05e08466559c174b46731e0f8c35f305082c845f298c55779c6058e96a0
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ebrstub.dllMD5
d3efe03300caf0fa2215206280d31220
SHA112ff3195bdaca5482034aac3c3e132d5ada421a9
SHA256b67d6eba635dc1cec42eec2d1a1ceee34e43cb3a55e6080b1a17d29af5d9cf08
SHA512a2e32cc4926e017f04a7feb3ed9da4a32741109b75ca845cdadc20b577c4d96f1de4d05e08466559c174b46731e0f8c35f305082c845f298c55779c6058e96a0
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edatact.dllMD5
70a6b86cb0a6a3f7b35421ec7b9f5b7f
SHA1baefcb03679575349e01668c4f0938643baaa022
SHA2560059d01f099fffa09373a6ead57f3cd1c6772667b9a7eeb6edabca3cd1963cf1
SHA5124d6cdd61afb68b3fe6b705c2298ce35a1e42834c17e4faae11413bda44f0739647b6d773e73b530046c37ec0e15d8687f7546c0cdf30dedf5b5ab2adbd8c427d
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edlghk.dllMD5
8fb2c1103382577f8248d83e7487ea86
SHA10c88efcfa1c77d597111125a6c031ceb47b18ba7
SHA2562e274740283a6977d068baf1d1535d7e235fbcfc0b7f620cb87bd42e07d30344
SHA512bc5564d1129cfe1aa1a1c12ea180253807d132ddf4a442ddde12851b2250d77534fde7e2b7db88151707f5a6b29ed9b9f86e7c0fee2931f48d75846a408bbe52
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7edyn.dllMD5
8d721a2bc356a862ac8b2349bbeb614c
SHA18090e240f528004402b29c11e5072bed79d95384
SHA2565dc33b6ae31bb0b277f6db3b983e4adf5c509646b574c0630864ef462c6626c3
SHA51257a61aef5c03e69ee26fc7baf3ae30198b95c28b0d8887e86015683c94ced7cb7e6a5cc310da13bb32d87f81ab33778c412d60f48a4f646e18d17242b609fb10
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7efeedmg.dllMD5
f18d8bcb38dfd1409cf19f3ebd3de3ea
SHA12ca2ea6cf1ad1fe87c25d4ab6b1c7729e48c6390
SHA256090686b394ebf791b262b97249b20083c6a78e6cb04847a3ba643eb64c5ff184
SHA512b251f89728dda4f7250d39c6875d5362a89076340df34fc04f5d03773c354b0297bce2d9d898c5359339bdba49620fb143d72b5d9a6ce4ef2ab33ddab57e73a7
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehtmlmu.dllMD5
65871eaefe51bf6ba0731f4fc62c2f55
SHA1eaa9d46b8fab8f3d48bb239adfe46ba312434017
SHA25672d7cb57c8de250ebe3fe65317957b9045a09c4a70d0751f016230f321d0a3f6
SHA5129e72a3b07de65773e654b433e28ea0189a96d3656ca518948738c6e02edbeb5ea65779699d94490a7589735aa65988287b390a7639b11b1cea226c04262267b9
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ehttpct.dllMD5
6df45cd8b40014f94f1a949fb96d3284
SHA1978867b422339e68971e56c49c66f14f2acd745d
SHA256c7a2447a749292e6aa3a8db104b46058af0f044ee376d6ca49a3764955d9b6b1
SHA512aacbf2c8cf9e06d94b622762d33d2f8614410589ef8f0e02b87006e74c7c0dddab1ebd9e6018b6857b34ffcf5100b896c2bf06067e3bde659972ef966a64d996
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eidle.dllMD5
121fe87b463651d75c9bff704883c978
SHA1dc971c75ffce77cc952fb6660a2603e09d62d4d9
SHA256120b46557864c807dde6be7c0c1e71a2110d784a242dc79159945669d920fdb6
SHA51275337eb17c5db5276ecdc789e8e075376c18941047358e0946dc710580a5bbf2bf122d0c443e02e04f908bad18b5eb31c84b4e29a0676886af51d754b3bf1520
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eieovr.dllMD5
b315203e6d9995156946194516cf5332
SHA192ac05fff3ad68271062a3dcb87e12ee6b816ddb
SHA256aa30c65ee96701116138ebae7d1f0e831452a749f1f9724232a03e660ef13f51
SHA51283d897c787d37804dee112dac89c51066969c59b77080404da0c2f0cd36db478f0eed31f127bc1e636ce3ce4ca4b96a2fc8a4aa62d2da52336fff8d33762ce5d
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7emlbtn.dllMD5
896943b4b92b7e3f406844674f629076
SHA13eb4a6a25199e6339ec04f36189c71738de63ce7
SHA256f8274d77f804ad805806d531e940956d096f75c6b6b17f34a753f1cbce6c1632
SHA51235a39b00cf7e0da8b151a6261f833f12e442107157602d0a8cf991a424978158177203b79290f4b0ad8e6d0fee70e4655980727c3db3f26b249c49d98afa7e71
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7emsg.dllMD5
92aad41d2e12e797af52d4bcd75cbed7
SHA1dfd07b722e317d1cddaab7d5b31bfab57cc5e739
SHA256a2122cc682e9155708a0a8c12d1e0935231c82a30f4ec1afe0245d8ea4c7e7f6
SHA512b005d8ed9d9413914a7c3b28277ab7b126843dcf2a4ca28e58c8e5cdb942d11384deb69cd7ecd5bb7d6ac9f5d593de36a5ded07bc8dc68f0b833ae3110276397
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eradio.dllMD5
4876e787ed8d945838235f8cfe079d05
SHA177c8dc985373b1e5d9035ecb3a831c7dd1abfd55
SHA25697b3a0272aa17e018d91d235cf5e21882a626bfc0ece264a699c25c2999bb9fc
SHA512dc920a2ad55acc725ee362bab710f50e8edc92729bcc6c1793471e9fef17352218c9680e132ddea95dbe16415c6c2c18cd00b0f52b1c3143395fff8e681e7ac4
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eregfft.dllMD5
5de55f0f8967fdb31ee5b259a5aba975
SHA1c5f26031d5e0c487bff0d60aa44603135bf60395
SHA256159ffbb40567e8ebbcb29a24fa76bad6f1af81f5ec45a75cc5875dcdb5a78e4b
SHA51272320cec163ee236569a7f747e4aa819a81796f7de13feccd553477546223ca706e67f2554f724b240b1445753129d476485bd2b8e57d413877467437c684028
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7ereghk.dllMD5
071d962e0e256dcf0b360b59ad6897eb
SHA1a2f202f68fef2a31e9fe3ae124a46b908349778c
SHA2563f2295b542c1163f96e6cab547074a2d052320874f39ce0ee4428adea9a8fe9e
SHA51255ae5128c278619452f88b6f1267fa97665d9b49ce1062f88fc920e11287060f96148db414bfc97cee5d8ae85ed5044be3f49eeadbe23e17129c8063c68fe87d
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eregiet.dllMD5
a4c73c71941826db74af6598336eda99
SHA165d604a070334183e5034cdeec5838e46d705794
SHA25664fa4044c2e8657b84eea6de847254731f20c010eed16bce9e82201dad825c13
SHA512a8471104d239709c039a56f1aefb0f9004c1b038df3bf830e125a1efbcab5fbe2e77e19d4d78fee50c8357c192dc27e67957cb951225a01907a6322591efe6c4
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7escript.dllMD5
2c0327baa4c4e39bc839fcaeb7156dd2
SHA172e48f7f37e208a52ad975eaecab29fc50223c27
SHA2565b1fe0d4b92c46a303e112763b926c978d5a60462f72327aa4655d7663507652
SHA5129b2b3e90fdfc5067e3d3f5c13d60103eb036f9e3ba8cce990fb97a17a4668b9033ce823793f03fb39070b140d0e3d1956000d0b339735e938dba40b95c566034
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7eskin.dllMD5
00fbbb2b564dd1f2f54ed0810a08b8d9
SHA1857980a7b7ab77ff8e34a090ccd76b8ba628e7e4
SHA2565925099be414f4f006fdbbac9d46b50d2c25e97410e9f1bd931e13ec586cd669
SHA51213b6e9965fdfe4ec390b5d9146303d34e12dc0e23f85202a0954345cdb83d9d004a98eaf45dd4fb0cfd684546d483b7a23e7dbc63f64df506dd7b5bbc5ed4547
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7esknlcr.dllMD5
4d660347c844a8bf9ee0fbe4a086bd54
SHA1496310ee0816b49176e03226db102fae9aa452b4
SHA256561bd2c1ead9313dc75693b36b8741108113186494c153ede8ae2dfd490b2a7b
SHA5124c20bf2979083dd55565d866caddd3cb4f7fdc8b606f905698476a96cbd9f2d974b4f0c00ad6c38cd61e3b54e249356c1622384a6753818bbdb3249e0ce33483
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7etpinst.dllMD5
cf0646bb879911192c833e314e0afc57
SHA172489280930f183e34fe5af817f207a5eb65f8d4
SHA256d6ac1b4a4cf592a269768f5792cd53be89425ed3eed95223dda9a3ca6b42d428
SHA5120bac280faeffb0c79d1eae260795d94556a81090200d8f59a79dfc09724eee2d0a8ea2e915cb886bd2fa7f74951473a584a68d88a44d6d1c84f714b479a05305
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7etpinst.dllMD5
cf0646bb879911192c833e314e0afc57
SHA172489280930f183e34fe5af817f207a5eb65f8d4
SHA256d6ac1b4a4cf592a269768f5792cd53be89425ed3eed95223dda9a3ca6b42d428
SHA5120bac280faeffb0c79d1eae260795d94556a81090200d8f59a79dfc09724eee2d0a8ea2e915cb886bd2fa7f74951473a584a68d88a44d6d1c84f714b479a05305
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\7euabtn.dllMD5
6335d76eb910f4ae1fc616b208c7c300
SHA1110033f4a78dca521e8ba73f75747e4e3b6ae545
SHA25654fa5362ab82e7b7d631c48b7931ca50efeac29e2bfbbea30619f8f6be3b45e3
SHA51260fef65b4fe22ca617d4b5bf7bf3bb3ba44190437666889f26c4e65244b423b97681fcc44d11606ffdc4ccd71b598f096c7b08de07ecf1c82ac0a617963c5ec7
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\CREXT.DLLMD5
e83ba06c9fd18923c168a12e3f30e81d
SHA16902d246f8fc2457c9ae369b094292de6eb454bc
SHA256dce18833e08121db1bb9c56cc9229405ee13cb9b1961956bccfe7679cf929d45
SHA512eb6d0d601b6a1c8dfdddfe13c69e19eb4031afc34d0788cdb620211123d070e63a99fe7a5bdbbc1070550ea18b55e59273f0d73d6f0eaf1a1d502a491c7c4acb
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\DPNMNGR.DLLMD5
500b47a48a172c0625692fdcc01b3889
SHA1244414d9d39e114e7989c3b35a5ff038508ecfc1
SHA256c62544ba1c451d590883230838373ee89838f6db2327ec4b5a5111460a8e3a49
SHA512e4677e9a16c3d45401b87443801f6ba69f57b5e9c1537abafbe80c6a98c08b5eba1a54f696fb6aa6fbe03209717d7e648e4a039acc8cc6e4e010c79586864718
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\EXEMANAGER.DLLMD5
511cda01fb8a730349e0d6577136e053
SHA16ff50369661027a1cd5f5e465f78c78913ff84cc
SHA2560f26dbb7816ed764d475cf640e88b21ee8ff38d2435e1f1ff357adfa03887449
SHA512edc2b90a8c67094fc500b3ffbfdfafc103a624ec41c3be9a25a242c92bee2a809e5d38d5940d2dade79e0c5f91071987970871b948ead7b5680565b4c722b695
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\NP7eStub.dllMD5
a533dbc055dee221544aa51c7966e381
SHA19ad3dc56ec83ac3a076dd5f1bd83068f5185fc0b
SHA2565221660f2c7d1b781c8fd0b40ce99a0d404b86dbaef1e29efca2d385fdeb6f3b
SHA512464ec4a634e177059beb7a44ecb4837825a246535d0f2881466c4675325755e1f54f54de527af8891d233f4dff338dfe44c89201014dc9afa7abb3930e4d26a8
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8EXTEX.DLLMD5
995c45ccb72ab2efdd3f1602ad8ec907
SHA12f938d8c9a5d3c9c239793346d43193ba1cbfcd6
SHA25670e5d3fab80653f3a0d96f4c8ee0cd4034c4b1120b455313ddd1654027887c72
SHA51220f9009d8039004726409fa62296b2fc6f4a5b461426ad6d7736922f11cbbfffcbb42fb60ec731d239f723fe89ea64a0655f764ef018289fd6c1b01123be5040
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8EXTPEX.DLLMD5
7f98949c5607f96114dd87a538f2b269
SHA1b8944722e8d577e67925dd4a72d1d8e44c3bc6ca
SHA256908e9d66885f2f3d610da9ad2e038acb26622969b2a8fad2da6ad7b0c2d69150
SHA512aa6a514e830567b9d71c09e61b160fd5766db051c18b8a08ee85c52b58fc939b381111bc641573f0c42676600ef9beca523a0acb1b74434ad0392080e8f5ae8a
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8HTML.DLLMD5
e8298b19ec987061e98f83dff8c310be
SHA17bbff8810bb79104fe275fbbf7de48dcbd877e01
SHA256ef6c98b1f7aa59cea89f8756e7d2adf8f55de2bdf3f93bcbab542accaa1aa6aa
SHA51253389d996517ec00538e7afdd6d2f4b8d7a97dfb3e197c467ebfe3d791f48fd6a7263149f8433ad8bbf07fe0d8c4a61913426c3d5ea4e2a183f7633513f3690e
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8RES.DLLMD5
db180749d8ee186258c07510ac5a077b
SHA1bd9dcd952552226e2491d62b13b8c9549f2accca
SHA256fa2e50519f5153e522d900af064b7c8f0069d00d835420a5664a168e78df072e
SHA5128aa9106a6d2b39457b43bead3c055275c5523a66701701be5b6005658c9b0db23aae4fa86a5aded5b84b47b3ef00111d03c2d76eb2d56fd4f3bd347f9fec0ff3
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8RES.DLLMD5
db180749d8ee186258c07510ac5a077b
SHA1bd9dcd952552226e2491d62b13b8c9549f2accca
SHA256fa2e50519f5153e522d900af064b7c8f0069d00d835420a5664a168e78df072e
SHA5128aa9106a6d2b39457b43bead3c055275c5523a66701701be5b6005658c9b0db23aae4fa86a5aded5b84b47b3ef00111d03c2d76eb2d56fd4f3bd347f9fec0ff3
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\T8TICKER.DLLMD5
3d4aca84349bff8642dc00145bbc51c4
SHA12e85c71e79c5b2a65d8ccdd5b21afe559102062f
SHA256ba9df414f1ec5af8a5a876ae5b4c7d43f5ed2fccfaa16a497c1b34131d97a0c6
SHA512c1fe162a93d2e2f33369d58fee8eb334a67671a83dd7195c6348891841623342d008b2497abd893f9e4e09844da312c6751c294cef25290e855228eb3ddb58d1
-
\Program Files (x86)\HomeworkSimplified_7e\bar\1.bin\VERIFY.DLLMD5
1c4945f06ab24e466a56924195610857
SHA1d0787beae97ce99982e7f5000772831421fd48e4
SHA256c4924fb51a23f6ac1b1ce261faddf1d8a8b01c9ae20e3216b417b352afb12348
SHA512adf3b8d4a688236a34f50bcce2102a69d0a87729ab17e90ac9e3c58f00f297fc9c0733c71a4abe7872d7de473f32634af8013ca367316ab4363c8d2b84fe58a8
-
memory/1124-138-0x0000000000000000-mapping.dmp
-
memory/2148-176-0x0000000000000000-mapping.dmp
-
memory/2884-129-0x0000000000000000-mapping.dmp
-
memory/2924-125-0x0000000000000000-mapping.dmp
-
memory/3432-186-0x0000000000000000-mapping.dmp
-
memory/3500-159-0x00000000001E1000-0x00000000001E3000-memory.dmpFilesize
8KB
-
memory/3500-143-0x0000000000000000-mapping.dmp
-
memory/3992-122-0x0000000000000000-mapping.dmp