25f16d3c5b878ced64d79edf91c29908f9110276162894228a1662f1060e3db8

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Size 3.5MB
Sample261014-nd2qlafg69
SHA256 25f16d3c5b878ced64d79edf91c29908f9110276162894228a1662f1060e3db8
MD5 32b14bbc1c47b9bdf4d96cfafff73830
SHA1 91688bc6015a49d67f9f49f64e597e2301349363
SHA512 ed5b683042a9d13f5ab916130824145e8f066677785e2026dca6b6a373d14fb326cd2b005cfcfdddf5bc7c47198de91d5826e9a5cbd6055c7934c0ddacf8749f
SSDEEP 98304:FB1C+q8FFwpeEk2wCOwh2YhsglD/Szqi6GlNCME:5Ma1Ek2Zh2Y//86GDE
TLSH
T1EC0633037088C2EDD4758635FC6388AB05EA6558ED356AEB7B786F71222E1D378331C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YourFace_Updater.lnk	SetupUpdater.exe

Executes dropped EXE 10 IoCs

pid	Process
5864	FileHunter.exe
4448	updater.exe
2680	bundle.exe
2848	MyBabylonTB.exe
4460	pumpa.exe
5568	updater.exe
4440	Setup.exe
3948	MainInstallerAutoEmbedded.exe
2992	SetupAuto.exe
5336	SetupUpdater.exe

Loads dropped DLL 26 IoCs

pid	Process
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
2680	bundle.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
2292	rundll32.exe
4440	Setup.exe
2468	rundll32.exe
2680	bundle.exe
2680	bundle.exe
3948	MainInstallerAutoEmbedded.exe
2992	SetupAuto.exe
5336	SetupUpdater.exe
5336	SetupUpdater.exe
5336	SetupUpdater.exe
3948	MainInstallerAutoEmbedded.exe
3948	MainInstallerAutoEmbedded.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompuCare Check for updates = "C:\\Users\\Admin\\AppData\\Roaming\\SuperPump\\updater.exe"	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "C:\\Users\\Admin\\AppData\\Roaming\\2YourFace\\bho.dll"	SetupAuto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\NoExplorer = "1"	SetupAuto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FileHunter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FileHunter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bundle.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bundle.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MainInstallerAutoEmbedded.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MainInstallerAutoEmbedded.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileHunter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pumpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyBabylonTB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MainInstallerAutoEmbedded.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupUpdater.exe

NSIS installer 8 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c4e2-57.dat	nsis_installer_1
behavioral2/files/0x000d00000001c4e2-57.dat	nsis_installer_2
behavioral2/files/0x000d00000001c4f3-189.dat	nsis_installer_1
behavioral2/files/0x000d00000001c4f3-189.dat	nsis_installer_2
behavioral2/files/0x000400000001bc03-199.dat	nsis_installer_1
behavioral2/files/0x000400000001bc03-199.dat	nsis_installer_2
behavioral2/files/0x001200000001c526-219.dat	nsis_installer_1
behavioral2/files/0x001200000001c526-219.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IECookies = "\|affilID=\|trkInfo=\|visitorID=\|URI="	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\URL = "http://search.babylon.com/?q={searchTerms}&affID=112042&babsrc=SP_ss&mntrId=9366c3ec0000000000006ab3bf6be046"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IECookies = "\|affilID=112042\|trkInfo=\|visitorID="	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF6FE19C-C35B-456A-83EF-0ACCBC14F55D}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\2YourFace"	SetupUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF6FE19C-C35B-456A-83EF-0ACCBC14F55D}\AppName = "Updater.exe"	SetupUpdater.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\DisplayName = "Search the web (Babylon)"	Setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF6FE19C-C35B-456A-83EF-0ACCBC14F55D}	SetupUpdater.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF6FE19C-C35B-456A-83EF-0ACCBC14F55D}\Policy = "3"	SetupUpdater.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://search.babylon.com/?affID=112042&babsrc=HP_ss&mntrId=9366c3ec0000000000006ab3bf6be046"	Setup.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Test.cap	Setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TEST.CAP	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Prod.cap	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "2YourFace Addon"	SetupAuto.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ThreadingModel = "Apartment"	SetupAuto.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Prod.cap\Info = 433f39789c636262604903622146b36a23174b23330353035d47334b275d136757135d471747635d230b233367271347732757935a060101019e658b3d011dbb0b7d	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\2YourFace\\bho.dll"	SetupAuto.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
4440	Setup.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe
5864	FileHunter.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4440	Setup.exe
Token: SeTakeOwnershipPrivilege	4440	Setup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
5864	FileHunter.exe
5864	FileHunter.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 5864	3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe	91
PID 3584 wrote to memory of 4448	3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe	92
PID 3584 wrote to memory of 2680	3584	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe	93
PID 2680 wrote to memory of 2848	2680	bundle.exe	95
PID 5864 wrote to memory of 4460	5864	FileHunter.exe	97
PID 2848 wrote to memory of 4440	2848	MyBabylonTB.exe	99
PID 2680 wrote to memory of 3948	2680	bundle.exe	104
PID 3948 wrote to memory of 2992	3948	MainInstallerAutoEmbedded.exe	105
PID 3948 wrote to memory of 5336	3948	MainInstallerAutoEmbedded.exe	106

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Roaming\SuperPump\FileHunter.exe
  "C:\Users\Admin\AppData\Roaming\SuperPump\FileHunter.exe" "beyblade.mei.mei.porn_[Trusted Download]"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Users\Admin\AppData\Roaming\SuperPump\pumpa.exe
    "C:\Users\Admin\AppData\Roaming\SuperPump\pumpa.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4460
- C:\Users\Admin\AppData\Roaming\SuperPump\updater.exe
  "C:\Users\Admin\AppData\Roaming\SuperPump\updater.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\nsy2222.tmp\bundle.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy2222.tmp\bundle.exe" /TOOLBAR=1 /2YOURFACE=1 /HOMEPAGE=1 /SEARCH=1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\MyBabylonTB.exe
    C:\Users\Admin\AppData\Local\Temp\\MyBabylonTB.exe /aflt=babsst /babTrack="affID=112042" /srcExt=ss /instlRef=sst /S /mhp /mnt /mds
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\Setup.exe" /aflt=babsst /babTrack="affID=112042" /srcExt=ss /instlRef=sst /S /mhp /mnt /mds
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4440
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\639FFE~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache URI|http://babylon.com
        5⤵
        Loads dropped DLL
        Checks whether UAC is enabled
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2292
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\639FFE~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache trkInfo|http://babylon.com
        5⤵
        Loads dropped DLL
        Checks whether UAC is enabled
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2468
- - C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe
    C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe /PID=104 /SUB= /NOTIFY=0 /FFP=0 /SILENT=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
      C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe /PID=104 /NOTIFY=0 /FFR=1 /FFP=0 /S
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\SetupUpdater.exe
      C:\Users\Admin\AppData\Local\Temp\SetupUpdater.exe /S
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:5336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1968

C:\Users\Admin\AppData\Roaming\SuperPump\updater.exe
C:\Users\Admin\AppData\Roaming\SuperPump\updater.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BExternal.dll

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\BExternal.dll
Size 126KB
SHA256 fcee9d5c80b11b82add301e142dea2b40b05f0839ef7cd0a8b0fff84a67eccd0
MD5 743acbf54eb091066be6ab3cb12c5988
SHA1 43a205985790c47a7e611fa2d3cab9b4eb59121f
SHA512 014cf6b9896a2f76b8d110bce862c46a56471ae74582cbae7af672af49ae052d7827fc28806dbe80c911d05c4688d7e08ef486bc7d7acc2b05fa7b2b3f2a3689
SSDEEP 1536:ipquadh0SvYmLlegRTgcRigdn32EFt6vKGNUvMGcBpYyEPf1cM5KMn+WCb4:ipquG6CNTydq2EFtekcvQF5KM+W3
TLSH
T1A3C35B117491C036E56B087E897EC62D5A2E7C308FA449C77BC806AE4EB66D2EF31747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BabyTBConf.ini

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\BabyTBConf.ini
Size 578B
SHA256 fd4e1415e5e901d3452dde75bc4aa3174a45d9d501b1a6970745900d15f44404
MD5 b7f84726b65befbe897568e73b9e07a0
SHA1 407a1facd276b8a200cc266020dc24f89bf953a6
SHA512 ae86d95e583bc3ea110d31bdb59276d75d2944ee22fa7b975710ac1cd0a0e233aa7b8e38f269f286c50d6c0c3a51d4e166c836c8c73d6af991afc3ef0aac1367
TLSH
T109F06DAF786D62AEF4B5D6B1A0E9B0D0D290B686DAE8A86C80C675247045D72390331C
MD5 SHA1 SHA512 TLSH

Submit Download

Babylon.dat

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\Babylon.dat
Size 12KB
SHA256 7029ed42440ab0b23c76c2800871002151776f927cc77855590e79b31b96838c
MD5 adbb6a655ae518830ba1afefdb84668f
SHA1 a1be53d99a67fff011ea035c310588e635c718e1
SHA512 b5ddfa301fdcd852a35c6b8a5d4eed78c43bc250d7e2c7d95b548d5f5ce216f2b9f5eabf5e1c0c87691d735fc1ac7a33a5c236c5560a4777ef7bf75510f0b228
SSDEEP 192:IDqG5umjGVILJ7hzEJboFI1BI1x7RQ1EGqoEie/XeS8k0oP0dNdNhkAU0RSB2rBe:fG8m3JyJb71C1x7RQqu+0RSll
TLSH
T15B427347ABE021C0E61F6B0FE0F86987DC2678E7778AD8C98DBD3F6414B5B012B26514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blueStar.png

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\blueStar.png
Size 14KB
SHA256 008aebc73a7bd79e914db753b83a385c1aac320ebbcf4ead8fa49f74e3f30f22
MD5 a7fcdf142648bac756fcfe06a31f42e4
SHA1 4df99b119c183c821ed1bf0f825536318c9c3353
SHA512 ddd8571b02909ede720af8e27044e126002a749719f41fe65d44004a5165ebfd90e5cca007e6014194de510a0076862839ecd056bf0043113337ab25086037eb
SSDEEP 384:zJXE050VuGbvjS42rJemPNStj1ulEMWr/5ehSN1/IqCme7YB:R350YGbvUrJ8tpulEbMhSN1InxMB
TLSH
T1E162C0F2F104911B7F5EFE424CC19329980F841DCEAE765ADAC04AF924D1D76AE35863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eula.html

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\eula.html
Size 79KB
SHA256 f7f4148b58242a889a8694d734e49ca96bdad63d7fa5d5be130acfa9414b5cb5
MD5 1b73a781f7f5b0d61624bd97050a2ed0
SHA1 01b848625761d5dede115e8599e4c72f126f8a3c
SHA512 76eb4cd01eae14b0050802ad4cd0e401e2e65705d4d4b8c25e3632bd24745ec85df129c51332500823953755314a51907f0a713d0c2011054490acebc9c2787f
SSDEEP 1536:nStK805SVSAWxAskeTWAz2Tkk/IfjfXUOh+dNNTTdK+pX4rpBsnPi/oWXWNe:FSVSAuHGLNTTA+eHGi/7mw
TLSH
T12F83F9A7F34413B2D5C7076276AAAAD4F32D802C3B375958286D901E23D6F68437F399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globe.png

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\globe.png
Size 33KB
SHA256 3eca21891a2b484a38098410c5d8410361e91ae4dd84cb565891281145501f42
MD5 cc53fb9e9456eb79479151090cb16cbd
SHA1 e61004bf729757f3f225f77f0236b82518f68662
SHA512 0aac27727044ef9cf05e7a8d35d4395c9812a9169fd1661f95f53a2d809a7a73a034058b8080529ab50471688877cfdb45a282308ef86eb4812a2d734e02d28b
SSDEEP 768:F35NZLZpn6oGsqxyU71U/Oa7+TqxuNKUX5ew/7qcVm:HFRURaOa7++4NDeomcVm
TLSH
T195F2E0656C3A016CFCF571B5ED5D5E0F4664C13FBA320628EA962EC9026B947830EA3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.js

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\options.js
Size 119B
SHA256 92db8b549583a5498689a42840a282f33d734c3cb081ac6f896377e56d043252
MD5 771f230f8bbc96a03b13976667918f1f
SHA1 0fba422c76b89cdb5d12e657064c49a9b1b7abae
SHA512 b8209b679f30fea49ea34b77b7f4126acef962a17b292cbab711660c7ec23646bab91e66ce49fde6570ee3c053bb6b8d521b6917cb16f3e925ce8f82d7b4c8f4
TLSH
T1D7B092C941EA1101D2631AA0760E2262223509228A0A8AA4458D87C13B9A8276342E7C
MD5 SHA1 SHA512 TLSH

Submit Download

pBar.gif

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\pBar.gif
Size 3KB
SHA256 e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3
MD5 26621cb27bbc94f6bab3561791ac013b
SHA1 4010a489350cf59fd8f36f8e59b53e724c49cc5b
SHA512 9a19e8f233113519b22d9f3b205f2a3c1b59669a0431a5c3ef6d7ed66882b93c8582f3baa13df4647bcc265d19f7c6543758623044315105479d2533b11f92c6
TLSH
T1D361D70BE711B1E3F39B81302DBE15881BA7A6F9C5793B011286695F78437A1274FB89
MD5 SHA1 SHA512 TLSH

Submit Download

page0.html

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page0.html
Size 1KB
SHA256 783a0e39d4a751462e26e4acfcf6fb4953f818980ad3d7d7fb821ac35c00c29f
MD5 cf33120dd42cee842d96532843bb1961
SHA1 1db4f3e0aa1e4036a078a05f48fefdbb8744e3cf
SHA512 889d4043672b551a08979054add55bca4c5a4438fef5189b1ecf309c803ff1468664ed1123b0d22ceecb21a7bc5cfbf85a7428ed72ad7be04596185432aa68e3
TLSH
T1F231030D5C869040C0B22375E9F2C60DEA6696134341C95839CCD9D3AFB9A68DE63EDC
MD5 SHA1 SHA512 TLSH

Submit Download

page2.css

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page2.css
Size 2KB
SHA256 9ca3bd0f0c3ac1533fcda2e20e2fb3c18deb40986b37ae6edff594becb82405d
MD5 085cf46c4d1c8dea9edd79ee37d6d5bd
SHA1 30cb66994c45261a4aaa6d9ecdf1b1890ed09b45
SHA512 66ea917206a7e771e48e3734004e6b96619c5534cca35c2e59e7c2922bec7dca5fbb6536e8940013871becce7493b0e2b1844cc5f37668396639c6d7c7e321a9
TLSH
T15B515A25FB00210BB077A335EBB21246F637442B5382467EBFACB640CF781595565FD8
MD5 SHA1 SHA512 TLSH

Submit Download

page2.html

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page2.html
Size 3KB
SHA256 abb8953ffc3818e54e86019e1920595d65ba0997f3fd7fd47480a450cd7ee485
MD5 12152ded3604e8baaf82c078f8034d60
SHA1 0867dec241a257e3e9ad9e8d20b9e06e3bce7184
SHA512 a38ed7d7ef0be98ef362b4f5345961ac56f2db9e184b8a405dd3b09611796fda2189837a3bc0c27152276225a2fd4c8bfe8324c70df0d67b9cc826212448e79b
TLSH
T12D81FE300ED99800C27280A499F56B92ECA5930B4B515E5872ED27D33FB7D089E4F678
MD5 SHA1 SHA512 TLSH

Submit Download

page2Lrg.css

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page2Lrg.css
Size 1KB
SHA256 5d7bd6b3acb31788f12475528d51d98778f1dbc940b2d6dc6317704d17d0964d
MD5 db15b568f9d195635b3fcab87ef6293f
SHA1 6ae0f374531cb3013857880e8469a103492b8393
SHA512 a8d2baf03d85e31847b21ee5c193d11e2f7ccd9ed7630feab3c8e4fe780bc62d1847ff4608654b3201fa6c39175c7d6e650163d9347db40454935856af3f7af7
TLSH
T18D41AB99DF90A015E377E465BBF98340F72604475B028A6ABAB87384CF7809D6562EC8
MD5 SHA1 SHA512 TLSH

Submit Download

page3.css

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page3.css
Size 1KB
SHA256 226a67f6e05fd889f91253158e583c443cbc7c27d29e8b441925849f820565cf
MD5 07784ad77f30fa018949e412b2257aab
SHA1 8595c222a3741bfa83c5a4d982c845c8038062a6
SHA512 2fe022c30d9280f224ca159edf485ca7ba870bd32b7fb82ee86b3657cdd2e9bdf52525408566ec3ecff80660390f8fac8f04b166623082c706213597f1178cf8
TLSH
T1FF11DD66CDA2A049A233955AB7F24E0C692A008F870B0B38B5B07568C7D549D35315C4
MD5 SHA1 SHA512 TLSH

Submit Download

page3.html

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page3.html
Size 1KB
SHA256 7f2252432fff22505b6fbcce5077a9f455006f724dfa705fbc0540325a14c28c
MD5 b23c25988099403433efb7fb64715676
SHA1 e833527e1c021b311286e6e2d1c2f0530be0a565
SHA512 8f721e25e47fc5508a0ae1d887a556c22b64b9eb4d2a7ad019b0ddbe4c91649ca52c4582e3cf99338f4b779bd50832110054c46e9bf9f2ffc9a4469343f6838f
TLSH
T19031AC144487841180B39691BAF79B4AFE92824343428A543ADC77C3BFF796DCF47AA9
MD5 SHA1 SHA512 TLSH

Submit Download

page3Lrg.css

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\page3Lrg.css
Size 977B
SHA256 74a9e635dc555a07820a288d0dfe05adea386292757f4cd6933ba3ce6697bef6
MD5 b3520c555c46a7020d8f27bfe81df0ca
SHA1 59398086abe3987c2a91edacb74eca94bbd63d7d
SHA512 0b3243cd84b44be79cc7d45a1e18d9840cb393aaf0b82229a0e5a4378d4588c1d65f1ba80530fa10659777fa6ca7b45785fe4fd4aff8dc6047956f93299c5ca5
TLSH
T102111465CEEAA04EF3339657A3774E4C9D3A0046B707073CB9F83560D38549D24311C5
MD5 SHA1 SHA512 TLSH

Submit Download

progress.png

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\progress.png
Size 2KB
SHA256 eb7dbbb4b7f4020a91f5b64084fb3ce08aeac2f72be66959332041ed06b59bf5
MD5 dee08d8cbcdeb8013adf28ecf150aaf3
SHA1 c61cd9b1bd0127244b9d311f493fc514aa5c08d6
SHA512 c7ff9e00e5afd3b14947006127c912a3c0e7e7fbdde558f5575e6499deb27eb39199206497bfa4372ce469a0fac64df03ec165c0565a619774531c7311d3223f
TLSH
T13E51AEAFCD30604FB8AE3C420DDC4202E77C227C8A5B3738A8C235CE5095E036B62071
MD5 SHA1 SHA512 TLSH

Submit Download

setup.js

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\setup.js
Size 13KB
SHA256 01d6d025c169e9c36600d097749f76f8e877846cd8733b7dd958aaea7c54884c
MD5 a95607ce49fa0af8ed7a3f5667c3eb31
SHA1 5e4b5a30e56c42329afdf216625bf35be69a82aa
SHA512 1f1fe95c04964de2f3fd73a7ba1632fecaf1c9ec80f918859eb91702e10333f1ba0342a85d1129ddb48cbc3ab74a5dcf92f8c4c053f683ecdbf34dee0112015b
SSDEEP 192:3RROrafaiapTmZAKWgGDko9MabtX44fQVJ8PDcuphnMx7plvJweWva71iwi0:3HKKagGDAaJXmyQu3nMgJa71iwi0
TLSH
T1D8522E98624B1552567733788F6F920CFB7184274946825ABC9CF4D42FB0938D2BAEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

title.png

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\title.png
Size 25KB
SHA256 4be568ed2044e1b74bc1d61d13ce71080e5a9717ed481616a6efc1ec4c35dd0c
MD5 12ef76069cc40b8ad478d9091915ded6
SHA1 fabad560b6e6839f9e5ae1268695d11ca35f9d74
SHA512 5625082a87aa75266c9680a4f4b31eb7b1df084bba6c7e2e70512f232556f9029af06a0a63b342ffc220bf3797cc09f333437fe26547ea6494913f1c59b2e067
SSDEEP 768:K35B8qDoa0mq6RGWU/RLVVNuzIxdnsjPTM2OdF52jmuD:rsF0mq6R376dcsd7uD
TLSH
T1B2C2D1436D37D12DF64CDE010FAE1156AB7C21242FAE3B5546DB58EB608807E5E92CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolBar.jpg

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\HtmlScreens\toolBar.jpg
Size 19KB
SHA256 bc488502223b3369dd657e8bac70abc42ffde2223a0661fb507c8ec87778bca1
MD5 56dc3cb42b46309e642c15167003685d
SHA1 045749de2c1492e5dfc4c44f9eb6c0feefe06b3d
SHA512 5f3dc868d6e128407e071d6d7d7b9d0bbe7e45a32ff76985dfa53fe9dad0f5fb372ce64d35170c3719a06dd6762e4bb33089bfaedf93e6064c06c74a21b65a60
SSDEEP 384:aaKcRQnEF4TYNg7N0UVsUBjj/iOIWlZ8knwH:aapQEMYyR0UVF/vrlZ8ko
TLSH
T152928D26BB928D39EFD1D2B491E1E7D2A2B27D61AFE375C5B81D7D403B316C0098D205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\Setup.exe
Size 1.7MB
SHA256 6e7425ace83127aa18a94927144f3d97870f7395606285606635c3ae591f1b52
MD5 14c2d4576d528ed76fada4f4fa1a5952
SHA1 3a9d7d4639b5eb8bec42df972c44493690eaadfc
SHA512 15c32a49946429e15ff8a8e4293d2ccccd160c43c24d3b6f9ccb0373f3dfb666e3c04c062feecc5dd6415f44c7230a09f0cc423aed601a121c2afec28d772558
SSDEEP 24576:O1BJJlQ7/R4mvj5eTSBAJLaKQE+Jpikhy8Hp2LYy5kA:oQ7WtjGblhhHELYAkA
TLSH
T11B852A00B642C139F5F315B18EBE816E6238BD505B6290CBB38C1A6E5DF1BE26D35763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupStrings.dat

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\SetupStrings.dat
Size 63KB
SHA256 31fdb44bc58ee37f01712c2e9b5f0f7c29058a6cd7f869df2f0ee6d77a552dc2
MD5 07bb1523dc51ec1fd5913b0a70ab98ee
SHA1 216f853cb251f32f5c91345404efd48f041ad5bd
SHA512 8ae9b6ca8a6e6f9692161422b5815944a7ef6e74ff51dbfd9a0dee83828b1140ce399fc40765313e6d2657603731bdd1c791b56df07fe42fb2d152b584d922db
SSDEEP 1536:vNaQXL26BOn4RboOcUMPFha4Q/7diCrpeRmR8:FaQXK6BUuP4PnivfK
TLSH
T1BA5302122C9C2E7A9248FAC3BACF8C77C97D537E17FBE53D89540590B88503595D2AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bab033.tbinst.dat

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\bab033.tbinst.dat
Size 236B
SHA256 1368324e8df1654fb9c3bcae320e982ff9f40e76e0cc118d5f507649e1ec2f2e
MD5 1ee8c638e49ee7137607722768afc5a2
SHA1 8719d7a498a49b042cd6fc411cac6c44f3c0f43a
SHA512 2acb5547bb9b62505a5332e3b2752c5004fee9579bc45c46271e53d42fff5f412f3a18863ed382052d961d33d0e0449d9c111950060663660d7dbb21e9bff575
TLSH
T146D09710B0F808F4D30B972838EC28C24A7DB302EF82094CA50033A24281E341758001
MD5 SHA1 SHA512 TLSH

Submit Download

bab091.norecovericon.dat

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\bab091.norecovericon.dat
Size 174B
SHA256 e58ea352c050e6353fb5b4fa32a97800298c1603489d3b47794509af6c89ec4c
MD5 4f6e1fdbef102cdbd379fdac550b9f48
SHA1 5da6ee5b88a4040c80e5269e0cd2b0880b20659c
SHA512 54efc9bde44f332932a97396e59eca5b6ea1ac72f929ccffa1bdab96dc3ae8d61e126adbd26d12d0bc83141cee03b24ad2bada411230c4708b7a9ae9c60aecbe
TLSH
T176C08040CA012675C102536494AD7CFF78E1FC5D1FC0D58E137152B04A6A54F7591161
MD5 SHA1 SHA512 TLSH

Submit Download

sign

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\sign
Size 80KB
SHA256 9fb7ed24ed57aebd1314119ad70fee1d74c614bfd3c8fcc85716797803de8878
MD5 73dbc500e121b83ec57bb2563203259a
SHA1 658adac13fc362f5292cbbda19ade1d228ff7901
SHA512 c5fd20a4d90f16c147e02afc82b477054b3bfa8d321017f32f99606febc076bed86b249f372779c3582f8a3de859b8d3998b0bdbc873953d9e5e15b552fafc2f
SSDEEP 96:od4dV5d7LzdgddFT9ZHt+Tfy06PY+CQZebcKd4dV5d7HdgdAeuKqIdE5/NBHsJ20:z+9ZHwa06Q+5p9JHQ
TLSH
T1A683758E6A08B401CBAECB3416E20EB3C47C597D0D94BBA554F5301C9FED851E23D976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\639FFECA-BAB0-7891-9A90-16E0BC35618D\sqlite3.dll
Size 508KB
SHA256 de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
MD5 0f66e8e2340569fb17e774dac2010e31
SHA1 406bb6854e7384ff77c0b847bf2f24f3315874a3
SHA512 39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
SSDEEP 6144:RgEF6lmEVKtkDCQ/kUrc7dBLhuKgrQCjBXPTnrKcCxcfKvrLJLqgx5YMk4HJ0yPF:GEEdkUrc7RuKcQCdGVtT0MkCwwV/Hn
TLSH
T100B45C53A452DC39E8D202B481720737966CDAA0DD63EB43A5D1F93B6EF35C1B62930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IECOOK~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\639FFE~1\IECOOK~1.DLL
Size 5KB
SHA256 ccba25e2b6462f5f5646ab9c2e1f63a941b1ab7911d3e0a32a29ebb65cbda437
MD5 5a27c8702510d0b6c698163053fde6d1
SHA1 69fdc602a51e52c603f23a80e9b087c262dce940
SHA512 ecf38339ff38b601509a1f5aee16cd0ee7c70662940a81f45e18f91581a8b2964129603b47606f762b371245b039d4faa91b30cff125d46d32253a0e88401e51
SSDEEP 48:q6GliEa/CNqt5kZqfBRR5I1kXB1X6cLsSStJvuHlDUlIvRCSCdCw:IoKMDksZRU1kR1Kc4SSLvuhUlI5Ct
TLSH
T1B5B19737BBD9C13BE0E015B256E61650217E7A22135140EF79876C1F0760EEBECBD212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MainInstallerAutoEmbedded.exe

Path C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe
Size 796KB
SHA256 e288d49f6011dcd3f893e54ceafda9b6b491543966521c483064a7df43e5bdd2
MD5 7fc6bc14a74dc69773587af10132d8c9
SHA1 9d98b268eaa7f4ad208bde39944fdb1ab201e076
SHA512 a738205fb26bf259e70b1cacfd10f9168d381778ef90a49847b8d332d93b471cbdcf6357a3d2dfb2e41a4666cba98dd9dc2867a20d472636e5fc8080cc073742
SSDEEP 24576:P7yrmq17YLUAl1+O50aT+1bXkS/EZQM7G7ZQ51bmtfWR163i95cVmB:jgbyLV1ILT/ES46S5Bmted6VmB
TLSH
T12D0523281AE288CBE9F663F07174B25DD1BAED04A71C291B8B542FD21F716878C07979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MyBabylonTB.exe

Path C:\Users\Admin\AppData\Local\Temp\MyBabylonTB.exe
Size 845KB
SHA256 588b7896a3712043efd9789e8bd2de35d2bcc082344f2d2cb7a90cfadc66b6d9
MD5 3d91ecdbb3404485702fb92b26b17d90
SHA1 5dfc514a7a1e037683fed57029f49fa6c6f04dbf
SHA512 1cc40cfa7328eb251f9cc5bc4c5ba695e213c8efda94e8ef23cfc7786a561c8298c05b39fbbbcfccc90eaf3a18090f1d6fd4ecc405795565fdb8790c9b2093d3
SSDEEP 24576:s5dJLagA9LRqvhD2LuD5zPI9xvnQwCb3D:F9cWu5w9OwS3D
TLSH
T1A70533CC2B1E9710CA7325702B68E7007AB56F703D63AA57FE81B72876397444F65A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupAuto.exe

Path C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
Size 512KB
SHA256 f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5
MD5 ff0198fd1f59b71c1deec34b6b0b0c07
SHA1 cae622ad91a3bab0996589e3bf905c9d4eeb6059
SHA512 96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc
SSDEEP 12288:Qnm2P17YuUAlhZk4ZN5lviET7MacVdekBCaeKOKEZQM7gM7ZQN:Qnh17YuUAlh+S5ZdT7sbekOKEZQM717M
TLSH
T199B423181BE1986BE9F722B0206567B9D3FFAE49521C19074B942FD11B228ABCC0797D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleFC.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6091.tmp\SimpleFC.dll
Size 175KB
SHA256 72f33da081b8d579f437e7aa2ba8d9cb9602270b88093ff9411ac6316b52fc6e
MD5 d38543fc9ae37d188a23e06ee11d3504
SHA1 174fe778f66db4a527fddf21b1c23e1bc1ceceeb
SHA512 43d1874e5821d8e5530eaa34d42b76aa867528368779fadcfd2691825297accf04e94bd34867442a76c25d4729edefba9469de6500acfe6f665949f11878c54b
SSDEEP 3072:l2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVn5O4z6ULfLb6Cu:Us4zIg+rKTTmnhfAoSxZ5OVu/
TLSH
T1DA046D36F2C08537D1772B7C8D9A9294642AFE502E3D280F7AE80D4C5B3D69169793CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy2222.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy2222.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle.exe

Path C:\Users\Admin\AppData\Local\Temp\nsy2222.tmp\bundle.exe
Size 1.6MB
SHA256 c207ee428f0eb876e23f5b7ac859f0602aff15ac533eeb6b74262e99f3658342
MD5 981780e62db7df6ebf7dc3fc94ff9df4
SHA1 32cafdcfe5822f0eea2def9829afa30e746feeb6
SHA512 a59c19741b258223dee6a8f631d2cc442c9fb5cc9d13b87e81cb9b5bdd2cede636ac442b3aa254abe9b50f88eb810cd9769d91697e8fabc5ce2f844ef47cbb99
SSDEEP 49152:e8YWaDwae/oxwOLa1IgZ/yS4SS0emt5NMVqi:ZYpktoxwSa1IgEy7FRQ
TLSH
T1DD85330C1A72899AD7B233B47268F309F6BB9E5875353617CB817B712F316428C07DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tools.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy2222.tmp\tools.dll
Size 236KB
SHA256 1873de723938193f9f0877b08c160884b79503b6607598158ad99bd909189fdc
MD5 e12f05661436f2974cf91b5fc76fb5f4
SHA1 5e0b7887950204713bef3da0018911279f2540ec
SHA512 61d42e055865dd98552b29dd69dc3d761bc7f77c1af108ad13b0b390059be5668657645258c0c08052a5fe1e9f6bdb018da136eb103b7335097487ec0de5d22d
SSDEEP 6144:hGaNIz2T+zQfmL8iY2h07OiQBlm0su0ID/nE6B6jcdiDckXc8gyN5B9Tv/1erPL0:O6T+ceL8iY2h07OiQBlm0su0ID/nE6B6
TLSH
T12C34C6595AE95D67C7DE7BB3E49742887473ECC5BB0063224A0AD31920D13CDE983FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Roaming\2YourFace\Updater.exe
Size 219KB
SHA256 b7c83ce96df6a282fa18e8551d5c6de87a08f4e256ad0e1105069155138ed5a2
MD5 61a75fa584626ad7236a5e0ecf0ce806
SHA1 28b1b5548e12d56773d3fcdf252617e94f07da96
SHA512 2f38d0d06ddcd4d4506623120902a194f33f84e87a6260d08e55a2658e40edf959d0fc83c37561db7002b3e43a569fd2bcc3b70328ab37efe39b9b9b8d2cc4d8
SSDEEP 3072:wl8YkA/LTmULfUn8/SxUpcqrRUmF0QPQQZIKxm9qpTmaVp:wl8Yk26wfUnTgcmGQPQQgqpjp
TLSH
T1DF244A2272818072E31A073059A1F6F44AB9BC7915E1E54FF7B87E3A5E31293967720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst.exe

Path C:\Users\Admin\AppData\Roaming\2YourFace\uninst.exe
Size 72KB
SHA256 f630aab24c3c6766ff8436a4918900768c5c54e3fda3b1717d171f7c1d8906a1
MD5 6af9997be2b2a717d54ec28486c17afb
SHA1 70d28e6806ee4a82f674887f2efbadb3e75a0ba4
SHA512 85bd5ca8c1a2259acc3ec6f09ebb30dd9df8bbdfe41cef563675caadb1720510f165002bcc74ca3f51d5b6b9e8fd1c70b589126d8934f1aec30e92954fe1d2e5
SSDEEP 1536:TpgpHzb9dZVX9fHMvG0D3XJkgdLeAyNL5ycaVxw6jSJAlfQ1q:9gXdZt9P6D3XJkceA4xaVC6jSUfQ1q
TLSH
T1C173D10E3AC1487BD6F6067119BBA7BBFBBEDA9101445E170B901F3F2E71152CE1216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileHunter.exe

Path C:\Users\Admin\AppData\Roaming\SuperPump\FileHunter.exe
Size 2.4MB
SHA256 7e059cca32002d59c9467591b73b95ec9e217e00592aa33a8abfc5444b927d96
MD5 7c27878d875463bbe164b7ccfce33218
SHA1 69c3dc83ea3a0ef6c327e4f996f9ffc6cd1d98ae
SHA512 0384ce53bc1de8ffb11f710613b153ba0285243f38848e9cc2c8209b8a636fdc66e72c82aa16d14dd4c1fbd3715892005061ebb4f026b9a01ccc30792b145026
SSDEEP 49152:b/foT9I8UKdpKSOeAMGz3BHe+g4yFb+Zf00TIT6R7i:boT9Ip4+g4yBW7i
TLSH
T189C56D53AA8C803BC03A2E3B5C7BD754943F7E646A92B81B6FE41B4D0E357406D39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pumpa.exe

Path C:\Users\Admin\AppData\Roaming\SuperPump\pumpa.exe
Size 1.4MB
SHA256 0d66b29515127a63523b260f36f8a7b0d13a6279cccb08f95f111b5cc09712eb
MD5 37fa043ec0640c61c32803ef9271abb0
SHA1 28c347fed675afeb98ac977992d8432808c9a107
SHA512 997a3195677d734e9878196995283cbac74f2ce0688a9998183bf87d7cf9d6b4aee448b41e055cd4d2025df1ba1c9df49b0baefb526140109b34f7f117754069
SSDEEP 24576:UozpCSKB1aL5d4JvJ3eJZKRL9DJf58XQ3yBmhdfcWiBxnXyW/LSfPy2XbNcdq7Rp:fzASKByd4JvJ3eJC5iQ3ygfcWiBxnXyn
TLSH
T150657C80FFDBC1B6DA8B22B2042AD71F85659A5647122FD7F35C1F0A6D613C17C3624A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\SuperPump\updater.exe
Size 254KB
SHA256 96e471eee44692eb387411b6789831fd5802b3636a53c18fde9e6643f6914ec0
MD5 14560f2d4eda150916b0b1dac4ca6362
SHA1 2476f57dba548edb544db860d5cf7190099c179c
SHA512 5d2b1a2f79c31d74513d4569515fa82ba51a9311d6e22f91a7835d9aaf9efa72e2db7c37a17516a2841f190712469430b3e8ed9da78352dfbdf6910065996cf8
SSDEEP 3072:dUtiBRq35Dhy2mtRR9RRTRRLRc7n4upGOeHXF/GJiBRq35Dhy2mtRR9RRTRRLRc9:dU7j4qGN3Fsj4
TLSH
T100444A55A6C0980FC3637AF921E4F71410358F94BE08A251AC30BA2B35F7B57EC62B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.txt

Path C:\Users\Admin\AppData\Roaming\SystemUpdaterApp\id.txt
Size 32B
SHA256 0c836a0ee4c16e2798b90c293e1c17064f639fb1d4c9221cd2e08ca341a23f5f
MD5 087fe30fe6d1e6f8e08c3d2d2acf036e
SHA1 61798d197946027bd7d8f079d15070b436a04e0c
SHA512 9ce7119e068021ccee69cc64f8404e72d7a91bc2d4cb34f7a8f4b1533622576b98af6b4be6fab9179729c4736db0aedcf81f97145e1830bac36e1412933c9d4e
MD5 SHA1 SHA512

Submit Download

memory/3584-32-0x00000000034B0000-0x00000000034C0000-memory.dmp

Download

memory/3584-24-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-31-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-30-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-29-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-27-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-26-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-33-0x0000000073C62000-0x0000000073C64000-memory.dmp

Download

memory/3584-20-0x0000000073C62000-0x0000000073C64000-memory.dmp

Download

memory/3584-150-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-19-0x00000000034B0000-0x00000000034C0000-memory.dmp

Download

memory/3584-34-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-35-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-36-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/3584-140-0x0000000073C60000-0x0000000074281000-memory.dmp

Download

memory/4440-178-0x0000000060900000-0x0000000060970000-memory.dmp

Download

memory/5336-235-0x00000000021C0000-0x00000000021F0000-memory.dmp

Download

memory/5864-250-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-251-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-252-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-253-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-254-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-256-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-257-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-258-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-259-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-260-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-261-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-262-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-263-0x0000000000400000-0x0000000000675000-memory.dmp

Download

memory/5864-264-0x0000000000400000-0x0000000000675000-memory.dmp

Download