Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 22:04

General

  • Target

    $PLUGINSDIR/bundle.exe

  • Size

    1.6MB

  • MD5

    981780e62db7df6ebf7dc3fc94ff9df4

  • SHA1

    32cafdcfe5822f0eea2def9829afa30e746feeb6

  • SHA256

    c207ee428f0eb876e23f5b7ac859f0602aff15ac533eeb6b74262e99f3658342

  • SHA512

    a59c19741b258223dee6a8f631d2cc442c9fb5cc9d13b87e81cb9b5bdd2cede636ac442b3aa254abe9b50f88eb810cd9769d91697e8fabc5ce2f844ef47cbb99

  • SSDEEP

    49152:e8YWaDwae/oxwOLa1IgZ/yS4SS0emt5NMVqi:ZYpktoxwSa1IgEy7FRQ

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\MyBabylonTB.exe
      C:\Users\Admin\AppData\Local\Temp\\MyBabylonTB.exe /aflt=babsst /babTrack="affID=112042" /srcExt=ss /instlRef=sst /S /mhp /mnt /mds
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Setup.exe" /aflt=babsst /babTrack="affID=112042" /srcExt=ss /instlRef=sst /S /mhp /mnt /mds
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2660
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCB525~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache URI|http://babylon.com
          4⤵
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Program Files (x86)\Internet Explorer\IELowutil.exe
            "C:\Program Files (x86)\Internet Explorer\IELowutil.exe" -embedding
            5⤵
              PID:2716
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCB525~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache trkInfo|http://babylon.com
            4⤵
            • Loads dropped DLL
            • Modifies Internet Explorer settings
            PID:632
      • C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe
        C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe /PID=104 /SUB= /NOTIFY=0 /FFP=0 /SILENT=1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Users\Admin\AppData\Local\Temp\SetupUpdater.exe
          C:\Users\Admin\AppData\Local\Temp\SetupUpdater.exe /S
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          PID:836
        • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
          C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe /PID=104 /NOTIFY=0 /FFR=1 /FFP=0 /S
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          • Modifies registry class
          PID:2896

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Babylon\Setup\Setup.exe

            Filesize

            724KB

            MD5

            dd8e85bf0104aca325c3837f98d480ea

            SHA1

            229b5ba6778a05dea2e43290a99e2d3f8a4f3a21

            SHA256

            19b2a896266ad06f80cefa146bdc504a5ff8c8d01c8554fb85c28d4bb8a7fa38

            SHA512

            d46dcc6198fd1910893e299effa826dbdded65dfe2cf1c8e29b164d72f97fc1720a72a5cb71a38c8247e08aeeb3996de68bad45395f45b1f885f021af9eea9dd

          • C:\Users\Admin\AppData\Local\Babylon\Setup\Setup2.zpb

            Filesize

            3KB

            MD5

            5e6230b3b16798e23720958756ac6d9e

            SHA1

            c7bcb001c48a67d4c9d6e70e92473ebd85b30585

            SHA256

            d49ec47f5d27a09a17e00a6eb78f49a761c9f5881ec81fb07cc49fd0a5f287b2

            SHA512

            6b1c132f0e4fc2ca6b5e8d807671c586d84e044e4db8380682fd4d071160177c0f7e7a6afae3ee74a4fbd5c65aca0c0876948f5a42deafdbb685c5b7989b5aae

          • C:\Users\Admin\AppData\Local\Temp\Cab18B1.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\BExternal.dll

            Filesize

            126KB

            MD5

            743acbf54eb091066be6ab3cb12c5988

            SHA1

            43a205985790c47a7e611fa2d3cab9b4eb59121f

            SHA256

            fcee9d5c80b11b82add301e142dea2b40b05f0839ef7cd0a8b0fff84a67eccd0

            SHA512

            014cf6b9896a2f76b8d110bce862c46a56471ae74582cbae7af672af49ae052d7827fc28806dbe80c911d05c4688d7e08ef486bc7d7acc2b05fa7b2b3f2a3689

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\BabyTBConf.ini

            Filesize

            578B

            MD5

            961b3776d7490ea09b0564c86ea55088

            SHA1

            a9aa2346b219712501a61467379e9ac9c4e9733d

            SHA256

            0d0d4f4057f6072e3ff9ca24eb9ff10f4448634236f4aa9aa27dc33b27660956

            SHA512

            2a5f02b1dda9f7d91ac10fc2e75990735ad47bd9126d114b4608047c6abe752a18842f12f2a3c263e7fe30666eddbe26687b5738f0d1cb97fb469cfa81c77719

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Babylon.dat

            Filesize

            12KB

            MD5

            adbb6a655ae518830ba1afefdb84668f

            SHA1

            a1be53d99a67fff011ea035c310588e635c718e1

            SHA256

            7029ed42440ab0b23c76c2800871002151776f927cc77855590e79b31b96838c

            SHA512

            b5ddfa301fdcd852a35c6b8a5d4eed78c43bc250d7e2c7d95b548d5f5ce216f2b9f5eabf5e1c0c87691d735fc1ac7a33a5c236c5560a4777ef7bf75510f0b228

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\blueStar.png

            Filesize

            14KB

            MD5

            a7fcdf142648bac756fcfe06a31f42e4

            SHA1

            4df99b119c183c821ed1bf0f825536318c9c3353

            SHA256

            008aebc73a7bd79e914db753b83a385c1aac320ebbcf4ead8fa49f74e3f30f22

            SHA512

            ddd8571b02909ede720af8e27044e126002a749719f41fe65d44004a5165ebfd90e5cca007e6014194de510a0076862839ecd056bf0043113337ab25086037eb

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\eula.html

            Filesize

            79KB

            MD5

            1b73a781f7f5b0d61624bd97050a2ed0

            SHA1

            01b848625761d5dede115e8599e4c72f126f8a3c

            SHA256

            f7f4148b58242a889a8694d734e49ca96bdad63d7fa5d5be130acfa9414b5cb5

            SHA512

            76eb4cd01eae14b0050802ad4cd0e401e2e65705d4d4b8c25e3632bd24745ec85df129c51332500823953755314a51907f0a713d0c2011054490acebc9c2787f

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\globe.png

            Filesize

            33KB

            MD5

            cc53fb9e9456eb79479151090cb16cbd

            SHA1

            e61004bf729757f3f225f77f0236b82518f68662

            SHA256

            3eca21891a2b484a38098410c5d8410361e91ae4dd84cb565891281145501f42

            SHA512

            0aac27727044ef9cf05e7a8d35d4395c9812a9169fd1661f95f53a2d809a7a73a034058b8080529ab50471688877cfdb45a282308ef86eb4812a2d734e02d28b

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\options.js

            Filesize

            119B

            MD5

            771f230f8bbc96a03b13976667918f1f

            SHA1

            0fba422c76b89cdb5d12e657064c49a9b1b7abae

            SHA256

            92db8b549583a5498689a42840a282f33d734c3cb081ac6f896377e56d043252

            SHA512

            b8209b679f30fea49ea34b77b7f4126acef962a17b292cbab711660c7ec23646bab91e66ce49fde6570ee3c053bb6b8d521b6917cb16f3e925ce8f82d7b4c8f4

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\pBar.gif

            Filesize

            3KB

            MD5

            26621cb27bbc94f6bab3561791ac013b

            SHA1

            4010a489350cf59fd8f36f8e59b53e724c49cc5b

            SHA256

            e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3

            SHA512

            9a19e8f233113519b22d9f3b205f2a3c1b59669a0431a5c3ef6d7ed66882b93c8582f3baa13df4647bcc265d19f7c6543758623044315105479d2533b11f92c6

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page0.html

            Filesize

            1KB

            MD5

            cf33120dd42cee842d96532843bb1961

            SHA1

            1db4f3e0aa1e4036a078a05f48fefdbb8744e3cf

            SHA256

            783a0e39d4a751462e26e4acfcf6fb4953f818980ad3d7d7fb821ac35c00c29f

            SHA512

            889d4043672b551a08979054add55bca4c5a4438fef5189b1ecf309c803ff1468664ed1123b0d22ceecb21a7bc5cfbf85a7428ed72ad7be04596185432aa68e3

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page2.css

            Filesize

            2KB

            MD5

            085cf46c4d1c8dea9edd79ee37d6d5bd

            SHA1

            30cb66994c45261a4aaa6d9ecdf1b1890ed09b45

            SHA256

            9ca3bd0f0c3ac1533fcda2e20e2fb3c18deb40986b37ae6edff594becb82405d

            SHA512

            66ea917206a7e771e48e3734004e6b96619c5534cca35c2e59e7c2922bec7dca5fbb6536e8940013871becce7493b0e2b1844cc5f37668396639c6d7c7e321a9

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page2.html

            Filesize

            3KB

            MD5

            12152ded3604e8baaf82c078f8034d60

            SHA1

            0867dec241a257e3e9ad9e8d20b9e06e3bce7184

            SHA256

            abb8953ffc3818e54e86019e1920595d65ba0997f3fd7fd47480a450cd7ee485

            SHA512

            a38ed7d7ef0be98ef362b4f5345961ac56f2db9e184b8a405dd3b09611796fda2189837a3bc0c27152276225a2fd4c8bfe8324c70df0d67b9cc826212448e79b

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page2Lrg.css

            Filesize

            1KB

            MD5

            db15b568f9d195635b3fcab87ef6293f

            SHA1

            6ae0f374531cb3013857880e8469a103492b8393

            SHA256

            5d7bd6b3acb31788f12475528d51d98778f1dbc940b2d6dc6317704d17d0964d

            SHA512

            a8d2baf03d85e31847b21ee5c193d11e2f7ccd9ed7630feab3c8e4fe780bc62d1847ff4608654b3201fa6c39175c7d6e650163d9347db40454935856af3f7af7

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page3.css

            Filesize

            1KB

            MD5

            07784ad77f30fa018949e412b2257aab

            SHA1

            8595c222a3741bfa83c5a4d982c845c8038062a6

            SHA256

            226a67f6e05fd889f91253158e583c443cbc7c27d29e8b441925849f820565cf

            SHA512

            2fe022c30d9280f224ca159edf485ca7ba870bd32b7fb82ee86b3657cdd2e9bdf52525408566ec3ecff80660390f8fac8f04b166623082c706213597f1178cf8

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page3.html

            Filesize

            1KB

            MD5

            b23c25988099403433efb7fb64715676

            SHA1

            e833527e1c021b311286e6e2d1c2f0530be0a565

            SHA256

            7f2252432fff22505b6fbcce5077a9f455006f724dfa705fbc0540325a14c28c

            SHA512

            8f721e25e47fc5508a0ae1d887a556c22b64b9eb4d2a7ad019b0ddbe4c91649ca52c4582e3cf99338f4b779bd50832110054c46e9bf9f2ffc9a4469343f6838f

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\page3Lrg.css

            Filesize

            977B

            MD5

            b3520c555c46a7020d8f27bfe81df0ca

            SHA1

            59398086abe3987c2a91edacb74eca94bbd63d7d

            SHA256

            74a9e635dc555a07820a288d0dfe05adea386292757f4cd6933ba3ce6697bef6

            SHA512

            0b3243cd84b44be79cc7d45a1e18d9840cb393aaf0b82229a0e5a4378d4588c1d65f1ba80530fa10659777fa6ca7b45785fe4fd4aff8dc6047956f93299c5ca5

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\progress.png

            Filesize

            2KB

            MD5

            dee08d8cbcdeb8013adf28ecf150aaf3

            SHA1

            c61cd9b1bd0127244b9d311f493fc514aa5c08d6

            SHA256

            eb7dbbb4b7f4020a91f5b64084fb3ce08aeac2f72be66959332041ed06b59bf5

            SHA512

            c7ff9e00e5afd3b14947006127c912a3c0e7e7fbdde558f5575e6499deb27eb39199206497bfa4372ce469a0fac64df03ec165c0565a619774531c7311d3223f

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\setup.js

            Filesize

            13KB

            MD5

            a95607ce49fa0af8ed7a3f5667c3eb31

            SHA1

            5e4b5a30e56c42329afdf216625bf35be69a82aa

            SHA256

            01d6d025c169e9c36600d097749f76f8e877846cd8733b7dd958aaea7c54884c

            SHA512

            1f1fe95c04964de2f3fd73a7ba1632fecaf1c9ec80f918859eb91702e10333f1ba0342a85d1129ddb48cbc3ab74a5dcf92f8c4c053f683ecdbf34dee0112015b

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\title.png

            Filesize

            25KB

            MD5

            12ef76069cc40b8ad478d9091915ded6

            SHA1

            fabad560b6e6839f9e5ae1268695d11ca35f9d74

            SHA256

            4be568ed2044e1b74bc1d61d13ce71080e5a9717ed481616a6efc1ec4c35dd0c

            SHA512

            5625082a87aa75266c9680a4f4b31eb7b1df084bba6c7e2e70512f232556f9029af06a0a63b342ffc220bf3797cc09f333437fe26547ea6494913f1c59b2e067

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\HtmlScreens\toolBar.jpg

            Filesize

            19KB

            MD5

            56dc3cb42b46309e642c15167003685d

            SHA1

            045749de2c1492e5dfc4c44f9eb6c0feefe06b3d

            SHA256

            bc488502223b3369dd657e8bac70abc42ffde2223a0661fb507c8ec87778bca1

            SHA512

            5f3dc868d6e128407e071d6d7d7b9d0bbe7e45a32ff76985dfa53fe9dad0f5fb372ce64d35170c3719a06dd6762e4bb33089bfaedf93e6064c06c74a21b65a60

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Latest\kstp.txt

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Latest\setup.exe

            Filesize

            8KB

            MD5

            5790a04f78c61c3caea7ddd6f01829d2

            SHA1

            9d783d964338a5378280dd3c3b72519d11f73ffa

            SHA256

            726b0e7e515f7bd62c912b094fa95c7c2285a44e03d264f5dd9e70729c0e9606

            SHA512

            9134fc02095e313fcb528fa32c8534929fddfb7b7b139a829f2b3eb32cd4c606f6d2ec6dff57a890ea250ce1430eb272461accfe05164bd4cfa496c0a1474ad0

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Setup.exe

            Filesize

            121KB

            MD5

            dae6a256aa35b00ecf7b441901955d6f

            SHA1

            d2fc2901ebc7e3e1a632b34b422950ef0318e619

            SHA256

            46e7c4b89cc46a2d51c089b53f2ec81e0b1f5950f4b02caf27374b680f65547c

            SHA512

            3e2a29f2ee4461e0cb3fee3121af3dc73f04ec6a6804294bc50d9e875061fd5175827cceca6b6d6e3b1ba817d714a762ecd88e717f908d682b98dc2a8a6993fe

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Setup.exe

            Filesize

            40KB

            MD5

            dd24d4dae1a54c6a6ce24af25e6afe5c

            SHA1

            29710abfcfdf182147c72a81cfb5ce9b8079dd48

            SHA256

            9464e4edfcc4570548f4e45d82dc8ca3072fcfb30b22b202faa4b1ba9599dd2c

            SHA512

            883398ba6e4ea28da60765c10c13fcd146a48cf77b0f21cd20fd65d04e89b97ed5b5a4c13204d716d484b7ebee929902350ed15235c2ac22db1da504a2252ceb

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\SetupStrings.dat

            Filesize

            57KB

            MD5

            5d3de731e33166ed6264a656fc349f41

            SHA1

            6700a590681dab36af2253356f6e0bce39f6f689

            SHA256

            708807c7c0d63153f4f38d33ca24f8a5af381ea585926a51d40c501ae18195ba

            SHA512

            413d45b4601f5618270153b550255b536d37937cd61f7fafc31ac05360098ed3eaac1f167855164bc9bfe222cb1cb9adb6758db0e390f03e80de35575bd05c45

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\bab033.tbinst.dat

            Filesize

            236B

            MD5

            1ee8c638e49ee7137607722768afc5a2

            SHA1

            8719d7a498a49b042cd6fc411cac6c44f3c0f43a

            SHA256

            1368324e8df1654fb9c3bcae320e982ff9f40e76e0cc118d5f507649e1ec2f2e

            SHA512

            2acb5547bb9b62505a5332e3b2752c5004fee9579bc45c46271e53d42fff5f412f3a18863ed382052d961d33d0e0449d9c111950060663660d7dbb21e9bff575

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\bab091.norecovericon.dat

            Filesize

            174B

            MD5

            4f6e1fdbef102cdbd379fdac550b9f48

            SHA1

            5da6ee5b88a4040c80e5269e0cd2b0880b20659c

            SHA256

            e58ea352c050e6353fb5b4fa32a97800298c1603489d3b47794509af6c89ec4c

            SHA512

            54efc9bde44f332932a97396e59eca5b6ea1ac72f929ccffa1bdab96dc3ae8d61e126adbd26d12d0bc83141cee03b24ad2bada411230c4708b7a9ae9c60aecbe

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\sign

            Filesize

            80KB

            MD5

            73dbc500e121b83ec57bb2563203259a

            SHA1

            658adac13fc362f5292cbbda19ade1d228ff7901

            SHA256

            9fb7ed24ed57aebd1314119ad70fee1d74c614bfd3c8fcc85716797803de8878

            SHA512

            c5fd20a4d90f16c147e02afc82b477054b3bfa8d321017f32f99606febc076bed86b249f372779c3582f8a3de859b8d3998b0bdbc873953d9e5e15b552fafc2f

          • C:\Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\sqlite3.dll

            Filesize

            508KB

            MD5

            0f66e8e2340569fb17e774dac2010e31

            SHA1

            406bb6854e7384ff77c0b847bf2f24f3315874a3

            SHA256

            de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

            SHA512

            39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

          • C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe

            Filesize

            576KB

            MD5

            f85dccb8419cff0b1aba6766ce30908e

            SHA1

            f6a8093fbc4b8bd0d083cad7f62ca2730f0a7223

            SHA256

            c94b66ac8e131b3e5bb3a3d49d9970e8fcf8d3198111e9918d71d79005ab6278

            SHA512

            8d328ae66b648516b942ce3b4287373b3bf9f3cf10a881fdcd6d6793b828afa70f20e831cbf0cdc9b13c283b6bd9a8c9dd406f6e6595afbc9fdc967188dfae15

          • C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe

            Filesize

            757KB

            MD5

            7448d4c08bd4c99223c2cbf7b9bf4bf1

            SHA1

            50ca175673406b5ed92a481a42a86dcd23e536a7

            SHA256

            55f3ac154b593739b58feb7e3fa00bdf09bac024242c4a0db1497d8adab8efee

            SHA512

            03cd9689150d3a05a5f6fc70b983d65251d4b5dbe7eef9113fc785c9da32e5ca2759eaf11a58ce84095cafa8c411da43d68fd52fcf0451ba00ebe64af938f8be

          • C:\Users\Admin\AppData\Local\Temp\MyBabylonTB.exe

            Filesize

            567KB

            MD5

            281d8d0ec028494b3957c811b520346b

            SHA1

            70f3484ef45911364987476d155e99161837f4fd

            SHA256

            fbcbd8f54af237ae83b17a6bf94c24b48566b508a2c34fae899b97cb7a87b6d7

            SHA512

            1145f19192a722e758aa5be418ff3f1f1cbe02d2f2ad58302668b823186c7cbc54dfae231ad12f589009817f18c1981440d4197ea0d64851948ef8c982583d11

          • C:\Users\Admin\AppData\Local\Temp\Tar18D3.tmp

            Filesize

            171KB

            MD5

            9c0c641c06238516f27941aa1166d427

            SHA1

            64cd549fb8cf014fcd9312aa7a5b023847b6c977

            SHA256

            4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

            SHA512

            936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          • C:\Users\Admin\AppData\Local\Temp\nsy91C5.tmp\SimpleFC.dll

            Filesize

            175KB

            MD5

            d38543fc9ae37d188a23e06ee11d3504

            SHA1

            174fe778f66db4a527fddf21b1c23e1bc1ceceeb

            SHA256

            72f33da081b8d579f437e7aa2ba8d9cb9602270b88093ff9411ac6316b52fc6e

            SHA512

            43d1874e5821d8e5530eaa34d42b76aa867528368779fadcfd2691825297accf04e94bd34867442a76c25d4729edefba9469de6500acfe6f665949f11878c54b

          • \Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\Setup.exe

            Filesize

            341KB

            MD5

            6726f1b70b05b9a3b5a7c065ab867ca7

            SHA1

            6bea2739c4300403bc222a19688a1e23aeaf9c2b

            SHA256

            bed25af8f29da45dd19d2325120e147ea51d171cc9bdd8be9ee3a2b60f468024

            SHA512

            8286dd994a4a4a6665817a0d38ebdbdc33066a0746c176a0ffacbd05b0656577a002d239bd2617318fbb6838dfeb34d3797e528b6b257aace032f47bb208a373

          • \Users\Admin\AppData\Local\Temp\FCB5252E-BAB0-7891-915F-27B480368D5C\sqlite3.dll

            Filesize

            311KB

            MD5

            e3ab2b43fde5659ffc79629456e5d84a

            SHA1

            c1e5beb8e0a0eb010fb9921268299372d661603d

            SHA256

            653ffd8650a89ed0e18c342780f7cd787b3fd95aa158cd9104c7730de1c56e2d

            SHA512

            53f2c5552a62a5a7a9b7c092dfe7174c85b4a808cdd7346415e727e52cc961aef47d746af9e816ff788569c2506dd6be553003671ab145708af1751a7cfefb3d

          • \Users\Admin\AppData\Local\Temp\FCB525~1\IECOOK~1.DLL

            Filesize

            5KB

            MD5

            5a27c8702510d0b6c698163053fde6d1

            SHA1

            69fdc602a51e52c603f23a80e9b087c262dce940

            SHA256

            ccba25e2b6462f5f5646ab9c2e1f63a941b1ab7911d3e0a32a29ebb65cbda437

            SHA512

            ecf38339ff38b601509a1f5aee16cd0ee7c70662940a81f45e18f91581a8b2964129603b47606f762b371245b039d4faa91b30cff125d46d32253a0e88401e51

          • \Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe

            Filesize

            703KB

            MD5

            d460be51bcb9099c13c3e619f3ccfa5e

            SHA1

            c0e347f72e8b96318237bc38d1e19e8a6acce707

            SHA256

            6445d8b3319da492e8f5a5979f5ba449c4dab9ebc607049961e4ce563702e4e4

            SHA512

            cc1f91abfbf582e95464248ae6ee5b0f63d542b54914ee6472d325fc7cec8b17e0a57ae81aef7a77e4747a3603e2a3d9a366acb8864834f22206d0636f3a6654

          • \Users\Admin\AppData\Local\Temp\MyBabylonTB.exe

            Filesize

            845KB

            MD5

            3d91ecdbb3404485702fb92b26b17d90

            SHA1

            5dfc514a7a1e037683fed57029f49fa6c6f04dbf

            SHA256

            588b7896a3712043efd9789e8bd2de35d2bcc082344f2d2cb7a90cfadc66b6d9

            SHA512

            1cc40cfa7328eb251f9cc5bc4c5ba695e213c8efda94e8ef23cfc7786a561c8298c05b39fbbbcfccc90eaf3a18090f1d6fd4ecc405795565fdb8790c9b2093d3

          • \Users\Admin\AppData\Local\Temp\SetupAuto.exe

            Filesize

            512KB

            MD5

            ff0198fd1f59b71c1deec34b6b0b0c07

            SHA1

            cae622ad91a3bab0996589e3bf905c9d4eeb6059

            SHA256

            f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5

            SHA512

            96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc

          • \Users\Admin\AppData\Local\Temp\SetupUpdater.exe

            Filesize

            260KB

            MD5

            2fef4da41b5f58e66d6de6b318bf3004

            SHA1

            66ef30ff290e8615cad27abb884cc8a2d250c3e7

            SHA256

            7c8472e322a87d039c22e8f48ab55107508898102b17a011222b2b0da9df4790

            SHA512

            8e6ee8e5660a10f227a9690822f278f393e865665c6d63d0a625241d58c6d48292964c3a30b594afca775de75d06604742925cb4fc42fd18c0cd14dd46cc9f1e

          • \Users\Admin\AppData\Local\Temp\nsi1391.tmp\NSISdl.dll

            Filesize

            14KB

            MD5

            a5f8399a743ab7f9c88c645c35b1ebb5

            SHA1

            168f3c158913b0367bf79fa413357fbe97018191

            SHA256

            dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

            SHA512

            824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

          • \Users\Admin\AppData\Local\Temp\nsi1391.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • \Users\Admin\AppData\Roaming\2YourFace\Updater.exe

            Filesize

            219KB

            MD5

            61a75fa584626ad7236a5e0ecf0ce806

            SHA1

            28b1b5548e12d56773d3fcdf252617e94f07da96

            SHA256

            b7c83ce96df6a282fa18e8551d5c6de87a08f4e256ad0e1105069155138ed5a2

            SHA512

            2f38d0d06ddcd4d4506623120902a194f33f84e87a6260d08e55a2658e40edf959d0fc83c37561db7002b3e43a569fd2bcc3b70328ab37efe39b9b9b8d2cc4d8

          • memory/632-197-0x0000000000280000-0x0000000000282000-memory.dmp

            Filesize

            8KB

          • memory/836-266-0x00000000029B0000-0x00000000029E0000-memory.dmp

            Filesize

            192KB

          • memory/2552-51-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2660-199-0x0000000060900000-0x0000000060970000-memory.dmp

            Filesize

            448KB

          • memory/2660-192-0x0000000003170000-0x0000000003172000-memory.dmp

            Filesize

            8KB

          • memory/2716-50-0x0000000002070000-0x0000000002072000-memory.dmp

            Filesize

            8KB